Minnesota unauthorized computer access guide
Unauthorized Computer Access under Minnesota Statutes § 609.891
Minnesota’s unauthorized-computer-access statute is not a generic ban on using someone else’s account or violating an information-technology policy. In the statute’s words, the state must prove that the person acted “intentionally and without authorization” and attempted to penetrate, or actually penetrated, a statutorily defined computer security system or electronic terminal. The classification then depends on a separate aggravating theory: public-safety risk, protected data, personal data, a qualifying prior adjudication, terminal-panel conduct, a grave risk of death, or a device placed to capture access-device information. A useful defense analysis therefore starts with the charged subdivision, the alleged offense date, the source and limits of authorization, the protected object, and the native digital record—not with the shorthand label “hacking.”
I separate the accusation from the system record.
If you hire me, I identify the exact subdivision, retrieve the offense-date version, and test every required link: who acted, what system or terminal was involved, what made it a security system, how authorization was granted or limited, what event allegedly penetrated it, and what additional fact is supposed to elevate the charge. I examine native logs, identity architecture, account history, devices, collection methods, time sources, notices, policies, agreements, and alternative users. A suspicious login, policy dispute, exposed credential, or security alert does not by itself prove § 609.891.
The state must prove intentional, unauthorized penetration or attempted penetration of a covered target
The base sentence of § 609.891 contains several distinct requirements. A precise complaint and trial theory should identify the intentional act, the absence of authorization, the attempted or completed penetration, and whether the target was a computer security system or an electronic terminal. The statute does not say that every unauthorized use of a computer, every breach of workplace policy, or every access to confidential information is this offense.
Intentional conduct
The conduct must be intentional under Minnesota’s criminal-code definition, not merely accidental, negligent, or technically unexpected.
Without authorization
Owner permission, delegated permission, approved times and purposes, and legally sufficient limits must be examined.
Attempt or completion
The statute expressly reaches both an attempt to penetrate and actual penetration; the state should say which it alleges.
Computer security system
The target must meet § 609.87’s purpose-based definition, not merely be any password, file, application, or computer.
Electronic terminal
For post-July 2018 conduct, the target may instead be a covered fund-transfer terminal such as an ATM, point-of-sale terminal, or gas pump.
Aggravating theory
Anything above the base misdemeanor requires proof of a separate fact listed in subdivision 2 or 3.
Intent must be tied to the facts that make the act criminal
Section 609.02 defines “intentionally” to mean that the actor has a purpose to do the specified thing or cause the specified result, or believes the act, if successful, will cause it. The definition also generally requires knowledge of the facts set out after “intentionally” that make the conduct criminal. That makes the evidence about mistake, automated processes, stale sessions, mistaken system identity, shared workstations, security testing, and owner communications relevant. It does not create a blanket ignorance-of-law defense; § 609.02 says criminal intent ordinarily does not require knowledge of the statute’s existence or legal meaning.
Attempt and completed penetration are different factual theories
The words “attempts to or does penetrate” prevent a failed technical effort from automatically escaping the statute, but they do not eliminate proof. An attempt theory should identify the intentional act directed toward penetration and why it went beyond preparation. Minnesota’s general attempt statute, § 609.17, supplies background law, yet § 609.891 expressly incorporates attempted penetration into the offense itself. The complaint, jury instructions, and sentencing position should therefore be checked for consistency rather than assuming the general half-maximum attempt provision controls a specifically graded § 609.891 conviction.
“Penetrate” should not be replaced with an invented universal test
The computer-crime definitions do not provide a separate definition of “penetrate,” and official exact-citation research did not locate a published Minnesota appellate opinion comprehensively defining that word for every modern architecture. The state should identify the alleged boundary and the event that crossed or tried to cross it: a rejected login, successful authentication, privilege escalation, token replay, API call, panel opening, bypass of a protective control, or another event. Different systems create different factual questions. This guide does not turn any failed password or policy breach into penetration as a matter of law.
The aggravating fact determines whether the case is a misdemeanor, gross misdemeanor, or felony
Subdivision 4 is the default. The prosecution must prove one of the enumerated subdivision 3 or subdivision 2 theories to obtain a higher classification. Several theories use terms defined elsewhere, so the label attached by an investigator or organization is not enough.
| theory | Additional fact the state must prove | Current maximum |
|---|---|---|
| Base misdemeanor | Subdivision 1 violation, with no proven higher theory. | 90 days and/or $1,000. |
| Public-health-and-safety risk | The violation occurred in a manner creating a risk to public health and safety. | 364 days and/or $3,000. |
| Protected-data security | The violation compromised security of qualifying § 609.52 trade-secret data or government “not public data” under § 13.02. | 364 days and/or $3,000. |
| Personal data | The violation gained access to personal data as § 609.87 defines it. | 364 days and/or $3,000. |
| Repeat misdemeanor | A second or subsequent misdemeanor violation within five years, with the required prior adjudication before the new offense. | 364 days and/or $3,000. |
| Terminal panel | Access or attempted access to a terminal by opening or attempting to open a panel/access door without authorization. | 364 days and/or $3,000. |
| Grave risk of death | The violation occurred in a manner creating a grave risk of causing a person’s death. | 10 years and/or $20,000. |
| Repeat gross misdemeanor | A second or subsequent gross-misdemeanor violation, with the required prior adjudication before the new offense. | 10 years and/or $20,000. |
| Terminal capture device | Unauthorized panel/access-door opening plus placement/attachment or attempted placement/attachment of a device to capture, store, or communicate access-device information. | 5 years and/or $10,000 under § 609.03 because paragraph (c) fixes no punishment. |
Risk to public health and safety is not the same as grave risk of death
The gross-misdemeanor and felony risk theories use different language and must not be collapsed. A prosecutor relying on public-health-and-safety risk should identify the threatened function, the people exposed, the mechanism, and the level of risk. A ten-year felony requires the more specific “grave risk of causing the death of a person.” A theoretical vulnerability, mere access to an important network, or generalized claim that cyber incidents are dangerous is not a substitute for proof that the charged violation occurred in the statutorily described manner.
Protected data has legal definitions, not just a confidentiality label
The protected-data theory contains two alternatives. First, it covers data protected under the trade-secret theft clause in § 609.52, subdivision 2(a)(8). Section 609.52’s trade-secret definition looks to independent economic value from not being generally known or readily ascertainable and to reasonable efforts to maintain secrecy. The theft clause also states a complete defense when the information was rightfully known or available from a source other than the owner. A nondisclosure label, password, or internal classification can be evidence, but it does not conclusively establish each statutory feature.
Second, the theory covers “not public data” as § 13.02, subdivision 8a defines it. That is a Minnesota Government Data Practices Act classification: government data classified by statute, federal law, or temporary classification as confidential, private, nonpublic, or protected nonpublic. It does not mean any information a private business calls nonpublic. The state should identify the government data set and the law that supplies the classification.
Personal data is broader than a payment-card number but still defined
Section 609.87 defines personal data as computer property or a computer program containing records of employment, salary, credit, or other financial or personal information about another person. The state should identify what record was reached and how it fits that definition. A system that can contain personal data is not necessarily proof that the charged penetration gained access to such data. Database permissions, query logs, viewed objects, exports, endpoint artifacts, and application audit trails may distinguish potential access from actual access.
Repeat theories require sequencing, not simply a record search
Section 609.02, subdivision 11 defines “second or subsequent” to mean that before commission of the new violation, the actor had been adjudicated guilty of the specified similar violation. For the gross-misdemeanor theory, the current text also says “within five years.” The prior case’s level, statute, adjudication date, new offense date, and any statutory lookback computation should be verified from certified records. An arrest, charge, simultaneous count, later conviction, or unrelated computer offense is not automatically the specified prior adjudication.
The terminal felony has a compound sequence
The terminal-device felony is not proved merely by showing a suspicious device near a gas pump or ATM. Paragraph (c) ties the subdivision 1 violation to unauthorized opening of a panel or access door and placing, attaching, or attempting to place or attach an electronic device to capture, store, or communicate access-device information. The evidence should establish the terminal, the opening, lack of authorization, the device, its placement or attempted placement, its function, and attribution. Photographs, seals, service logs, surveillance, fingerprints or DNA, device firmware, stored data, network traffic, and expert testing may bear on different links.
The 1989, 2006, 2018, and 2023 changes answer different questions
Computer investigations often examine historical access or delayed discovery. The current statute cannot automatically be projected backward. The alleged act date determines the definitions, available charge theories, maximums, and sentencing rules.
| Period | Law to check | Material distinction |
|---|---|---|
| August 1, 1989 to July 31, 2006 | 1989 enactment and intervening amendments. | The original security-system definition also required a conspicuous warning or knowing response through an authorized code; the statute used “without authority.” |
| August 1, 2006 to July 31, 2018 | 2006 amended definitions and offense. | “Without authorization,” the detailed authorization definition, and the personal-data gross-misdemeanor theory applied. |
| On or after August 1, 2018 | 2018 electronic-terminal amendments. | Electronic terminals and access devices entered the definitions; terminal panel and capture-device theories became available prospectively. |
| Current gross-misdemeanor sentencing | 2023 gross-misdemeanor reform. | The current maximum is 364 days. The reform included express retroactive sentencing treatment; it did not create the terminal offenses. |
The original security-system definition was narrower in a specific way
When the Legislature enacted § 609.891 in 1989, a computer security system had to be intended to protect confidentiality and secrecy and also either display a conspicuous secure-system warning or require the person seeking access to knowingly respond through an authorized code. The current definition retains the protective purpose but not that second warning-or-code requirement. For older conduct, whether the alleged target met the then-effective two-part definition can be decisive.
August 1, 2006 changed authorization and added personal data
The 2006 session law replaced “without authority” with “without authorization,” added the statutory authorization framework, defined personal data, and added the personal-data gross-misdemeanor approach. It applies to crimes committed on or after August 1, 2006. An allegation based on employer permissions, time-and-purpose limits, or access to personnel or financial records needs the offense-date text, not just today’s version.
August 1, 2018 is the terminal dividing line
The electronic-terminal amendments apply to crimes committed on or after August 1, 2018. They added terminals to subdivision 1, defined electronic terminal and access device, expanded specified inspection authorization, and created the terminal-panel gross misdemeanor and capture-device felony. A pre-August 2018 event cannot be charged under those later-created theories merely because investigators discovered it later.
The 2020 and 2023 history entries should not be misdescribed
The 2020 amendment made a technical paragraph-reference correction in the protected-data clause. The 2023 change reflected Minnesota’s statewide reduction of the gross-misdemeanor maximum from one year to 364 days and its associated revisor work. Neither amendment added the electronic-terminal crimes. Accurately describing legislative history matters because an incorrect date can lead to the wrong elements or penalty statement.
The target and permission questions use statutory terms
Section 609.87 supplies definitions for Minnesota’s computer-crime provisions. The state should connect the charged technology to those definitions rather than relying on a broad popular meaning of hacking.
A computer security system is defined by protective purpose
Current subdivision 11 describes a software program or computer device intended to protect the confidentiality and secrecy of data and information stored in or accessible through the computer system. That may include an authentication gateway, encryption control, access-control device, or another protective mechanism, depending on the evidence. A computer system containing sensitive data is not necessarily itself the security system; the prosecution should identify the protective program or device and prove its intended purpose.
Access and penetration should not be conflated
Section 609.87 defines “access” as instructing, communicating with, storing data in, or retrieving data from a computer, system, or network. Section 609.891, however, uses “penetrate” for the base offense. Access evidence may help prove the allegation, but the distinct statutory words should be respected. An application may communicate with a backend in routine operation; a browser may retrieve public data; a device may automatically renew a session. The state still must prove intentional unauthorized attempted or completed penetration of the covered protective system or terminal.
An electronic terminal is a fund-transfer device, not every kiosk
The definition excludes a telephone operated by a consumer and covers an electronic device through which an individual or company may initiate an electronic fund transfer. It specifically includes point-of-sale terminals, ATMs, cash-dispensing machines, and gas-pump dispensers. Whether another device qualifies depends on its function, not its appearance. A terminal’s service enclosure, payment reader, networking hardware, and main computer may also present distinct proof questions.
An access device is a specified transaction card
For the terminal felony, an “access device” means a card used by a person or company to initiate transactions and serving as account access, issued prepaid in a specific amount, or used to access government benefits. The prosecution should connect the attached electronic device’s claimed function to information from such a card. A generic radio, maintenance tool, diagnostic board, or storage device does not establish that purpose without technical evidence.
A reliable timeline requires more than a screenshot or exported alert
Computer-access cases are often built from many systems that record different layers: identity provider, VPN, firewall, web server, application, database, endpoint, cloud control plane, email, ticketing system, payment terminal, and physical surveillance. A complete review asks what each record actually measures, which clock it used, how long it was retained, how it was exported, what was filtered, and whether the record can be tied to the person and charged act.
Start with identity architecture
The investigation should identify local and federated accounts, aliases, service accounts, privileged roles, tokens, API keys, certificates, multifactor methods, recovery channels, session duration, device enrollment, and delegation. A username in one application may map through several identity layers. The evidentiary chain must show that the identifier in the log corresponds to the accused person at the relevant moment and was not shared, automated, spoofed, or compromised.
Preserve native records and the method of collection
Rendered PDFs and screenshots can omit fields, filters, time-zone settings, pagination, revision history, and machine-readable context. Native exports, schemas, query text, collection notes, audit settings, retention configuration, and cryptographic hash values make independent review more meaningful. If a vendor generated a report, discovery should identify the vendor system, data source, parameters, transformation steps, and knowledgeable witness.
Normalize time carefully
Records may use UTC, local time, device time, server time, daylight-saving adjustments, Unix epochs, or unsynchronized clocks. A one-hour or several-minute shift can change whether an event occurred before permission ended, during a maintenance window, or while another person possessed a device. The chronology should record each source’s time basis and known drift rather than silently converting everything into one apparently exact timeline.
Distinguish an alert from the underlying event
A security alert is a rule’s conclusion about data, not necessarily the data itself. “Impossible travel,” “malicious login,” “privilege escalation,” “panel tamper,” or “data access” may depend on thresholds, enrichment sources, geolocation, false-positive handling, and later analyst annotations. The defense should obtain the rule version, raw inputs, suppression logic, analyst work, and alternative explanations. An alert can guide investigation without proving every criminal element.
Terminal evidence needs physical and technical correlation
For a gas pump, ATM, or point-of-sale terminal, preserve seal and inspection history, authorized maintenance, panel keys, access logs, surveillance, photographs, device placement, wiring, firmware, memory, radio behavior, transaction anomalies, and chain of custody. An object recovered inside a terminal should be documented in place before removal where possible. Expert testing must distinguish what the device could do, what it was configured to do, and what it actually did.
Evidence rules still apply to technical proof
Minnesota Rules of Evidence 401 and 403 govern relevance and unfair prejudice or confusion. Rule 901 requires sufficient evidence that an item is what its proponent claims. Rule 1002 addresses proof of the content of writings, recordings, and photographs, while Rule 1006 governs summaries of voluminous material. Criminal Procedure Rule 9 governs disclosure. These rules do not create automatic exclusion; they organize case-specific challenges to foundation, completeness, summaries, experts, and the underlying source material.
The felony maximum depends on which paragraph supports the conviction
It is inaccurate to state one universal felony maximum for § 609.891. The grave-risk and qualifying-repeat theories expressly carry ten years and/or $20,000. The terminal capture-device paragraph calls the offense a felony but supplies no punishment. Section 609.03 therefore provides the default five-year and/or $10,000 felony maximum. That distinction should appear in the complaint, plea petition, jury instructions, verdict, and sentencing materials.
Minimum fines and custody are separate questions
Section 609.891 states no universal mandatory minimum jail or prison term. Under current § 609.101, the 30-percent minimum-fine starting figure is $300 for the base misdemeanor, $900 for each gross-misdemeanor theory, $6,000 for the grave-risk and qualifying-repeat felonies, and $3,000 for the terminal capture-device felony. The misdemeanor and gross-misdemeanor figures remain subject to the uniform Judicial Council fine schedule. Qualifying public-defender status, indigence, or undue hardship permits reduction to at least $50; community work service may substitute for a fine; and installments may be authorized. These fine rules do not determine the custody disposition and are separate from restitution and the statutory surcharge.
| Conviction basis | Statutory maximum | Current Guidelines treatment |
|---|---|---|
| Misdemeanor, subd. 4 | 90 days and/or $1,000 | Not sentenced on the felony grid. |
| Gross misdemeanor, subd. 3 | 364 days and/or $3,000 | Not sentenced on the felony grid. |
| Grave-risk felony, subd. 2(a) | 10 years and/or $20,000 | Listed as unranked; court assigns and explains a severity level under Guidelines § 2.A.4. |
| Repeat-GM felony, subd. 2(b) | 10 years and/or $20,000 | Listed as unranked; court assigns and explains a severity level. |
| Terminal-device felony, subd. 2(c) | 5 years and/or $10,000 through § 609.03 | Severity level 2 in the current Offense Severity Reference Table. |
Unranked does not mean unpunished or automatically presumptive probation
For an unranked felony, current Guidelines § 2.A.4 directs the sentencing court to assign an appropriate severity level and state why. The court may consider the gravity of the conduct, ranked offenses with similar elements, sentencing of other people for the same unranked offense, and analogous conduct. The eventual presumptive disposition and duration then depend on that level, criminal-history score, and applicable Guidelines version. A lawyer should not quote a grid sentence before resolving those inputs.
Restitution is separate from classification
Sections 611A.04 and 611A.045 govern restitution requests and the court’s decision. A claimant may identify investigation, repair, replacement, response, lost use, or other claimed losses, but the defense can examine direct causation, documentation, reasonableness, duplication, insurance or recovery, and the defendant’s resources as the governing law permits. A restitution request does not retroactively prove penetration, authorization, a protected-data theory, or the level of risk.
Collateral effects depend on the conviction and the person’s circumstances
A felony or gross-misdemeanor record can affect employment, professional licensing, security clearances, housing, immigration, education, and access to sensitive systems. Those consequences are not uniform and should not be promised from a generic page. Immigration advice requires qualified immigration counsel and the actual statute, record, and status. Record relief likewise requires a current § 609A analysis; this page does not promise eligibility, timing, sealing scope, or a result.
The strongest analysis tests each statutory and technical link
There is no universal “computer crime defense.” The useful questions depend on the paragraph, technology, permission record, alleged actor, and aggravating fact.
Target identity: was there a covered security system or terminal?
Require the state to identify the software program or device claimed to protect confidentiality and secrecy, or the terminal claimed to initiate electronic fund transfers. System diagrams, vendor documentation, configuration, purpose, witness knowledge, and the offense-date definition matter. A database, public webpage, ordinary workstation, door, kiosk, or payment-adjacent device should not be relabeled without factual support.
Authorization: what permission existed and how was it limited?
Build a permission timeline from ownership, agreements, assignments, actual practice, tickets, messages, policy versions, notices, and revocation. Determine whether the accused person had express permission, delegated authority, emergency authority, testing authority, or owner-approved time and purpose. Then compare that record to the exact alleged act. The inquiry is more precise than asking whether credentials worked or whether an employer later disapproved.
Attribution: what connects the event to the person?
Test shared credentials, device sharing, physical access, remote access, VPN exit points, carrier-grade network translation, dynamic addresses, token theft, phishing, malware, automation, service accounts, administrator impersonation, and forensic contamination. Correlate independent sources. A username plus an IP address can be an investigative lead; without the surrounding identity and device record, it may not prove who intentionally acted.
Penetration and attempt: what boundary was crossed or approached?
Identify the protective boundary and compare the alleged event to normal system operation. Was there a successful authentication, a rejected request, a scan, a cached page, an API error, a privilege change, or physical opening? What evidence shows intent rather than automated traffic, misconfiguration, accidental selection, or authorized testing? For an attempt, what act allegedly moved beyond preparation toward prohibited penetration?
Classification: did the aggravating fact actually occur?
Challenge classification independently of the base conduct. For personal data, identify the exact record reached. For trade secrets, examine economic value, secrecy, other sources, and reasonable secrecy measures. For government data, identify the legal classification. For risk theories, demand evidence of the mechanism and degree of risk. For repeat theories, verify the prior adjudication and sequencing. For terminal theories, prove each physical and device-function component.
Suppression and constitutional issues are case-specific
Device searches, cloud warrants, workplace consent, third-party records, private searches, scope, particularity, compelled access, interrogation, and seizure duration can create Fourth or Fifth Amendment questions. The answer depends on the warrant, affidavits, accounts, devices, custody, employer or provider involvement, and what officers actually did. Preserve those records and litigate the concrete issue rather than relying on a categorical internet statement.
A plea or trial decision should use the exact theory and evidence record
Before evaluating an offer, compare the charged paragraph with provable alternatives, maximums, Guidelines treatment, criminal history, restitution exposure, collateral objectives, suppression issues, expert needs, and trial proof. A reduction from an unranked ten-year felony to a severity-level-2 terminal felony can change sentencing analysis; a reduction to a gross misdemeanor or misdemeanor changes it again. Labels alone do not measure the practical outcome.
A trial assessment should identify which fact disputes require lay witnesses, system custodians, forensic experts, terminal technicians, data-classification witnesses, or trade-secret proof. It should also identify admissible exhibits, demonstratives, summary evidence, and instructions that keep separate the base offense and aggravating theory. A technically complex narrative becomes manageable when each evidentiary proposition is assigned to a statutory element.
Preserve first; do not investigate by accessing systems without permission
Keep the complaint, warrant materials, notices, agreements, policies, access approvals, tickets, emails, texts, device receipts, account alerts, termination records, photographs, and the names of people who can explain permissions or shared access. Preserve original devices without wiping, resetting, updating, rooting, or installing cleanup tools. Do not log back into an account, terminal, employer system, or cloud service without clear authorization merely to collect evidence.
Defense counsel can pursue preservation letters, native exports, audit settings, vendor records, surveillance, maintenance and seal logs, cloud-provider material, authentication history, and forensic imaging. Some records roll over quickly. Early work should identify the shortest retention windows and avoid changes that alter metadata or create new events mistaken for old ones.
Minnesota unauthorized computer access questions
Is every unauthorized login a violation of § 609.891?
No automatic rule makes it so. The state must prove intentional unauthorized attempted or completed penetration of a statutorily covered computer security system or electronic terminal. The target, protective purpose, authorization, intent, and event all require evidence.
Can a person be charged when the penetration failed?
Yes. Subdivision 1 expressly includes a person who “attempts to” penetrate. The state still must prove the intentional act, lack of authorization, covered target, and attempt law; preparation or an unexplained failed request is not self-proving.
Does using a coworker’s password prove the crime?
Not by itself. It may be important evidence, but the case still requires proof of the person who used it, the scope of owner permission, the covered security system, penetration or attempt, intent, and any claimed aggravating theory.
What makes the offense a gross misdemeanor?
Current law lists five theories: public-health-and-safety risk; compromise of qualifying trade-secret or government not-public data; access to personal data; a qualifying repeat misdemeanor within five years; or unauthorized opening/attempted opening of an electronic-terminal panel or access door.
What makes unauthorized access a felony?
A grave risk of causing death, a qualifying second or subsequent gross-misdemeanor violation, or the compound terminal capture-device theory can support a felony. The first two have a ten-year/$20,000 maximum; the terminal-device theory uses § 609.03’s five-year/$10,000 default.
Does confidential company information automatically count as protected data?
No. The specific gross-misdemeanor clause refers to trade-secret data protected under § 609.52 or government “not public data” under § 13.02. Each has legal requirements beyond an internal confidential label.
What is personal data under this statute?
Section 609.87 describes computer property or programs containing employment, salary, credit, other financial, or personal information about another person. The state should prove that the charged violation actually gained access to the identified data.
Do the gas-pump and ATM theories apply to old conduct?
Not before their effective date. The 2018 terminal amendments apply to crimes committed on or after August 1, 2018. Earlier conduct requires the earlier statute and definitions.
Can many log entries become many separate counts?
The answer depends on charging language, acts, victims or systems, unit-of-prosecution law, and the evidence. Section 609.891 does not authorize an automatic one-log-entry/one-count formula. Multiplicity and multiple punishment require case-specific review.
What should I do after learning about an investigation?
Preserve devices and records, stop unauthorized access, avoid deleting or altering data, do not interview witnesses or explain technical events impulsively, and obtain counsel. Counsel can address preservation, warrants, discovery, forensic review, and the next court deadline.
Related Minnesota defense guides
A lawyer’s file review of Unauthorized Computer Access in Minnesota
I do not assume the complaint’s narrative and its statutory citation line up. The practical work is to test that fit, identify what the State can actually prove, and separate a serious allegation from a legally sufficient case.
Read the count as a set of propositions the State must prove
For Unauthorized Computer Access in Minnesota, the governing text begins with Minn. Stat. §§ 609.891, 609.87, and 609.03. That citation matters because a familiar charge name can contain several statutory routes, definitions, and sentencing rules. I read the exact count, the alleged date, and every incorporated definition before deciding which facts are material and which allegations are simply part of the narrative.
Next, I connect each material fact to evidence the prosecution can actually present. The source might be a witness, a recording, a certified record, laboratory work, device data, or an admissible inference—but it should be identifiable and testable. That approach shows whether the real dispute concerns what happened, how evidence was obtained, whether it is admissible, or whether it proves the required element at all.
The evidence I would ask for first
For Unauthorized Computer Access in Minnesota, I would not begin with a canned list of defenses. I would begin with the source file: the charging paper, every police report, uncut recordings, witness interviews, warrants and returns, device and account records, photographs with metadata, expert or laboratory material, certified prior records, court orders, and any document the prosecution relies on to prove an element or increase the classification. A police summary can identify what an officer or witness says happened, but it cannot substitute for the recording, photograph, data, or document being summarized. The same is true of a complaint. It identifies the prosecution’s theory at the start of the case; it does not prove the theory.
I put those materials on one chronology. That lets me see what was known at each decision point, which account was contemporaneous, what appeared only after people spoke with one another, and where the record is silent. It also keeps an admissibility question separate from a factual one. A fact can be disputed even if the evidence was lawfully obtained. Evidence can also be accurate yet inadmissible for a particular purpose. Those are different arguments and should not be blurred together.
Read the charging document against the offense date
The alleged date matters because statutes, penalty thresholds, definitions, sentencing rules, and published decisions change. I save the version in force on that date and read the session-law history when the current online text is different. I also check whether a later amendment was merely clarifying or made a substantive change; that is a legal question, not an assumption. The same discipline applies to prior convictions and administrative events. A prior must fit the definition the charged statute actually uses, fall within any stated lookback period, and be proved by a reliable record.
I then compare the formal count with the probable-cause narrative and the discovery. If the prosecution’s theory shifts, I want the amended pleading and enough detail to prepare. If several factual alternatives are alleged, I identify whether they are separate elements, alternative means, enhancement facts, or merely evidentiary details. That distinction affects notice, motions, jury instructions, unanimity arguments, and how a verdict form should be read.
Separate an evidentiary weakness from a suppression issue
Not every troubling fact produces a motion to suppress. Suppression ordinarily requires a constitutional, statutory, or rule-based violation with a remedy that reaches the evidence at issue. A weak identification, an incomplete investigation, or a witness inconsistency may be powerful at trial without making evidence inadmissible. By contrast, a stop, search, interrogation, identification procedure, warrant, or test can raise a legal issue even when the resulting evidence appears incriminating. I analyze both tracks and do not promise dismissal simply because one problem exists.
For a search issue, I reconstruct what officers knew before each intrusion and what authority they claimed. For a statement, I examine custody, questioning, warnings, voluntariness, recording, and the complete context. For scientific or technical evidence, I request the method, underlying data, quality-control material, uncertainty information, and chain of custody. For hearsay or confrontation questions, I identify the actual statement, its purpose, the declarant, and the proposed foundation. Specificity matters; “the evidence is bad” is not a motion.
Prepare negotiation and trial at the same time
A plea decision should be compared with the case the State could present at trial, not with the complaint’s maximum penalty in isolation. I want to know the strongest admissible proof, the weakest required element, the realistic motion practice, the likely instructions, and the consequences of every proposed disposition. That includes custody, probation, treatment, restitution, driving, firearm restrictions, registration, employment or licensing, immigration consultation, family-court effects, and record consequences when they are actually triggered. I avoid telling a client that every collateral consequence applies to every conviction.
Trial preparation gives negotiation its credibility. Witness interviews, exhibit review, motions in limine, expert consultation, demonstrative evidence, jury instructions, and a clean theory of the case force both sides to confront what can be proved. Negotiation can continue while that work is underway. The two tracks are not opposites.
A case-law point worth keeping in its proper place
Appellate decisions matter, but a quotation should not be detached from the issue the court was deciding. In State v. Fleck, 777 N.W.2d 233, 236 (Minn. 2010), the Minnesota Supreme Court described sufficiency review as viewing the evidence “in the light most favorable to the conviction.” That is an appellate-review rule, not a reduction of the State’s trial burden. At trial, the prosecution still must prove every element beyond a reasonable doubt. I cite the case for the proposition it actually decided and then return to the charged statute, the jury instructions, and the admissible evidence in the present file.
What I would want you to understand before choosing an outcome
You should be able to identify the exact charge, the facts that set its level, the disputed elements, the evidence that matters most, the motions that have a legal basis, the realistic trial issues, and the concrete effect of each proposed resolution. If an answer depends on a missing report, recording, expert opinion, or certified record, I will say so. An honest answer about what remains unknown is more useful than a confident guess.