Your accounts, their accounts, and the line between them.

The Computer Fraud and Abuse Act makes it a federal crime to intentionally get into a computer either without authorization at all, or with some authorization that you then push past. The second idea has a name in the statute: "exceeds authorized access", and the statute defines it as using access you do have to reach information you are not entitled to reach. Nothing in the law says that sharing a home, a bed, a mortgage or a surname gives you permission to open the other person's account. Permission comes from whoever controls the account, and a spouse who has never given you their password has not given you permission. That is true even if the laptop sits on the kitchen table you both paid for, even if you pay the phone bill, and even if you have guessed the password rather than been told it. The Justice Department has published its own view of when it will bring these charges, and it names this exact situation: someone who is allowed to use their own account on a service but instead goes into someone else's account. The reach of the law is broad because "protected computer" is defined to include any computer "used in or affecting interstate or foreign commerce or communication" – which in practice means any device or account that talks to the internet.

The Wiretap Act makes it a federal crime to intentionally intercept a wire, oral or electronic communication, or to try to, or to get somebody else to do it for you. "Intercept" is defined as acquiring the contents of a communication using a device, and courts have long read that as catching a communication while it is moving – a live call, a message in flight. That is why the Act sits alongside the Stored Communications Act, which covers messages already sitting in an account. The federal exception that people usually mean when they say "one-party consent" is at s. 2511(2)(d): it is not unlawful under this chapter for a private person to intercept a communication where that person is a party to it, or where one of the parties has given prior consent – unless the recording is being made in order to commit a crime or a tort. So under federal law, recording your own phone call is treated very differently from putting a recorder on a call between your spouse and somebody else. The second one is the thing the statute is aimed at. But federal law is a floor, not a ceiling. The federal exception itself points to state law, because it withdraws its own protection where the interception is for the purpose of a criminal or tortious act "in violation of the Constitution or laws of the United States or of any State". A number of states require every party to a conversation to consent, not just one. Before you record anything, find out what your own state requires – and the state of the person on the other end of the line, if they are somewhere else.

This is the Stored Communications Act. Where the Wiretap Act is about catching a message in flight, this one is about the mailbox. It makes it an offense to intentionally get into a facility through which an electronic communication service is provided without authorization, or to intentionally push past the authorization you have, and by doing so to obtain, alter or block access to a communication held in electronic storage there. In ordinary language: logging into somebody else's email, message app, or social media inbox and reading what is stored in it. Opening your husband's or wife's email account without their permission to see what they have been writing is precisely the conduct this section describes. The punishment depends on why it was done. If it was done for commercial advantage, malicious destruction or damage, private commercial gain, or to further a crime or a tort, a first offense carries a fine or up to five years, and a later one up to ten. In any other case it is a fine or up to one year for a first offense, and up to five years for a repeat. The section has exceptions, and one of them is the reason your own inbox is your own business: the section does not apply to conduct authorized "by a user of that service with respect to a communication of or intended for that user".

Yes, and this is the part people underestimate. Both statutes carry a private right to sue, and neither one depends on anybody being prosecuted first. Under the Wiretap Act, a person whose communication was intercepted, disclosed or intentionally used in breach of the chapter may bring a civil action and recover appropriate relief, which the statute spells out as equitable or declaratory relief, damages, punitive damages in appropriate cases, and a reasonable lawyer's fee and litigation costs. The damages are not tied to proving a loss: the court may award the greater of actual damages plus the violator's profits, or statutory damages of the greater of one hundred dollars a day for each day of violation or ten thousand dollars. Under the Stored Communications Act, a subscriber or other person aggrieved by a knowing or intentional violation may sue, and the floor is one thousand dollars, with punitive damages available if the violation was willful or intentional, plus costs and lawyer's fees. The Computer Fraud and Abuse Act has its own civil action too, at s. 1030(g), though it is narrower: it requires the conduct to involve one of a listed set of factors, and it must be brought within two years. What this means in a divorce is simple. Getting into your spouse's accounts can produce a money judgment against you in a separate lawsuit, brought by them, quite apart from any criminal exposure and quite apart from what the divorce judge thinks of it.

The federal stalking statute is written broadly enough to cover surveillance. It reaches someone who acts with intent to "kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person", and it covers doing that through the mail, an interactive computer service, an electronic communication service or system, or any other facility of interstate or foreign commerce – which is how a tracking app or a monitoring service installed on a phone comes within it. The conduct has to be a course of conduct that puts the person in reasonable fear of death or serious bodily injury, or causes, tries to cause, or would reasonably be expected to cause substantial emotional distress. On detection, the Federal Trade Commission publishes a plain-language page. It describes stalkerware as software installed on your device without your knowledge, and it gives warning signs in the form of questions to ask yourself – a battery draining faster than usual, unexpected data use, a phone overheating or turning itself off and on, and the harder signs: does the other person know where you are when you have not told them, or what you said in a private conversation. The Commission's most important instruction is about order of operations. Do not rip the software out first. Talk to a domestic violence advocate before you remove it, because removing it tells the person watching that you know, and because the monitoring may be evidence. Then document what you have, and either get a new phone on an account the other person cannot reach, or do a full factory reset – and do not restore apps from the old backup, because the stalkerware comes back with them.

This is the part worth being clear-headed about, because the answer is: quite a lot. The statutes above are about getting into an account or a device that is not yours, or catching a communication you are not part of. They are not about paper, and they are not about your own records. Your own tax returns, your own bank and credit card statements, your own pay stubs, your own retirement account statements, your own credit report, mail addressed to you, and documents you keep in your own files are yours. You can copy them, photograph them, and take them to a lawyer. Joint records are yours too, because they are yours as well as theirs. A jointly filed tax return is a clean example, and the Internal Revenue Service says so on its own form: copies of jointly filed returns may be furnished to either spouse, and only one signature is required. The same logic runs through a joint bank account or a jointly held mortgage – you are a customer of that institution and you can ask it for your records. Papers kept openly in a shared home, in a filing cabinet or a desk drawer you both use, are in a different world from an account with a password on it. And in your own email, your own messages, and your own call history, you may read, screenshot and print anything you like, including messages the other person sent you, because the Stored Communications Act's own exception covers conduct authorized by a user of the service with respect to a communication of or intended for that user. Where the line lies is at the login screen and at the live conversation. If you have to enter someone else's password, install something on their phone, guess a security answer, or capture a call you are not on, you have stepped from one side to the other.

Start with the account that controls all the others: your email. Whoever can receive a password reset for your email can eventually reach everything else, so that one gets a new, unique password and the strongest second factor you can turn on. The Federal Trade Commission's advice, when an account may have been reached by someone else, is a short and specific list, and it is worth doing in order. Change the password. Sign out of all devices, which kicks out anyone still logged in elsewhere. Turn on two-factor authentication if the account offers it. Then check your account recovery information, and make sure the recovery email addresses and phone numbers listed are ones you entered and can reach – this is the step people skip, and it is the one that matters most in a separation, because a recovery address quietly pointing at a spouse's phone number undoes the new password. Check your email settings for forwarding rules and delete any you did not create. On strength, the Commission says to aim for at least twelve characters and to let a password manager generate them. On second factors, it says security keys are the strongest form because they do not use credentials that can be stolen, that an authenticator app is next, and that a code by text or email is better than nothing but less safe. The National Institute of Standards and Technology, writing for the people who build these systems rather than for you, sets a floor of fifteen characters for a password used on its own, says services must not impose character-mix rules, and says they must not force periodic password changes unless there is evidence the password has been compromised. The Cybersecurity and Infrastructure Security Agency's line is the shortest: turn it on everywhere it is offered.

There is no single federal page that walks you through untangling a shared Apple or Google account, a family plan, a car app, or a smart speaker. What official guidance exists is general, and it is still useful, because the same three moves cover most of it. First, inventory. Anything that logs in, anything with a screen, anything with a microphone or a camera, anything that reports a location: the phone, the tablet, the laptop, the watch, the car's app, the doorbell, the thermostat, the speakers, the streaming logins, the shared photo library, the shared calendar, the shared notes. Second, work out for each one who is the account owner and who is a member, because those are different powers – an owner can usually see, add and remove members, and a member usually cannot. Third, change what you can and replace what you cannot. Where a service lets you leave a family group or turn off location sharing, do it. Where it does not, because the account is in the other person's name and always was, the honest answer is that you need your own new account rather than a settings change. The Federal Trade Commission's guidance on internet-connected devices in the home is about the router and the defaults: everything in the house reaches the internet through the router, so change the default administrative username, password and network name to something unique, turn on encryption in the wireless security settings, and disable features you will not use, such as remote management. The National Institute of Standards and Technology's own researcher adds points that land squarely on a household coming apart: check that everyone in the household is comfortable with a smart device before it is in the home, never reuse a password across devices, turn off features you do not use, review the privacy settings including how long video and audio are kept, keep updates automatic and retire devices too old to receive them, and consider putting the smart devices on a separate network from the computer that holds your financial documents.

We could not find guidance from any federal agency on how to detect an AirTag or a similar Bluetooth tracker, and we are not going to write one for you. We searched the Federal Trade Commission's consumer site, the Cybersecurity and Infrastructure Security Agency, the Justice Department including the Office on Violence Against Women, and the Office for Victims of Crime. What is there is broader. The federal stalking statute reaches placing someone under surveillance with the intent to harass or intimidate, and the Office for Victims of Crime's own description of stalking names the method directly, listing "tracking a victim's whereabouts using technology such as cameras or global positioning systems (GPSs)" among the things stalkers do. The Cybersecurity and Infrastructure Security Agency's page on tracking technologies is about software rather than tags, and says that tracking technologies let third parties gather information about you and that keyloggers, rootkits, stalkerware and trojan horses are among the tools used to track people. Practically, this is the gap where the phone makers rather than the government have done the work: both major phone platforms now raise an alert when an unknown tracker is found moving with you, and both publish their own instructions for scanning. Those are company pages, not government ones, which is why we are not quoting them here as though they were law. If a tracker turns up, an advocate or the police can help you handle it in a way that preserves it as evidence rather than destroying it.

Begin with the warning that the Department of Health and Human Services puts at the top of its own pages on abuse, because it applies to reading this one. Anyone with access to your phone or computer can see what sites you have visited; you cannot completely clear that history; and it may be safer to use a public computer at a library, or a friend's phone. That is the first move in a technology safety plan, and it comes before passwords. From there the federal guidance is about advocates and about records. The Office for Victims of Crime says to take all threats seriously and to trust your instincts, to contact a local victim services agency or a domestic violence program where trained advocates will work with you on a concrete safety plan, and to document every incident thoroughly – keeping emails, messages, gifts and letters, and photographing property damage or injuries – because the police can use it. The Office on Women's Health adds the same for stalking: write down every incident with the time and date, take screenshots of anything that happened online, keep voicemails and photos, and get the names of witnesses. On your address: there is no single federal Safe at Home program. Address confidentiality programs are run state by state, and where a state has one, it gives a survivor a legal substitute mailing address to use wherever a home, work or school address is demanded, and forwards the real mail. The Justice Department's Office for Victims of Crime describes one such program, Pennsylvania's, in exactly those terms. Ask your own state's attorney general or victim advocate office whether your state has one and what it is called. Separately, federal law protects your information once you are in the system: any program funded under the Violence Against Women Act is forbidden to release personally identifying information about the people it serves without their informed, written, time-limited consent, and it says in terms that an abuser cannot give that consent on a child's behalf.