Minnesota computer-access facilitation guide
Facilitating Access to a Computer Security System under Minnesota Statutes § 609.8913
Minnesota’s facilitating-access statute does not punish every shared password, careless credential practice, or disclosure followed by someone else’s misconduct. Section 609.8913 requires a connected sequence. The accused person must facilitate access to a statutorily defined computer security system; know or have reason to know that the facilitation aids another person; the other person must intend to commit a crime; and that person must in fact commit a crime. The statute’s inclusive definition adds that facilitating access includes intentional disclosure of specified confidential system information when it provides the means or opportunity to commit a crime. Each link requires its own proof.
I test every link between the disclosure, the recipient, and the completed crime.
If you hire me, I identify the exact communication the state calls facilitation, the information disclosed, the computer security system it concerned, the recipient, the scope of permission, the evidence of what you knew or had reason to know, and the crime the state claims the recipient intended and completed. I obtain native messages, headers, access logs, vault and account history, devices, time records, policies, and the underlying case evidence. A forwarded credential or suspicious login is not a substitute for the full statutory sequence.
Section 609.8913 combines conduct, awareness, another person’s intent, and a completed offense
The statute is one sentence, but it is not one undifferentiated idea. Breaking the language into proof questions prevents a case from being decided by the emotional force of words such as password, confidential, or cybercrime.
Facilitation
The accused person must facilitate access, including—but not limited to—an intentional disclosure described by the statute.
Covered target
The access must concern a “computer security system” as § 609.87 defines that term.
Aiding another
The facilitation must aid another person, not simply expose information without a recipient or usable opportunity.
Know or reason to know
The accused person must know or have reason to know that the facilitation is aiding the other person.
Criminal intent
The other person—not merely the accused person—must intend to commit a crime.
Crime in fact
The other person must actually commit a crime; the text does not stop at intent or preparation.
The prosecution should identify the crime
Because the statute requires another person who “intends to commit a crime and in fact commits a crime,” the charging theory should identify that offense and the conduct constituting it. The statute says “a crime,” not specifically unauthorized computer access. The completed offense could be a computer crime, theft, fraud, privacy offense, or another crime depending on the facts, but the state must prove an actual crime rather than a policy violation, civil wrong, or generalized bad purpose.
The intended and completed crime language also raises chronology and identity questions. When did the recipient form the intent? What facilitation came before or during the crime? Who committed it? What evidence establishes every element? Was the activity actually authorized, unsuccessful, abandoned, or committed by someone else? The answers should come from the underlying offense record rather than an investigator’s summary.
The statute is not identical to general accomplice liability
Section 609.05 can impose liability when a person intentionally aids, advises, hires, counsels, conspires with, or otherwise procures another to commit a crime. Section 609.8913 uses its own conduct definition and “knows or has reason to know” language, is classified as a gross misdemeanor, and expressly requires the other person to intend and in fact commit a crime. Related evidence may overlap, but the elements and penalty structures should not be merged. A complaint charging both requires count-by-count analysis.
The statute gives examples, then requires a means or opportunity for crime
The second sentence says facilitating access “includes” intentional disclosure of a computer password, identifying code, personal information number, or other confidential information about a computer security system that provides a person with the means or opportunity for commission of a crime. “Includes” signals that the examples are not necessarily exhaustive, but it does not erase the requirements attached to them.
The disclosure example is expressly intentional
Accidental posting, an automatic password-manager fill, misaddressed routine message, system-generated invitation, credential leak, malware exfiltration, or compromised account may expose information without an intentional disclosure by the accused person. The state should prove who sent or revealed the information and the person’s state of mind. The message’s content, surrounding conversation, device history, account security, recipients, edits, deletions, and later conduct may all matter.
Confidential information must be about the security system
A password and identifying code are listed examples. The residual phrase reaches “other confidential information about a computer security system.” A server address, username, recovery answer, token, API key, certificate, network diagram, vulnerability detail, physical location, or bypass method might be alleged, but the state should show both confidentiality and the required relationship to the security system. Public documentation, ordinary contact information, or a fact already independently known may present different issues.
The disclosed information must provide means or opportunity
The statutory definition links the disclosure to means or opportunity for crime. A communication irrelevant to the completed offense should not be treated as facilitation merely because it concerned technology. The analysis should ask what the recipient could do with the specific information, whether it was valid at the time, whether another factor was required, what system it reached, and how it related to the actual offense.
A security system is not simply any computer account
Section 609.87 defines a computer security system as a software program or computer device intended to protect the confidentiality and secrecy of data and information stored in or accessible through a computer system. The protective program or device and its purpose should be identified through architecture, configuration, vendor material, and knowledgeable witnesses. A service, database, application, or computer may contain sensitive information without itself being the charged security system.
Authorized credential sharing can look similar in a partial record
Organizations routinely delegate access through help desks, shared service accounts, break-glass credentials, vendor support, family account management, credential vaults, onboarding, incident response, and temporary coverage. Those practices may be poor security or contrary to policy, but the criminal question requires the full statutory sequence. Permission records, role assignments, tickets, approvals, past practice, and the complete conversation can distinguish authorized operational sharing from criminal facilitation.
The recipient must in fact commit a crime
The enacted sequence describes the accused person as “aiding another who intends to commit a crime and in fact commits a crime.” This language is a meaningful limit. If the recipient merely talked, prepared, attempted an act that is not itself a completed crime, accessed with authorization, or committed only a civil or policy violation, the state must explain how the statutory condition is nevertheless met. A conviction of the recipient may be evidence, but § 609.8913 does not say that a separate conviction is the only way to prove the crime. The prosecution may seek to prove the underlying offense within the facilitator’s case, which makes discovery and instructions especially important.
| Question | Proof to identify | Common gap |
|---|---|---|
| Who was aided? | Recipient identity, communications, account and device attribution. | A screen name or account is assumed to identify a person. |
| What did the recipient intend? | Statements, instructions, planning, timing, and conduct supporting the specified criminal purpose. | The recipient’s intent is inferred only from a later event. |
| What crime occurred? | Statute, offense-date version, and evidence satisfying every element. | A policy violation or suspicious event is called a crime without element proof. |
| How did facilitation aid it? | The disclosed information, validity, use, access event, and connection to the completed offense. | Temporal proximity substitutes for a technical or evidentiary link. |
The underlying offense should be pleaded and proved with precision
Identify its statute, offense-date version, elements, classification, victim or protected interest, and act. If the alleged crime is unauthorized computer access, determine the security system, authorization, penetration, and aggravating theory. If theft, identify property, intent, value, and ownership. If fraud, identify the representation or scheme, reliance or other required result, and loss. The facilitating count cannot be stronger than unsupported assumptions about the underlying crime.
Causation language should not be overstated
The statutory definition requires information providing means or opportunity, while the first sentence speaks of aiding another. The text does not expressly require that the facilitation be the sole cause of the completed crime. Nor does it permit the relationship to be ignored. The evidence should show how the disclosure or other facilitation aided access and how that access related to the crime. Independent access, preexisting credentials, public information, or an unrelated method may undermine the state’s claimed connection.
Attempt and conspiracy are separate statutes
Sections 609.17 and 609.175 define attempt and conspiracy under their own terms. Whether an attempted or conspired offense counts as the “crime” actually committed depends on the precise charging theory and proof; it should not be assumed away. If the recipient is charged only with preparation or conduct short of a criminal attempt, that distinction matters. The same conduct may also generate accomplice-liability allegations under § 609.05, but each count must retain its own elements.
The offense began August 1, 2006
Section 609.8913 was enacted in 2006 Minnesota Laws chapter 260, article 1, section 37. The session law states that it is effective August 1, 2006 and applies to crimes committed on or after that date. There is no § 609.8913 offense for earlier conduct under this later-created section.
| Date | Applicable point | Why it matters |
|---|---|---|
| Before August 1, 2006 | Section 609.8913 was not yet effective. | The later-created offense cannot be applied retroactively. |
| On or after August 1, 2006 | The current core language applies; confirm the version in effect on the alleged date. | The enactment also broadened the incorporated security-system definition. |
| Current sentencing | Gross-misdemeanor maximum is 364 days and/or $3,000. | 2023 reform changed the former one-year formulation and included express retroactive sentencing treatment. |
The incorporated security-system definition changed the same day
Before the 2006 amendment, § 609.87’s definition also required a conspicuous secure-system warning or a knowing response through an authorized code. Chapter 260 removed that second component, leaving the protective-purpose definition. Because § 609.8913 itself began on August 1, 2006, its first effective cases used the broadened definition. The history should not be confused with the separate 2018 electronic-terminal amendments to § 609.891.
The 364-day maximum is a sentencing change, not a new offense element
Current §§ 609.03 and 609.0342 provide the 364-day/$3,000 gross-misdemeanor ceiling. The 2023 law contains its own effective and retroactive sentencing language. That amendment did not change § 609.8913’s facilitation, awareness, intent, or completed-crime requirements. A historical case needs both the offense-date elements and the current law governing any lawful sentencing or correction question.
Native messages and access records must be connected, authenticated, and timed
A typical case may combine text messages, email, collaboration platforms, credential-manager logs, identity-provider events, application logs, endpoint artifacts, cloud records, and evidence from the recipient’s device. Each source answers a different question. A message can show a disclosure; it may not show that the credential worked. A login can show account use; it may not identify who used it. A completed offense can show harm; it may not show what the accused person knew before facilitating access.
Preserve the complete communication
A cropped screenshot can omit participants, timestamps, replies, edits, reactions, attachments, quoted messages, delivery status, and metadata. Seek native exports, account identifiers, headers, database records, device extraction, and the collection process. Determine whether disappearing messages, synchronized devices, backups, account takeovers, or shared accounts affected the record. Authentication requires more than assuming that a displayed name identifies the author.
Map the credential lifecycle
Identify when a password, code, PIN, token, recovery secret, or access detail was created, who received it, where it was stored, when it changed, and when it was valid. Check password resets, MFA challenges, token issuance and revocation, vault checkouts, service accounts, temporary credentials, administrator impersonation, support sessions, and automatic sharing. An obsolete or invalid credential may not provide means or opportunity; a working credential does not by itself prove a criminal disclosure.
Separate account attribution from person attribution
Correlate IP data, device identifiers, physical location, session tokens, browser artifacts, endpoint telemetry, phone records, surveillance, and communications. Consider shared devices, VPNs, remote desktops, carrier-grade address sharing, malware, credential stuffing, phishing, and deliberate spoofing. The recipient’s account activity must be connected both to the recipient and to the facilitated information rather than inferred from temporal proximity alone.
Normalize clocks and preserve collection context
Systems may record UTC, local time, server time, device time, or Unix epochs; clocks may drift and daylight-saving conversions may differ. Record each source’s time basis and export settings. Preserve raw data, schemas, filters, search queries, retention settings, analyst notes, and cryptographic hashes. A vendor report or security alert should be traced to its underlying data and rule version.
Apply the evidence and discovery rules to the actual exhibit
Minnesota Rules of Evidence 401 and 403 address relevance and unfair prejudice or confusion. Rule 901 addresses authentication. Rule 1002 addresses proof of content, and Rule 1006 governs summaries of voluminous records. Criminal Procedure Rule 9 governs disclosure. These rules do not guarantee admission or exclusion; they frame case-specific disputes over complete communications, machine records, summaries, expert opinions, and access to underlying data.
The offense is a gross misdemeanor regardless of the underlying crime’s level
Section 609.8913 classifies facilitating access as a gross misdemeanor. Current law supplies a maximum of 364 days and/or a $3,000 fine, and the section states no universal mandatory minimum jail term. Section 609.101 separately supplies a $900 minimum-fine starting figure, subject to a lower uniform Judicial Council fine schedule. Qualifying public-defender status, indigence, or undue hardship permits reduction to at least $50; community work service may substitute for a fine; and installments may be authorized. The statute does not elevate this facilitating count to a felony merely because the other person’s completed crime was a felony. The underlying offense may generate separate charges or accomplice allegations, but those require their own legal basis.
| Issue | Current framework | Necessary caution |
|---|---|---|
| Jail | Up to 364 days | A maximum is not a prediction; stayed time, executed time, probation, and alternatives depend on the case. |
| Fine | Up to $3,000 | Court-imposed financial obligations depend on the judgment and governing law. |
| Restitution | Possible under §§ 611A.04 and 611A.045 | Direct causation, documentation, reasonableness, duplication, and ability-to-pay issues require separate analysis. |
| Other counts | Possible based on the underlying crime and conduct | Multiple punishment, merger, and behavioral-incident questions are not automatic. |
| Collateral effects | Employment, licensing, security access, immigration, housing, or record consequences may arise | They vary by conviction, occupation, status, agency, and current law. |
Restitution does not prove the offense
A claimed loss may include investigation, response, repair, replacement, interruption, or other items. The defense can examine whether each loss was directly caused by the offense of conviction, supported, reasonable, already recovered, or duplicated. Costs attributable to the recipient’s separate crime, organizational upgrades, or unrelated remediation should not be silently shifted without applying the restitution statutes.
Multiple punishment requires a fact-specific § 609.035 analysis
When the state charges facilitation, accomplice liability, and one or more computer or property offenses, Minnesota’s single-behavioral-incident law may affect sentencing. The result depends on time, place, criminal objective, statutory exceptions, and the offenses of conviction. The page does not promise merger or separate punishment. Counsel should preserve objections and compare the charging, plea, verdict, and sentencing record.
Collateral consequences cannot be responsibly reduced to a checklist
A gross-misdemeanor computer-related conviction can matter to positions involving trust, data, finance, government systems, regulated credentials, or security clearances. Immigration consequences require advice from qualified immigration counsel using the actual conviction record and status. Expungement and record-sealing questions require a current Chapter 609A analysis. No page can promise eligibility or a result.
A strong review separates disclosure, usefulness, awareness, intent, and completion
Was there an intentional disclosure or other facilitation?
Identify the precise act and author. Test account compromise, accidental transmission, automatic sharing, authorized support, credential-vault behavior, system invitations, and incomplete screenshots. If the state relies on conduct outside the listed disclosure examples, require a clear explanation of how it facilitated access.
Did the information concern a computer security system?
Demand proof of the protective program or device and its intended confidentiality function. Determine whether the information was confidential at the time, publicly available, stale, independently known, or unrelated to that system. The label “password” does not answer whether it provided meaningful access to the charged security system.
Did it actually provide means or opportunity?
Test validity, scope, MFA, network restrictions, role permissions, expiration, resets, and the recipient’s independent access. Determine whether the recipient used the disclosed information or another theory. A temporal sequence can support an inference, but the technical record may prove or disprove the connection.
What did the accused person know or have reason to know?
Reconstruct the facts available before the crime: the request, stated purpose, relationship, prior experience, warnings, policies, communications, payment, concealment, and legitimate context. Do not let the recipient’s later conduct rewrite what was knowable earlier. Challenge an instruction that equates ordinary carelessness with the statutory mental state without supporting law.
What crime did the other person intend and commit?
Analyze the underlying statute element by element. If the recipient had authorization, abandoned conduct before a criminal attempt, committed a different act, or cannot be identified, the completed-crime link may fail. If the state changes its underlying-offense theory, address notice, discovery, instructions, and the unanimity or verdict-form issues raised by the actual case.
Are the records authentic, complete, and lawfully obtained?
Review warrants, subpoenas, consent, private searches, cloud process, device seizure, interrogation, account attribution, collection tools, exports, and chain of custody. Seek native evidence and underlying data. Suppression, exclusion, completeness, and expert issues depend on facts and governing law; they should not be promised categorically.
Evaluate the facilitating count together with the underlying case—but keep their elements separate
A plea offer may resolve both the facilitator’s gross misdemeanor and allegations tied to the recipient’s crime. Compare the provable § 609.8913 sequence, exposure on every count, criminal history, restitution, collateral priorities, evidentiary motions, witness risk, and the language of the proposed factual basis. Do not admit that another person committed a crime without identifying the offense and facts.
For trial, organize the case into a demonstrable chronology: system, confidential information, disclosure, recipient, access event, accused person’s awareness, recipient’s intent, and completed offense. Identify which witness or authenticated record proves each link. That structure helps prevent the state from substituting a cybersecurity-policy narrative for the enacted elements.
Keep the original messages and devices; do not delete or test credentials
Preserve the complaint, warrants, messages, email, attachments, policies, permission records, tickets, credential-vault history, alerts, account notices, calendars, invoices, and the names of people who understood the access arrangement. Do not delete communications, reset devices, wipe accounts, install cleanup software, contact the recipient to coordinate stories, or try the credential. Those actions can destroy metadata, create new access events, or generate separate concerns.
Counsel can identify short-retention sources, send appropriate preservation requests, pursue native exports, obtain underlying-offense discovery, and arrange defensible forensic collection. A prompt response is especially important when collaboration platforms, identity systems, cameras, or vendor logs retain data only briefly.
Minnesota facilitating-access questions
Is sharing a password automatically a crime?
No. The statute requires the full sequence: facilitation of access to a computer security system, knowledge or reason to know of aiding another, that person’s criminal intent, and a crime actually committed. The definition’s disclosure example is intentional and must provide means or opportunity for crime.
What is the maximum penalty?
The offense is a gross misdemeanor. Current §§ 609.03 and 609.0342 provide a maximum of 364 days and/or $3,000. That ceiling is not a prediction of the actual disposition.
Does the recipient have to be convicted first?
The text requires that the other person in fact commit a crime, but it does not expressly require a prior separate conviction. The state may attempt to prove the underlying crime in the facilitator’s case, making the elements, discovery, instructions, and verdict structure important.
Must the completed crime be computer hacking?
The statute says “a crime” and does not limit the phrase to § 609.891. The prosecution should identify the particular offense and prove its elements and connection to the facilitated access.
Can accidental disclosure satisfy the listed example?
The definition says intentional disclosure. An accidental message, compromised account, automatic sharing rule, or malware event raises different proof questions. Other alleged forms of facilitation still require the statute’s complete sequence.
What does “has reason to know” mean?
The phrase permits more than proof of an admission, but this statute does not separately define it and no comprehensive published construction was located in the official exact-citation search. The factfinder must apply controlling instructions to concrete facts available at the time, not hindsight alone.
What if the credential was invalid?
Validity matters to whether the information provided means or opportunity and whether it aided access. Expiration, reset, MFA, role restrictions, or the recipient’s independent access can weaken the claimed connection, though the complete facts still control.
Can I also face accomplice charges?
Potentially, if § 609.05 and the underlying offense are supported. Facilitation and accomplice liability are not identical, and multiple-count or multiple-punishment questions require separate legal analysis.
When did this crime become effective?
August 1, 2006, for crimes committed on or after that date. The same act broadened the incorporated computer-security-system definition.
What should I preserve?
Keep complete native communications, devices, account and vault records, policies, permissions, tickets, alerts, and underlying-case documents. Do not delete, alter, or test credentials. Counsel can arrange targeted preservation and forensic collection.
Continue with the direct-access and computer-offense pages
A lawyer’s file review of Facilitating Access to Computer Security System in Minnesota
Most bad early advice comes from answering the charge label instead of reading the charging clause. I begin with the operative count and work outward: definitions, exceptions, enhancement facts, evidence, procedure, and only then possible outcomes.
Read the count as a set of propositions the State must prove
To understand Facilitating Access to Computer Security System in Minnesota, I start with Minn. Stat. §§ 609.8913, 609.87, 609.03, and 609.0342 and the version of the law in effect on the alleged date. The offense classification sets the outer framework, but it does not tell us what happened or what the state can prove. I then identify every fact that could change the charge or sentence and look for the record, testimony, or forensic evidence that supports—or contradicts—each one.
From there, I build a proof map. For every required element, I identify the witness, recording, document, test result, or admissible inference the prosecution would rely on, then compare that source with the rest of the file. This separates a disputed fact from a search, statement, or admissibility issue and keeps the analysis focused on problems that can actually affect the case.
The evidence I would ask for first
For Facilitating Access to Computer Security System in Minnesota, I would not begin with a canned list of defenses. I would begin with the source file: the charging paper, every police report, uncut recordings, witness interviews, warrants and returns, device and account records, photographs with metadata, expert or laboratory material, certified prior records, court orders, and any document the prosecution relies on to prove an element or increase the classification. A police summary can identify what an officer or witness says happened, but it cannot substitute for the recording, photograph, data, or document being summarized. The same is true of a complaint. It identifies the prosecution’s theory at the start of the case; it does not prove the theory.
I put those materials on one chronology. That lets me see what was known at each decision point, which account was contemporaneous, what appeared only after people spoke with one another, and where the record is silent. It also keeps an admissibility question separate from a factual one. A fact can be disputed even if the evidence was lawfully obtained. Evidence can also be accurate yet inadmissible for a particular purpose. Those are different arguments and should not be blurred together.
Read the charging document against the offense date
The alleged date matters because statutes, penalty thresholds, definitions, sentencing rules, and published decisions change. I save the version in force on that date and read the session-law history when the current online text is different. I also check whether a later amendment was merely clarifying or made a substantive change; that is a legal question, not an assumption. The same discipline applies to prior convictions and administrative events. A prior must fit the definition the charged statute actually uses, fall within any stated lookback period, and be proved by a reliable record.
I then compare the formal count with the probable-cause narrative and the discovery. If the prosecution’s theory shifts, I want the amended pleading and enough detail to prepare. If several factual alternatives are alleged, I identify whether they are separate elements, alternative means, enhancement facts, or merely evidentiary details. That distinction affects notice, motions, jury instructions, unanimity arguments, and how a verdict form should be read.
Separate an evidentiary weakness from a suppression issue
Not every troubling fact produces a motion to suppress. Suppression ordinarily requires a constitutional, statutory, or rule-based violation with a remedy that reaches the evidence at issue. A weak identification, an incomplete investigation, or a witness inconsistency may be powerful at trial without making evidence inadmissible. By contrast, a stop, search, interrogation, identification procedure, warrant, or test can raise a legal issue even when the resulting evidence appears incriminating. I analyze both tracks and do not promise dismissal simply because one problem exists.
For a search issue, I reconstruct what officers knew before each intrusion and what authority they claimed. For a statement, I examine custody, questioning, warnings, voluntariness, recording, and the complete context. For scientific or technical evidence, I request the method, underlying data, quality-control material, uncertainty information, and chain of custody. For hearsay or confrontation questions, I identify the actual statement, its purpose, the declarant, and the proposed foundation. Specificity matters; “the evidence is bad” is not a motion.
Prepare negotiation and trial at the same time
A plea decision should be compared with the case the State could present at trial, not with the complaint’s maximum penalty in isolation. I want to know the strongest admissible proof, the weakest required element, the realistic motion practice, the likely instructions, and the consequences of every proposed disposition. That includes custody, probation, treatment, restitution, driving, firearm restrictions, registration, employment or licensing, immigration consultation, family-court effects, and record consequences when they are actually triggered. I avoid telling a client that every collateral consequence applies to every conviction.
Trial preparation gives negotiation its credibility. Witness interviews, exhibit review, motions in limine, expert consultation, demonstrative evidence, jury instructions, and a clean theory of the case force both sides to confront what can be proved. Negotiation can continue while that work is underway. The two tracks are not opposites.
A case-law point worth keeping in its proper place
Appellate decisions matter, but a quotation should not be detached from the issue the court was deciding. In State v. Fleck, 777 N.W.2d 233, 236 (Minn. 2010), the Minnesota Supreme Court described sufficiency review as viewing the evidence “in the light most favorable to the conviction.” That is an appellate-review rule, not a reduction of the State’s trial burden. At trial, the prosecution still must prove every element beyond a reasonable doubt. I cite the case for the proposition it actually decided and then return to the charged statute, the jury instructions, and the admissible evidence in the present file.
What I would want you to understand before choosing an outcome
You should be able to identify the exact charge, the facts that set its level, the disputed elements, the evidence that matters most, the motions that have a legal basis, the realistic trial issues, and the concrete effect of each proposed resolution. If an answer depends on a missing report, recording, expert opinion, or certified record, I will say so. An honest answer about what remains unknown is more useful than a confident guess.