Law / United States / 
Massachusetts
Unauthorized access to a computer system; penalties
Mass. Gen. Laws ch. 266, § 120F
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access a computer system without authorization, and stop accessing it once you know your access is no longer authorized.
- A password or other authentication requirement is itself notice that access is limited to authorized users, so bypassing or ignoring one exposes you under this section.
- A public page requiring no password or authentication raises no exposure under this section by itself.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Punishable by imprisonment in the house of correction for not more than 30 days, a fine of not more than $1,000, or both.
Penalty structure
Fixed criminal fine cap; the section separately authorizes up to 30 days' imprisonment in the house of correction, alone or together with the fine.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 1,000
What it makes you log
Logging duty
Section 120F makes knowing unauthorized access to a computer system, or failure to end access known to be unauthorized, an offence, and treats a password or other authentication requirement as notice that access is limited. It imposes no duty to create, keep, produce or review a log or record and states no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
Whoever, without authorization, knowingly accesses a computer system by any means, or after gaining access by any means knows that access is not authorized and fails to terminate it, is punished by up to 30 days in the house of correction, a fine of up to $1,000, or both.
The section states that a password or other authentication requirement itself constitutes notice that access is limited to authorized users, the same authorization-gate reasoning the Computer Fraud and Abuse Act (CFAA)'s federal case law uses, so a public, unauthenticated page raises no exposure under this section on the same logic. Section 120F was inserted by chapter 168 of the Acts of 1994. Chapter 168 was approved , and carries no effective-date clause or emergency preamble of its own.
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .