What to do after a computer-damage accusation or search

Stop making changes to the disputed system unless immediate action is necessary to protect people or prevent ongoing harm and counsel has addressed preservation. Logging in to “fix” an issue can overwrite logs, change timestamps, expand alleged damage, violate a no-contact or access restriction, or be portrayed as concealment.

Do not delete messages, wipe devices, rotate credentials to exclude investigators, destroy hardware, run cleanup utilities, contact witnesses to coordinate explanations, or remotely erase an account. Preserve first. A defensible forensic image is more useful than a well-intentioned attempt to tidy the evidence.

Save the complaint, warrant, inventory, preservation request, employment agreement, acceptable-use rules, access approvals, work tickets, change requests, source-control records, vendor contracts, termination documents, device receipts, and communications defining the accused person’s role.

Write a confidential chronology for counsel. Identify each device and account, who owned it, who administered it, who shared credentials, what change was expected, when access was withdrawn, what notice was given, what failed, and what remediation occurred.

Do not assume an employer’s internal conclusion is the criminal-law answer. Incident reports are often written quickly to restore service, satisfy insurers, notify customers, or preserve civil claims. The State must prove the criminal statute, not merely a policy violation or expensive outage.

Section 609.88 contains three different offenses

Clause (a) applies when a person intentionally and without authorization damages or destroys protected computer property. The prosecution must prove an intentional act, lack of authorization, damage or destruction, protected property, causation, identity, and the loss level alleged.

Clause (b) addresses alteration. Its wording creates alternatives: a person may be charged with intentionally and without authorization altering protected property, or with altering it with intent to injure or defraud. The complaint and jury instructions should identify which mental-state and authorization theory the State is pursuing.

Clause (c) addresses distribution of a destructive computer program. It requires unauthorized distribution and an intent to damage or destroy protected property. Merely possessing code, discussing a vulnerability, writing a proof of concept, or transmitting ordinary software is not the complete offense.

The clauses should not be collapsed into a generic allegation that the accused “hacked” a victim. Damage, destruction, alteration, and distribution are different acts. Authorization and intent operate differently. Loss determines the offense level but does not replace proof of the underlying conduct.

A defense audit should track the charging language word by word. If the complaint alleges deletion but the proof shows an authorized configuration change, or alleges distribution but shows only local execution, the variance can matter.

What counts as computer property under Minnesota law

Minn. Stat. § 609.87 (2026) defines a computer as an electronic device performing logical, arithmetic, or memory functions through signal manipulation. A computer system includes related, connected, or unconnected computers and peripheral equipment. A computer network includes the interconnection of a communication system and computer, as well as two or more interconnected computers or systems, and includes private and public telecommunications networks.

The protected “property” is not limited to hardware. The definition includes electronically processed or produced data and information contained in a computer or computer software, whether machine-readable or human-readable. Source code, databases, configuration files, customer records, stored documents, system images, and other digital information can therefore be within the statute.

Computer software includes a program, procedures, and associated documentation concerned with computer operation. A system-change case may involve multiple objects: a physical server, operating system, application, database, cloud environment, logs, backups, and business data.

The State should identify what was damaged, destroyed, or altered. Saying “the network” or “the system” can conceal whether any protected property actually changed, which owner or lessee suffered loss, and how the accused’s act caused it.

Temporary unavailability can matter under the loss definition even when data are restored, but an interruption does not eliminate the need to prove the charged act and causation.

Authorization is specific to owner, time, purpose, and notice

Section 609.87 defines authorization primarily through the owner’s permission. It also recognizes specified government and device-inspection access and access by people with express permission from an owner, operator, or designated representative, limited to approved times and purposes.

An owner can limit authorization through actual oral or written notice, a prominent written notice adjacent to the computer, or a notice displayed or announced by the computer. Permission is therefore not always all-or-nothing.

In workplace cases, the central evidence may include job duties, administrator roles, tickets, supervisor instructions, emergency practices, prior custom, written policies, offboarding records, and the exact time access was revoked. Technical ability to log in is not necessarily legal permission; conversely, a later claim that work was unauthorized does not erase permission actually given at the time.

Authority can be disputed inside organizations. A manager may approve a change the owner later dislikes. A vendor may receive permission from an apparent representative. A contractor’s statement of work may authorize testing but limit production changes. Shared governance can create factual uncertainty about who could grant or withdraw permission.

The clause (b) intent-to-injure-or-defraud alternative deserves separate treatment. Its text does not simply repeat the unauthorized-alteration branch. Counsel should analyze the exact grammar and charge rather than assuming lack of authorization is always the only disputed issue.

A mistake, accident, or negligence is not enough by itself

Clauses (a) and (b) use “intentionally.” Clause (c) requires intent to damage or destroy. Criminal intent cannot be inferred merely because a change produced a serious outage.

Software deployment, database migration, access-control changes, backup rotation, security testing, patching, and incident response can cause unintended damage. Logs may show the accused performed an act but not why, what result was expected, or whether the person understood the risk.

Intent evidence may include messages, threats, searches, test runs, code comments, concealment, timing around termination, use of another identity, disabling logs, selecting destructive commands, demanding money, or prior knowledge of the system. Each fact needs authentication and context.

After-the-fact panic is not conclusive proof of original intent. A person may conceal an embarrassing error, violate policy, or give a poor account without having intended the damage. Those facts can hurt credibility, but they do not relieve the State of proving the charged mental state.

For clause (b)’s injury-or-fraud theory, the State must identify the intended injury or fraudulent objective. Competitive advantage, spite, financial gain, concealment, and retaliation may be alleged, but motive and statutory intent are not identical.

Damage, destruction, and alteration are related but not interchangeable

Damage ordinarily implies impairment in value, function, condition, availability, or utility. Destruction suggests a more complete loss. Alteration can be broader: a change to data, software, configuration, permissions, or system state may qualify even if the property still operates.

The State should prove the before-and-after condition. Baselines, hashes, configuration exports, source-control commits, backups, audit trails, monitoring data, database logs, and forensic images can show whether a change occurred and when.

A system that was already unstable, compromised, misconfigured, obsolete, or undergoing maintenance presents causation questions. Multiple administrators, automatic jobs, third-party services, malware, hardware failure, and security tools can change data without the accused doing so.

Not every inconvenient change creates measurable statutory loss. A corrected typo, reversible permission change, harmless test record, or brief interruption may fall below the felony thresholds even if the underlying misdemeanor elements are proved.

Deletion is not always permanent destruction. Files may remain in snapshots, recycle areas, replication, archives, cloud version history, or backups. Restoration does not necessarily erase temporary-loss claims, but it affects what happened, the reasonable response, and the amount.

What is a destructive computer program?

Section 609.87 defines a destructive program through function or product. A program performs a destructive function if it degrades performance, disables a computer or peripheral or program, or destroys or alters programs or data.

A program produces a destructive product if it creates unauthorized data, including data that consume memory; causes unauthorized alteration of data or programs; or produces another destructive program, including a self-replicating program.

That definition can reach malware, ransomware, wipers, logic bombs, destructive scripts, malicious macros, and some self-replicating code. But function and intent matter. Security research tools, penetration-testing frameworks, remote-management utilities, backup scripts, and administrative commands can have lawful uses.

Clause (c) requires distribution without authorization and intent to damage or destroy. Analysts should identify what was sent, to whom or what system, whether the transfer completed, whether the program met the statutory definition, and whether the accused intended the required result.

A vendor who unknowingly passes a compromised update presents a different case from a person who packages and deploys code designed to erase data. Criminal liability cannot be established solely by tracing a file through an account.

Proving who caused the change

Usernames, IP addresses, device names, and access tokens are clues, not people. Credentials can be shared, stolen, cached, delegated, reused, or left active. Automated services may execute under a human account. Remote-access tools and virtual machines can obscure the originating user.

Reliable attribution may require authentication logs, multifactor records, endpoint telemetry, IP allocation, device identifiers, geolocation, physical access, camera video, key-card data, command history, shell artifacts, source-control signatures, cloud audit records, and witness testimony.

Timestamps need careful normalization. Systems may use UTC, local time, daylight-saving offsets, inconsistent clocks, or retention formats. Exporting records can change metadata. A timeline should state its sources and conversion method.

Investigators should preserve exculpatory logs as well as incriminating ones. Short retention periods can erase failed-login data, DHCP assignments, identity-provider records, security alerts, backups, or version histories. A defense team may need rapid preservation demands and subpoenas.

Circumstantial attribution is permitted, but it must exclude reasonable innocent explanations under Minnesota’s circumstantial-evidence framework when the conviction rests on circumstances.

Minnesota uses a special statutory definition of loss

Section 609.87, subdivision 10, defines loss as the greatest of three measures: the retail market value of the property or services involved; the reasonable repair or replacement cost, whichever is less; or the reasonable value of damage caused by unavailability or lack of utility until repair or replacement can be completed.

The “greatest” language favors the highest valid measure, but each measure has limits. The State must supply admissible evidence, connect it to protected property or services, and show reasonableness. A total submitted by a complainant is not self-authenticating.

Repair and replacement are not simply added without regard to the phrase “whichever is less.” If repair restores the property reasonably for less than replacement, the statute directs attention to repair for that measure. Upgrading an old system to a superior one is not automatically reasonable replacement loss caused by the defendant.

Market value may be difficult for custom software or unique data. Expert methodology, comparable products, development cost, useful life, licensing, depreciation, and actual market evidence may matter. Original development spending is not necessarily current retail market value.

Unavailability loss must be tied to lack of utility until repair or replacement can be effected. The duration, affected functions, reasonable mitigation, actual downtime, restored capacity, and proof of business impact all deserve scrutiny.

Incident-response expenses and business interruption

After an outage, an organization may engage forensic consultants, lawyers, public-relations firms, breach-notification vendors, credit-monitoring services, hardware vendors, and overtime staff. Those expenses may be reasonable for business or regulatory reasons, but the criminal loss amount under section 609.87 has its own definition.

The State should separate repair from investigation, prevention, upgrade, compliance, public relations, and litigation. Determining how an incident happened is not always the same as repairing damaged property. Hardening the system against future threats can be prudent without being replacement loss caused by the charged act.

Labor should be supported by dates, roles, hours, rates, tasks, and ordinary compensation. Salaried employees may perform restoration work, but the value calculation should not double-count salary, overtime, vendor invoices, and the same lost productivity.

Lost revenue is not necessarily lost profit and may be recovered later. The unavailability measure asks for reasonable value of lost utility, not a speculative projection of every sale that might have occurred. Causation, mitigation, seasonality, alternative channels, backlog recovery, and variable costs matter.

Insurance payments do not necessarily erase victim loss or restitution issues, but invoices prepared for an insurer may reveal scope, depreciation, exclusions, betterment, and competing causes.

Forensic evidence in a Minnesota computer-damage case

A sound examination documents acquisition, chain of custody, tools, versions, settings, hashes, time zones, filters, excluded data, and analyst steps. Conclusions should be reproducible by another qualified examiner.

Live systems change constantly. Memory, active connections, cloud logs, and volatile processes may disappear on shutdown; continuing operation can also overwrite disk evidence. Responders must make choices, and those choices should be recorded rather than hidden behind a conclusory report.

Forensic images are valuable, but cloud services, software-as-a-service platforms, containers, serverless functions, and distributed systems may not fit a traditional single-drive model. Provider records and tenant audit logs can be as important as a seized laptop.

The defense should obtain native logs, not only screenshots or summaries. Screenshots omit metadata, surrounding entries, retention gaps, query criteria, and export transformations. An analyst’s chart is demonstrative evidence, not the underlying event.

Code analysis should distinguish design, capability, execution, and effect. A script capable of deleting files did not necessarily run; a command may have run against a test environment; and a destructive result may come from an unexpected variable rather than intentional targeting.

Search warrants and compelled access

Computer-damage warrants may seek devices, storage media, credentials, cloud records, messages, source code, financial records, and evidence of identity or intent. The affidavit, particularity, date limits, account identifiers, search methods, and nexus to each place should be reviewed.

Seizing a device and searching its contents are distinct intrusions. A warrant for one suspected incident should not automatically become unlimited review of years of unrelated personal, family, medical, legal, or business data.

Third-party providers may respond to preservation demands, subpoenas, or warrants with different datasets. Counsel should determine what legal process was used, what jurisdiction issued it, what dates and fields were requested, and what the provider actually produced.

Compelled disclosure of passwords, biometric unlocking, and encrypted content can raise Fifth Amendment and warrant-scope questions. The answer depends on the order, facts, and controlling law. A person should not guess or resist physically; counsel should litigate the issue through lawful procedure.

Consent is also fact-specific. Investigators may rely on consent from an employer, account owner, co-user, or device custodian. Authority to consent and the scope of consent should be tested against ownership, access, policies, actual use, and the searched area.

Employees, contractors, administrators, and former workers

Many section 609.88 allegations arise when a relationship ends badly. An employee is terminated, a vendor is replaced, founders separate, or an administrator’s credentials remain active. Civil, contractual, and criminal questions can overlap without being identical.

Employment does not authorize every act, but it often supplies important context for permission, customary practices, emergency discretion, system ownership, and expected changes. A written policy may be relevant without conclusively deciding criminal authorization.

Offboarding records matter. The exact time of notice, account disablement, device return, token revocation, remote-session termination, and ownership transfer may determine whether an act preceded or followed withdrawal of permission.

Contractors may administer client systems using shared service accounts and automated tools. A client may own the data while the vendor owns some software or documentation. The complaint should identify whose property was altered and who could authorize the act.

Employers sometimes characterize retention of work product, deletion, competitor access, or credential disputes as one event. Computer theft, trade-secret theft, unauthorized access, computer damage, and civil contract claims have different elements. Charging several statutes does not eliminate proof problems in any one of them.

Related Minnesota and federal charges

Computer or electronic-data theft addresses transferring, concealing, taking, using, retaining, or disposing of computer property or services in specified circumstances. Damage and theft may arise from the same incident but are not the same offense.

Unauthorized computer access focuses on intentional unauthorized penetration or attempted penetration of a security system or electronic terminal. A person can access without causing damage, or cause an authorized alteration alleged to have injurious intent, so the statutes must be analyzed separately.

Criminal use of encryption under section 609.8912 requires using or possessing encryption to commit or further another crime. Ordinary encryption, password protection, and security practice are not independently criminal under that statute.

Identity theft, theft of trade secrets, fraud, extortion, stalking, threats, property damage, and racketeering allegations may be added depending on the facts. Federal investigators may examine the Computer Fraud and Abuse Act and wire, access-device, or extortion statutes.

Multiple counts raise issues of duplicative punishment, included offenses, venue, territorial jurisdiction, and whether alleged acts form one behavioral incident. Those questions depend on charging and proof, not simply on the number of statutes listed.

Penalty levels and Minnesota Sentencing Guidelines

If statutory loss exceeds $2,500, section 609.88 permits up to ten years in prison, a $50,000 fine, or both. If loss is more than $500 but no more than $2,500, the maximum is five years and a $10,000 fine. All other cases are misdemeanors with up to 90 days and a $1,000 fine.

The boundary language is exact. A loss of $500 falls in the misdemeanor category. A loss of $2,500 falls in the five-year category. The ten-year category requires more than $2,500.

The current Minnesota Sentencing Guidelines offense table ranks felony computer damage over $2,500 at severity level 3 and felony computer damage at $2,500 or less at severity level 2. Criminal-history score and other Guidelines rules affect the presumptive sentence.

Maximum punishment is not the same as a presumptive sentence. Disposition can include a stayed sentence, local confinement, probation, treatment or monitoring, restitution, restrictions on devices or network access, and other conditions. Facts, history, resolution, and lawful departure grounds matter.

Collateral consequences may include employment restrictions, professional-license review, immigration consequences for noncitizens, security-clearance issues, forfeiture exposure, loss of access to systems, and civil litigation.

Restitution is related to, but not identical with, the offense level

The statutory loss amount determines the computer-damage penalty tier. Restitution is governed by Minnesota’s victim-rights statutes and focuses on qualifying out-of-pocket loss caused by the offense. The numbers may overlap, but one should not be accepted as the other without analysis.

Defense counsel should request invoices, time records, proof of payment, insurance information, depreciation, salvage, backup-restoration records, business-interruption calculations, and evidence separating incident response from improvements.

Causation matters. Costs attributable to preexisting defects, unrelated attacks, routine modernization, compliance projects, or voluntary upgrades may not have been caused by the convicted conduct.

A restitution challenge can preserve objections to amount, causation, duplication, and legal eligibility. It should be coordinated with the defense to the charge so that positions about damage and restoration remain consistent.

Civil claims may seek broader damages under contracts, tort law, trade-secret law, or federal statutes. A civil demand is not proof beyond a reasonable doubt and should not dictate the criminal loss tier.

Defense analysis for computer damage

The act was authorized. Owner permission, delegated authority, work orders, emergency practice, supervisor approval, or contract terms may show authorization at the relevant time and for the relevant purpose.

The result was accidental. A mistaken command, software defect, undocumented dependency, failed update, or misunderstanding may cause real loss without the intent required by section 609.88.

The accused was not the actor. Shared credentials, compromised accounts, automated services, remote access, or incomplete logs may prevent reliable attribution.

No protected property was damaged, destroyed, or altered. A policy violation, unauthorized viewing, or attempted access may implicate another statute but not necessarily computer damage.

The destructive-program elements are missing. The program may not have been destructive, the accused may not have distributed it, distribution may have been authorized, or the required intent may be absent.

The loss amount is overstated. Duplicated invoices, upgrades, speculative revenue, excessive response, unrelated remediation, and failure to apply the repair-or-replacement limitation can improperly elevate a misdemeanor to a felony or a five-year felony to a ten-year felony.

Causation is uncertain. Hardware failure, another user, a separate attacker, vendor outage, security software, or preexisting corruption may explain all or part of the incident.

Evidence was unlawfully obtained or inadequately preserved. Warrant defects, overbroad searches, involuntary statements, broken chain of custody, lost logs, or nonreproducible forensic work may support suppression, exclusion, or reasonable doubt.

Minnesota case law and honest limits on reported authority

No reported Minnesota Supreme Court or precedential Court of Appeals decision located for this guide comprehensively defines damage, destruction, alteration, authorization, destructive program, and loss under section 609.88. The statutory text and definitions therefore do unusually heavy work. It would be misleading to present a trial-level result or an unrelated federal hacking case as controlling construction.

Attribution and intent are often circumstantial. In State v. Al-Naseer, 788 N.W.2d 469, 474 (Minn. 2010), the Minnesota Supreme Court said a conviction based on circumstantial evidence “warrants heightened scrutiny.” The decision did not involve computer damage, but its review framework applies when identity or intent rests on circumstances.

State v. Andersen, 784 N.W.2d 320, 329–30 (Minn. 2010), explains that circumstances proved must be consistent with guilt and inconsistent with a rational hypothesis other than guilt. That does not require the State to disprove fanciful possibilities; it does require disciplined analysis of reasonable alternatives supported by the evidence.

State v. Colvin, 645 N.W.2d 449, 452 (Minn. 2002), supplies the general principle that penal statutes are strictly construed. Colvin was a burglary case, not a computer case. Strict construction matters when the State asks a court to extend undefined criminal language, but courts still apply the statute’s fair text.

Frequently asked questions about Minnesota computer-damage charges