Law / United States / 
North Carolina
North Carolina Computer-Related Crime Act (unauthorized access and computer trespass)
N.C. Gen. Stat. §§ 14-453 to 14-458; § 1-539.2A
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not use a North Carolina computer or computer network without the owner's authorization, or beyond the scope of authorization granted, to remove, disable, or alter data, cause a malfunction, damage property, or make an unauthorized copy of computer data, programs, or software.
- Do not access a computer, including a government computer, without authorization to defraud or to obtain property or services by false pretenses; accessing a government computer without authorization for any other purpose carries heightened felony exposure.
- A person you access without authorization can bring a civil action against you for damages, including lost profits, plus the costs of suit.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Computer trespass under G.S. 14-458(b) is a Class 3 misdemeanor, a Class 1 misdemeanor where the damage to another's property is valued at less than $2,500, and a Class I felony where it is $2,500 or more; the other offences in Article 60 carry their own classes.
Statutory damages
G.S. 1-539.2A(a): where the injury arises from unsolicited bulk commercial email, an injured person other than an email service provider may elect, in lieu of actual damages, the lesser of $10 for each message or $25,000 per day, plus attorneys' fees; an injured email service provider may elect the greater of $10 for each message or $25,000 per day, plus attorneys' fees and costs. Other injuries recover the damages sustained, including loss of profits, and the costs of suit.
- As of
- Currency
- USD
Who enforces it
Enforcement body
Criminal prosecution of the Article 60 offences, and the injured person by a private civil action for computer trespass under G.S. 1-539.2A.
Settledness
- As of
- Open questions
- Does automated copying of a public web page contrary to a site's terms of use use a computer "in a manner exceeding the right or permission" of the owner under G.S. 14-458(a)?
What it makes you log
Logging duty
Sections 14-453 to 14-458 define the computer-crime offenses (accessing computers, government computers, computer trespass) and section 1-539.2A gives the injured person a damages action. None of the cited sections requires a person to create, keep, produce or review a log or record. Section 1-539.2A(b) refers to the long-arm statute for personal jurisdiction over bulk commercial email actions, which is a procedural reference and not a territorial test of the offenses.
- Kind
- None
- As of
What this law does
North Carolina's computer-related crime statute, Article 60 of Chapter 14, defines authorization by reference to the computer owner's consent, not exceeding the scope of that consent, a standard closer to the federal Computer Fraud and Abuse Act's without-authorization and exceeds-authorized-access tests than to Virginia's narrower malicious-intent-or-deception requirement.
Computer trespass under section 14-458 makes it unlawful to use a computer or computer network without authority and with intent to make an unauthorized copy of computer data, programs, or software residing in, communicated by, or produced by a computer or network, reaching unauthorized automated copying of data from a website. A violation is a Class 3 misdemeanor, rising to a Class 1 misdemeanor or a Class I felony depending on the dollar value of resulting property damage.
A separate offense, section 14-454, criminalizes accessing a computer without authorization to defraud or to obtain property or services by false pretenses, as a Class 1 misdemeanor or a Class G felony depending on the value obtained. Accessing a government computer without authorization for any other purpose is a Class H felony under section 14-454.1, rising above the analogous private-computer offense's misdemeanor default.
Anyone injured by a violation of the computer trespass statute may bring a private civil action for damages, including lost profits, under section 1-539.2A.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .