What to do after an unauthorized-access allegation

Stop accessing the disputed account, device, network, terminal, or data unless counsel confirms current authorization. A credential that still works does not necessarily mean the owner continues to permit its use.

Do not delete browsing history, clear logs, reset devices, destroy storage media, change shared credentials, remove terminal equipment, wipe messages, or contact witnesses to coordinate explanations. Preserve native evidence. Deletion can overwrite information that proves permission, another user, a benign purpose, or lack of penetration.

Save the complaint, warrant, property receipt, preservation request, release conditions, employment documents, system policies, work tickets, access approvals, termination communications, device records, and every notice that allegedly limited permission.

Create a private chronology for counsel: what system was involved, who owned or operated it, what security measure existed, how the accused received access, what action was attempted, what happened, what data were visible, who else used the account, and when permission changed.

Do not give investigators an improvised technical account. Small distinctions—opening a public page, authenticating to an authorized account, entering another user’s area, opening a physical terminal panel, or attaching a capture device—can change both the elements and offense level.

What the State must prove for the base offense

The accused must act intentionally. The conduct must occur without authorization. The person must attempt to or actually penetrate either a computer security system or an electronic terminal.

That sentence contains the whole base crime. It does not say that merely violating any website term, viewing any public page, receiving an unwanted message, or possessing a computer is enough.

The State should identify the precise security system or terminal, the alleged penetration, the act showing intent, the source and limit of authorization, the attempted or completed access, and the evidence tying that act to the accused.

Consequences such as data exposure, public risk, panel opening, repeat history, or skimmer placement increase the grade only after the base elements are proved. An aggravating label cannot cure a failure to establish intentional unauthorized penetration.

The standard is proof beyond a reasonable doubt. An employer’s security classification, a vendor’s alert, an account owner’s suspicion, or a platform’s policy decision may be evidence, but none replaces the criminal elements.

Definitions controlling a section 609.891 charge

Minn. Stat. § 609.87 (2026) defines a computer security system as a software program or computer device intended to protect the confidentiality and secrecy of data and information stored in or accessible through a computer system.

An electronic terminal is an electronic device—other than a consumer-operated telephone—through which a person or company may initiate an electronic fund transfer. The definition includes point-of-sale terminals, ATMs, cash-dispensing machines, and gas-pump dispensers.

An access device is a card used to initiate transactions that provides account access, is issued on a prepaid basis in a specific amount, or is used to access government benefits. This definition matters in the felony skimming provision.

“Access” means instructing or communicating with a computer, system, or network, storing data in it, or retrieving data from it. But the offense uses the more specific verb “penetrate.” A charge should establish more than the general fact that some electronic communication occurred.

Personal data means computer property or a computer program containing employment, salary, credit, or other financial or personal information relating to another person. Actual access to personal data supports a gross-misdemeanor enhancement.

The statute requires penetration of a security system or terminal

Section 609.891 does not separately define “penetrate.” In ordinary context, the word directs attention to crossing or attempting to cross the protection supplied by a computer security system, or gaining or attempting to gain access to an electronic terminal.

Facts can include password entry, bypassing authentication, using a token, exploiting a vulnerability, escalating privileges, opening a terminal panel, entering an administrator console, or submitting commands through an exposed service.

A public webpage with no confidentiality control presents a different issue from a private account, protected database, locked administrative interface, or terminal cabinet. The State should identify the security feature said to have been penetrated, not merely assert that the owner disliked the visit.

Successful data retrieval is not always required because the statute covers attempts. At the same time, an alert showing rejected credentials does not by itself identify the user or prove intentional criminal conduct. Automated software, saved passwords, typing mistakes, and security tests can generate failed attempts.

Because reported Minnesota appellate authority defining penetration is limited, the exact statutory nouns and real technical architecture matter. A courtroom analogy should not replace expert explanation of what the system did.

Permission can be broad, narrow, changed, or disputed

Authorization generally means permission from the owner of the computer, system, network, software, or other property. The statute also recognizes specified regulatory access and express permission from an owner, operator, or designated representative, limited to approved times and purposes.

An owner can limit authorization by actual oral or written notice, a prominent notice adjacent to the computer, or a notice displayed or announced by the computer. Logs showing a banner can be relevant, but the State should prove what version appeared, when it appeared, and what the user could actually see.

Credentials and permission are not identical. A former worker’s account may remain technically active after permission ends. A current worker may be authorized to use one database but not another. A customer may access their own account but not another customer’s information.

Permission can also be factually broader than a written policy suggests. Supervisors may approve exceptions, administrators may have emergency authority, and organizations may establish a consistent practice. The defense should preserve tickets, messages, role assignments, prior approvals, and witness evidence.

The relevant question is authorization for the charged act at the charged time. Later revocation, regret, or discipline does not rewrite earlier permission, and earlier permission does not necessarily continue forever.

An unsuccessful attempt can still be charged

The statute expressly applies when a person “attempts to” penetrate. The State therefore need not prove that the security barrier failed or that the accused obtained data for the base offense.

It must still prove intentional conduct directed toward unauthorized penetration. A stray click, browser autofill, mistyped account, accidental scan, cached session, or ordinary automated request is not necessarily a knowing criminal attempt.

Forensic review should determine whether the event was user-initiated, what software generated it, whether the request was repeated, what credentials or exploit were used, what response the system returned, and what the user did next.

Preparation and attempt are not always the same. Possessing a tool, reading documentation, or discussing access may support an inference, but the prosecution should identify the act allegedly constituting the attempted penetration.

Terminal enhancements have their own attempt wording. Attempting to open a panel can support the gross-misdemeanor theory, while attempting both panel access and attachment of a capture device can support the specific felony theory.

The ordinary offense is a misdemeanor

A violation without an enhancement is punishable by up to 90 days in jail, a $1,000 fine, or both. That classification matters: unauthorized access is not automatically a felony simply because a computer, password, or private account is involved.

A misdemeanor may still bring device seizure, employment consequences, protective conditions, immigration questions for noncitizens, professional discipline, restitution claims, and future enhancement exposure.

The complaint should not rely on the seriousness of a victim’s concern to imply an aggravator. Risk to public health and safety, personal-data access, protected-data compromise, prior convictions, grave risk of death, and terminal skimming are separate facts with separate proof.

Attempts can remain misdemeanors when no aggravating fact is proved. Lack of actual data access may defeat a personal-data enhancement even when the State proves attempted penetration.

Resolution should account for future consequences because another misdemeanor conviction within five years can support gross-misdemeanor treatment under subdivision 3(d).

Five ways unauthorized access becomes a gross misdemeanor

First, the violation is a gross misdemeanor when committed in a manner creating a risk to public health and safety. The State should identify the public, the health or safety interest, the mechanism of risk, and evidence that the charged access created it.

Second, the charge increases when the violation compromises the security of trade-secret data protected under the theft statute or data that are “not public data” under the Minnesota Government Data Practices Act. Compromise and actual public release are not necessarily the same, but the State must identify the data and its legal classification.

Third, a violation that gains access to personal data is a gross misdemeanor. The statutory definition covers employment, salary, credit, and other financial or personal information relating to someone else. “Gains access” demands proof that the accused reached the data, not merely that it existed behind the system.

Fourth, a second or subsequent misdemeanor conviction under the statute within five years becomes a gross misdemeanor. The court record, offense identity, conviction date, and five-year timing should be verified. An arrest, allegation, dismissed charge, or civil finding is not the specified prior conviction.

Fifth, unauthorized opening or attempted opening of a panel or access door to an electronic terminal is a gross misdemeanor. The electronic-terminal definition and physical act are essential; opening an ordinary computer case is not automatically this offense.

Three felony theories under section 609.891

A violation creating a grave risk of causing a person’s death is a felony carrying up to ten years and a $20,000 fine. The adjective “grave” and the death-risk requirement make this more demanding than the gross-misdemeanor public-safety provision.

A person convicted of a second or subsequent gross-misdemeanor violation of subdivision 1 also faces the same felony maximum. The enhancement text refers to conviction history; certified records and the identity of the prior statute and level matter.

The third felony addresses payment-terminal skimming. It applies when a person violates the base offense by accessing or attempting to access an electronic terminal through unauthorized panel or access-door opening and places or attaches—or attempts to place or attach—an electronic device to capture, store, or communicate access-device information.

The State must prove the capture-device purpose, not merely the presence of any electronic component. Maintenance modules, diagnostic equipment, legitimate payment hardware, trackers, cameras, and unrelated devices require factual classification.

Each felony theory should be specified. A grave-risk case, repeat-gross-misdemeanor case, and skimmer case use different evidence and Sentencing Guidelines treatment.

ATMs, card readers, point-of-sale systems, and gas pumps

The terminal provisions focus on devices through which electronic fund transfers can be initiated. Common examples include ATMs, cash dispensers, point-of-sale terminals, and gas-pump dispensers. A consumer-operated phone is expressly excluded from the electronic-terminal definition.

Panel or access-door evidence may include broken seals, tool marks, alarm records, service logs, surveillance, fingerprints, DNA, possession of keys or overlays, wireless signals, and recovered components.

Legitimate technicians, merchants, inspectors, installers, and security testers may be authorized to open terminals or attach diagnostic devices. Work orders, vendor identity, arrival logs, uniforms, equipment serial numbers, owner communications, and scope of work matter.

An overlay placed outside a reader may raise different factual questions from a device attached after a panel is opened. Prosecutors must match the alleged method to the statutory language they charge.

Possession of skimming equipment away from a terminal may support other charges or circumstantial proof, but section 609.891, subdivision 2(c), describes a particular access-and-attachment offense.

Trade secrets, government data, and personal information

The protected-data enhancement covers trade-secret data within the theft statute and government data classified as not public under section 13.02. A prosecutor should identify the record, legal classification, owner or custodian, confidentiality safeguards, and how access compromised security.

Not all government-held information is nonpublic. Minnesota’s Data Practices Act uses specific classifications and definitions. The responsible authority’s label can be relevant, but statutory classification controls.

Trade-secret status is also fact-dependent. The information must fit the governing statutory requirements; ordinary business information does not become a trade secret merely because an employer calls it confidential.

Personal data under section 609.87 is broad but still relates to another person. A user viewing their own account does not satisfy that phrase merely because the system also stores other customers’ data elsewhere.

Logs should show what object, table, record, or screen was returned. Permission to enter a system, ability to query a database, and actual retrieval of a particular person’s data are different propositions.

Public-safety risk and grave risk of death

Access to healthcare, transportation, emergency, water, energy, industrial, or public-safety systems can create serious concern. But system importance alone does not prove that a particular attempt created the risk required by the statute.

The analysis should identify the affected component, operational state, safeguards, redundancy, privileges obtained, commands available, actual interruption, and causal sequence from access to risk.

A sandbox, read-only account, test environment, inactive system, blocked request, or isolated network may present a different risk from production control with operational privileges. Experts should explain rather than assume the consequence.

For the felony, the risk must be grave and concern causing death. A generalized possibility of harm should be distinguished from a concrete, serious risk created by the charged violation.

For the gross misdemeanor, public health and safety still require more than private inconvenience or financial loss. The State should identify the public dimension and evidence of risk.

Accounts, IP addresses, devices, and identity

An account name does not conclusively identify the user. Passwords, tokens, API keys, shared administrator accounts, remote sessions, browser profiles, service accounts, and saved credentials can be used by several people or stolen.

An IP address generally identifies a connection assigned at a time, not necessarily the person operating the device. Network address translation, cellular gateways, business networks, public Wi-Fi, virtual private networks, proxies, and cloud infrastructure complicate attribution.

Strong attribution combines independent evidence: identity-provider logs, multifactor events, endpoint records, device identifiers, physical access, geolocation, camera video, messages, possession, command history, and knowledge unique to the user.

Time must be normalized. Systems may record UTC, local time, daylight-saving changes, or inaccurate clocks. A timeline that silently mixes zones can connect the wrong person to an event.

Alternative actors should be tested against evidence, not offered as speculation. The State bears the burden, while a credible defense identifies concrete access, motive, opportunity, log gaps, credential sharing, or malware consistent with someone else.

Forensic collection, warrants, and statements

Investigators may seek computers, phones, storage media, credentials, account records, terminal components, messages, tools, source code, financial records, and evidence of identity or intent. The affidavit and warrant should establish a nexus and describe the place and things to be searched.

Device seizure does not automatically authorize unlimited examination. Date limits, account identifiers, file categories, search methods, and the relationship between the suspected offense and personal data all deserve review.

Forensic evidence should document acquisition, chain of custody, tools, settings, hashes, time conversion, filters, and analyst steps. Native logs are more informative than screenshots or summaries.

Third-party cloud and platform records may be collected through preservation, subpoena, warrant, or consent. Counsel should identify the process, jurisdiction, fields requested, retention gaps, and whether the provider’s export altered format or metadata.

Statements require review for custody, interrogation, warnings, voluntariness, technical ambiguity, and completeness. A person may use “access,” “login,” “server,” or “admin” casually; the legal and technical meanings should not be supplied by an investigator after the fact.

Workplace access and former employees

Employment cases turn on scope. A worker may be permitted to enter a system for customer service but not to view a coworker’s salary, use production data for testing, or retrieve records after termination.

Conversely, internal culture may authorize practices not reflected in a dated policy. Supervisors may share credentials, assign broad troubleshooting, approve after-hours work, or tolerate cross-team access. Tickets and witnesses can establish actual permission.

Offboarding time is crucial. Notice, account disablement, remote-session termination, token revocation, equipment return, and continued vendor obligations should be placed on one timeline.

A policy breach is not automatically penetration of a computer security system. The State must prove the statutory object and act. Improper use of information reached through ordinary authorized access may implicate employment, civil, privacy, theft, or other law without necessarily satisfying section 609.891.

Owners, operators, and designated representatives may disagree about who could grant permission. Corporate governance, contracts, apparent authority, and technical roles can create genuine factual disputes.

Related computer, theft, fraud, and privacy charges

Computer damage under section 609.88 requires intentional damage, destruction, alteration, or destructive-program distribution. Access can occur without damage, and damage can be alleged through a separately authorized act with intent to injure or defraud.

Computer or electronic-data theft under section 609.89 addresses taking, transferring, concealing, using, retaining, or disposing of computer property or services under its specific theories. Viewing data is not automatically theft, but copying or retaining it may generate additional allegations.

Facilitating access to a computer security system under section 609.8913 covers knowingly transferring a means of access without authorization and knowing or having reason to know it will be used to commit or further a crime.

Identity theft, trade-secret theft, financial-transaction-card fraud, privacy offenses, criminal use of encryption, extortion, stalking, and ordinary theft or fraud can accompany the charge. Federal authorities may consider the Computer Fraud and Abuse Act and access-device statutes.

Multiple counts raise issues of included offenses, proof of separate acts, venue, territorial jurisdiction, and duplicative punishment. Each statute must be matched to evidence independently.

Sentencing and collateral consequences

The base misdemeanor maximum is 90 days and a $1,000 fine. A gross misdemeanor carries up to 364 days and a $3,000 fine. The grave-death-risk and repeat-gross-misdemeanor felonies carry up to ten years and a $20,000 fine.

The current Minnesota Sentencing Guidelines offense table lists the grave-risk and repeat felonies as unranked. The electronic-terminal capture-device felony is severity level 2. Criminal-history score and other Guidelines rules affect the presumptive sentence.

An unranked offense does not mean there are no Guidelines. The court assigns a severity level by comparing the offense with ranked crimes, considering the statutory maximum and the conduct’s nature.

Conditions may address devices, internet access, employment, financial systems, contact with alleged victims, restitution, monitoring, and return of property. Conditions must still be lawful and related to rehabilitation or public safety.

Consequences can include job loss, licensing action, school discipline, security-clearance problems, immigration consequences, forfeiture, civil litigation, and restrictions on access to accounts or facilities.

Defense issues in unauthorized computer access cases

There was authorization. Owner or representative permission, role assignment, work orders, prior practice, emergency authority, or lack of effective revocation may defeat an element.

No security system or electronic terminal was penetrated. Access to a public page, unprotected resource, ordinary phone, or nonqualifying device may not fit the statutory object.

The act was not intentional. Autofill, mistyping, cached sessions, automated requests, malware, and accidental clicks can generate access events without criminal purpose.

The accused was not the user. Shared or stolen credentials, network complexity, incomplete logs, remote control, and another authorized user can create reasonable doubt.

The enhancement is not proved. No personal data were reached; data were public; trade-secret status is absent; public risk is speculative; no grave death risk existed; the prior conviction does not qualify; or terminal-panel and capture-device facts are missing.

The attempt evidence shows only preparation. Possession of tools or research without a sufficiently directed act may fail to prove attempted penetration.

The search or statement was unlawful. Warrant scope, consent authority, compelled unlocking, interrogation, voluntariness, provider process, and chain of custody may support suppression or exclusion.

The forensic conclusion is unreliable. Bad timestamps, missing logs, unsupported attribution, altered exports, unvalidated tools, or a nonreproducible analysis can undermine the State’s proof.

Minnesota appellate authority and limits

No reported Minnesota Supreme Court or precedential Court of Appeals opinion located for this guide comprehensively defines “penetrate” or applies every enhancement in section 609.891. The guide therefore stays close to the statute and does not present commentary or an unrelated federal interpretation as controlling Minnesota law.

Identity and intent are often proved circumstantially. In State v. Al-Naseer, 788 N.W.2d 469, 474 (Minn. 2010), the Minnesota Supreme Court said that a circumstantial-evidence conviction “warrants heightened scrutiny.” The case was not a computer prosecution.

State v. Andersen, 784 N.W.2d 320, 329–30 (Minn. 2010), explains the two-step circumstantial-evidence analysis and requires the proved circumstances to exclude rational hypotheses inconsistent with guilt.

State v. Colvin, 645 N.W.2d 449, 452 (Minn. 2002), confirms that penal statutes are “strictly construed.” It did not involve computer access. The principle matters when the State seeks to broaden an undefined criminal term, while clear statutory language still controls.

Frequently asked questions about unauthorized computer access