Colorado § 18-5.5-102 - Cybercrime.

§ 18-5.5-102. Cybercrime.

(1) A person commits cybercrime if the person knowingly:

(a) Accesses a computer, computer network, or computer system or any part thereof without authorization; exceeds authorized access to a computer, computer network, or computer system or any part thereof; or uses a computer, computer network, or computer system or any part thereof without authorization or in excess of authorized access; or

(b) Accesses any computer, computer network, or computer system, or any part thereof for the purpose of devising or executing any scheme or artifice to defraud; or

(c) Accesses any computer, computer network, or computer system, or any part thereof to obtain, by means of false or fraudulent pretenses, representations, or promises, money; property; services; passwords or similar information through which a computer, computer network, or computer system or any part thereof may be accessed; or other thing of value; or

(d) Accesses any computer, computer network, or computer system, or any part thereof to commit theft; or

(e) Without authorization or in excess of authorized access alters, damages, interrupts, or causes the interruption or impairment of the proper functioning of, or causes any damage to, any computer, computer network, computer system, computer software, program, application, documentation, or data contained in such computer, computer network, or computer system or any part thereof; or

(f) Causes the transmission of a computer program, software, information, code, data, or command by means of a computer, computer network, or computer system or any part thereof with the intent to cause damage to or to cause the interruption or impairment of the proper functioning of or that actually causes damage to or the interruption or impairment of the proper functioning of any computer, computer network, computer system, or part thereof; or

(g) Uses or causes to be used a software application that runs automated tasks over the internet to access a computer, computer network, or computer system, or any part thereof, that circumvents or disables any electronic queues, waiting periods, or other technological measure intended by the seller to limit the number of event tickets that may be purchased by any single person in an online event ticket sale as defined in section 6-1-720, C.R.S.; or

(h) Solicits or offers to arrange a situation in which a minor may engage in prostitution, by means of using a computer, computer network, computer system, or any part thereof; or

(i) Directly or indirectly uses a scanning device to access, read, obtain, memorize, or store, temporarily or permanently, information encoded on the payment card without the permission of the authorized user of the payment card, and with the intent to defraud the authorized user, the issuer of the authorized user's payment card, or a merchant; or

(j) Directly or indirectly uses an encoding machine to place information encoded on the payment card onto a different payment card without the permission of the authorized user of the payment card from which the information being reencoded was obtained, and with the intent to defraud the authorized user, the issuer of the authorized user's payment card, or a merchant.

(2) (Deleted by amendment, L. 2000, p. 695, § 8, effective July 1, 2000.)

(3) (a) Except as provided in subsections (3)(b), (3)(b.5), and (3)(c) of this section, if the loss, damage, value of services, or thing of value taken, or cost of restoration or repair caused by a violation of this section is:

(I) (Deleted by amendment, L. 2018.)

(II) Less than three hundred dollars, cybercrime is a petty offense;

(III) Three hundred dollars or more but less than one thousand dollars, cybercrime is a class 2 misdemeanor;

(IV) One thousand dollars or more but less than two thousand dollars, cybercrime is a class 1 misdemeanor;

(V) Two thousand dollars or more but less than five thousand dollars, cybercrime is a class 6 felony;

(VI) Five thousand dollars or more but less than twenty thousand dollars, cybercrime is a class 5 felony;

(VII) Twenty thousand dollars or more but less than one hundred thousand dollars, cybercrime is a class 4 felony;

(VIII) One hundred thousand dollars or more but less than one million dollars, cybercrime is a class 3 felony; and

(IX) One million dollars or more, cybercrime is a class 2 felony.

(b) Cybercrime committed in violation of subsection (1)(a) of this section is a class 2 misdemeanor.

(b.5) Cybercrime committed in violation of subsection (1)(h), (1)(i), or (1)(j) of this section is a class 5 felony.

(c) (I) Cybercrime committed in violation of subsection (1)(g) of this section is a class 2 misdemeanor.

(II) If cybercrime is committed to obtain event tickets, each ticket purchased shall constitute a separate offense.

(III) Subsection (1)(g) of this section shall not prohibit the resale of tickets in a secondary market by a person other than the event sponsor or promoter.

(d) Consistent with section 18-1-202, a prosecution for a violation of subsection (1)(g) of this section may be tried in the county where the event has been, or will be, held.

(4) Nothing in this section precludes punishment pursuant to any other section of law.

(5) Notwithstanding any other provision of this section, an individual may authorize an agent to access and process, on that individual's behalf, that individual's personal data or other information held on a computer, computer network, or computer system and that is otherwise accessible to the individual. An authorized agent remains liable for any unauthorized activity on a system under applicable unfair competition laws; the federal "Computer Fraud and Abuse Act", 18 U.S.C. sec. 1030 et seq., as amended; and other provisions of this section.

Source: L. 79: Entire article added, p. 728, § 7, effective July 1. L. 83: (1) amended, p. 705, § 3, effective July 1. L. 84: (3) amended, p. 538, § 14, effective July 1, 1985. L. 89: (3) amended, p. 839, § 75, effective July 1. L. 92: (3) amended, p. 437, § 9, effective April 10. L. 98: (3) amended, p. 1440, § 18, effective July 1; (3) amended, p. 797, § 12, effective July 1. L. 2000: Entire section amended, p. 695, § 8, effective July 1. L. 2007: (3)(a) amended, p. 1696, § 14, effective July 1. L. 2008: (1)(g), (3)(c), and (3)(d) added and (3)(a) amended, p. 2230, §§ 3, 4, effective July 1. L. 2014: (3)(a) amended, (HB 14-1266), ch. 155, p. 539, § 5, effective August 6. L. 2018: IP(1) and (3) amended and (1)(h), (1)(i), (1)(j), and (4) added, (HB 18-1200), ch. 379, p. 2290, § 2, effective August 8. L. 2021: (3)(a)(II), (3)(a)(III), (3)(a)(IV), and (3)(c)(I) amended, (SB 21-271), ch. 462, p. 3191, § 256, effective March 1, 2022. L. 2022: (5) added, (SB 22-113), ch. 463, p. 3294, § 7, effective August 10. L. 2023: (3)(b) amended, (HB 23-1293), ch. 298, p. 1787, § 24, effective October 1.

Cross references: For the legislative declaration contained in the 2007 act amending subsection (3)(a), see section 1 of chapter 384, Session Laws of Colorado 2007.

ANNOTATION

Law reviews. For article, "Ownership of Software and Computer-stored Data", see 13 Colo. Law. 577 (1984).

Section not unconstitutionally vague or overbroad. People v. Pahl, 169 P.3d 169 (Colo. App. 2006) (decided under former law).

Subsection (1)(e) is not facially unconstitutionally vague. Deleting documents from one's employer's laptop clearly falls within the definition of "damage". The definition of damage is specific enough to provide a person of ordinary intelligence notice that the deletion of documents from a computer may cause damage to data in the computer. People v. Stotz, 2016 COA 16, 381 P.3d 357.

An applied constitutionally vague challenge to subsection (1)(e) fails. Subsection (1)(e) prohibits, with sufficient clarity, an employee's knowing deletion of the only electronic copies of thousands of computer documents, when the employee knows that deletion is not authorized by the employer. People v. Stotz, 2016 COA 16, 381 P.3d 357.

Subsection (1)(e) is not unconstitutionally overbroad. Subsection (1)(e) proscribes knowingly damaging an employer's property, knowing that the employee has no permission to do so. Such conduct is within the state's power to regulate. People v. Stotz, 2016 COA 16, 381 P.3d 357.

Term "access", as used in subsections (1)(c) and (1)(d), is clear and unambiguous as defined in the dictionary. Therefore, defendant accessed a computer system when she communicated with an automated telephone system by inputting data in response to computer-generated questions about her unemployment status. People v. Rice, 198 P.3d 1241 (Colo. App. 2008).

The term "knowingly" applies to every element of the offense in subsection (1)(e). People v. Stotz, 2016 COA 16, 381 P.3d 357.

Computer crime under subsection (1)(b) does not require an injury, loss, or damage for a conviction. When a victim suffers no injury, the penalty is the one that is associated with the lowest dollar threshold. People v. Galang, 2016 COA 68, 382 P.3d 1241.

ARTICLE 6

Offenses Involving the Family Relations

PART 1

ABORTION

18-6-101 to

18-6-105. (Repealed)

PART 2

BIGAMY

18-6-201. Bigamy.

18-6-202. Marrying a bigamist - repeal. (Repealed)

18-6-203. Definitions. (Repealed)

PART 3

INCEST

18-6-301. Incest.

18-6-302. Aggravated incest.

18-6-303. Sentencing.

PART 4

WRONGS TO CHILDREN

18-6-401. Child abuse - definition.

18-6-401.1. Child abuse - limitation for commencing proceedings - evidence - statutory privilege.

18-6-401.2. Habitual child abusers - indictment or information - verdict of the jury.

18-6-401.3. Video tape depositions - children - victims of child abuse.

18-6-401.4. Payment of treatment costs for the victim or victims of an act of child abuse.

18-6-402. Trafficking in children. (Repealed)

18-6-403. Sexual exploitation of a child - legislative declaration - definitions.

18-6-404. Procurement of a child for sexual exploitation.

18-6-405. Reports of convictions to department of education.

PART 5

ADULTERY

18-6-501. (Repealed)

PART 6

HARBORING A MINOR

18-6-601. Harboring a minor.

PART 7

CONTRIBUTING TO DELINQUENCY

18-6-701. Contributing to the delinquency of a minor.

PART 8

DOMESTIC VIOLENCE

18-6-800.3. Definitions.

18-6-801. Domestic violence - sentencing.

18-6-801.5. Domestic violence - evidence of similar transactions.

18-6-801.6. Domestic violence - summons and complaint.

18-6-802. Domestic violence - local board - treatment programs - liability immunity - repeal. (Repealed)

18-6-802.5. Domestic violence - treatment programs.

18-6-803. Commission - manual of standards for treatment of domestic violence perpetrators - repeal. (Repealed)

18-6-803.5. Crime of violation of a protection order - penalty - peace officers' duties - definitions.

18-6-803.6. Duties of peace officers and prosecuting agencies - preservation of evidence.

18-6-803.7. Central registry of protection orders - creation.

18-6-803.8. Foreign protection orders. (Repealed)

18-6-803.9. Assaults and deaths related to domestic violence - report. (Repealed)

18-6-804. Repeal of part. (Repealed)

18-6-805. Repeal of sections. (Repealed)

18-6-806. Notification of potential violation of military protection order - definitions.

18-6-807. Mandatory lethality assessments - short title - legislative declaration - definitions.

PART 1

ABORTION

18-6-101 to 18-6-105. (Repealed)

Source: L. 2013: Entire part repealed, (HB 13-1154), ch. 372, p. 2192, § 3, effective July 1.

Editor's note: This article was numbered as article 6 of chapter 40, C.R.S. 1963. For amendments to this part 1 prior to its repeal in 2013, consult the 2012 Colorado Revised Statutes, the Colorado statutory research explanatory note beginning on page vii in the front of this volume, and the editor's note following the article heading.

Cross references: For the legislative declaration in the 2013 act repealing this part 1, see section 1 of chapter 372, Session Laws of Colorado 2013.

PART 2

BIGAMY