Law / United States / 
Arizona
Unauthorized release of proprietary or confidential computer security information
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not communicate, release, or publish proprietary or confidential security information, security-related measures, algorithms, or encryption devices specific to a particular computer, system, or network without that system's owner's or operator's authorization.
- Publishing a security warning or defect information that is not specific to a particular owner's or operator's system, sharing security information among that system's own authorized users, notifying an owner or operator of a perceived threat, or non-target-specific security research, development, or testing is exempt.
- Security research that discloses findings specific to a particular target's own system is not exempt merely because it arose from otherwise-lawful access or legitimate research.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A class 6 felony, or a class 4 felony where the security information relates to a critical infrastructure resource.
What it makes you log
Logging duty
Subsection (A) defines the offence, (B) exempts three kinds of release (warnings not specific to one owner's system, release among a system's authorized users or notice to its owner, and security research not specific to one owner's system) and (D) grades the felony. Subsection (C) directs the court, at the end of a grand jury, hearing or trial, to preserve under section 44-405 the proprietary computer security information admitted in evidence; that is a court's handling of an exhibit and puts no duty to keep a log or record on the person charged. The section has no territorial clause.
- Kind
- None
- As of
What this law does
Makes it unlawful to communicate, release, or publish proprietary or confidential computer security information, security-related measures, algorithms, or encryption devices relating to a particular computer, system, or network, without the authorization of that system's owner or operator.
Exemptions cover releasing a security warning or defect information that is not specific to a particular owner's or operator's system, sharing security information among a system's own authorized users, notifying an owner or operator of a perceived threat, and research, development, or testing of security measures that is likewise not specific to a particular owner's or operator's system.
A scraper or security researcher who discovers and publishes a vulnerability specific to one operator's own system, rather than a generic product defect, is not exempted merely because the underlying access was otherwise lawful. The codified text carries no history note, and no day on which the section came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .