Law / United States / 
Connecticut
Connecticut Computer Crime (unauthorized access, undefined authorization test)
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Do not access a Connecticut-connected computer system knowing you lack authorization to do so; an ordinary read of an unrestricted public page with no notice of any restriction lacks that knowledge, but the statute does not say that a public page is outside the offence, so notice of a restriction can supply it.
- Be aware that unauthorized access to or copying of private personal data is valued at $1,500 per the statute's own grading rule, which can raise the offense level even for a small data set.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a person who requests an unrestricted public web page access a "computer system without authorization" under section 53a-251(b)(1) when the owner has published terms prohibiting automated collection?
- When can a person who keeps collecting data after a cease and desist letter show that "the person reasonably could not have known that his access was unauthorized" under the affirmative defense in section 53a-251(b)(2)(C)?
What it makes you log
Logging duty
Section 53a-251 defines six computer crimes, among them unauthorized access (b), theft of computer services (c), interruption of computer services (d), misuse of computer system information (e) and destruction of computer equipment (f). None requires anyone to create, keep, produce or review a log or record. Section 53a-261 treats the offence as committed in the state when an act in furtherance of it occurs there or when a computer system accessed is located there; the act-in-state branch is the hook, and the system-location branch has no hook value.
- Kind
- None
- As of
What this law does
Section 53a-251(b)(1) criminalizes unauthorized access to a computer system when a person, knowing that he is not authorized to do so, accesses or causes to be accessed any computer system without authorization.
Section 53a-251(b)(2) makes it an affirmative defense that the person reasonably believed the owner of the computer system, or a person empowered to license access, had authorized the access, reasonably believed the owner would have authorized it without payment of any consideration, or reasonably could not have known that the access was unauthorized.
The Appellate Court has read subsection (b) as directed at knowingly unauthorized access, and the first defense as exempting improper access made with a reasonable belief that it is authorized (Brantley v. City of New Haven, decided in 2007).
Section 53a-251(e)(1) separately reaches a person who, as a result of accessing a computer system, intentionally makes or causes to be made an unauthorized display, use, disclosure or copy of data residing in, communicated by or produced by a computer system. Computer crime in the fifth degree, which applies where the damage to or the value of the property or computer services is five hundred dollars or less, is a class B misdemeanor (section 53a-256).
Grading turns on the dollar value of damage or of computer services, and the statute fixes the value of private personal data at $1,500 for grading purposes (section 53a-259(c)), which matters specifically for personal-data scraping. Section 53a-251 was added by Public Act 84-206 and carries no History note in the official statute text, meaning it has never been amended since.
Its official source line records no effective date of its own, so the general rule for the effective date of a Connecticut public act applies (section 2-32 of the General Statutes: the first day of October following the session at which it was passed), and the section commenced .
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .