Law / United States / 
Minnesota
Minnesota Unauthorized Computer Access, penetrating a computer security system
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- A public page behind no login, access code, or other computer security system has nothing for you to penetrate under this statute's own terms, though no Minnesota court has confirmed this reading.
- Defeating a login or other computer security system, meaning a program or device intended to protect the confidentiality and secrecy of data, to access a Minnesota-connected computer system is what this statute targets.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a technical measure that is not a login, such as an IP block or a rate limit, count as a "computer security system" under Minn. Stat. section 609.87, subdivision 11, if it is "intended to protect the confidentiality and secrecy of data"?
- Does a page that any visitor can load involve data whose "confidentiality and secrecy" a program or device is "intended to protect" under the definition of "computer security system" in Minn. Stat. section 609.87, subdivision 11?
What it makes you log
Logging duty
Section 609.891 makes it an offence to intentionally and without authorization attempt to or penetrate a computer security system or electronic terminal, and grades the offence by risk and harm. It imposes no duty to create, keep, produce or review a log or record and states no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
Subdivision 1 provides that a person is guilty of unauthorized computer access if the person intentionally and without authorization attempts to or does penetrate a computer security system or electronic terminal, so the offense reaches an attempt as well as a completed penetration, and subdivision 4 makes a violation a misdemeanor.
This ties the offense to penetrating a computer security system rather than to access without permission as such, so a plain crawl of a public page behind no security system would not, on this section's own terms, appear to fall within it.
The grade rises to a gross misdemeanor where a violation creates a risk to public health and safety, compromises the security of data that are not public data, or gains access to personal data, and to a felony where it creates a grave risk of causing the death of a person. Further tiers apply to opening a panel or access door of an electronic terminal, including to place a device that captures access device information.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .