Virginia Computer Crimes Act

1. Part I — Building Blocks (cite, don't charge alone)

These three sections supply definitions and reach that every charging offense in Part II depends on. They are not standalone charges. Most contested issues at a computer-crime hearing turn on "uses," "without authority," or what counts as "property."

2. Quick Grade & Threshold Index

Felony class maxima (§ 18.2-10): Class 3 — 5 to 20 yrs + up to $100,000; Class 5 — 1 to 10 yrs (or jury/court may set ≤12 mo. / $2,500); Class 6 — 1 to 5 yrs (or ≤12 mo. / $2,500). Class 1 misdemeanor — up to 12 months / $2,500 (§ 18.2-11). Confirm current penalty ranges before relying on them.

3. § 18.2-152.3 — Computer Fraud

Class 5 felony / Class 1 misdemeanor by value.

Elements — Prove Each BRD

1. Use of a computer or computer network (includes attempt to cause an operation — § 18.2-152.2)
2. Without authority (§ 18.2-152.2 definition; reaches exceeding-authority insiders); and
3. the defendant thereby (a) obtained property or services by false pretenses, (b) embezzled or committed larceny, or (c) converted the property of another.

Proof / Evidence Notes

• Value is usually the contested element. The $1,000 line is the current felony threshold (raised from $200 via the 2018/2020 larceny amendments — older files may cite $200). Line up a valuation witness and document the basis (market value, replacement cost, value of services obtained).
• "Property" and "services" are broad (§ 18.2-152.2); pair with § 18.2-152.8 so intangible data supports the larceny/embezzlement predicate.
• Pick your theory in the charging document — false pretenses vs. larceny/embezzlement vs. conversion carry different proof. False pretenses needs a false representation of a present/past fact that induced the transfer; embezzlement needs entrustment; conversion needs wrongful exercise of dominion.
• Tie "without authority" to concrete proof of the permission's scope (credentials, policy, TOS) and where the defendant exceeded it.
• Consider stacking under § 18.2-152.11 (parallel false-pretenses / grand larceny) and § 18.2-152.15 (encryption) where applicable.

Key Virginia Case Law

Common Defenses & Rebuttals

4. § 18.2-152.3:1 — Spam / Unsolicited Commercial Email

Class 1 misdemeanor / Class 6 felony by volume or revenue.

Elements — Subsection A (Base Misdemeanor)

Proof / Evidence Notes

• Header/routing forensics drive this charge. Preserve full message headers; establish the falsification or forgery of transmission/routing data, not merely that email was unwanted.
• "Spam" excludes commercial email to a recipient with whom the sender has an existing business or personal relationship (§ 18.2-152.2) — anticipate that defense.
• For the felony, the volume/revenue thresholds are elements; prove them with EMSP logs, recipient counts within the defined time windows, and financial records tying revenue to the transmissions.
• Note the parallel civil remedy in § 18.2-152.12(B)–(C) (statutory damages per message/day); relevant if a victim EMSP is involved.

Common Defenses & Rebuttals

5. § 18.2-152.4 — Computer Trespass

Class 1 misdemeanor / Class 6 felony by aggravator.

Enumerated Acts — Prove at Least One

1. Temporarily/permanently remove, halt, or disable data, programs, or software from a computer/network
2. Cause a computer to malfunction (regardless of duration)
3. Alter, disable, or erase data, programs, or software
4. Effect creation/alteration of a financial instrument or electronic funds transfer
5. Use a computer/network to cause physical injury to property of another
6. Make/cause an unauthorized copy (any form) of data, programs, or software
7. [Subdivision 7 repealed]
8. Install, cause to be installed, or collect information through keystroke-logging software capturing all/most keystrokes of another
9. Install software on another's computer to (i) take control so it can damage another computer, or (ii) disable/disrupt its ability to share or transmit data to other computers or devices

Proof / Evidence Notes

• Subsection C carves out a lot. No liability for contract/license terms or EMSP anti-spam measures; for monitoring a minor or a person with a disability/mental impairment (§ 51.5-40.1); for a parent/guardian monitoring a minor's computer use, lawfully copying data, or denying access; or for activity a reasonable user should expect from a hardware/software provider, ISP, or telecom/cable operator, or that law requires/authorizes. The parental-monitoring and provider-expectation carve-outs are common defenses.
• Pin down which mental-state path you're on: malicious intent vs. intentionally deceptive means + without authority. The felony aggravators (critical-infrastructure target, $1,000 damage, >5 computers, A.8) generally require malicious intent — plead it.
• For the infrastructure felony, prove the target computer was exclusively used by/for the protected entity — establish with custodian testimony about the system's dedicated use.
• For the >5-computers felony, count the devices and tie each to a malicious installation; for the $1,000-damage felony, document repair/replacement/loss valuation.

Key Virginia Case Law

Several enumerated theories (esp. A.8 keystroke logging, A.9 control/disruption software) have limited published Virginia appellate construction. Where state authority is thin, federal CFAA (18 U.S.C. § 1030) decisions are sometimes cited as persuasive on "without authority"/"exceeds authorized access," but are not binding — frame them as such.

Common Defenses & Rebuttals

6. § 18.2-152.5 — Computer Invasion of Privacy

Class 1 misdemeanor / Class 6 felony aggravators.

Elements — Prove Each BRD

1. Use of a computer or computer network
2. The defendant intentionally examines without authority
3. Employment, salary, credit, or other financial or identifying information relating to another person, as defined in clauses (iii)–(xiii) of § 18.2-186.3(C)

Incorporated identifying information under § 18.2-186.3(C), clauses (iii)–(xiii): (iii) social security number; (iv) driver's license number; (v) bank account numbers; (vi) credit or debit card numbers; (vii) personal identification numbers (PIN); (viii) electronic identification codes; (ix) automated or electronic signatures; (x) biometric data; (xi) fingerprints; (xii) passwords; or (xiii) any other numbers or information that can be used to access a person's financial resources, obtain identification, or obtain money, credit, loans, goods, or services.

Note: clauses (i) name and (ii) date of birth are deliberately NOT incorporated — those two alone do not satisfy the element.

Proof / Evidence Notes

• The "after he knows/should know" timing is the heart of the offense. Build the record that defendant continued viewing once authority ended (e.g., after termination, after a warning, after opening a file plainly outside his role).
• Exception (subsection F). Does not apply to collecting info reasonably needed to (i) protect security of/diagnose/repair a computer, service, or business, or (ii) determine whether user is licensed/authorized to use specific software or service. Anticipate the "IT/security" defense.
• Match the data examined to a specific incorporated clause; if it's only name + DOB, the element fails.

Key Virginia Case Law

Common Defenses & Rebuttals

7. § 18.2-152.5:1 — Gather Identifying Info by Deception

Class 6 felony / Class 5 felony aggravators — the phishing/pretexting statute.

Elements — Prove Each BRD

1. The defendant (other than a law-enforcement officer under § 9.1-101 acting in official duties)
2. uses a computer to obtain, access, or record
3. through material artifice, trickery, or deception
4. any identifying information as defined in clauses (iii)–(xiii) of § 18.2-186.3(C) (same list as § 152.5)

Proof / Evidence Notes

• This is the phishing/pretexting statute. The gravamen is deception (a spoofed site, fake login, false pretext) used to harvest the data. Distinguish from § 18.2-152.5, which targets unauthorized examination without the artifice element.
• Prove the artifice/trickery/deception with specificity — the deceptive mechanism is what elevates this to a baseline felony.
• Same incorporated clause list as § 152.5; name + DOB alone do not suffice.
• Watch overlap with identity-theft (§ 18.2-186.3 itself) and computer fraud — § 18.2-152.11 permits parallel charging.

Common Defenses & Rebuttals

8. § 18.2-152.6 — Theft of Computer Services

Class 1 misdemeanor / Class 6 felony by value.

Elements — Prove Each BRD

1. The defendant willfully
2. obtained computer services (computer time, data processing, Internet, email, message services, or data stored in connection therewith — § 18.2-152.2)
3. without authority.

Proof / Evidence Notes

• Mind the $2,500 felony line. It is distinct from the $1,000 computer-fraud threshold. Value the services obtained (e.g., usage logs, bandwidth/compute metering, subscription value) and document the methodology.
• "Willfully" is the mental state — prove intent, not accident or authorized use that merely exceeded an informal expectation.
• Establish lack of authority concretely (no account, revoked credentials, circumvented paywall/license).

Construed mainly in the civil VCCA context — see A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (4th Cir. 2009) (§ 152.6 alongside § 152.3). Limited published Virginia criminal appellate construction located; verify before charging.

Common Defenses & Rebuttals

9. § 18.2-152.7 — Personal Trespass by Computer

Class 3 felony (malicious) / Class 6 felony (unlawful) — rarely charged.

Elements — Prove Each BRD

1. The defendant uses a computer or computer network
2. to cause physical injury to an individual (a person, not property — contrast § 18.2-152.4(A)(5))

Proof / Evidence Notes

• Physical injury to a person is the line. Separates this from computer trespass (§ 152.4, injury to property). Think medical-device tampering, industrial/SCADA manipulation causing bodily harm, or altering systems that control physical safety.
• Malice drives the grade — a Class 3 felony is a serious exposure; develop intent evidence (planning, motive, awareness that injury would result).
• Prove causation between the computer use and bodily injury with medical and technical evidence.

Common Defenses & Rebuttals

10. § 18.2-152.7:1 — Harassment by Computer

Class 1 misdemeanor.

Elements — Prove Each BRD

1. The defendant, with intent to coerce, intimidate, or harass any person
2. uses a computer or computer network to communicate
3. (a) obscene, vulgar, profane, lewd, lascivious, or indecent language; (b) any suggestion or proposal of an obscene nature; or (c) a threat of any illegal or immoral act.

Proof / Evidence Notes

• Specific intent is the core — intent to coerce, intimidate, or harass. Preserve the full communications and surrounding context (frequency, prior contact, response to requests to stop) to prove intent rather than mere offensive speech.
• Be alert to First Amendment limits. "Profane/indecent" language untethered from a true threat or obscenity may raise overbreadth/as-applied challenges. The statute was amended in 2020 and 2022; confirm the current text and any narrowing construction.
• Identify the actual sender — account attribution, IP/device evidence, authorship — a frequent contested issue.
• Cross-reference § 18.2-427 (obscene/threatening communications), which is similarly worded and shares the obscenity-test construction.

Key Virginia Case Law

Common Defenses & Rebuttals

11. § 18.2-152.7:2 — Scheme Involving False Representations

Class 1 misdemeanor — targets malicious hoaxes, not fraud for gain.

Elements — Prove Each BRD

1. The defendant acts without intent to receive any direct or indirect benefit
2. maliciously sends an electronically transmitted communication
3. containing a false representation intended to cause another to spend money; and
4. the false representation actually causes that person to spend money (result element).

Proof / Evidence Notes

• Prove the result: the victim actually spent money because of the false representation. Establish reliance and causation, plus the expenditure.
• "Maliciously" is required — develop intent to cause the victim loss/expense.

Enacted in 2020; no published Virginia appellate construction was located. Plead and prove strictly to the statutory text — especially the unusual "no direct or indirect benefit" element and the result element (victim actually spent money). Verify before the hearing.

Common Defenses & Rebuttals

12. § 18.2-152.14 — Computer as Instrument of Forgery

Grade follows the underlying forgery offense (§ 18.2-168 et seq.) — bridge statute, not a standalone charge.

Proof / Evidence Notes

• Prove every element of the predicate forgery offense — a writing/instrument of apparent legal efficacy, a false making or material alteration, and (for uttering) intent to defraud — substituting the data act for the tangible writing.
• Establish the data act (creation, alteration, or deletion) forensically: what was changed, by whom, when, and that it carried apparent legal significance.
• Confirm the current elements of the specific forgery section you charge before the hearing — this cheatsheet does not reproduce the forgery article.

Common Defenses & Rebuttals

13. § 18.2-152.15 — Encryption Used in Criminal Activity

Class 1 misdemeanor — separate and distinct offense; add-on count.

Elements — Prove Each BRD

1. The defendant willfully uses encryption
2. to further any criminal activity.

"Encryption" = enciphering intelligible data into unintelligible form, or deciphering unintelligible data into intelligible form.

Proof / Evidence Notes

• Prove (a) use of encryption, (b) willfulness, and (c) a nexus to furthering specific criminal activity. Not mere possession of encrypted data or routine/incidental encryption.
• Tie the encryption to the criminal purpose with forensic evidence (encrypted containers tied to the offense, timing, statements, concealment behavior).

No published Virginia appellate decision construing § 18.2-152.15 has been located — it is rarely charged and almost always paired with a predicate offense. Be prepared to argue the "willfully…to further" nexus from first principles and the statutory text. Verify before the hearing.

Common Defenses & Rebuttals

14. § 18.2-152.12 — Civil Relief & Damages (reference only)

Civil — not a criminal charge. Why a prosecutor keeps this handy: Provides a private civil cause of action for any person whose property or person is injured by an Article violation — including any computer-trespass act in § 18.2-152.4(A)(1)–(8) regardless of malicious intent. Damages include lost profits and costs of suit.

• Spam-specific statutory damages (subsections B–C). Injured persons/EMSPs may elect statutory damages in lieu of actual damages, plus attorney fees — context for § 152.3:1 matters and for victim restitution discussions.
• Subsection D. Lets the court protect the secrecy/security of the computer systems and trade secrets and the privacy of non-party complainants during proceedings — useful framing for protective-order requests touching sensitive systems.
• Subsection F. Sets the limitations period by cross-reference to § 8.01-40.1 and the long-arm provision (§ 8.01-328.1) for spam injuries — worth knowing when coordinating with victims.

15. Pre-Trial Checklist — Day of Court

• Charging document correct — statute, section, and subsection identified; theory of fraud/embezzlement/conversion specified if charging § 152.3
• Value threshold confirmed and documented § 152.3: $1,000 felony line (not $200). § 152.6: $2,500 felony line (not $1,000). Prepare valuation witness and basis.
• Definitional building blocks ready — § 152.2 definitions pleaded and proof mapped to each term
• § 152.8 invoked if intangible data is the 'property' — anticipate the 'not real property' defense
• 'Without authority' proof locked in — permissions scope document, TOS, employment policy, access logs, warning screens
• Digital forensic expert (if needed) subpoenaed and qualified
• Chain of custody for digital evidence documented — imaging, hash values, storage, access log
• Email/routing headers preserved in native format (spam and harassment cases)
• For § 152.3:1 (spam) — EMSP logs, recipient counts, revenue records pulled; Jaynes issue briefed
• For § 152.4 (trespass) — mental state pinned down (malicious vs. deceptive means + without authority); infrastructure target documentation ready if felony
• For § 152.5 (invasion of privacy) — identifying data matched to specific § 18.2-186.3(C) clause (iii)–(xiii); timing of unauthorized access documented
• For § 152.7 (personal trespass) — medical evidence secured; causation chain from computer act to bodily injury established
• For § 152.7:1 (harassment) — complete communications preserved with metadata; sender attribution evidence ready
• For § 152.14 (computer forgery) — predicate forgery statute identified and its elements mapped; data act established forensically
• For § 152.15 (encryption) — encryption tied to predicate offense by timing, content, and concealment behavior
• Stacking analysis done under § 152.11 — double-jeopardy/Blockburger same-elements review for sentencing
• Civil remedy under § 152.12 reviewed if victim EMSP or other civil plaintiff is involved
• Discovery complete and disclosed
• Brady/Giglio review done
• Carve-outs screened (§ 152.4(C) — parental monitoring, provider expectation, law-authorization exceptions)
• Plea cutoff and terms locked in

16. Key Cases — One-Line Holdings

17. Annotated Authority

Annotated authority — research layer, not printed on the PDF