Law / United States / 
Colorado
Colorado Cybercrime statute (unauthorized access, defined by express consent)
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not knowingly access a computer, computer network, or computer system without authorization, or beyond the scope of the authorization granted; Colorado defines authorization as the express consent of a person.
- Whether a public, unauthenticated page is accessed with the express consent the definition requires is open under Colorado law, so treat that question as unsettled.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does serving a page to every visitor give the "express consent of a person" that C.R.S. section 18-5.5-101(1) requires for "authorization" under section 18-5.5-102(1)(a)?
- Does a robots.txt directive or a cease-and-desist letter withdraw the "express consent of a person" that C.R.S. section 18-5.5-101(1) requires for "authorization", where the page stays open to the public?
What it makes you log
Logging duty
Section 18-5.5-102(1) lists the ways a person knowingly commits cybercrime, from access without authorization to altering, damaging or interrupting a system, and subsection (3) grades the offence by the loss or damage; subsection (5) lets an individual authorize an agent to access and process the individual's own data. No subsection requires anyone to create, keep, produce or review a log or record. Subsection (3)(d) sets the county of trial for the ticket-bot offence in (1)(g) only, and the section has no territorial clause.
- Kind
- None
- As of
What this law does
Subsection (1)(a) makes it a cybercrime for a person to knowingly access a computer, computer network, or computer system without authorization, exceed authorized access, or use one without authorization or in excess of authorized access, and subsection (3)(b) makes that offense a class 2 misdemeanor.
Subsection (1)(e) separately covers altering, damaging, or interrupting a computer or its data without authorization or in excess of authorized access, and subsection (1)(g) covers software that runs automated tasks over the internet to circumvent or disable electronic queues, waiting periods, or other technological measures intended to limit the number of event tickets one person may buy.
Subsection (5) provides that an individual may authorize an agent to access and process, on the individual's behalf, personal data or other information held on a computer that is otherwise accessible to the individual, and that an authorized agent remains liable for unauthorized activity under applicable unfair competition laws, the federal Computer Fraud and Abuse Act, and the other provisions of the section.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .