From Intrusion to Extortion: How Cyber Offenses Build on One Another

Start here. The offense is unauthorized access, and the entry notes that most statutes grade it by harm or intent. In the United States it is codified under 18 U.S.C. 1030, the Computer Fraud and Abuse Act, rather than under the word hacking.

Malware turns access into a tool. The offense covers creating and spreading harmful code, and one act of distribution can reach very many machines. The entry cites the Act provision on knowingly transmitting code that intentionally causes damage.

Spread malware far enough and infected machines can be joined into a network run by a botmaster. The entry records the 2006 federal sentence of 57 months for Jeanson James Ancheta, who built and rented out botnets.

A botnet is often aimed at one target to knock it offline. This offense is against availability rather than confidentiality, which separates it from hacking. The Panix SYN flood of September 6, 1996 is the recorded early example.

The path now turns to deceiving people. Phishing uses fake messages or sites to obtain passwords or install malware, and is usually prosecuted under fraud or computer statutes. The entry notes Jeffrey Brett Goodin as the first person convicted by a jury under the CAN-SPAM Act of 2003.

Stolen access or credentials end in exposure of protected information. The entry describes a breach as unauthorized exposure of personal data and notes that enforcement often works through notification duties such as the HIPAA Breach Notification Rule.

Here access, malware and stolen data combine with a payment demand. The entry describes encrypting a victim's files, the added threat of releasing stolen data, and the May 2021 DarkSide attack that shut down the Colonial Pipeline.

The same intrusion skills can serve secrecy rather than money. The entry separates covert, long-running collection of information from disruptive offenses, and notes that the Economic Espionage Act, sections 1831 to 1839, is the main United States law.

The path ends with the person on the receiving end. The entry describes repeated harassment or monitoring by electronic means, graded by severity in some states such as New Jersey, and notes the Wikipedia source observing little legal difference from cyberbullying in the United States.