Law / United States / 
West Virginia
West Virginia Computer Crime and Abuse Act
W. Va. Code §§ 61-3C-4, 61-3C-5
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Ordinary, non-deceptive automated access to a public West Virginia-connected page, performed without intent to obtain computer services without authorization and without a scheme to defraud, does not by itself fit either offense's elements.
- Do not knowingly, willfully, and without authorization access or cause to be accessed a computer or computer network with intent to obtain computer services; this is a misdemeanor punishable by a $200 to $1,000 fine, up to one year in county jail, or both.NIST AI RMFMAP 4.1
- Do not knowingly and willfully access a computer, computer service, or computer network to execute a scheme to defraud or to obtain money, property, or services by fraudulent pretenses; this is a felony punishable by up to $10,000 and ten years, or both.no control in the NIST AI RMF
- Do not introduce ransomware into a computer, computer system, or computer network with intent to extort money or other consideration; this is a separate felony punishable by up to $100,000 and ten years, or both.no control in the NIST AI RMF
- This Act contains no clause preserving or displacing an ordinary contract or license governing your access to a West Virginia-connected computer service; terms-of-service enforcement is a separate track under ordinary contract law, untested here against scraping specifically.
- Anyone injured by a violation of this Act may sue in circuit court for compensatory damages, punitive damages, and injunctive relief.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Three criminal tiers: unauthorized access to computer services with intent to obtain them is a misdemeanor (fine $200 to $1,000, or up to one year in county jail, or both); computer fraud (defrauding, or obtaining money, property, or services by fraudulent pretenses) is a felony (fine up to $10,000, or up to ten years, or both); introducing ransomware with intent to extort is a separate felony (fine up to $100,000, or up to ten years, or both); and unauthorized access to data on a Legislature-owned computer is a felony (fine up to $5,000, or up to five years, or both).
Penalty structure
West Virginia Code 61-3C-4(a): computer fraud (accessing a computer to execute a scheme to defraud or to obtain money, property or services by fraudulent pretenses) is a felony fined not more than $10,000, or up to 10 years, or both. Section 61-3C-5's unauthorized access is a misdemeanor fined $200 to $1,000. Section 61-3C-4(b) separately sets a fine of up to $100,000 for the ransomware offence it creates, and data of the Legislature carries a $5,000 tier.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
The article names no enforcing agency: offences are criminal (a felony or a misdemeanor) and an injured person may sue in circuit court under section 61-3C-16.
Settledness
- As of
- Open questions
- Does "without authorization" in section 61-3C-5, read with the defined term "authorization" as "express or implied consent", reach access to a public web page that the site operator's terms of use forbid?
What it makes you log
Logging duty
Sections 61-3C-4 and 61-3C-5 make it a felony to access a computer to carry out a fraud scheme, to introduce ransomware with intent to extort, or to access data on a Legislature computer without authorization, and a misdemeanor to access a computer or network without authorization with intent to obtain computer services. They impose no duty to create, keep, produce or review a log or record. Section 61-3C-20, which the row does not cite, subjects a person who violates the article to prosecution in the state where the computer or data is located in whole or in part or passes through the state in transit; that turns on where the system sits, so it carries no hook value and none is recorded.
- Kind
- None
- As of
What this law does
Section 61-3C-5 makes it a misdemeanor, fined $200 to $1,000 or up to one year in county jail, for any person to knowingly, willfully, and without authorization access or cause to be accessed a computer or computer network with the intent to obtain computer services; ordinary, non-deceptive automated access to a public page performed without such intent does not fit this offense's elements.
Section 61-3C-4 separately makes computer fraud, accessing a computer to execute a scheme to defraud or to obtain money, property, or services by fraudulent pretenses, a felony punishable by up to $10,000 and ten years, and makes introducing ransomware with intent to extort a separate felony punishable by up to $100,000 and ten years; a third tier in the same section punishes knowing, willful, unauthorized access to data stored in a computer owned by the Legislature with a fine of up to $5,000 and up to five years.
Authorization is defined as the express or implied consent a person gives another to access their computer, network, program, software, system, password, identifying code, or personal identification number.
Section 61-3C-17 provides a defense where the defendant had reasonable grounds to believe they had authority to access, or could not reasonably have known they lacked it, but the article contains no clause preserving or displacing ordinary contract or license terms, unlike Virginia's equivalent statute.
Section 61-3C-16 gives any person injured by a violation of the article a civil cause of action in circuit court for compensatory damages, punitive damages, and injunctive relief, brought within five years of the last act constituting a violation or two years of its discovery, whichever is earlier. The Act was originally enacted in 1989 as Senate Bill 92 and has been amended repeatedly since. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .