Crawls the web, in Arkansas

Ark. Code Ann. § 5-41-103 · Read the law's page

• Do not access, or cause to be accessed, a computer, computer system, or computer network to devise or execute a scheme to defraud or extort, or to obtain money, property, or a service through a false or fraudulent intent, representation, or promise.
• This offense turns on a fraudulent or extortionate purpose, not on whether the access itself was authorized.

Ark. Code Ann. § 5-41-104 · Read the law's page

• Do not intentionally and without authorization access, alter, delete, damage, destroy, or disrupt a computer, computer system, computer network, computer program, or data.
• The offense escalates from a misdemeanor to a Class D felony as the loss or damage caused rises past five hundred dollars and again past two thousand five hundred dollars.

Ark. Code Ann. § 5-41-203 · Read the law's page

• Do not knowingly and without authorization interfere with, deny, or cause the denial of access to a computer, system, or network to a person who has the duty and right to use it.
• Do not knowingly and without authorization use, access, attempt to access, or cause access to be gained to a computer, system, network, telecommunications device, telecommunications service, or information service.
• Either offense becomes a Class C felony where it is committed to devise or execute a scheme to defraud or illegally obtain property.
• A reasonable, good-faith belief that you were authorized, or that the person able to consent would have authorized you, is an affirmative defense, but it must be noticed to the prosecuting attorney at least fourteen calendar days before trial or hearing.

Ark. Code Ann. section 4-110-104(b) · Read the law's page

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you acquire, own, or license, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• This binds a person or business, a term defined to include a state agency, that acquires, owns, or licenses personal information about an Arkansas resident.
• This duty is separate from the same section's duty to take all reasonable steps to destroy or arrange for destruction of a customer's records containing personal information no longer retained, and from the Act's own breach-notification duty, researched as this jurisdiction's privacy row.
• There is no dedicated regulator or stated penalty amount for a violation of this duty; only the Arkansas Attorney General may bring an enforcement action, under the Arkansas Deceptive Trade Practices Act. Whether that Act's private-suit provision also reaches a violation of this duty has not been confirmed either way; treat it as an open question rather than a cleared risk.