Law / United States / 
New York
New York Computer Trespass, notice-based revocation and circumvention presumption
N.Y. Penal Law §§ 156.00, 156.05, 156.10
In force.
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not continue accessing a New York-connected system, or circumvent a technical security measure, after the operator has given you actual notice, including a cease-and-desist letter, that your access is unwanted; this statute treats notice alone as sufficient to convert continued access into unauthorized access, without needing a technical block.
- Repeated exposure to terms of use posted on every response to your automated queries can support a trespass-to-chattels claim even without a signed agreement, under Register.com v. Verio (2d Cir. 2004).
- Independently gathering the same time-sensitive facts a competitor also gathers is not hot-news misappropriation under New York law; copying a competitor's own compiled output, rather than gathering the underlying facts yourself, is the fact pattern the surviving tort still reaches.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a website owner's robots.txt file or terms of use give a scraper "actual notice" that its access "was without permission" under N.Y. Penal Law section 156.00(8)?
- Does rotating IP addresses or request headers to avoid a rate limit amount to a program that "bypasses, defrauds or otherwise circumvents a security measure" under N.Y. Penal Law section 156.00(8)?
What it makes you log
Logging duty
Sections 156.00, 156.05 and 156.10 define the terms and the offenses of unauthorized use of a computer and computer trespass. None requires a person to create, keep, produce or review a log or record, and none states a territorial clause. The definitions section 156.00 could not be re-read on its own host and is not quoted.
- Kind
- None
- As of
What this law does
Section 156.00(8) defines without authorization to mean using or accessing a computer, computer service, or computer network without the permission of the owner or lessor, or someone licensed or privileged by the owner or lessor, where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission, an express, textual revocation rule under which a communicated notice, including a cease-and-desist letter, that access is unwanted converts continued access into without authorization access, without needing a technical block at all.
The same subsection also provides that the knowing use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents a security measure installed or used with the user's authorization shall be presumptive evidence that such person used or accessed such computer without authorization, giving circumvention its own statutory evidentiary weight. Section 156.05 (unauthorized use of a computer, a class A misdemeanor) builds on the same authorization definition.
Section 156.10 (computer trespass, a class E felony, requiring either intent to commit a felony or knowing access to computer material) builds on the same authorization definition as well.
Register.com, Inc. v. Verio, Inc. (356 F.3d 393, 2d Cir. 2004), a New York-originated dispute, affirmed a preliminary injunction on a trespass-to-chattels theory where an automated WHOIS-query tool kept accessing a database after repeated exposure to posted terms of use prohibiting that use, even though the defendant never signed an agreement, holding repeated notice sufficient.
National Basketball Association v. Motorola, Inc. (105 F.3d 841, 2d Cir. 1997), applying New York's hot-news misappropriation tort, held the tort survives Copyright Act preemption only narrowly (the plaintiff generates time-sensitive information at a cost, the defendant free-rides on it, the parties are direct competitors, and free-riding would substantially threaten the product's existence or quality), and on the facts found no violation because Motorola independently gathered its own underlying facts rather than copying the NBA's compiled product; a scraper that copies a compiled output rather than independently gathering facts could still fall within the surviving tort.
The sections this entry groups came into force on different days.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .