Investigations & Prosecutions Guidelines

If you determine during an investigation that your case potentially appears to fall within any of the guidelines noted below, please contact the eCrime Unit of the Office of the California Attorney General to discuss whether the case might be appropriate for investigative assistance or prosecution by the eCrime Unit.

Identity Theft

(e.g., Penal Code § 529 – False Impersonation; Penal Code § 530.5 – Unauthorized Use of Personal Identifying Information; Penal Code § 532a – False Financial Statements)

State investigation or prosecution should be considered when any of the following factors potentially applies:

1. The conduct potentially involved multiple victims, a ring of more than two persons who conspired to commit offenses on more than one occasion, and multiple counties or states are involved.
2. Actual loss potentially exceeds $50,000.
3. The perpetrator was a state government employee, targeted state employees, or misappropriated information obtained from state files, databases, or networks.
4. The perpetrator created or used counterfeit or stolen state identification.
5. Local jurisdiction declines prosecution due to technical or resource issues.

Computer / Network Intrusion Crimes

(e.g., Penal Code § 502 violations - Hacking, Denial of Service, Theft of Data)

State investigation or prosecution should be considered when any of the following factors potentially applies:

1. An intrusion causes “significant” damage (e.g., loss of more than $50,000, impairment of records, threat to health and safety, actual physical injury).
2. An intrusion causes a “significant” breach of confidentiality (e.g., the value of the information was greater than $50,000, the intrusion was for the purpose of commercial gain, or the intrusion was for some other criminal purpose).
3. An intrusion involves a state government computer system.
4. Local jurisdiction declines prosecution due to technical or resource issues.

Intellectual Property Crimes

(e.g., Penal Code § 499c – Theft of Trade Secrets; Penal Code § 351a – Counterfeit Goods; Penal Code § 653w – Selling Pirated Sound Recordings or Audiovisual Works)

State investigation or prosecution should be considered when any of the following factors potentially applies:

1. The conduct potentially involved multiple victims, a ring of more than two persons who conspired to commit offenses on more than one occasion, and multiple counties or states are involved.
2. The target engages in large-scale operations (e.g., the holder of the intellectual property has potentially suffered a loss greater than $50,000).
3. The infringing or counterfeit goods or services present potential health or safety issues in multiple counties (e.g., counterfeit medications).
4. The state, one of its agencies, or a state program is a victim of the crime (e.g., Penal Code § 483.5 - Counterfeit of a Public Seal).
5. Local jurisdiction declines prosecution due to technical or resource issues.

Internet Fraud

(e.g., Penal Code § 535 - Internet Auction Fraud; Penal Code § 487 – Grand Theft)

State investigation or prosecution should be considered when any of the following factors potentially applies:

1. The actual loss is over $50,000.
2. The fraud or theft is from the state government, one of its agencies, or one of its programs.
3. The conduct potentially involved multiple victims, a ring of more than two persons who conspired to commit offenses on more than one occasion, and multiple counties or states are involved.
4. Local jurisdiction declines prosecution due to technical or resource issues.

Computer Component Theft & Theft of Other Technology Services

(e.g., Penal Code § 211 - Robbery; Penal Code § 502.8 - Telecommunications Fraud; Penal Code § 593d/593e – Satellite or Cable Service Fraud)

State investigation or prosecution should be considered when any of the following factors potentially applies:

1. The actual loss is over $50,000.
2. The theft is from the state government, one of its agencies, or one of its programs.
3. The conduct potentially involved multiple victims, a ring of more than two persons who conspired to commit offenses on more than one occasion, and multiple counties or states are involved.
4. Local jurisdiction declines prosecution due to technical or resource issues.

Internet Child Exploitation

(e.g., Penal Code § 288.4(a) – Luring a Child for Sexual Purposes; Penal Code § 311.2 – Distribution of Child Porn; Penal Code § 311.11 – Possession of Child Porn)

Local prosecution or federal prosecution should first be considered. State investigation or prosecution may be considered when any of the following factors potentially applies:

1. Local or federal jurisdiction declines prosecution due to technical or resource issues.
2. The subject distributes: (a) 50 or more images depicting child exploitation, (b) any images depicting sadistic or masochistic sexual activity with a minor, or (c) images of child exploitation for commercial sale.
3. The conduct potentially involved multiple victims, a ring of more than two persons who conspired to commit offenses on more than one occasion, and multiple counties or states are involved.
4. The subject is under investigation for other crimes by the eCrime Unit and child exploitation is a secondary offense to other criminal activities.

This checklist represents guidelines intended to assist law enforcement in determining what types of identity theft or technology crime cases generally warrant the expenditure of state investigative and prosecutorial resources. Cases that fall outside these parameters may nevertheless be considered for investigation or prosecution based on their unique facts. Factors include, for example, a particular subject’s criminal history, or a connection between the criminal conduct at issue and an ongoing investigation or prosecution of significance.

Investigators and prosecutors assigned to the eCrime Unit work with other local, state, and federal law enforcement agencies and task forces including the five California regional high-tech task forces funded through the High Technology Theft Apprehension and Prosecution Trust Fund Program. Cases investigated by the eCrime Unit will be considered for prosecution by the appropriate local district attorney’s office, California State Attorney General’s Office, and the United States Department of Justice.

Finally, this checklist is intended to aid the exercise of investigative and prosecutorial discretion only. It has no regulatory effect, and it confers no rights or remedies to defendants or any party in or subject to litigation with the State of California.