Minnesota cybercrime is a group of distinct offenses

“Cybercrime” is a useful search term, but it is not the name of a single Minnesota crime. A complaint should cite the statute and subdivision that the prosecutor claims were violated. That matters because the mental state, prohibited act, penalty, and available defenses change from one section to another.

The principal computer-crime provisions include computer damage under Minn. Stat. § 609.88 (2026), computer or electronic-data theft under section 609.89, and unauthorized computer access under section 609.891. Separate provisions address criminal use of encryption and facilitating access to a computer security system. Other cases are charged as identity theft, ordinary theft, harassment or stalking, financial-card fraud, privacy interference, or unlawful dissemination of private sexual images.

A sound defense does not accept a loose narrative and work backward. It makes the State identify the charged act. Did the accused penetrate a security system? Obtain services or property? Copy and then use data? Retain data after authority ended? Damage or alter a system? Use an identity with intent to commit unlawful activity? Record someone in a statutorily protected place? Disseminate a qualifying image? Those are not interchangeable accusations.

The offense date is also important. Technology statutes change. A current statute cannot be retroactively used to fill a gap in an older version. The statutory language in effect when the alleged conduct occurred ordinarily supplies the elements.

Authorization is often the central issue

Minnesota’s computer-crime definitions are more specific than ordinary workplace language. Under Minn. Stat. § 609.87, subd. 2a (2026), authorization generally means permission from the owner of the computer, system, network, software, or other property. Permission can be limited by actual oral or written notice, a prominent notice adjacent to the computer, or a notice displayed or announced by the computer.

That definition makes the permission evidence critical. An employee may have credentials but lack permission for a particular database. A former employee’s credentials may still function after permission ended. A family member may know a password but never have received authority to use the account. Conversely, a written policy may be broader or narrower than the technical controls, and supervisors may have given actual permission inconsistent with a generic handbook.

The important evidence may include onboarding documents, acceptable-use policies, role assignments, access-control lists, tickets, emails, chat messages, prior practice, offboarding records, and testimony from the person legally able to grant permission. A prosecutor should not be allowed to treat every policy violation as a criminal penetration of computer security. At the same time, a defense should not assume that possession of valid credentials proves authorization.

Scope and time deserve separate attention. Permission to view may not include permission to export. Permission for client service may not include use for a side business. Permission on Monday may have been revoked on Tuesday. Section 609.89 expressly addresses intentional retention of software or electronic data beyond an individual’s authority, so the date and content of any return-or-delete demand can become important.

Unauthorized computer access under section 609.891

Section 609.891 requires proof that the accused intentionally and without authorization attempted to or did penetrate a computer security system or electronic terminal. The State therefore needs more than proof that a person used a computer while doing something improper. It must prove the intentional, unauthorized penetration identified by the statute.

The basic offense is a misdemeanor. It becomes a gross misdemeanor under specified circumstances, including when the access creates a risk to public health and safety, compromises certain protected or nonpublic data, obtains personal data, follows a qualifying recent misdemeanor conviction, or involves opening or attempting to open a panel or access door of an electronic terminal. Felony treatment applies when the conduct creates a grave risk of causing death, follows the qualifying repeat-offense provision, or involves attaching or attempting to attach a device inside an electronic terminal to capture, store, or communicate access-device information.

This graded structure makes factual precision essential. Access to personal data must be proved, not inferred because a system contained personal data somewhere. A public-safety risk is different from ordinary inconvenience. The terminal-device provision is aimed at conduct such as skimming equipment and has physical acts beyond routine remote login activity.

Attempt liability is built into the access statute. A failed login, however, does not automatically prove an attempt to penetrate a security system. The State must connect the event to the accused and prove the required intent and absence of authorization. Automated password managers, cached credentials, service processes, mistyped usernames, security testing, and approved troubleshooting can produce events that resemble hostile activity when viewed without context.

Computer and electronic-data theft under section 609.89

Computer theft is broader than physically taking hardware, but it still has elements. Section 609.89 covers four principal types of conduct: unauthorized access for the purpose of obtaining services or property; taking, transferring, concealing, or retaining computer property with intent to deprive the owner; unauthorized access or copying followed by use, alteration, transfer, retention, or publication; and intentional retention of software or electronic data beyond the individual’s authority.

The distinctions matter. The first alternative requires a purpose of obtaining services or property. The second requires an intent to deprive. The third requires both unauthorized access or copying and an additional act involving the copied material. The fourth focuses on intentional retention after authority has ended. The complaint, discovery, and jury instructions should identify which theory the State is pursuing.

Copying does not deprive an owner of possession in the same physical sense as taking a laptop, which is why the statute separately describes copying, use, transfer, retention, and publication. The defense may need to determine what was actually copied, whether it was independently available, whether the accused created it, what contractual rights existed, and whether a retention directive was clear and received.

Loss controls the statutory maximum. Under the current statute, a loss exceeding $2,500 carries up to ten years and a $50,000 fine; a loss above $500 but not more than $2,500 carries up to five years and a $10,000 fine; other cases are misdemeanors. Those thresholds make the loss methodology a merits issue, not merely a sentencing detail.

A company’s invoice is not conclusive. Claimed loss may include incident response, system restoration, investigation, business interruption, replacement, or alleged value of data. The defense should ask whether the expense was actually incurred, reasonably attributable to the charged conduct, supported by records, and counted only once. Routine upgrades or an internal investigation that would have occurred anyway should not be accepted without scrutiny.

Computer damage and destructive programs

Section 609.88 prohibits specified intentional, unauthorized damage or destruction; intentional unauthorized alteration or alteration with intent to injure or defraud; and distribution of a destructive computer program without authorization and with intent to damage or destroy covered property. The statute is concerned with the required intent and effect, not merely an unwanted change.

In a workplace case, ordinary administration can alter logs, permissions, settings, and files. Software updates can disrupt services. A rushed departure can leave a system in a broken state without an intent to damage. Malware alerts can be false positives. The defense should isolate the alleged act, its timestamp, the account and process responsible, the affected asset, and the causal link between that act and the claimed harm.

The same loss thresholds used in section 609.89 apply: more than $2,500 permits a ten-year maximum, more than $500 through $2,500 permits a five-year maximum, and all other cases fall at the misdemeanor level. A technical expert may be needed to separate restoration costs caused by the alleged act from upgrades, preexisting failures, security improvements, lost-profit assumptions, and voluntary business decisions.

Do not overlook alternative causes. Multiple administrators may share privileges. Cloud providers may rotate or revoke keys. Backups can be incomplete. A vendor can cause an outage. A later responder may overwrite evidence while trying to restore service. A persuasive defense timeline accounts for those events rather than merely arguing that the State’s expert is wrong.

Encryption and facilitating access are separate charges

Encryption is ordinary, lawful technology. Phones, messaging applications, banks, hospitals, lawyers, and businesses use it every day. Minn. Stat. § 609.8912 (2026) does not criminalize encryption in the abstract. It addresses intentional use or attempted use of encryption to commit, further, or facilitate a crime; conceal a crime; conceal or protect the identity of a person who committed a crime; or disrupt another person’s computer operation.

The referenced criminal purpose must be proved. Use of a phone passcode, encrypted chat, virtual private network, or encrypted storage does not by itself establish that purpose. Privacy practices may be routine, required by work, or used for legitimate personal security. Timing, communications, configuration, and surrounding conduct determine whether encryption is evidence of a charged objective or simply a normal feature of modern computing.

Section 609.8913 separately addresses knowingly facilitating access to a computer security system without authorization. In a multi-user system, that can raise difficult questions about whose credentials were used, what the accused knew about another person’s permission, and whether assistance was meant for an unauthorized intrusion or an approved task.

When several statutes are charged from the same incident, counsel should examine whether the counts require different acts, whether multiple punishment is lawful, and whether the State is using ordinary security behavior as a substitute for proof of criminal intent.

Identity theft, accounts, and forged digital likenesses

Minn. Stat. § 609.527 (2026) makes it identity theft to transfer, possess, or use an identity that is not one’s own with intent to commit, aid, or abet unlawful activity. The intent element is indispensable. Innocent possession of another person’s information, authorized account management, and mistaken autofill are not the same as using an identity to facilitate unlawful activity.

The statutory definition of identity is broad. It includes traditional identifiers, electronic addresses and account information, telecommunication identifiers, and—under the current 2026 text—a forged digital likeness. The new definition covers a technically created or altered representation that misrepresents an individual’s appearance, speech, or conduct and is realistic enough to cause a reasonable person to believe it depicts the actual individual.

That amendment reaches modern deepfake allegations, but it does not erase the rest of the crime. The State must still prove transfer, possession, or use of another’s identity and the required intent to commit or assist unlawful activity. Questions can arise about parody, obvious fabrication, consent, ownership, account delegation, and whether the likeness was realistic under the statutory standard.

Identity-theft penalties depend on factors including direct victims, combined loss, and aggravating circumstances. The State may aggregate conduct, identify financial institutions or account holders as victims, and seek restitution. The defense should audit the victim count and loss evidence transaction by transaction, identify reversals and reimbursements, and distinguish alleged gross activity from actual statutory loss.

Interference with privacy and secret recordings

Minn. Stat. § 609.746 (2026) now contains several distinct forms of interference with privacy. Some provisions address entering another’s property and peeping or using a device through a window or other aperture. Others address hotels, tanning booths, bathrooms, locker rooms, changing rooms, indoor showers, dwellings, and other places where a reasonable person would expect privacy. Another provision addresses using a device under or around clothing.

The elements change by paragraph. Some require property entry. Some require surreptitious use. Some require an intent to intrude on privacy. The newer same-room recording provision requires use of a device in a listed or protected place with intent to photograph, record, or broadcast an image of intimate parts without consent. The clothing provision has its own acts and intent.

Base violations can be misdemeanors or gross misdemeanors. Prior qualifying convictions and minor victims can increase the level. A specified offense against a minor, committed by a person more than 36 months older with knowledge of the minor’s presence and sexual intent, carries up to four years. The precise paragraph therefore affects both the elements and exposure.

The 2023 amendments matter in older cases. Before those amendments, the Supreme Court held that the former device provision did not reach a recording made from inside the same room because the statute required use through an aperture of a dwelling. Current paragraph (e) now addresses certain recording inside the protected place. The offense date decides which language applies.

Potential defenses include lack of the required intent, absence of surreptitious conduct where required, consent, a location outside the statutory description, failure to prove intimate parts or the specified clothing area, age or knowledge disputes, and statutory exceptions for lawful official conduct or conspicuously disclosed commercial surveillance in the circumstances the statute identifies.

Nonconsensual dissemination of private sexual images

Minn. Stat. § 617.261 (2026) applies when a person intentionally disseminates a qualifying image of an identifiable person, knows or reasonably should know that the depicted person does not consent to dissemination, and knows or reasonably should know the image was obtained or created under circumstances giving the depicted person a reasonable expectation of privacy.

“Dissemination” includes distribution to one or more people other than the person depicted, as well as public publication. A one-to-one message can therefore qualify. The image must depict a sexual act or exposed intimate parts, and identification can come from the image itself or personal information displayed with it.

Consent to capture or possess the image is not a defense. That rule prevents a defendant from equating consent to make an intimate image with consent to distribute it. But consent to the charged dissemination, identity, expectation of privacy, knowledge, and intentional distribution remain legitimate element questions.

The ordinary offense is a gross misdemeanor. It can become a three-year felony if a listed aggravating factor exists, including financial loss, profit motive, operating a service for dissemination, posting on a website, intent to harass, acquiring the image through specified crimes, or a prior conviction under chapter 617.

The statute contains exemptions for lawful criminal investigations, reporting unlawful conduct, protected treatment communications, specified public or commercial images, lawful public-interest dissemination, legitimate research or education, and qualifying legal proceedings. Those provisions must be applied to the facts rather than dismissed as mere affirmative excuses.

State and federal exposure can overlap

Online conduct does not stop at a state border. A Minnesota investigation can draw interest from federal agencies, especially when it involves interstate systems, financial institutions, government networks, large losses, access-device fraud, extortion, child sexual abuse material, or many alleged victims.

The federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, contains several separate offenses involving unauthorized access or exceeding authorized access. Federal wire-fraud, identity-theft, access-device, and interception statutes may also be considered depending on the facts. Federal and state definitions are not identical; a conclusion under one law should not be copied into the other.

Dual exposure changes interview strategy, device-consent decisions, plea analysis, loss litigation, and communication with investigators. A person contacted as a witness can become a target after producing devices or making a technically inaccurate explanation. Counsel should identify the investigating agencies, warrants, subpoenas, grand-jury process, and any parallel civil or employment matter before assuming the case will remain in one court.

An account, device, or IP address is not automatically a person

Digital evidence often identifies a machine, connection, credential, browser session, or account. The criminal case requires proof about a human being. Attribution is the work of linking the two reliably.

An IP address may be shared by a household, business, school, hotel, virtual private network, carrier-grade network, or public connection. A device may have several users. A cloud account may remain logged in across devices. Credentials can be shared, stolen, synced, phished, or stored in a browser. Remote-access tools, scheduled tasks, malware, and application tokens can generate activity when the named user is not at the keyboard.

Useful attribution evidence includes device possession, login history, multifactor events, cookies and tokens, saved passwords, location data, contemporaneous messages, file-system artifacts, browser history, recovery accounts, payment records, camera footage, and proof of exclusive opportunity. None should be viewed in isolation.

Investigators sometimes reason from account ownership to action and then treat later conduct as confirmation. A defense review should test alternative users and alternative mechanisms early. The best question is not simply whether the account belonged to the accused, but what evidence shows who performed the specific charged act at the specific time.

Digital forensics, metadata, and system logs

Digital evidence is powerful because systems record details that human witnesses forget. It is also easy to misunderstand because timestamps, retention policies, collection methods, and application behavior vary.

A forensic review should identify the source and format of each important artifact. A screenshot is not the same as the underlying message database. A spreadsheet exported by a company is not the same as the server log from which it was created. A report summarizing “access” may combine successful logins, failed attempts, automated refreshes, and application activity.

Timestamps require attention to time zones, daylight-saving changes, server clocks, device settings, and whether an application records creation, modification, upload, download, or viewing. Cloud synchronization can place a file on a device without a deliberate download. Thumbnail and cache files may be automatically created. File-access timestamps can change during collection or routine system activity.

Chain of custody remains important. Counsel should obtain forensic images when available, hash values, collection notes, tool versions, extraction logs, account-return data, and documentation of any filtering. If a private company collected the evidence before police involvement, its methods and preservation decisions must also be examined.

An expert is not necessary in every case, but the defense should know when a technical issue cannot responsibly be resolved by argument alone. The expert’s assignment should be focused: validate the State’s extraction, reconstruct an event, test attribution, identify missing logs, analyze malware, evaluate deletion claims, or audit loss causation.

Phones, cloud accounts, warrants, and consent

Digital investigations can involve seizure of a phone or computer, forensic search of the device, provider records, cloud content, location information, and account metadata. Each source may involve a different legal process and a different privacy interest.

Under Minn. Stat. § 626.085 (2026), a government entity generally must obtain a search warrant to require disclosure of electronic-communication information, subject to statutory exceptions including valid consent and specified exigent circumstances. The statute addresses notice and related process. Other Minnesota and federal provisions govern device information, tracking, stored communications, and interception.

In Riley v. California, 573 U.S. 373, 401 (2014), the United States Supreme Court’s answer to searching digital information on a seized phone was concise: “get a warrant.” That does not mean every digital search is unlawful without one. Consent, exigency, abandonment, private searches, and other doctrines may matter. It does mean a phone’s digital contents are not treated like ordinary physical objects found in a pocket.

Warrant review should examine probable cause, nexus, particularity, time periods, target accounts, applications or services, data categories, and execution. A warrant for evidence of one alleged act should not become an unrestricted license to inspect every year of a person’s digital life. Minnesota law contains specific particularity and destruction provisions for electronic information in covered circumstances.

Consent must be voluntary and within the consenting person’s actual or apparent authority. Consent to take custody of a device is not necessarily consent to search every account reachable from it. A spouse, employer, parent, or account administrator may have authority over some property and not others. The exact words, forms, scope, and later revocation matter.

The Fourth Amendment generally restrains government, not a purely private search. But a private person or company can become a government agent depending on law-enforcement knowledge, participation, and purpose. That analysis is fact-specific.

What to preserve—and what never to alter

Once an investigation is possible, do not delete accounts, wipe devices, change logs, run cleanup utilities, remotely reset hardware, contact alleged victims, or ask another person to remove material. Even conduct motivated by panic or privacy can be characterized as consciousness of guilt, obstruction, or destruction of evidence. It can also erase evidence that would have helped the defense.

Preservation should be careful and lawful. Keep devices in their existing condition. Save notices, policies, permission messages, account alerts, provider emails, employment records, and communications that explain access. Record who had physical access to relevant devices and credentials. Identify backups, old phones, external drives, routers, password managers, and cloud services before retention periods expire.

Do not forward contraband or intimate material to counsel by ordinary email. Contact counsel first so collection can be handled lawfully and without creating new distribution. Materials involving minors demand particular caution; possession and transmission can themselves create serious criminal exposure.

A lawyer may send appropriate preservation requests to providers, employers, or other custodians. That is different from trying to influence testimony or hide evidence. Early preservation often matters because security video, IP assignments, authentication logs, and application data may disappear under routine retention schedules.

Charge levels, loss, sentencing, and restitution

Cybercrime exposure cannot be summarized by one maximum. Unauthorized access ranges from a misdemeanor to a ten-year felony depending on risk, data, repeat history, and terminal conduct. Computer damage and computer theft range from misdemeanor treatment to ten-year felonies based principally on statutory loss thresholds. Identity theft uses its own victim-and-loss structure. Privacy and private-image offenses have separate aggravators.

The statutory maximum is not the presumptive sentence. For felonies, the Minnesota Sentencing Guidelines offense-severity reference table assigns rankings to many computer and privacy offenses, while some offenses are unranked. Computer damage and computer theft are generally ranked by the applicable loss category. Certain unauthorized-access offenses are ranked differently, and some remain unranked. The guideline edition effective on the offense date and the defendant’s criminal-history score control the starting calculation.

Restitution can be a major issue even when incarceration is not. A business or individual may claim investigation expenses, restoration, lost income, replacement costs, credit monitoring, or other losses. Restitution requires a legally sufficient connection to the offense and supporting proof. Insurance payments, reimbursements, ordinary overhead, duplicate claims, and speculative losses should be identified.

Collateral consequences can include employment termination, professional licensing action, immigration consequences, no-contact conditions, restrictions on computer or Internet use, forfeiture, civil litigation, and damage to security clearances or fiduciary roles. Conditions restricting technology should be narrowly connected to the offense and workable in modern life.

What the controlling appellate decisions say

Minnesota’s privacy cases show why exact statutory text matters, especially when technology changes faster than legislation.

In State v. Pakhnyuk, 926 N.W.2d 914, 927 (Minn. 2019), the Supreme Court interpreted the former peeping provision and held that the intent requirement “applies only to the peeping conduct described in clause (2),” not the property-entry element. The decision demonstrates that grammar, structure, and legislative history can determine which act a mental-state phrase modifies.

In State v. McReynolds, 973 N.W.2d 314, 318 (Minn. 2022), the accused used a phone inside the same room to record a naked woman without consent. The former paragraph required recording through a window or other aperture of a dwelling, so the plea lacked a sufficient basis. The Court emphasized: “Our sole task is to determine whether McReynolds’ actions are criminalized under existing Minnesota law.” The Legislature later added current paragraph (e), which covers specified same-room recording. McReynolds remains important for offense-date analysis and the rule that courts cannot enlarge a criminal statute to reach conduct its text did not cover.

In State v. Casillas, 952 N.W.2d 629, 643 (Minn. 2020), the Supreme Court upheld section 617.261 against a First Amendment challenge. The Court concluded the statute was “justified by a compelling government interest and is narrowly tailored.” The holding does not eliminate element-based defenses. It means a facial argument that the entire private-image statute violates the First Amendment cannot simply ignore binding Minnesota precedent.

Together, these decisions reinforce a practical rule: the moral force of an accusation does not replace statutory proof. Current language, historical language, the precise paragraph, and the facts admitted or proved must match.

Building a defense around the real evidence

A strong defense is organized around propositions the State must prove and the records that can prove or disprove them. Begin with a one-page charge chart. List the statutory act, mental state, authorization requirement, aggravating factor, loss threshold, offense date, and evidence cited for each.

Next build two timelines: a human timeline and a system timeline. The human timeline tracks work assignments, account sharing, relationship events, travel, possession, notices, and communications. The system timeline tracks authentication, access, file events, uploads, downloads, messages, configuration changes, and forensic collection. Inconsistencies between the two can expose attribution or intent problems.

Then audit the government’s acquisition of evidence. Obtain warrants and affidavits, provider returns, consent forms, extraction reports, inventories, preservation requests, and chain-of-custody material. Identify data collected outside the warrant’s time, account, or category limitations and evidence derived from any unlawful search.

Finally, assess resolution with the same rigor. A plea to a reduced offense may still carry restitution, device restrictions, employment consequences, a felony record, or immigration effects. The factual basis should admit only conduct that satisfies the agreed offense. Broad technical language can create later disputes about probation, restitution, or civil liability.

If investigators request an interview, a device passcode, consent form, or voluntary production, legal advice should come before a response. A technically imprecise answer can look deceptive even when it was simply mistaken. Counsel can clarify status, preserve evidence, and communicate without guessing.

For a confidential consultation about a Minnesota computer, privacy, or digital-evidence investigation, schedule a call with Wynne Law Firm.

Frequently asked questions about Minnesota cybercrime defense