H. Michael Steinberg has over 32 years experience practicing Colorado criminal law. Mr. Steinberg strives to stay current with the ever changing aspects of criminal law issues and updates resulting in his extensive knowledge of successful criminal defense as well as appellate work. He is also an active member of the National Association of Criminal Defense Lawyers, the Colorado Criminal Defense Bar Association, the Colorado Trial Lawyer's Association, and the Colorado and Arapahoe Bar Associations.
Published on:

Colorado Criminal Law – Understanding the Colorado Computer Crime Laws And Company Computers Under § 18-5.5-102 CRS

img001
By H. Michael Steinberg Colorado Theft Crimes Criminal Defense Lawyer
Employees who are assigned laptop computers upon leaving their employment should be aware of a 2016 Colorado case that addresses what they should do and not do with their employer’s laptop.

Known to some as the Colorado Computer Hacking Law, Colorado’s Computer Crime “Act” was actually two separate laws that are read together – C.R.S. § 18-5.5-101 and C.R.S. Section 18-5.5-102.

The purpose of this article is to alert the reader to a trap for the unwary former employee who has been assigned a “company computer.”

Bottom line Colorado criminal law:- Colorado’s Computer Crime Law C.R.S. Section 18-5.5-102(1)(a) prohibits knowingly accessing or using a computer, computer network, or computer system without authorization or exceeding authorized access.

The behavior punishable by this law is very broad in scope.

A person also commits Computer Crime in Colorado if the person knowingly: . . .

(e) Without authorization or in excess of authorized access alters, damages, interrupts, or causes the interruption or impairment of the proper functioning of, or causes any damage to, any computer, computer network, computer system, computer software, program, application, documentation, or data contained in such computer, computer network, or computer system or any part thereof.

At least THREE definitions found in Section 18-5.5-101, C.R.S. are critically important in these cases: Those three defined terms are “authorization,” “in excess of authorized access,” and “damage” are defined in the law (Section 18-5.5-101, C.R.S.)

Authorization” means the express consent of a person which may include an employee’s job description to use said person’s computer, computer network, computer program, computer software, computer system, property, or services as those terms are defined in this section.

“Damage” includes, but is not limited to, any impairment to the integrity of availability of information, data, computer program, computer software, or services on or via a computer, computer network, or computer system or part thereof.
“Exceed authorized access” means to access a computer with authorization and to use such access to obtain or alter information, data, computer program, or computer software that the person is not entitled to so obtain or alter.

The 2016 Colorado Computer Crime Case Of People v. Stotz

In the recent 2016 Colorado case of People v. Stotz, the reach of the Colorado Computer Crime law was extended mightily.

The Colorado Court of Appeals issued its opinion in People v. Stotz on Thursday, February 11, 2016. In Stotz, three employees from a Colorado corporation resigned to work for a competitor. But, when they returned their company laptops, there were thousands of files missing including bids that were directed at new business.

A forensic computer concern did an analysis of the deleted files but could not recover the missing data. A complaint was filed with the Denver District Attorney’s Economic Crimes unit felony criminal charges were filed against the former employees.

After a jury trial – the Defendant’s were convicted under the Colorado Computer Crime statutes and were sentenced under those laws.

The Judge And Jury Heard, And Rejected The Defense Of No “Damages”

The trial court held and the appellate court sustained the evidence that:

“…the deletion of thousands of documents from an employer’s computer clearly falls within the statutory definition of “damage,” and that (the law’s definition of damage) is specific enough to provide notice to a person of ordinary intelligence that the deletion of thousands of documents may cause damage to the computer’s data.”

The Defendant’s in Stotz argued that they had the right to do whatever they wanted with their employer-owned laptops. The jury disagreed. Because these Defendants’ knowingly destroyed the data on their computers without their former employer’s permission, their conduct fell within the State’s computer crime laws.

We conclude that this provision is constitutional as applied to employees who a jury determined had deleted thousands of documents from their company-issued laptops, knowing that they acted without authorization or in excess of authorized access in doing so.

Furthermore, the following arguments, which may make sense to individuals in the same situation who are reading about this case, were rejected.

The Defendants unsuccessfully argued that:

(1) they had full authority over their own laptops, and management neither exercised any control, nor promulgated any rules or guidelines, over the placement, retention, or deletion of the content of their laptops;

(2) the legislative intent of the computer crime statute was to criminalize hacking and the use of a computer to commit fraud and embezzlement, not to prosecute employees for data deletion decisions; and

(3) as demonstrated by out-of-state cases, the statute provides insufficient notice that it reaches employees’ acts with respect to information on a computer that the employees had authority to access.

Finally – An Unforseen Part Of The Conviction – A Large Amount Of Restitution Is Ordered For The Necessary Forensic Investigation

The victim a computer forensic company to determine whether the data that had been deleted from the Defendants’ laptops was recoverable.

Following the conviction, t he Trial Court in the Stotz case sentenced the Defendants to a two-year suspended prison sentence, imposed two years’ probation, and then awarded the victim company over $104,000.00 in restitution.

What follows is Colorado’s 2016 version of the Computer Crime Law 18-5.5-102

Section 18-5.5-102. Computer crime.

(1) A person commits computer crime if the person knowingly:

(a) Accesses a computer, computer network, or computer system or any part thereof without authorization; exceeds authorized access to a computer, computer network, or computer system or any part thereof; or uses a computer, computer network, or computer system or any part thereof without authorization or in excess of authorized access; or
(b) Accesses any computer, computer network, or computer system, or any part thereof for the purpose of devising or executing any scheme or artifice to defraud;
or
(c) Accesses any computer, computer network, or computer system, or any part thereof to obtain, by means of false or fraudulent pretenses, representations, or promises, money; property; services; passwords or similar information through which a computer, computer network, or computer system or any part thereof may be accessed; or other thing of value; or
(d) Accesses any computer, computer network, or computer system, or any part thereof to commit theft; or
(e) Without authorization or in excess of authorized access alters, damages, interrupts, or causes the interruption or impairment of the proper functioning of, or causes any damage to, any computer, computer network, computer system, computer software, program, application, documentation, or data contained in such computer, computer network, or computer system or any part thereof; or
(f) Causes the transmission of a computer program, software, information, code, data, or command by means of a computer, computer network, or computer system or any part thereof with the intent to cause damage to or to cause the interruption or impairment of the proper functioning of or that actually causes damage to or the interruption or impairment of the proper functioning of any computer, computer network, computer system, or part thereof; or
(g) Uses or causes to be used a software application that runs automated tasks over the internet to access a computer, computer network, or computer system, or any part thereof, that circumvents or disables any electronic queues, waiting periods, or other technological measure intended by the seller to limit the number of event tickets that may be purchased by any single person in an on-line event ticket sale as defined in section 6-1-720, C.R.S.

(2) (Deleted by amendment, L. 2000, p. 695, Section 8, effective July 1, 2000.)

(3) (a) Except as provided in paragraphs (b) and (c) of this subsection (3), if the loss, damage, value of services, or thing of value taken, or cost of restoration or repair caused by a violation of this section is:

(I) Less than fifty dollars, computer crime is a class 1 petty offense;
(II) Fifty dollars or more but less than three hundred dollars, computer crime is a class 3 misdemeanor;
(III) Three hundred dollars or more but less than seven hundred fifty dollars, computer crime is a class 2 misdemeanor;
(IV) Seven hundred fifty dollars or more but less than two thousand dollars, computer crime is a class 1 misdemeanor;
(V) Two thousand dollars or more but less than five thousand dollars, computer crime is a class 6 felony;
(VI) Five thousand dollars or more but less than twenty thousand dollars, computer crime is a class 5 felony;
(VII) Twenty thousand dollars or more but less than one hundred thousand dollars, computer crime is a class 4 felony;
(VIII) One hundred thousand dollars or more but less than one million dollars, computer crime is a class 3 felony; and (IX) One million dollars or more, computer crime is a class 2 felony.

(b) Computer crime committed in violation of paragraph (a) of subsection (1) of this section is a class 2 misdemeanor; except that, if the person has previously been convicted under this section, a previous version of this section, or a statute of another state of similar content and purport, computer crime committed in violation of paragraph (a) of subsection (1) of this section is a class 6 felony.

(c) (I) Computer crime committed in violation of paragraph (g) of subsection (1) of this section is a class 1 misdemeanor.

(II) If computer crime is committed to obtain event tickets, each ticket purchased shall constitute a separate offense.

(III) Paragraph (g) of subsection (1) of this section shall not prohibit the resale of tickets in a secondary market by a person other than the event sponsor or (d) Consistent with section 18-1-202, a prosecution for a violation of paragraph (g) of subsection (1) of this section may be tried in the county where the event has been, or will be, held.

Colorado Criminal Law – Understanding the Colorado Computer Crime Laws And Company Computers Under Section 18-5.5-102 CRS

If you found any of the information I have provided on this web page article helpful please click my Plus+1 or the Share buttons for Twitter and Facebook below so that others may also find it.

Never stop fighting – never stop believing in yourself and your right to due process of law.

ABOUT THE AUTHOR: H. Michael Steinberg – Email The Author at hmsteinberg@hotmail.com – A Denver Colorado Criminal Defense Lawyer – or call his office at 303-627-7777 during business hours – or call his cell if you cannot wait and need his immediate assistance – 720-220-2277. Attorney H. Michael Steinberg is passionate about criminal defense. His extensive knowledge and experience of Colorado Criminal Law gives him the edge you need to properly handle your case.

“A good criminal defense lawyer is someone who devotes themselves to their client’s case from beginning to end, always realizing that this case is the most important thing in that client’s life.”

You should be careful to make a responsible choice in selecting a Colorado Criminal Defense Lawyer – and we encourage you to “vet” our firm. Over the last 30 plus years – by focusing ONLY on Colorado criminal law – H. Michael has had the necessary time to commit to the task of constantly updating himself on nearly every area of criminal law, to include Colorado criminal law and procedure and trial and courtroom practice. H. Michael works hard to get his clients the best possible results in and out of the courtroom. He has written, and continues to write, extensively on Colorado criminal law and he hopes this article helps you in some small way – Colorado Criminal Law – Understanding the Colorado Computer Crime Laws And Company Computers Under Section 18-5.5-102 CRS.