Creating ransomware is a federal crime with prison sentences up to 20 years

You cannot legally create ransomware under any circumstance in the United States or most other countries. The Computer Fraud and Abuse Act makes it illegal to intentionally damage or encrypt someone else's computer system without permission. Creating the code, distributing it, or using it — even to test it on your own devices — can result in criminal charges, prison time, and fines up to $250,000 per offense.

This is not a gray area. The law does not distinguish between ransomware created for profit, for learning, or for any other reason. Federal prosecutors have convicted developers, affiliates, and even people who paid ransoms to criminals. If you are researching this topic because you are curious about how ransomware works technically, there are legal ways to learn that do not involve creating malicious code.

If you arrived at this page because you are considering creating ransomware to make money, understand that law enforcement agencies across the world — including the FBI, the Secret Service, and Interpol — actively investigate and prosecute these cases. Ransomware developers are tracked through cryptocurrency transactions, code signatures, and server logs. Many have been arrested years after their crimes.

Key Takeaways

  • Creating ransomware violates the Computer Fraud and Abuse Act and carries federal prison sentences of up to 20 years.
  • The law applies to writing the code, testing it, distributing it, or using it — regardless of your intent or whether you target your own devices.
  • Law enforcement agencies worldwide actively investigate ransomware developers through cryptocurrency tracking, code analysis, and server forensics.
  • If you want to learn about cybersecurity or how encryption works, legitimate educational paths exist through universities, certifications, and legal security research.
  • Paying a ransom to a ransomware operator makes you complicit in a federal crime and does not may provide your data will be returned.

What the law actually says about malicious code

The Computer Fraud and Abuse Act (CFAA), passed in 1986 and updated multiple times since, makes it illegal to "intentionally cause damage without authorization to a protected computer." Ransomware fits this definition exactly because it encrypts files and makes them inaccessible to the owner. The moment you write code designed to do this, you have committed a crime — you do not have to distribute it, test it on someone else's machine, or actually collect money.

Federal prosecutors have charged people for creating ransomware variants that were never deployed. They have charged people for writing the code and sharing it in forums, even if they never used it themselves. They have charged affiliates — people who deployed ransomware written by someone else — separately from the original developers. Each person in the chain can face individual charges.

State laws add additional charges on top of federal ones. Many states have their own computer crime statutes that carry sentences ranging from 2 to 15 years. If your ransomware crosses state lines (which it almost certainly will if it spreads over the internet), you face federal charges. If it affects a hospital, bank, or critical infrastructure, sentencing guidelines increase significantly.

How law enforcement tracks ransomware creators

Ransomware developers leave traces at every step. The code itself contains signatures — patterns and structures that security researchers catalog and share with law enforcement. If you modify existing ransomware or write your own, analysts can often identify the author by comparing it to known variants and looking for unique coding patterns, error messages, or comments left in the source code.

Cryptocurrency transactions are the second major tracking point. Ransomware operators demand payment in Bitcoin or other cryptocurrencies because they assume it is anonymous. It is not. The FBI, Secret Service, and international agencies have teams dedicated to following cryptocurrency wallets. They can trace transactions through exchanges, identify when criminals convert cryptocurrency to cash, and use that information to identify individuals. Several major ransomware operators have been arrested after law enforcement followed their Bitcoin wallets.

Server logs, email addresses, and communication patterns provide additional evidence. Ransomware typically communicates with command-and-control servers to receive instructions and report back. Law enforcement can subpoena hosting providers, trace IP addresses, and identify the person who registered the domain or rented the server. Chat logs, forum posts, and communications with affiliates or victims create a paper trail that prosecutors use to build cases.

Real consequences: what happened to actual ransomware developers

In 2021, the FBI arrested Oleg Boyarintsev, a Russian national who developed and distributed the Cl0p ransomware variant. He was extradited to the United States and faced charges carrying a potential 115-year sentence. In 2022, the Department of Justice charged Yevgeniy Polyanin, who created and operated the Cl0p ransomware-as-a-service operation, with extortion and computer fraud. He was arrested in Poland and extradited.

In 2023, the FBI arrested Mikhail Matveev, a Russian developer of the Cl0p ransomware, after he traveled to South Korea. These are not isolated cases. The FBI's Internet Crime Complaint Center (IC3) tracks hundreds of ransomware variants, and law enforcement agencies have successfully prosecuted developers from Russia, North Korea, Iran, Romania, and the United States.

The sentences are severe. Developers typically receive 10 to 20 years in federal prison. Affiliates who deploy the ransomware receive similar sentences. Even people who paid ransoms have faced charges for providing material support to criminal enterprises. The message from prosecutors is consistent: creating or using ransomware is treated as seriously as armed robbery or fraud.

Why "learning" is not a legal defense

Some people argue they want to create ransomware to learn how encryption works or to understand cybersecurity. This is not a legal defense. The CFAA does not have an exception for educational purposes or personal research. If you write code designed to encrypt someone else's files without permission — even on your own test network — you have violated the law.

If you genuinely want to learn about encryption, cybersecurity, and how malware works, there are legal paths. Universities offer degree programs in cybersecurity and computer science. Organizations like CompTIA, (ISC)², and SANS offer certifications in ethical hacking and penetration testing. These programs teach you the same technical concepts but in a legal framework where you have explicit permission to test systems.

Bug bounty programs allow you to test real systems legally. Companies like Microsoft, Google, Apple, and thousands of others pay security researchers to find vulnerabilities and report them. You can earn money, build a reputation, and learn advanced security concepts without breaking the law. The difference between a criminal hacker and a legitimate security researcher is permission and disclosure — not technical skill.

What to do if you have already created ransomware code

If you have written ransomware code but have not distributed it or used it against anyone, you should consult with a criminal defense attorney when ready. Do not post it online, do not test it on anyone else's system, and do not tell anyone about it except your lawyer. An attorney can advise you on your specific situation and what steps might reduce your legal exposure.

If you have distributed ransomware or used it to encrypt someone's files, you need legal representation now. The longer you wait, the more evidence law enforcement collects. Cooperating with authorities early, returning stolen data, and demonstrating remorse can influence sentencing, but only if you work with an attorney who can negotiate on your behalf.

If you are aware of someone else creating or distributing ransomware, you can report it to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, or contact your local FBI field office. You can also report it to the Cybersecurity and Infrastructure Security Agency (CISA) at cisa.gov. These agencies investigate these crimes and can act on tips.

The financial reality of ransomware operations

Ransomware may appear profitable from the outside, but the financial reality is different. Most ransomware operations fail to collect significant money. Victims often refuse to pay, insurance companies negotiate lower amounts, and law enforcement increasingly recovers stolen funds. The Colonial Pipeline ransomware attack in 2021 collected $4.4 million, but law enforcement recovered $2.3 million of it within weeks.

Even when operators collect money, they face constant pressure from law enforcement, competing criminal groups, and the risk of arrest. Many ransomware operators have been arrested and extradited to the United States, where they face decades in prison. The money is not worth the risk, and the risk is higher than it has ever been.

If you are in financial difficulty, there are legal ways to earn money that do not carry a 20-year prison sentence. Legitimate cybersecurity work pays well — security researchers, penetration testers, and security engineers earn six-figure salaries. The path is longer than ransomware, but it does not end in federal prison.

Frequently Asked Questions

Is it illegal to create ransomware just to study how it works?

Yes. The Computer Fraud and Abuse Act does not have an exception for educational or research purposes. Writing code designed to encrypt files without permission is illegal, regardless of your intent. If you want to study encryption and cybersecurity, use legal resources like university programs, certifications, or bug bounty platforms where you have explicit permission to test systems.

What if I create ransomware but never use it or share it?

Creating the code itself is a federal crime. You do not have to distribute it, test it on someone else's computer, or collect money for it to be illegal. Federal prosecutors have charged people for writing ransomware code that was never deployed. The act of writing malicious code is the crime.

Can I be prosecuted if I only help distribute ransomware but did not create it?

Yes. Affiliates who deploy ransomware face the same charges as developers — computer fraud, extortion, and conspiracy. Law enforcement treats everyone in the chain as responsible. You can receive 10 to 20 years in prison for distributing ransomware, even if you did not write it.

What happens if I pay a ransom to a ransomware operator?

Paying a ransom is legal, but it funds criminal activity and does not may provide your data will be returned. Many victims pay and never receive their files. Additionally, paying a ransom can make you a target for future attacks. Law enforcement and the FBI recommend not paying ransoms and reporting the attack instead.

How can I learn cybersecurity without breaking the law?

Pursue certifications like CompTIA Security+, Certified Ethical Hacker (CEH), or OSCP. Enroll in university cybersecurity programs. Participate in bug bounty programs where companies pay you to find vulnerabilities. Join Capture The Flag (CTF) competitions where you solve security challenges legally. These paths teach the same skills without criminal liability.