Law / United States / 
New Jersey
New Jersey Computer Criminal Activity, objective reasonable-person authorization test
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Whether your access to a New Jersey-connected system is authorized turns on the permission of the person with lawful authority to give it and, alternatively, on whether a reasonable person would believe the access was authorized; an open, unrestricted page with no login wall or technical block tends to favor a reading of authorized access, though no New Jersey court has applied this to a scraping fact pattern.
- There is no statutory notice-based revocation mechanism here, and no New Jersey decision holds that a bare demand letter alone ends authorization, but a clear written demand to stop weakens any reasonable belief that continued access is authorized.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a written demand from the operator to stop change what "a reasonable person would believe" about whether continued access to an open page "was authorized" under N.J.S.A. 2C:20-23(q)?
- Is the reasonable person in N.J.S.A. 2C:20-23(q) an ordinary user, or a person who knows of the operator's technical blocks, when deciding whether "a reasonable person would believe that the act was authorized"?
What it makes you log
Logging duty
Section 2C:20-25 defines computer criminal activity (access, alteration, damage, fraud, obtaining or copying data). It imposes no duty to create, keep, produce or review a log or record. Section 13 of the 1984 act, as amended (2C:20-34), makes the situs of the offense also the place where the actual damage occurs; its limbs on the location of the computer or device used carry no hook value.
- Kind
- None
- As of
What this law does
A person is guilty of computer criminal activity if the person purposely or knowingly and without authorization, or in excess of authorization, accesses any data, data base, computer storage medium, computer program, computer software, computer equipment, computer, computer system or computer network, a crime of the third degree.
Separate subsections punish altering, damaging or destroying data or denying, disrupting or impairing computer services, and obtaining, taking, copying or using data stored in a computer.
A violation of any subsection is a crime of the first degree if the offense results in a substantial interruption or impairment of public communication, transportation, supply of water, gas or power, or other public service, in damages or loss in excess of $250,000, or in significant bodily injury, and every sentence of imprisonment for a first-degree violation includes a minimum term of one-third to one-half of the sentence imposed.
N.J.S.A. 2C:20-23(q) defines authorization as permission, authority or consent given by a person who possesses lawful authority to grant it, and adds that an actor has authorization if a reasonable person would believe that the act was authorized.
The definition adds an objective question, so for an open, unauthenticated page with no login wall, technical block or other denial signal in front of it, the operative question is whether a reasonable person would believe access was authorized, which favors treating ordinary public-page crawling as authorized absent such a signal.
P.L. 2003, c. 39, approved and effective immediately, amended section 2 of P.L.1984, c.184 (C.2C:20-23), which contains the definition of authorization, and section 4 of P.L.1984, c.184 (C.2C:20-25), which defines the offense.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .