Law / United States / 
Maryland
Maryland Unauthorized Access to Computers, with a civil private right of action
Md. Code Ann., Crim. Law § 7-302
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access, or exceed authorized access to, a Maryland-connected computer network, system, or database intentionally and without authorization; the statute defines access but never authorization, so whether an unrestricted public page counts as authorized is unsettled rather than resolved by its text.
- A violation exposes you to a civil suit by anyone who suffers a specific and direct injury, with actual damages and attorney's fees recoverable, independent of and in addition to any criminal exposure and independent of MODPA's own enforcement scheme.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a person who requests an unrestricted public web page act 'without authorization' under Criminal Law section 7-302(c)(1)?
- Does a person who violates a website's terms of use 'exceed the person's authorized access' under Criminal Law section 7-302(c)(1)(i)?
What it makes you log
Logging duty
Section 7-302 prohibits unauthorized access, possession of access codes, ransomware and related acts, sets the penalties and gives an injured person a civil action (subsection g). It imposes no duty to create, keep, produce or review a log or record. Subsection (f) lets a court try the offence in any county where the defendant acted or where the accessed computer is located; that is a venue rule turning on where the computer sits and has no hook value, so none is recorded.
- Kind
- None
- As of
What this law does
Section 7-302(c)(1) provides that a person may not intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person's authorized access to all or part of a computer network, computer control language, computer, computer software, computer system, computer service, or computer database, or copy, attempt to copy, possess, or attempt to possess the contents of a computer database accessed in violation of that clause.
Reading the section end to end, among its definitions access is defined (to instruct, communicate with, store data in, retrieve or intercept data from, or otherwise use the resources of a computer program, system, or network); authorization and without authorization are never defined anywhere in the section, and it carries no publicly-available-data exception and no notice-based revocation clause of any kind, so there is no textual hook either way for how a Maryland court would treat a public, unauthenticated page.
Section 7-302(g) separately creates a civil private right of action: a person who has suffered a specific and direct injury because of a violation of this section may bring a civil action, recover actual damages and reasonable attorney's fees and court costs, and a prior criminal conviction is not a prerequisite to suit. This civil right of action expands a scraper's exposure in Maryland beyond the criminal penalties in subsection (d), because a conviction is not a prerequisite to suit.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .