Law / United States / 
Washington
Washington Cybercrime Act, technological-access-barrier authorization test
RCW 9A.90.030, RCW 9A.90.040, RCW 9A.90.050
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Scraping a public page with no technological access barrier is not, by this statute's own definition, access without authorization, regardless of a posted policy or terms of service.
- A bare violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, does not by itself satisfy this statute's without-authorization definition; only knowingly circumventing a technological access barrier does.
- White-hat security research, and circumventing a measure that does not effectively control access to a computer, are expressly excluded from without-authorization access under this statute.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- When is a technological access measure "specifically designed to exclude or prevent unauthorized individuals" under RCW 9A.90.030(12), for a rate limit, an IP block or a login prompt in front of a page that is otherwise public?
- Does changing an IP address or user agent to continue after a block "circumvent technological access barriers" under RCW 9A.90.030(12) when the owner has said the visitor is not permitted?
What it makes you log
Logging duty
RCW 9A.90.040 and 9A.90.050 make it a class C felony or a gross misdemeanor to intentionally gain access to a computer system or electronic database of another without authorization, the first degree applying where the access is to commit another crime or involves a government agency's computer or database. They impose no duty to create, keep, produce or review a log or record, and the chapter states no territorial clause, so no hook is recorded.
- Kind
- None
- As of
What this law does
RCW 9A.90.040 (computer trespass, first degree) and RCW 9A.90.050 (second degree) prohibit gaining access to a computer system or electronic database without authorization.
RCW 9A.90.030(12) statutorily defines without authorization as knowingly circumventing technological access barriers to a data system to obtain information without the owner's express or implied permission, where the access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining the information, but the definition expressly excludes white hat security research and circumventing a measure that does not effectively control access to a computer, and expressly excludes a bare violation of a duty, agreement, or contractual obligation such as an acceptable use policy or terms of service agreement.
This is a codified, narrow, gates-based authorization test, functionally aligned with the Ninth Circuit's hiQ v. LinkedIn reasoning and the gates-up-or-down logic of Van Buren v. United States: a public page with no technological access barrier cannot, by the statute's own definition, be accessed without authorization no matter what a posted policy says, and a bare ToS violation with no technical circumvention does not satisfy the definition either.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .