Law / United States / 
Delaware
Delaware Computer Crime (unauthorized access, with a private civil right of action)
Del. Code tit. 11, §§ 932, 939, 941
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Do not access a Delaware-connected computer system knowing you lack authorization to do so; an openly served page carries no obvious authorization barrier, but this statute's own text does not resolve the question for a public page.
- Defeating a technical access control, such as a rate limit, IP block, or CAPTCHA, exposes you to a private civil suit under section 941, including treble damages where the conduct is wilful and malicious, not only to criminal liability.
These lines are LexLint's reading of the law's text. Also read by: Sarwal v. Nephrosant, Inc., C.A. No. 2023-0222-BWD (Del. Ch. ) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Court of Chancery dismissed a counterclaim under the Act as not reasonably conceivable, observing that the counterclaims did not allege that the computer systems involved were located in Delaware or that any act in furtherance of the violations occurred in Delaware.
- As of
- Case link
- https://courts.delaware.gov/Opinions/Download.aspx?id=384290
- Case citation
- Sarwal v. Nephrosant, Inc., C.A. No. 2023-0222-BWD (Del. Ch. )
- Open questions
- Does a person who retrieves data from an openly served website access a computer system "without authorization" under 11 Del. C. section 932 when the site's terms of use forbid automated collection?
- What must a person know to be "knowing that the person is not authorized to do so" under 11 Del. C. section 932, and does an operator's technical block or written demand supply that knowledge?
What it makes you log
Logging duty
Sections 932, 939 and 941 define the offense of unauthorized access, grade its penalties by the damage or value involved, and give an aggrieved person an injunction, restitution, receivership and damages action. None requires anyone to create, keep or produce a log or record. Section 940 states that an offense is deemed committed in Delaware if any act in furtherance occurs in the State; its further limb, where the computer system accessed is located in the State, carries no hook value.
- Kind
- None
- As of
What this law does
Section 931 defines access as instructing, communicating with, storing data in or retrieving data from a computer, computer system or computer network, and defines no term for authorization. Section 932 provides that a person is guilty of the computer crime of unauthorized access to a computer system when, knowing that the person is not authorized to do so, the person accesses or causes to be accessed any computer system without authorization.
Section 933 punishes accessing or using a computer system with intent to obtain unauthorized computer services, software or data, section 934 punishes intentionally or recklessly disrupting or degrading computer services without authorization, and section 935(1) punishes a person who, as a result of accessing a computer system, intentionally makes an unauthorized display, use, disclosure or copy of data residing in, communicated by or produced by a computer system.
Section 939 grades penalties by the damage to or value of the property or computer services affected, from a class D felony above $10,000 to a class A misdemeanor under $1,500, and section 939(h) fixes the value of private personal data at $500 for grading purposes.
Section 941 creates an express civil right of action for any aggrieved person, recoverable in the Court of Chancery (injunction, restitution, receivership) or at law (actual damages, damages for unjust enrichment, and treble damages where there has been a showing of wilful and malicious conduct), plus reasonable costs and attorney's fees to a prevailing plaintiff, with no criminal action required first and a three-year discovery-based limitations period.
So a person who violates section 932 faces private civil exposure, not only prosecution.
The offenses and the civil remedy were enacted together by chapter 438 of volume 64 of the Laws of Delaware (Senate Bill 492), approved , with the civil remedy then numbered section 939; the enrolled act's own text of section 932 reads identically in substance to the current codification (only a later gender-neutral pronoun update was made), so the section dates to its original 1984 commencement.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .