Law / United States / 
Kentucky
Kentucky Unlawful Access to a Computer
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, cause to be accessed, or attempt to access a Kentucky-connected computer, computer system, computer network, or the data or software on one, without the effective consent of the owner.
- Consent obtained by deception or coercion, or given by a person not authorized to act for the owner, is not effective consent, so deceptively circumventing a login, paywall, or other technical access control falls within this statute.
- Access made without effective consent is criminal even where it causes no loss or damage; access causing loss or damage of $300 or more is a felony, and access made to defraud or to obtain money, property, or services is the most serious tier.
- Do not receive, conceal, or use data or property known to have been obtained through a violation of this statute; doing so is a separate felony.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Kentucky grades unauthorized computer access by degree: a Class C felony where the access is made to defraud or to obtain money, property, or services (KRS 434.845); a Class D felony where the access, without that purpose, causes loss or damage of $300 or more (KRS 434.850); a Class A misdemeanor where the loss or damage is under $300 (KRS 434.851); and a Class B misdemeanor where the access causes no loss or damage at all (KRS 434.853). Receiving or using the proceeds of a KRS 434.845 violation is a separate Class C felony (KRS 434.855, misuse of computer information).
What it makes you log
Logging duty
KRS 434.845 to 434.855 define four degrees of unlawful access to a computer and the offence of misuse of computer information. They impose no duty to create, keep, produce or review a log or record; the books, records and documents named in 434.855 are proceeds of an offence, not a record the person must keep. The sections state no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
Kentucky makes it unlawful to access, cause to be accessed, or attempt to access a computer, computer system, computer network, or any data or software on one, without the effective consent of the owner, and grades the offense in four degrees. Access made to defraud or to obtain money, property, or services is a Class C felony (first degree). Access without that purpose that causes loss or damage of $300 or more is a Class D felony (second degree).
Access causing loss or damage of less than $300 is a Class A misdemeanor (third degree). Access causing no loss or damage at all is still a Class B misdemeanor (fourth degree), so the statute does not require any resulting harm to establish criminal liability, only the absence of effective consent. Separately, knowingly receiving, concealing, or using data or property obtained through a first-degree violation is its own Class C felony (misuse of computer information).
Effective consent is defined at KRS 434.840 and is not effective when induced by deception or coercion or given by a person not authorized to act for the owner, so deceptively circumventing a login, paywall, or other access control falls within the statute regardless of which degree applies.
The statute's text does not expressly except ordinary, unauthenticated access to a publicly available page, and no Kentucky court decision construing the without-effective-consent standard as applied to automated collection of public web content has been located.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .