Law / United States / 
Maine
Aggravated criminal invasion of computer privacy
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not intentionally make an unauthorized copy of a computer program, software, or information from a Maine-connected computer resource, knowing you are not authorized to do so; this reaches unauthorized bulk copying even without any resulting damage.NIST AI RMFMAP 4.1
- Do not intentionally or knowingly damage a computer resource, or introduce or allow the introduction of a computer virus into one, without a reasonable ground to believe you have the right to do so.no control in the NIST AI RMF
- A violation is a Class C crime, carrying up to 5 years of imprisonment and a fine of up to $5,000.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Aggravated criminal invasion of computer privacy under 17-A M.R.S. § 433 is a Class C crime, punishable by imprisonment of up to 5 years (17-A M.R.S. § 1604(1)(C)) and a fine of up to $5,000 (17-A M.R.S. § 1704(3)).
Penalty structure
Maximum fine for a Class C crime under 17-A M.R.S. § 1704(3); the statute also authorizes imprisonment of up to 5 years under § 1604(1)(C).
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 5,000
What it makes you log
Logging duty
Section 433 makes unauthorized copying of computer programs, software or information, damaging another person's computer resource, and introducing a computer virus into a computer resource an offence, a Class C crime. It imposes no duty to create, keep, produce or review a log or record and states no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
A person commits aggravated criminal invasion of computer privacy, a Class C crime, by intentionally making an unauthorized copy of a computer program, software, or information, knowing the person is not authorized to do so; by intentionally or knowingly damaging a computer resource with no reasonable ground to believe the person has the right to do so; or by intentionally or knowingly introducing or allowing the introduction of a computer virus into a computer resource.
Unauthorized copying under the first branch does not require proof of resulting damage, so it reaches bulk automated copying of data from a computer resource without authorization, not only intrusions that damage or infect a system.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .