Computer or Electronic Data Theft in Minnesota
Minnesota’s computer-theft law reaches more than stealing a laptop or “hacking” a network.
Minnesota criminal defense guide
Computer or Electronic Data Theft in Minnesota
Minnesota’s computer-theft law reaches more than stealing a laptop or “hacking” a network. It contains four separate theories covering unauthorized access for property or services, taking a computer or data with intent to deprive the owner, unauthorized copying followed by use or disclosure, and intentionally keeping software or electronic data after authority ends. The charge turns on authorization, claim of right, purpose, later handling of data, attribution, and the statute’s specialized loss calculation.
Section 609.89 creates four separate computer-theft theories
Subdivision 1 does not define one general offense. It lists four alternatives, and each uses different conduct and intent language. A complaint should identify the clause rather than rely on the vague accusation that someone “stole data.”
Clause (1) covers intentional access, or causing access, without authorization or claim of right, for the purpose of obtaining services or property. It focuses on access and purpose; it does not require the same intent-to-deprive language used in clause (2).
Clause (2) covers intentionally taking, transferring, concealing, or retaining possession of a computer, computer system, or software or data inside a computer, system, or network, without claim of right and with intent to deprive the owner of use or possession.
Clause (3) covers intentionally accessing or copying software or electronic data without authorization or claim of right and then using, altering, transferring, retaining, or publishing it. Both the unauthorized access or copying and one of the listed later acts matter.
Clause (4) covers intentionally retaining copies of software or electronic data beyond the individual’s authority. It is especially important in employment, contracting, litigation, licensing, and account-transition disputes.
The Legislature added clauses (3) and (4) and the defined term “electronic data” in 2023. Older summaries that describe only access for services or taking with intent to deprive are incomplete.
The State must also prove loss for the offense level. A prosecutor should not merge authorization, ownership, misuse, and loss into one conclusion. Each issue has its own statutory work.
Computer-crime definitions control the charge
Minn. Stat. § 609.87 (2026) supplies definitions for sections 609.87 through 609.891 and several related provisions. Everyday technology terms should not replace them.
“Access” means instructing, communicating with, storing data in, or retrieving data from a computer, computer system, or computer network. Logging in, sending commands, uploading, downloading, querying, synchronizing, or causing an automated process can qualify depending on proof.
A “computer” is an electronic device performing logical, arithmetic, or memory functions by manipulating signals. The definition is broad enough to cover more than desktop and laptop machines.
A “computer system” means related computers and peripheral equipment, whether connected or unconnected. A “computer network” includes public and private telecommunications networks and interconnected computers or systems.
“Computer software” includes programs, procedures, and associated operating documentation. “Electronic data” means digitally stored, transmitted, or processed records or information on a computer, system, network, or in software.
Property expressly includes electronically processed or produced data and information, whether machine-readable or human-readable. Services include computer time, data processing, and storage functions.
These definitions can reach source code, customer records, photographs, credentials, database exports, cloud files, model data, business documents, configurations, and other digital material. Coverage still does not prove lack of authorization, intent, or loss.
Accessing a computer to obtain services or property
Clause (1) requires intentional access without authorization or claim of right and a purpose of obtaining property or services. Mere accidental connection or automated background activity is not enough.
Examples can include using another person’s cloud storage, paid computing resources, subscription software, processing capacity, account benefits, database information, or digital property without permission. The State must identify what the accused sought.
The clause covers causing a computer to be accessed. A person may use a script, bot, scheduled job, remote service, malicious link, or another person to initiate the access. Attribution and purpose remain essential.
“For the purpose of” is a mental-state requirement. Browsing out of curiosity, testing with permission, troubleshooting, or accidental synchronization may be wrong or against policy without proving a purpose to obtain property or services.
Claim of right can arise from ownership, license, contract, joint project, payment, agency, or a good-faith belief in entitlement. It is not established simply because information would be useful.
Completed access may occur without a successful download. If the purpose was to obtain services or property, the access itself can satisfy the conduct clause. Failure can still matter to intent and loss.
Unauthorized access to penetrate a security system can also implicate section 609.891. Prosecutors must distinguish the charges and prove each element.
Taking or retaining a computer or data with intent to deprive
Clause (2) resembles traditional theft but expressly includes computers, systems, software, and data. It requires intentional conduct, lack of claim of right, and intent to deprive the owner of use or possession.
The listed acts are taking, transferring, concealing, and retaining possession. Moving a laptop, transferring files, hiding a drive, withholding credentials, or keeping the only usable copy can be alleged depending on the facts.
Copying data does not always deprive the owner of use or possession because the original may remain. That is one reason the Legislature added clauses (3) and (4), which specifically address copying, later use, and excess retention.
Intent to deprive can be shown by deletion, encryption, refusal to return, concealment, demands, competitive use, disabling access, or statements. The State must prove the intent rather than infer it from possession alone.
Shared ownership and company-property disputes require care. A founder, partner, employee, client, vendor, or coauthor may claim an ownership or license interest. Civil ownership law and contracts can shape claim of right.
A person may lawfully possess a device but wrongfully retain particular data, or lack a claim to the device while owning some files on it. The complaint should identify the property and owner precisely.
Returning a device does not necessarily resolve copied data; returning data does not necessarily resolve the device. Each alleged object and act should be separated.
Unauthorized copying followed by use, alteration, transfer, retention, or publication
Clause (3) is a two-stage offense. The accused must intentionally access or copy software or electronic data without authorization or claim of right, and then use, alter, transfer, retain, or publish it.
A download alone may constitute copying and retention, but the State should identify the facts satisfying both parts rather than assume every cache file proves a conscious act.
“Uses” can include applying data for work, sales, competition, impersonation, analysis, or another objective. “Transfers” can include uploading, emailing, messaging, synchronizing, or moving files to another device or account.
“Publishes” can reach making the data available to others. The audience, platform, access settings, and actual act matter. A local draft is different from a public post or shared folder.
“Alters” can include changing records, source code, metadata, account information, images, permissions, or file contents. Alteration may also implicate computer damage if the statutory requirements are met.
Automatic backups, browser caches, email synchronization, thumbnail creation, and system indexing can generate copies without a user intentionally deciding to retain each one. Forensic interpretation must distinguish system behavior from human action.
The 2023 amendment is important for conduct after copying. Pre-2023 cases and materials quote a narrower statute. The date of conduct controls the applicable version.
Intentionally retaining copies beyond one’s authority
Clause (4) can apply even when the original access and copying were authorized. It focuses on intentionally keeping copies after authority ends or beyond its scope.
Common settings include departure from employment, completion of a consulting project, termination of a software license, return of discovery, expiration of a data-sharing agreement, or a demand to delete confidential materials.
The State must prove what authority existed, when and how it ended, what copies remained, and intentional retention. A vague expectation that “everything should be gone” may not resolve authority or intent.
Copies can exist on laptops, phones, external drives, personal email, cloud storage, backup systems, version histories, collaboration platforms, and synchronized folders. A person may not know every automatic copy exists.
A litigation hold, regulatory duty, professional-record obligation, contract, ownership interest, or counsel instruction may supply authority or complicate deletion. A person should not delete disputed data without legal advice.
Partial deletion can be misread. Backup retention schedules and administrative control may prevent immediate removal. Logs and IT testimony can establish who could delete which copy.
Intentional use after authority ends can support clause (3) as well as clause (4). Charging multiple counts requires a clear act and permissible unit of prosecution.
Employees, contractors, and former insiders
Many section 609.89 investigations arise from workplace departures. The criminal case should not be reduced to the employer’s label of “confidential” or the former worker’s belief that files were “my work.”
Relevant documents include employment agreements, invention assignments, confidentiality clauses, handbooks, acceptable-use policies, client contracts, project scopes, separation instructions, and return-of-property certifications.
Actual practice matters. Employees may routinely work from home, use personal devices, email files, retain portfolios, share credentials, or keep templates with management knowledge. That practice may inform authorization, though it does not necessarily authorize competitive use or client-data retention.
Timing is crucial. A download during authorized employment can become alleged excess retention after termination. Clause (4) may apply differently from a theory that the original access was unauthorized.
Trade-secret status is not an element of section 609.89. Data can be covered without being a trade secret, and information labeled a trade secret may still be lawfully possessed by a particular user.
Whistleblowing, reporting law violations, preserving evidence, and consulting counsel can raise authorization, public-policy, privilege, and other legal issues. They are not automatic exemptions, but purpose and lawful duties matter.
A civil injunction, trade-secret lawsuit, or contract claim can proceed alongside criminal investigation. Standards and remedies differ, and testimony in one matter can affect another.
Cloud accounts, shared credentials, and remote access
Cloud computing blurs device location and ownership. A file stored on a third-party server can still be electronic data in a computer network or system.
A password that still works does not prove continued authorization. Conversely, use of a shared credential does not identify which person logged in. Provider logs, device history, IP addresses, multifactor events, and activity patterns matter.
Shared family, team, or business accounts create attribution problems. The visible account name may identify the subscriber but not the actor. Delegated access and service accounts can make logs appear under another person’s name.
Synchronization may copy data automatically to linked devices. It can also delete, alter, or upload files across endpoints. A reliable timeline should account for system settings and time-zone differences.
Remote-management tools, virtual private networks, APIs, automation platforms, and cloud integrations can cause access without a user physically operating the owner’s machine.
Revocation should be documented. Account disablement, password resets, termination letters, on-screen notices, access-control changes, and acknowledged instructions can show when authority ended.
Provider preservation is time-sensitive. Counsel may need to request retention of access logs and account records before routine deletion.
Digital forensics, attribution, and chain of custody
Computer-theft cases often turn on forensic artifacts: file-system timestamps, browser history, USB records, cloud logs, email headers, application databases, registry entries, backups, account sessions, and network records.
Timestamps are not self-explanatory. Copying can change creation dates; systems record local or universal time; clocks drift; and cloud platforms display different zones. Expert interpretation may be required.
A hash value can show two files are identical and help verify forensic integrity. It does not prove who copied the file or whether possession was authorized.
IP addresses can identify a connection, not always a person. Shared networks, mobile carriers, VPNs, remote desktops, compromised accounts, and network-address translation complicate attribution.
Forensic collection should preserve metadata and use validated methods. Opening files, running searches, or allowing ordinary synchronization can change evidence. Personal devices may contain privileged and irrelevant data requiring careful protocols.
Chain of custody is more than a label on an evidence bag. Investigators should document who collected each device, when it was isolated, whether it remained powered on, which forensic image was created, the hash values used to verify that image, and every later examination. If a business system stayed live, logs should show retention settings, administrator activity, software updates, and any changes made during incident response. A gap does not automatically make evidence inadmissible, but unexplained alteration can affect authenticity and weight. The defense should compare the original collection notes, forensic image, examiner report, and produced files rather than assume that a screenshot or exported folder accurately represents the system at the alleged time.
Witness testimony should establish ownership, authorization, notices, data function, system behavior, and loss. An IT employee may explain logs but lack authority to define contractual ownership; a manager may know policy but not forensic operation.
Police searches of devices and cloud accounts require probable cause and particularity. Overbroad warrants, privileged communications, and searches exceeding authorized scope can support suppression or other remedies.
How Minnesota calculates computer-theft loss
Section 609.87 defines loss as the greatest of three measures: retail market value of the property or services; reasonable repair or replacement cost, whichever is less; or reasonable value of damage from unavailability or lost utility until repair or replacement.
The State cannot simply use the owner’s preferred figure. It should identify the measure, evidence, time period, and causal connection to the charged conduct.
Market value may be difficult for proprietary data. Development cost, sale price, licensing value, competitive value, and replacement cost are not interchangeable.
Repair or replacement must be reasonable. A full system rebuild may be unnecessary if restoration from backup was available. Internal labor can be compensable in some settings but requires documentation and allocation.
Loss of utility requires proof that property or services were unavailable or less useful, for how long, and what that was worth. Speculative future profits or reputational harm should not be accepted without a lawful basis.
Loss exceeding $2,500 carries up to ten years and a $50,000 fine. Loss above $500 through $2,500 carries up to five years and $10,000. All other cases are misdemeanors carrying up to 90 days and $1,000.
The current Minnesota Sentencing Guidelines severity table ranks computer theft at level 2 when loss is $2,500 or less and level 3 when it exceeds $2,500. The guidelines apply to felony sentencing; criminal history and other rules affect disposition.
Minnesota proof principles when direct computer-theft cases are limited
There is little modern published Minnesota appellate authority construing the 2023 clauses. Courts must therefore start with the current statute and definitions rather than transplant federal computer-law language.
Intent and attribution are often circumstantial. In State v. Al-Naseer, 788 N.W.2d 469, 474–80 (Minn. 2010), the Minnesota Supreme Court stated that a circumstantial-evidence conviction “warrants heightened scrutiny.”
In State v. Andersen, 784 N.W.2d 320, 329–31 (Minn. 2010), the court explained that the circumstances proved must be consistent with guilt and “inconsistent with any rational hypothesis except that of guilt.” Neither decision involved computer theft, but both govern Minnesota circumstantial-evidence review.
Reasonable innocent explanations can include shared accounts, automated synchronization, authorized project work, backup retention, miscommunicated revocation, device compromise, or mistaken attribution. They must be supported by evidence, not imagined.
Federal cases under the Computer Fraud and Abuse Act can be informative about technology but use different text. Minnesota expressly defines authorization and now separately criminalizes retention beyond authority.
Any opinion predating July 2023 addressed a statute without clauses (3) and (4). Citation should state that limitation.
Defense issues in a computer or data theft case
Authorization existed. The owner, operator, supervisor, contract, license, role, or ordinary practice may have permitted the access, copying, use, or retention.
No effective limit was communicated. The statute identifies actual, posted, and on-screen notice. A later policy interpretation may not prove what the accused knew.
Claim of right. Ownership, joint development, license, payment, agency, or good-faith entitlement may negate a clause.
No required purpose or intent. Accidental access, automatic copying, troubleshooting, backup behavior, or authorized preservation may not show a purpose to obtain property or intent to deprive.
No qualifying later act. Clause (3) requires use, alteration, transfer, retention, or publication after unauthorized access or copying.
No intentional excess retention. A person may not know of cached, backed-up, or synchronized copies, or may lack the technical ability to remove them.
Wrong user or compromised account. Credentials, IP addresses, and account names do not always identify the human actor.
Loss is overstated. Market value, restoration, and downtime must be reasonable and caused by the offense.
Wrong statutory version. Conduct before the 2023 amendment cannot be prosecuted retroactively under new clauses.
Unlawful search. An overbroad device, account, or workplace search may support suppression.
What to do after a computer-theft accusation
Stop accessing the disputed systems and data unless counsel confirms continuing authorization. A credential that still works is not permission.
Preserve devices and accounts without exploring them. Do not wipe, reset, uninstall, rename, move, or open disputed files. Ordinary use can change evidence.
Save policies, contracts, licenses, supervisor messages, access notices, separation documents, project instructions, and evidence of ordinary practices.
Write a privileged chronology for counsel identifying devices, accounts, users, access dates, purposes, data, notices, returns, deletion requests, and alleged loss.
Do not contact coworkers or administrators to coordinate explanations or ask them to change logs. Do not use another person’s credentials to gather evidence.
You may decline a voluntary police interview and request counsel. Technical explanations given from memory can create inaccurate admissions.
Early work can preserve provider logs, retain a forensic examiner, image devices lawfully, challenge loss, and identify which of the four clauses the State can actually support.
Frequently asked questions about Minnesota computer theft
Is computer theft the same as hacking?
No. Hacking may involve unauthorized access, but section 609.89 also covers taking computers or data, unauthorized copying followed by use, and keeping copies beyond authority.
Can I be charged if I had a valid password?
Yes, potentially. A working password does not establish authorization for every time and purpose. The owner’s permission, limits, notices, and your claim of right matter.
Can an employee download work files?
It depends on job duties, policy, instructions, purpose, and later use or retention. Routine authorized work differs from exporting a database for personal or competitive use.
What if I created the files?
Authorship does not always equal ownership or unlimited authority. Employment agreements, licenses, client rights, joint work, and company policies can determine claim of right.
Can keeping files after leaving a job be a crime?
Clause (4) covers intentionally retaining software or electronic data copies beyond authority. The State must prove what authority existed, when it ended, what remained, and intentional retention.
Do automatic backups count as intentional retention?
Not automatically. Backup and synchronization systems can retain copies without conscious action. Knowledge, control, notices, deletion ability, and later conduct matter.
Can copying data be theft if the owner still has it?
Yes, under the 2023 clauses if unauthorized copying is followed by use, alteration, transfer, retention, or publication. Clause (2)’s intent-to-deprive theory is different.
What does “claim of right” mean?
It concerns a genuine legal or good-faith entitlement to the property, services, access, or data. Ownership, contract, license, agency, and permission can be relevant.
How can police prove who used an account?
They may use device artifacts, IP records, multifactor events, locations, messages, file history, writing style, and admissions. A username or subscriber identity alone may be insufficient.
How is loss calculated?
Minnesota uses the greatest of market value, reasonable repair or replacement cost, or reasonable value of lost utility until restoration. The owner’s unsupported estimate is not conclusive.
What is the felony threshold?
Loss above $500 triggers a felony maximum under section 609.89. More than $500 through $2,500 carries up to five years; over $2,500 carries up to ten years.
Can computer damage be charged too?
Yes. Altering, damaging, or destroying computers, software, networks, or data can implicate section 609.88. Each offense has separate elements.
What if conduct happened before the 2023 amendment?
Clauses (3) and (4) cannot be applied retroactively to earlier conduct. The applicable statutory version must match the alleged date.
Can a computer-theft conviction be expunged?
Section 609.89 appears among felony offenses potentially eligible under Minn. Stat. § 609A.02 (2026), subject to the final offense, waiting period, and all statutory requirements.
How long can Minnesota bring the charge?
The limitations period depends on offense level and facts under Minn. Stat. § 628.26 (2026). A specific calculation should be performed for the charged conduct.