Chapter 3: Cybercrime-Related Conditions (Probation and Supervised Release Conditions)

A. Statutory Authority

Under 18 U.S.C. §§ 3563(b) and 3583(d), a court may order additional conditions of probation or supervised release to the extent they:

1. are reasonably related to the relevant sentencing factors listed at 18 U.S.C. § 3553(a);
2. involve only such deprivations of liberty or property as are reasonably necessary for the relevant sentencing purposes listed at 18 U.S.C. § 3553(a); and
3. are consistent with any pertinent policy statements issued by the Sentencing Commission.

B. Introduction

This section contains a variety of conditions officers may recommend and judges may impose, as appropriate, when the circumstances of a supervision case qualify it for participation in cybercrime management (i.e., use of special conditions for the use of Computer Devices, defined below, intended to assist with the supervision of technically proficient individuals). The conditions to be considered cover a variety of different topics, and no one condition should be assumed to be comprehensive or sufficient, standing alone. 

When the circumstances of a case merit cybercrime management, the General Condition described below must be applied and should be accompanied by one or more conditions for device types and one or more search condition. In every instance, consideration should be given to the specific devices available or potentially available to the individual being supervised, the corresponding conditions listed in the menu below (e.g., device- or use-specific conditions), and the potential applicability of the Payment Condition.

C. Key Terms and Definitions

1. Computer Device
   
   Refers to devices that either compute or access the internet or other networks, including (a) desktop or laptop computers; (b) smartphones, smart watches, and tablets; (c) smart appliances/Internet of Things (IoT) devices, including hub or personal assistant devices; and (d) all network accessing devices, including internet-connectable gaming systems.
    
2. Cybercrime Management
   
   The use of special conditions for supervision related to the use of Computer Devices, intended to assist with the supervision of technically proficient individuals.
    
3. Standard Computer Device
   
   A Standard Computer Device is one that can be monitored using commonly used and readily available monitoring software. These devices use one of the following operating systems (OS): Windows, Mac OS, Android, or iOS. The strengths and weakness of monitoring software vary among these four OS versions, requiring various levels of configuration and/or management to provide reasonable assurance of device compliance.
    
4. Non-Standard Computer Device
   
   A Non-Standard Computer Device is one that cannot be monitored through commonly used and readily available monitoring software. Various OS versions such as Linux and Chromium, as well as proprietary OS versions of devices such as those found on game consoles and personal assistants (e.g., Amazon Alexa and Google Assistant), are not able to be monitored in any practical manner. Additionally, many items that are technically “computer devices” in some sense and are part of everyday life cannot be monitored, such as Internet of Things (IoT) devices.
    
5. Computer Device Configuration
   
   Configuration is the arrangement of the hardware and software components of a Computer Device and/or network components. Configuration can refer to hardware, software, or a combination of both. For example, a laptop PC might have 8GB or 16GB of main memory, multiple USB ports, a hard disk or solid-state drive (SSD), a wireless card, and an operating system.
   
   Software configuration is the process of selecting programmable options to make a program function the way the user intends. Hardware configuration is the process of assembling the desired components for a custom system.
   
   Software configuration management (SCM) is the task of tracking and controlling changes in the software. SCM practices include revision control and the establishment of baselines.
    
6. Computer Device Management  
   
   Computer Device Management (CDM) is the process of installing, operating, and maintaining a Computer Device. CDM involves a variety of administrative tools and actions that help keep devices and networks running smoothly. For purposes of conditions of supervision, Computer Devices subject to CDM can be separated into Standard Computer Devices and Non-Standard Computer Devices, as defined above.
   
   CDM is an essential part of effectively and appropriately using and maintaining a Computer Device and its associated operating system. It controls how software applications interact with the hardware attached to a computer system. This includes locating, setting up, allocating, and managing access to devices like printers, scanners, storage units, and network interfaces.
   
   Effective CDM enables an organization to administer and maintain devices, including virtual machines, physical computers, mobile devices, and Internet of Things (IoT) devices. It is also a critical component of an organization’s security strategy and helps troubleshoot devices when they don’t work properly. For example, when Windows detects a problem with a device, that device will be marked for users and system administrators with a yellow exclamation mark.

D. Menu of Cybercrime Management Conditions

E. Condition Language and Explanations

1. General Condition for Cybercrime Management
   
   You are ordered to participate in cybercrime management and will inform your officer of all computer devices possessed or accessible to you. This includes (a) desktop or laptop computers; (b) smartphones, smart watches, and tablets; (c) smart appliances/Internet of Things (IoT) devices, including hub or personal assistant devices; and (d) all network accessing devices, including internet-connectable gaming systems. You will not acquire or access any new or additional computer devices unless approved by your officer. You will also inform your officer of all your computer device, internet service provider (ISP), and social media user accounts (local and on-line services), both upon entering supervision and in the event that you create or receive additional user accounts.
   
   Purpose: This requirement is essential for mandating the individual’s enrollment in Cybercrime Management. It necessitates an individual on supervision to disclose all computer devices under their use or accessibility, and mandates that they refrain from obtaining new devices without prior discussion and approval from their supervising officer. The primary aim is to establish a framework of accountability for both the individual and the officer, thereby reinforcing effective supervisory efforts. It is important to clarify that this stipulation does not explicitly mandate monitoring or the inspection of any computer devices. Instead, it restricts the individual’s use to only disclosed, approved computer devices. The overarching objective is to ensure accountability of the devices the individual may access or possess.
   
   Implementation: This condition should make clear all computer devices are to be reported by the person under supervision at the inception of supervision and that no additional computer devices are to be used, accessed, or possessed unless approved by the USPPSO. Program requirements shall be explained to the person under supervision at the onset of supervision. Program requirements should not be restrictive in nature and should be designed with the least intrusive requirements to promote the public safety and successful completion of supervision. It should also be made clear to the person under supervision that they are obliged to disclose all local and online accounts (computer, network, internet service provider (ISP), social media, etc.). Required account disclosures are not intended to include financial or medical accounts, unless explicitly ordered by the Court. The person under supervision should also be notified that they may attempt to resolve with the Court any program requirements that are perceived to be unreasonable.
    
2. Monitored Computer Devices with Internet Access
   
   You are permitted use of standard computer device(s) (desktop/laptop computers, smart phones/tablets) with internet access and will permit the U.S. Probation/Pretrial Services Office (USPPSO) to configure, manage, and install monitoring software on all your approved standard computer devices. Your standard computer device(s) are limited to those that can be configured, managed, and monitored by the USPPSO. The configuration, management, and monitoring of your standard computer devices shall be specific to your Court-ordered conditions, risk and needs, and cybercrime management requirements.
   
   Purpose: This condition establishes a clear definition for the allowable computer device types that can be utilized, along with the essential tasks required to ensure the effective implementation of cybercrime management program supervision with computer monitoring. It brings transparency to all parties involved regarding the Court’s expectations and the extent of authority granted to the officer.
   
   To enhance the reliability of cybercrime management program compliance, it is necessary for supervising officers to use computer device configuration and/or management, to both increase the likelihood of compliance with the Court’s orders while decreasing the likelihood that devices can be circumvented.
   
   Implementation: This condition should make clear the monitored use of computer device(s) and internet for the person being supervised is not at the discretion of the officer. This condition should also make clear the delegated authority to the officer is for the approval of the standard computer device(s) for compliance with the Court's ordered conditions and program requirements (computer devices that can be configured, managed, and monitored).
    
3. Monitored Computer without Internet Access
   
   You are permitted use of standard computer devices (desktop/laptop computer, smart phones/tablets) without internet access and will permit the U.S. Probation/Pretrial Services Office (USPPSO) to configure and install monitoring software on all your approved standard computer devices. Your standard computer device(s) are limited to those that can be configured, managed, and monitored by the USPPSO. The configuration, management, and monitoring of your standard computer devices shall be specific to your Court ordered conditions, risk and needs, and Cybercrime Management Program requirements.
   
   Purpose: This condition establishes a clear definition for the allowable computer device types that can be utilized, along with the essential tasks required to ensure the effective implementation of cybercrime management program supervision with computer monitoring. It brings transparency to all parties involved regarding the Court’s expectations and the extent of authority granted to the officer.
   
   To enhance the reliability of cybercrime management program compliance, it is necessary for supervising officers to use computer device configuration and/or management, to both increase the likelihood of compliance with the Court’s orders while decreasing the likelihood that devices can be circumvented.
   
   Implementing these measures should reduce the need for frequent searches to verify the functionality and status of the computer device and monitoring software.
   
   Implementation: This condition should make clear the monitored use of computer devices without internet access for the person being supervised is not at the discretion of the officer. This condition should also make clear the delegated authority to the officer is for the approval of the standard computer device for compliance with the Court's ordered conditions and program requirements (devices that can be configured, managed, and monitored). 
    
4. Unmonitored Computer with Internet Access
   
   You are permitted use of standard computer devices (desktop/laptop computers, smart phones/tablets) with internet access and will permit the U.S. Probation/Pretrial Services Office (USPPSO) to configure and manage all your approved standard computer devices. The approval of your standard computer devices is limited to devices that can be configured and managed by the USPPSO. The configuration and management of your standard computer devices shall be specific to your Court ordered conditions, risk and needs, and Cybercrime Management Program requirements.
   
   Purpose: This condition establishes a clear definition for the allowable computer device types that can be utilized, along with the essential tasks required to ensure the effective implementation of cybercrime management program supervision without computer monitoring. It brings transparency to all parties involved regarding the Court’s expectations and the extent of authority granted to the officer.
   
   To enhance the reliability of cybercrime management program compliance, it is necessary for supervising officers to use computer device configuration and/or management, to both increase the likelihood of compliance with the Court’s orders while decreasing the likelihood that devices can be circumvented.
   
   Implementation: This condition should make clear the unmonitored use of computer device and internet for the person being supervised is not at the discretion of the officer. This condition should also make clear the delegated authority to the officer is for the approval of the standard computer device for compliance with the Court’s ordered conditions and program requirements (i.e., devices that can be configured and managed).
    
5. Unmonitored Computer without Internet Access
   
   You are permitted use of standard computer device(s) (desktop/laptop computer, smart phones/tablets) without internet access and will permit the U.S. Probation/Pretrial Services Office (USPPSO) to configure and manage all your approved standard computer devices. Your standard computer device(s) are limited to those that can be configured and managed by the USPPSO. The configuration and management of your standard computer devices shall be specific to your Court ordered conditions, risk and needs, and Cybercrime Management Program requirements.
   
   Purpose: This condition establishes a clear definition for the allowable computer device types that can be utilized, along with the essential tasks required to ensure the effective implementation of cybercrime management program supervision without computer monitoring. It brings transparency to all parties involved regarding the Court’s expectations and the extent of authority granted to the officer.
   
   To enhance the reliability of cybercrime management program compliance, it is necessary for supervising officers to use computer device configuration and/or management, to both increase the likelihood of compliance with the Court’s orders while decreasing the likelihood that devices can be circumvented.
   
   Implementing these measures should reduce the need for frequent searches to verify the functionality and status of the computer device.
   
   Implementation: This condition should make clear the unmonitored use of computer devices without internet access for the person being supervised is not at the discretion of the officer. This condition should also make clear the delegated authority to the officer is for the approval of the standard computer device for compliance with the Court's ordered conditions and program requirements (devices that can be configured and managed).
    
6. No Computer Use
   
   You are restricted from any personal use of standard computer devices (desktop/laptop computer, smart phones/tablets).
   
   Purpose: This restriction is necessary when less restrictive measures (e.g., monitored computer use) are not sufficient to address the risks posed by the person under supervision. It is intended to be used only in rare cases where there is a great risk of harm or where the person under supervision has been repeatedly non-compliant with less restrictive measures. This does not exclude the use of publicly available limited/specific use computers, or those used for employment (non-self-employment).
   
   Implementation: This condition should make clear the personal use of standard computer devices is not approved and not authorized by the Court ordered condition. This does not apply to employment, non-standard, or publicly accessible limited purpose computer devices, which should be addressed in separate conditions.
    
7. Non-Standard Computer Devices/Internet of Things (IoT)
   
   Non-standard computer devices possessed or accessible to you (such as smart TV’s, refrigerators, game systems, and personal assistants) shall be assessed by the U.S. Probation/Pretrial Services Office (USPPSO) for risk and need of use. You must permit the United States Probation and Pretrial Services Office (USPPSO) to configure and/or manage approved non-standard devices for compliance with your Court ordered conditions and cybercrime management requirements. Non-standard computer devices that are not able to be configured and/or managed, or which are assessed as being of substantial risk to the successful completion of supervision, may be prohibited.
   
   Purpose: This condition allows the officer to evaluate particular computer devices to determine the potential impact their use might have on both community safety and the effectiveness of supervision. These computer devices typically cannot be monitored. However, non-standard computer devices that can be accounted for, configured, and managed in a way that reasonably mitigates risks to the community, while also contributing to the overall success of supervision, may be approved by the officer.
   
   Implementation: This condition should make clear the non-standard computer devices used, possessed, and accessible to the person under supervision are to be evaluated and shall not be restricted without justification.
    
8. Publicly Accessible/Limited Purpose Computer Devices
   
   You may access publicly accessible computer devices for legitimate transactional purposes (such as ATMs, kiosks, and point of sale terminals). With the awareness and approval of your officer, you may also use specialized computer devices outside your residence (i.e., employment agency, work search, and employers’ computer devices) but only for their intended use.
   
   Purpose: This condition permits individuals under supervision the ability to use computer devices that are commonly used by the general public. Although these devices may not offer the complete range of functions found in a personal computer, they are, in essence, computer devices. The inclusion of this condition serves to clarify the Court’s intent and the officer’s authority to authorize the use of such devices, which are neither owned nor possessed by the individual under supervision and are outside the scope of any available monitoring, configuration, management, or search capabilities.
   
   Implementation: This condition should make clear the person under supervision may access or use publicly available specialized computer devices such as kiosks, points of sale, ATMs, and other similar devices. This condition also allows for the officer’s ability to approve specialized devices outside the residence that must be used for specific purposes, such as employment or work-related searches, and makes clear such computers can only be used for their intended purpose (i.e., not using a work search computer to web browse or log in to social media).
    
9. Restrictions on Specific and/or General Use 
   
   (Legitimate and necessary)
   
   Your use of standard computer device(s) (desktop/laptop computers, smart phones/tablets) is restricted to legitimate and necessary purposes. Examples of legitimate and necessary use are employment, education, religious activities, treatment services, medical services, communication with friends/family and attorney, personal finance, and legal obligations.
   
   Purpose: This condition aims to strike a balance between mitigating the individual’s risk and allowing them legitimate and necessary use of computer devices. It does not entail a complete prohibition on computer device or internet usage but instead outlines a framework for authorized use. The goal is to ensure reasonable efforts are made to minimize risk while recognizing the necessity of computer device use in various circumstances.
   
   Implementation: This condition restricts the type of use of computer devices and/or the internet to what is legitimate and necessary. There should be an agreement/understanding to what is legitimate and necessary for the person being supervised and the U.S. Probation/Pretrial Services Office. Any dispute between the officer and person under supervision should be resolved with the aid of the Court. The recommendation/use of this condition should be justified based on the individual’s risk and should only be recommended when the level of use, or types of use, need to be addressed.
    
10. Restricted Use
    
    You shall not access (insert specific “blacklisted” sites, applications, categories, or activities here based on identified individual risk).
    
    Purpose: This condition is intended to allow the person under supervision broad use of computers and the internet, subject only to restrictions on the specific “blacklisted” sites, applications, categories, or activities described in the condition.
    
    Implementation: This condition should be used when identified risks are present and the type of use or specific use should be restricted (i.e., categorical classification such as social media, entertainment, or specific risks to an individual or entity/organization, etc.).
    
    You shall only access (insert specific “whitelisted” sites, applications, categories, or activities here based on identified individual risk).
    
    Purpose: This condition is intended to allow only very limited use of computers and the internet by a person under supervision, due to either the degree of risk they present or to non-compliance with lesser restrictions.
    
    Implementation: This condition should be used when identified risks are present and the type of use or specific use should be the only use permissible (i.e., employment, contact with family, work search, or specific entities or individuals such as banking or legal services).
     
11. Computer Device Limitations
    
    You may be limited to two standard computer devices (desktop/laptop computer, smart phones/tablets), unless otherwise approved by your officer.
    
    Purpose: This condition is intended to aid the officer in managing a person under supervision’s standard computer devices, as managing multiple devices can be resource-intensive, particularly in the case of monitored devices.
    
    Implementation: This only applies to standard computer devices (devices that can be configured, managed, and monitored (if ordered)). Non-standard/IoT devices are to be evaluated separately.
    
    This condition should be used when the limiting of computer devices is necessary for the successful management of the individual’s computer use to promote the reasonable assurance of compliance to the Court and the successful supervision of the individual.
     
12. Payment Responsibility for Computer Monitoring
    
    Full responsibility:
    You are responsible for all computer monitoring and/or management costs for your approved computer devices.
    
    Partial responsibility:
    You are responsible for computer monitoring and/or management costs for your approved computer devices based on your ability to pay, as determined by the Probation/Pretrial Services Office
    
    Purpose: These conditions are intended to give clear direction to the person under supervision and the probation officer regarding responsibility for the costs of computer monitoring.
    
    Implementation: This condition should be used when ordering individual to pay for computer monitoring services either completely or on a percentage or scale.
     
13. Computer Search for Monitoring and/or Management Purposes
    
    You must allow the U.S. Probation/Pretrial Services Office to conduct initial and periodic unannounced searches of any computer devices or networked systems used or possessed by you. Initial searches of computer devices and networked systems will be conducted to determine if they contain or allow access to any materials or capabilities which would violate the Court’s ordered conditions; or programs/applications, settings, configurations that would be problematic for monitoring software (if ordered) and Cybercrime Management Program requirements. Periodic unannounced searches of these devices and systems will be conducted to verify that the monitoring software is functional (if ordered), that required configurations are unaltered, and that no circumvention efforts have been made to alter the device’s operation(s) or functionality.
    
    Purpose: This condition is intended to provide clarity to the person under supervision and the probation officer regarding routine (that is, not based on suspicion of misconduct) initial and periodic searches that are necessary to successfully manage and/or monitor computer devices in accordance with the Court’s other conditions.
    
    Implementation: This condition should be ordered to verify there is no violation material or abilities present on or accessible to the computer device for the initial search, and to verify periodically the device is functional and compliant with program requirements.
     
14. General Reasonable Suspicion Search Condition

    You must submit your person; property; house; residence; vehicle; papers; computer devices, other electronic communications, network or cloud storage, data storage devices or media; or office, to a search conducted by a United States probation officer. The probation officer may conduct a search under this condition only when reasonable suspicion exists that you have violated a condition of supervision and that the areas to be searched contain evidence of this violation.  Any search must be conducted at a reasonable time and in a reasonable manner.  Failure to submit to a search may be grounds for revocation of release. You must warn any other occupants that the premises may be subject to searches pursuant to this condition.

    Purpose: This condition serves the statutory sentencing purposes of deterrence, public protection, and rehabilitation, and aids the probation officer in fulfilling their statutory duty to keep informed about the person under supervision’s character and conduct. It permits a probation officer to intervene quickly when reasonable suspicion exists that the person under supervision has engaged in criminal conduct or a violation of a condition of supervision.

    Implementation: A reasonable search condition may be warranted where the person under supervision was convicted of, or has a history of, certain types of offenses (e.g., violent offenses, weapons offenses, drug distribution offenses, sexual offenses, offenses related to terrorism, or sophisticated financial offenses). Such a condition may also be warranted where there are other identifiable risks based on the person under supervision’s history or characteristics, or where they have a history of unsuccessful attempts at completing a term of supervision.

    Due to the intrusive nature of search conditions, officers should discuss these conditions with the person under supervision and potential occupants of their proposed residence during the planning stage, when possible, and should be discussed again at the commencement of supervision. 

    As stated in the condition, searches are to be conducted only where there is articulable reasonable suspicion that evidence of criminal conduct or a violation of conditions will be found at the place (or in the item or computer device) to be searched. Before conducting a search, officers should consider less intrusive measures to address suspected violation behavior.  Conducting a search typically involves approval from the officer’s supervisor and the chief probation officer. Following a search, the officer is required to submit a report, and information or evidence gathered during the search may be used in the regular course of managing noncompliance (e.g., increasing treatment services or the intensity of supervision, notifying the court and potentially seeking modification of conditions or revocation of supervision), and may also be used for reporting serious criminal conduct to another law enforcement agency.