In-depth legal guide
North Dakota Critical-Infrastructure Tampering Defense
N.D.C.C. § 12.1-21-06 is not a general trespass, protest, vandalism, or workplace-mistake statute. For an individual charge under the current law, the State must connect a substantial interruption or impairment of a critical-infrastructure facility or public service to one of five enacted mechanisms. The prosecution must then prove the culpability level that controls the grade. The site, service effect, causal chain, accused act, authority to work, technical records, and alleged offense date all matter. A label such as “pipeline protest,” “utility interference,” or “infrastructure damage” does not replace that theory-specific proof.
You will work directly with me.
I will identify the precise theory and law in force on the alleged date, reconstruct what occurred at the site, obtain native operational and digital records, test whether the claimed effect was substantial and actually caused by the alleged conduct, separate intent from result, and examine employment scope, authorization, protected activity, conspiracy, and sentencing issues. Technical evidence often matters as much as witness characterization in these cases.
Five current theories share a required substantial interruption or impairment
Each theory requires the result in subsection 1, but the alleged act and the evidence needed to prove it differ.
- Property theory—1(a)
- Tampering with or damaging the tangible property of another, causing the required substantial facility or service effect.
- Operator theory—1(b)
- Incapacitating an operator of a critical-infrastructure facility or public service, with the required causal result.
- Equipment theory—1(c)
- Damaging, destroying, vandalizing, defacing, or tampering with equipment in a critical-infrastructure facility.
- Operations theory—1(d)
- Damaging, destroying, vandalizing, defacing, impeding, inhibiting, or tampering with facility operations.
- Construction theory—1(e)
- Interfering with, inhibiting, impeding, or preventing construction or repair of a critical-infrastructure facility.
- Common result
- The theory must cause a substantial interruption or impairment of a covered facility or public service; an objectionable act without that result is not enough for this section.
Official starting points
- N.D.C.C. § 12.1-21-06 — current offense, grades, worker provision, organization fine, assembly clause, and facility list.
- N.D.C.C. chapter 12.1-02 — culpability and causal relationship.
- Enrolled 2019 SB 2044 — amendment creating the current critical-infrastructure structure.
Translate the accusation into records that can be tested
The case may turn on original system data and site authority rather than a report’s high-level conclusion.
Facility identity
Permits, maps, ownership, function, regulatory status, and the precise component or construction site at issue.
Service baseline
Normal capacity, redundancy, maintenance, alarms, prior faults, scheduled work, and conditions immediately before the event.
Actual effect
Duration, geographic reach, customers or operations affected, lost capacity, degraded performance, restoration steps, and measurement method.
Causal chain
The accused act, concurrent failures, operator decisions, automatic safeguards, third-party actions, and whether the same effect would have occurred anyway.
Role and authority
Employment or contract scope, work orders, permits, supervision, access rights, instructions, deviations, and authorization changes.
Mental state
Complete communications, plans, warnings, training, technical knowledge, mistakes, response after discovery, and evidence for the grade alleged.
“Substantial interruption or impairment” cannot be assumed from the facility’s importance
A critical facility can experience an inconvenience, delay, isolated defect, cosmetic mark, attempted interference, or short-lived operational response without every event necessarily becoming a completed § 12.1-21-06 offense. The enacted result is a substantial interruption or impairment. The statute does not assign a numerical duration, dollar loss, customer count, capacity reduction, or geographic threshold. The prosecution therefore must prove substantiality from the actual effect and context, while the defense can test whether a report uses the importance of the facility as a substitute for the magnitude of the interruption or impairment.
Useful records may include supervisory-control and data-acquisition logs, alarm histories, network-monitoring data, dispatch tickets, operator journals, repair orders, service-level measurements, throughput reports, customer-impact records, train movement logs, construction schedules, inspection data, photographs, video, telemetry, access logs, vendor reports, and restoration timelines. A summary saying “service was interrupted” does not show how the conclusion was derived. Native data can reveal an alarm without lost service, an automatic failover, a pre-existing condition, scheduled maintenance, operator precaution, redundant capacity, delayed reporting, or a materially different duration.
Causation is a separate element
Section 12.1-02-05 governs causal relationship when causing a result is an element. The defense should build one timeline from alleged act through system response and claimed effect. A facility may have multiple simultaneous causes: equipment age, weather, software fault, contractor work, ordinary shutdown, a third party, operator error, or a safety protocol. The question is not merely whether the accused was present before an interruption. It is whether the charged theory and conduct satisfy North Dakota’s causal rules for the result proved.
Subsequent remedial work is not necessarily proof that the accused caused the original effect. A facility may replace a part out of caution, conduct an inspection, pause construction, reroute service, or increase security after any reported incident. Counsel should separate what was physically changed, what operators chose to do, what the system automatically did, and why. Expert testimony may be necessary when the conclusion depends on engineering, network architecture, utility operations, pipeline behavior, rail scheduling, or specialized construction sequencing.
A “critical infrastructure facility” has a detailed statutory scope
Subsection 6 uses an extensive “includes” list. It covers refineries; electric generation and transmission components; chemical, polymer, and rubber manufacturing; drinking-water and wastewater systems; natural-gas compression, transmission, distribution, and storage; liquefied-natural-gas facilities; wireline and wireless telecommunications and internet infrastructure; ports, rail yards, track, trucking terminals, and other freight facilities; gas processing; licensed broadcast transmission; specified steel-making facilities; certain federally regulated chemical facilities; regulated dams; petroleum storage and distribution; oil, gas, hazardous-liquid, and chemical pipelines, tanks, rail facilities, and storage; oil and gas production sites; and a site designated or approved for construction of a listed facility.
The analysis should identify the exact subdivision, component, boundary, and function. A business that uses electricity or internet is not automatically an electrical or telecommunications facility. A warehouse near a pipeline, office near a rail yard, ordinary construction project, vehicle near a utility site, or commercial property adjacent to a listed facility requires a more exact statutory fit. Permits, plats, regulatory filings, site diagrams, asset records, construction approvals, testimony from a qualified witness, and photographs can establish or contest the necessary nexus.
“Public service” remains an independent statutory phrase
The current offense also reaches a public service, but § 12.1-21-06 does not supply a standalone definition in subsection 6. The charging instrument should state whether the State relies on a listed critical-infrastructure facility, a public service, or both. Counsel should not assume those concepts are identical. The service offered, its users, provider, operational component, and claimed interruption need factual and legal development.
The five verbs and objects are not interchangeable
Subsection 1(a) concerns another’s tangible property. Subsection 1(b) concerns an operator. Subsection 1(c) concerns equipment in a facility. Subsection 1(d) concerns operations. Subsection 1(e) concerns construction or repair. A damaged fence may raise different questions from a disabled operator, changed valve, blocked repair crew, network intrusion, defaced equipment, delayed train, or interrupted construction site. The complaint, probable-cause statement, discovery, and jury instructions should identify the actual theory rather than combine words from several alternatives into an untestable accusation.
Intentional, knowing, reckless, and residual grades require disciplined analysis
The highest current grade applies if the actor engages in the conduct intentionally. Under North Dakota’s culpability definitions, intent ordinarily concerns a purpose to cause the result or engage in the conduct. A class A misdemeanor applies when the conduct is knowing or reckless. Knowledge and recklessness are different: awareness of the nature of conduct or attendant circumstances is not the same as conscious and clearly unjustifiable disregard of a substantial likelihood. The statute’s residual class B misdemeanor language should not be treated as permission to omit every enacted fact; the State must still prove the charged conduct, covered facility or service, substantial result, and causation beyond a reasonable doubt.
The grade cannot be selected simply because the result was serious. A long outage may support an inference when combined with planning, technical knowledge, warnings, deliberate acts, or admissions, but result alone does not automatically prove purpose, awareness, or conscious disregard. Conversely, a person’s statement that no harm was intended does not end the inquiry. Training, experience, system access, prior warnings, concealment, steps taken, tool selection, timing, communications, safety procedures, and conduct after discovery can support or undermine the alleged mental state.
Mistake must be tied to an element or culpability level
A mistaken map, mislabeled line, outdated work order, misunderstood shutdown status, configuration error, wrong equipment identity, inaccurate instruction, or belief about permission may matter if it negates the required culpability or another fact. It is not enough to call every error “accidental.” The defense should identify the specific belief, its source, when it arose, what the accused observed, and how it affects the charged grade and causal theory.
Attempt, accomplice, solicitation, and conspiracy theories require their own law
If the substantial result did not occur, the prosecution may consider an inchoate or accomplice theory rather than a completed subsection 1 offense. Those theories have separate requirements under North Dakota law. Subsection 4 also creates a particular organizational-conspiracy fine rule tied to § 12.1-06-04 and to an individual who pleaded guilty or was convicted under subsection 1. Counsel should not collapse an organization’s special fine into the ordinary maximum for an individual defendant.
The current section does not apply to an employee or contractor acting within the scope of the work
Subsection 3 defines an employee or contractor as a person hired or under contract to provide services to a critical-infrastructure facility or public service. The exclusion is not resolved by a job title alone. The inquiry includes who hired the person, the contract or employment relationship, the services to be provided, assigned location, work order, supervisor direction, shift, authorization, safety procedures, access privileges, customary practice, emergency authority, and whether the disputed act remained within scope.
Work records can cut both ways. A repair technician, operator, construction worker, utility locator, inspector, vendor, subcontractor, or consultant may have authority to shut down, isolate, test, alter, enter, or delay a component as part of assigned work. An employee can also act for a personal purpose or materially depart from instructions. The statute’s text should be applied to the actual relationship and conduct, not replaced by a blanket rule that every worker is exempt or every policy violation is outside the scope.
Authorization can also matter to theory-specific proof
For subsection 1(a), chapter 12.1-21 separately recognizes consent as a defense when property “of another” is an element. Authority may also affect whether conduct was tampering, damage, interference, or ordinary operations. Written permissions, maintenance plans, lockout records, change tickets, access logs, keys, credentials, radio traffic, and complete communications should be preserved. A later dispute over quality of work is not automatically criminal tampering, while a formally authorized entry does not necessarily authorize every act.
The statute expressly preserves lawful assembly and peaceful, orderly petition
Subsection 5 says the section may not be construed to prevent or prohibit lawful assembly and peaceful and orderly petition for redress of grievances, including a labor dispute. That clause matters in protest, picketing, demonstration, labor, advocacy, and public-comment settings. It does not create immunity for every act occurring during expressive activity, and the existence of a political message does not eliminate the State’s burden to prove the elements. The correct analysis separates speech, association, and petition from the specific conduct, location, theory, result, causation, and culpability alleged.
Obtain the full event record: permits, organizer instructions, theory maps, police announcements, dispersal orders, body-camera and drone footage, livestreams, press video, radio traffic, witness locations, train or utility logs, and complete recordings before and after a short clip. Identify who did what. Group presence, shared viewpoint, clothing, or proximity does not by itself establish that a particular person damaged equipment, incapacitated an operator, interfered with operations, or caused the required result.
Jessee and Hebert remain relevant but concern the pre-2019 statute
In State v. Jessee, 2018 ND 241, the North Dakota Supreme Court held that the earlier tangible-property tampering theory required a change, alteration, or harmful conduct toward the property. Presence on railroad tracks, without that kind of conduct, was insufficient even though rail service was delayed. State v. Hebert, 2018 ND 252, applied Jessee and reversed a similar conviction. These decisions are important against treating presence as tampering under current subsection 1(a), whose core tangible-property language remains. But the Legislature materially rewrote § 12.1-21-06 in 2019, adding current theories involving equipment, operations, and construction or repair. The cases did not construe those later alternatives. The alleged offense date and charged theory therefore control how far their reasoning reaches.
Build one defensible timeline from original records
Preserve native operational data
Request original logs, not only spreadsheets or screenshots prepared for litigation. Preserve time zones, system clocks, data dictionaries, device identifiers, export method, retention settings, hash values where available, and the witness who can explain collection. A control-room summary may combine automated alerts, operator notes, and later conclusions; each layer must be distinguished.
Test attribution
Access badges, account credentials, network addresses, device ownership, fingerprints, DNA, tool marks, location data, video, work schedules, vehicle records, communications, and witness observations may connect or disconnect a person from an act. Shared credentials, remote access, subcontractors, common tools, delayed logins, cloned devices, and incomplete camera coverage can complicate attribution.
Use Rule 16 and evidence rules deliberately
Criminal Rule 16 governs discovery. Evidence Rule 106 may require relevant completing context. Rules 401 and 403 address relevance and unfair-prejudice risks. Rule 404 limits propensity use of other acts. Rule 602 requires personal knowledge. Rules 701 and 702 separate lay observations from specialized engineering, utility, network, rail, construction, and forensic opinions. Rules 801 and 803 govern statements and record exceptions; 901 and 902 govern authentication; and Rule 1001 addresses electronically stored originals.
Audit loss calculations without substituting them for elements
Repair cost, lost production, delay damages, overtime, customer credits, or business loss may affect restitution or sentencing, but § 12.1-21-06 does not replace its substantial-interruption requirement with a dollar threshold. Separate direct damage from precautionary work, upgrades, unrelated deferred maintenance, lost-profit assumptions, and costs caused by later decisions.
Current individual ceilings and the separate organization fine
| Current theory or finding | Classification | Current maximum | Proof caution |
|---|---|---|---|
| Intentional conduct satisfying subsection 1 | Class C felony | Five years, $10,000 fine, or both | The required result, listed mechanism, causation, and intentional grade must each be proved. |
| Knowing or reckless conduct satisfying subsection 1 | Class A misdemeanor | 360 days, $3,000 fine, or both | Knowledge and recklessness are distinct culpability concepts. |
| Otherwise, after a completed violation is proved | Class B misdemeanor | 30 days, $1,500 fine, or both | Residual grading does not erase the facility, result, theory, and causation elements. |
| Qualifying organization conspiracy under subsection 4 | Special organization fine | Fine equivalent to the subsection 2 penalty for each qualifying individual, capped at $100,000 | Requires the specified conspiracy and individual plea or conviction conditions. |
These are ceilings, not forecasts. Section 12.1-32-02 authorizes sentencing alternatives and generally bars a court-created minimum incarceration term unless specifically authorized. Restitution must be tied to legally compensable loss caused by the offense. A felony conviction may create serious employment, licensing, immigration, firearm, travel, housing, contracting, and record consequences, but no collateral consequence should be described as automatic without checking its separate trigger and the final disposition.
Offense-date law is essential. Before the 2019 amendment, the statute referred to public communication, transportation, water, gas, power, or other public service and used three mechanisms. SB 2044 replaced that structure with the present critical-infrastructure definition, five theories, worker provision, organization fine, and assembly clause. A current-law summary cannot be retroactively substituted for alleged conduct before the amendment’s effective date.
A theory-specific defense avoids both underreading and overreading the statute
First, I identify the offense date and compare the charging instrument with the statute then in force. If the charge uses current subsection 1(c), 1(d), or 1(e) language for pre-amendment conduct, that is not a minor drafting issue. If the State charges 1(a), it should not substitute the broader operations verbs for proof of tampering with or damaging tangible property.
Second, I require the State’s facility and service theory to become concrete. The case should identify the component, statutory category, operational function, property interest where relevant, public service, and alleged result. A map and technical witness may expose that the act occurred outside the relevant facility, involved a noncovered system, or did not affect the service claimed.
Third, I reconstruct causation with native data and qualified interpretation. The prosecution may have strong technical proof, or it may rely on a sequence—act, alarm, outage—without testing intervening causes. The defense should neither deny obvious facts nor accept an unsupported causal conclusion. The same disciplined approach applies to substantiality and loss.
Fourth, I separate act, identity, result, causation, and culpability. One piece of evidence may support several inferences, but it does not eliminate separate elements. A planning message may support intent but not prove the actual system effect; an outage record may prove a result but not who caused it; a badge swipe may prove access but not the charged act; a work-order violation may prove a policy departure but not criminal tampering.
Finally, I evaluate motions, experts, admissibility, negotiation, trial instructions, sentencing, and collateral effects together. Search warrants for devices, cloud accounts, location records, work systems, or residences raise scope and particularity questions. Technical evidence must be authenticated and explained reliably. Any resolution should specify the offense, grade, factual basis, restitution, property or device disposition, and downstream consequences rather than treating “critical infrastructure” as a complete answer.
Frequently asked questions about North Dakota infrastructure charges
Is being present at a protest near infrastructure enough?
No. The State must prove the accused’s charged conduct, the statutory facility or public service, a listed mechanism, causation, the substantial interruption or impairment, and the culpability level. Jessee and Hebert rejected treating mere presence on tracks as tangible-property tampering under the predecessor theory, while current post-2019 alternatives must be analyzed separately.
Must the State prove physical damage?
Not under every current theory. Subsections 1(d) and 1(e), for example, include impeding, inhibiting, or interfering with operations, construction, or repair. But the State must still prove the exact theory and the required substantial interruption or impairment caused by it.
What makes the result “substantial”?
The section gives no numeric threshold. Duration, reach, capacity loss, operational importance, customers affected, degradation, safety effect, restoration, and context may matter. The prosecution must prove substantiality; the importance of the facility alone does not answer the question.
Are employees and contractors exempt?
The section does not apply to an employee or contractor acting within the scope of employment or contract, as defined by subsection 3. The relationship, assigned services, authority, instructions, location, timing, purpose, and alleged departure from scope require evidence. A job title alone does not decide it.
Does the statute prohibit peaceful protest or labor activity?
Subsection 5 expressly preserves lawful assembly and peaceful, orderly petition for redress of grievances, including labor disputes. It does not immunize independently criminal conduct, but expressive association or proximity alone does not prove the offense.
What are the current maximum penalties?
Intentional conduct is a class C felony with a five-year and $10,000 ceiling; knowing or reckless conduct is a class A misdemeanor with a 360-day and $3,000 ceiling; the residual grade is a class B misdemeanor with a 30-day and $1,500 ceiling. These are maximums, not mandatory outcomes.
Why does the alleged offense date matter?
The Legislature substantially rewrote § 12.1-21-06 in 2019. Earlier conduct was governed by a narrower public-service structure. The court must apply the law effective on the alleged date, subject to applicable retroactivity principles; current wording cannot simply be assumed.
What should I preserve before speaking with a lawyer?
Preserve the complaint, cited subsection, site and service records, work authority, original operational data, complete communications, media, access logs, devices, witness names, technical documents, and a dated timeline. Do not enter a site, delete data, alter equipment, test a system, or violate an order.
A lawyer’s file review of North Dakota Critical-Infrastructure Tampering Defense
A useful defense analysis starts by slowing the case down. The title of the charge is not an element, and the largest number in a penalty provision is not a prediction. I read the count, the incorporated definitions, and the alleged facts side by side before I tell a client what I think.
Read the count as a set of propositions the State must prove
For North Dakota Critical-Infrastructure Tampering Defense, the governing text begins with N.D.C.C. §§ 12.1-21-06, 12.1-02-02, 12.1-02-05, and 12.1-32-01; 2019 SB 2044; State v. Jessee, 2018 ND 241; State v. Hebert, 2018 ND 252. That citation matters because a familiar charge name can contain several statutory routes, definitions, and sentencing rules. I read the exact count, the alleged date, and every incorporated definition before deciding which facts are material and which allegations are simply part of the narrative.
Next, I connect each material fact to evidence the prosecution can actually present. The source might be a witness, a recording, a certified record, laboratory work, device data, or an admissible inference—but it should be identifiable and testable. That approach shows whether the real dispute concerns what happened, how evidence was obtained, whether it is admissible, or whether it proves the required element at all.
The evidence I would ask for first
For North Dakota Critical-Infrastructure Tampering Defense, I would not begin with a canned list of defenses. I would begin with the source file: the charging paper, every police report, uncut recordings, witness interviews, warrants and returns, device and account records, photographs with metadata, expert or laboratory material, certified prior records, court orders, and any document the prosecution relies on to prove an element or increase the classification. A police summary can identify what an officer or witness says happened, but it cannot substitute for the recording, photograph, data, or document being summarized. The same is true of a complaint. It identifies the prosecution’s theory at the start of the case; it does not prove the theory.
I put those materials on one chronology. That lets me see what was known at each decision point, which account was contemporaneous, what appeared only after people spoke with one another, and where the record is silent. It also keeps an admissibility question separate from a factual one. A fact can be disputed even if the evidence was lawfully obtained. Evidence can also be accurate yet inadmissible for a particular purpose. Those are different arguments and should not be blurred together.
Read the charging document against the offense date
The alleged date matters because statutes, penalty thresholds, definitions, sentencing rules, and published decisions change. I save the version in force on that date and read the session-law history when the current online text is different. I also check whether a later amendment was merely clarifying or made a substantive change; that is a legal question, not an assumption. The same discipline applies to prior convictions and administrative events. A prior must fit the definition the charged statute actually uses, fall within any stated lookback period, and be proved by a reliable record.
I then compare the formal count with the probable-cause narrative and the discovery. If the prosecution’s theory shifts, I want the amended pleading and enough detail to prepare. If several factual alternatives are alleged, I identify whether they are separate elements, alternative means, enhancement facts, or merely evidentiary details. That distinction affects notice, motions, jury instructions, unanimity arguments, and how a verdict form should be read.
Separate an evidentiary weakness from a suppression issue
Not every troubling fact produces a motion to suppress. Suppression ordinarily requires a constitutional, statutory, or rule-based violation with a remedy that reaches the evidence at issue. A weak identification, an incomplete investigation, or a witness inconsistency may be powerful at trial without making evidence inadmissible. By contrast, a stop, search, interrogation, identification procedure, warrant, or test can raise a legal issue even when the resulting evidence appears incriminating. I analyze both tracks and do not promise dismissal simply because one problem exists.
For a search issue, I reconstruct what officers knew before each intrusion and what authority they claimed. For a statement, I examine custody, questioning, warnings, voluntariness, recording, and the complete context. For scientific or technical evidence, I request the method, underlying data, quality-control material, uncertainty information, and chain of custody. For hearsay or confrontation questions, I identify the actual statement, its purpose, the declarant, and the proposed foundation. Specificity matters; “the evidence is bad” is not a motion.
Prepare negotiation and trial at the same time
A plea decision should be compared with the case the State could present at trial, not with the complaint’s maximum penalty in isolation. I want to know the strongest admissible proof, the weakest required element, the realistic motion practice, the likely instructions, and the consequences of every proposed disposition. That includes custody, probation, treatment, restitution, driving, firearm restrictions, registration, employment or licensing, immigration consultation, family-court effects, and record consequences when they are actually triggered. I avoid telling a client that every collateral consequence applies to every conviction.
Trial preparation gives negotiation its credibility. Witness interviews, exhibit review, motions in limine, expert consultation, demonstrative evidence, jury instructions, and a clean theory of the case force both sides to confront what can be proved. Negotiation can continue while that work is underway. The two tracks are not opposites.
A case-law point worth keeping in its proper place
Appellate decisions matter, but a quotation should not be detached from the issue the court was deciding. In State v. Hartson, 2024 ND 78, ¶ 26, the North Dakota Supreme Court explained that, on a sufficiency challenge, “we do not weigh conflicting evidence, or judge the credibility of witnesses.” That is an appellate-review rule, not a reduction of the State’s burden at trial. At trial, the prosecution still must prove every element beyond a reasonable doubt. I cite the case for the point it actually decided and then return to the charged statute, the instructions, and the admissible evidence in the present file.
What I would want you to understand before choosing an outcome
You should be able to identify the exact charge, the facts that set its level, the disputed elements, the evidence that matters most, the motions that have a legal basis, the realistic trial issues, and the concrete effect of each proposed resolution. If an answer depends on a missing report, recording, expert opinion, or certified record, I will say so. An honest answer about what remains unknown is more useful than a confident guess.