Cyber Crime

Cyber Crime Defense Attorneys in Alabama

Cyber crime charges in Alabama carry serious felony exposure — and they move on two tracks simultaneously. A single incident of unauthorized computer access, data theft, or online fraud can trigger both state prosecution under Alabama's Digital Crime Act and federal prosecution under the Computer Fraud and Abuse Act. The digital evidence in these cases is voluminous, the investigations are conducted by technically sophisticated agencies, and the charges are often filed long after the conduct occurred. If you are under investigation or have been charged with a computer-related offense in Alabama, you need defense counsel who understands both the law and the technology.

All inquiries are 100% confidential. We are here to defend your constitutional rights at every step of your case.

Alabama's Digital Crime Act: The Current Law

The operative state statute governing cyber crime in Alabama is the Alabama Digital Crime Act, codified at Alabama Code §§ 13A-8-110 through 13A-8-119. This Act — enacted in 2012 and replacing the earlier Alabama Computer Crime Act — covers computer tampering, encoded data fraud, phishing, and unauthorized disclosure of stored electronic communications.

Note: Two sections of the older Alabama Computer Crime Act — § 13A-8-102 (offenses against intellectual property) and § 13A-8-103 (offenses against computer equipment) — were both repealed by Act 2012-432, effective August 1, 2012, when the Digital Crime Act took effect. Any charge referencing those sections should be carefully scrutinized.

Computer Tampering — § 13A-8-112

Computer tampering is the broadest and most commonly charged offense under the Digital Crime Act. It covers unauthorized access to, alteration of, or destruction of computer systems, networks, programs, or data — including introducing malware or viruses, disrupting network services, and denying authorized users access to systems.

The charge level escalates based on intent and harm:

• Class A Misdemeanor — base offense, unauthorized access without aggravating factors (up to 1 year)
• Class C Felony — if the actor's intent was to commit an unlawful act, obtain a benefit, or defraud or harm another (1 year 1 day to 10 years)
• Class B Felony — if victim expenditures exceed $2,500, or if the offense impairs governmental operations, public communications, transportation, or utility services; also applies to unauthorized access to Alabama Criminal Justice Information Center systems (2 to 20 years)
• Class A Felony — if victim expenditures exceed $100,000, or if the offense causes physical injury to any uninvolved person (10 to 99 years or life)

Each individual record misused in a ACJIC system breach is charged as a separate offense under § 13A-8-112(b)(5) — meaning a single incident involving multiple records can generate multiple Class B felony counts.

Encoded Data Fraud — § 13A-8-113

Encoded data fraud covers the possession or use of scanning devices and reencoders to capture or clone information stored on credit or debit cards, identification documents, or other magnetic stripe or RFID-enabled items — without authorization. Possession of each cloned card constitutes a separate count. Encoded data fraud is a Class C felony carrying 1 year and 1 day to 10 years in prison.

Phishing — § 13A-8-114

Phishing under Alabama law covers impersonating a business through a website, email, or other online communication to induce another person to provide identifying information. The offense does not require that the victim actually be deceived or that information actually be obtained — the solicitation itself is sufficient. Phishing is a Class C felony. Multiple violations arising from a single act or course of conduct count as one violation, but a multi-campaign operation generates separate counts per scheme.

Federal Prosecution: 18 U.S.C. § 1030 (CFAA)

Many Alabama cyber crime cases that begin as state investigations are referred to or prosecuted concurrently by federal authorities under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. The CFAA covers unauthorized access to "protected computers" — broadly defined to include virtually any computer connected to the internet or involved in interstate commerce.

Federal penalties range from 1 year to 20 years depending on the offense:

• Unauthorized access to obtain information: up to 1 to 5 years
• Computer fraud (accessing with intent to defraud): up to 5 to 10 years
• Intentional damage to protected computers: up to 1 to 10 years
• Reckless damage: up to 1 to 5 years
• Extortion involving computers: up to 5 years

Second or subsequent offenses double the maximum sentence. Federal cyber crime cases are investigated by the FBI's Cyber Division, the Secret Service's Electronic Crimes Task Force, and the Department of Homeland Security — agencies with deep forensic resources and extended investigative timelines.

For cases that escalate into full federal prosecution, the considerations around mandatory sentencing under the Federal Sentencing Guidelines, cooperation, and plea negotiation are addressed in our federal crimes defense page.

Identity Theft and Online Fraud in Alabama

Beyond the Digital Crime Act, Alabama prosecutes related digital offenses under separate identity theft and fraud statutes. Alabama's Consumer Identity Protection Act covers theft and fraudulent use of personal identifying information. Online fraud involving wire transfers, bank accounts, or financial institutions commonly triggers parallel federal prosecution under 18 U.S.C. § 1343 (wire fraud, up to 20 years per count) or 18 U.S.C. § 1344 (bank fraud, up to 30 years).

The compounding of counts is one of the most consequential features of cyber crime prosecution at the federal level. A fraud scheme involving 50 electronic transactions is potentially charged as 50 separate counts of wire fraud — each carrying up to 20 years. Federal prosecutors routinely charge counts this way to generate plea leverage, and the guidelines sentencing calculation reflects the total number of counts and loss amount.

How We Defend Cyber Crime Cases

Digital evidence cases require the same rigorous Fourth Amendment analysis as any other criminal case — and often more. Investigators must obtain proper legal authority to seize computers, search stored data, intercept communications, and compel disclosure of electronic records from service providers. Deficiencies in search warrants, overbroad seizure of devices, and unlawful compelled disclosure of stored communications are all viable suppression issues in cyber crime cases.

Beyond the constitutional issues, we examine:

Authorization and access scope. Computer tampering and CFAA charges require proof that the defendant acted without authorization or in excess of authorization. Where a defendant had any legitimate access to a system, the boundary of that authorization is a contested factual issue — and recent Supreme Court guidance in Van Buren v. United States (2021) has narrowed what constitutes "exceeding authorized access" under federal law.

Attribution. Digital evidence — IP addresses, device identifiers, account activity logs — does not automatically identify the person who performed an act. Shared networks, spoofed accounts, malware operating on a victim's own machine, and compromised credentials are all documented defense considerations in cyber cases. The government must prove the defendant personally performed the charged conduct, not merely that a device or account associated with the defendant was involved.

Challenging forensic methodology. Digital forensic analysis is not infallible. Chain of custody for electronic evidence, the reliability of forensic tools, and the integrity of data extraction are all subject to expert challenge.