Minnesota computer-damage charge guide
Computer Damage under Minnesota Statutes § 609.88
Minnesota’s computer-damage statute is not a generic ban on using a computer without permission. Section 609.88 creates three distinct alternatives: intentional and unauthorized damage or destruction; intentional alteration that is either unauthorized or done with intent to injure or defraud; and unauthorized distribution of a destructive computer program with intent to damage or destroy. The state must identify the covered computer property, the act, the approach-specific mental state, authorization, attribution, causation, and—when seeking a felony tier—the statutory amount of loss. “Loss” has a specific definition in § 609.87 and is not automatically every dollar claimed after an incident. A useful defense review therefore begins with native system evidence, permissions, change history, source code or program samples, forensic methods, outage and repair records, and a line-by-line loss calculation.
I separate what changed from who caused it and what the statute counts as loss.
If you hire me, I compare the complaint with the charged paragraph, permissions, notices, logs, forensic images, hashes, change history, backups, code or program samples, communications, repair evidence, and loss records. I work with qualified technical expertise when needed and test the state’s attribution, causation, mental-state, and valuation theory rather than accepting an incident-response label as a legal conclusion.
Subdivision 1 uses different verbs and different mental-state language
A charge should identify paragraph (a), (b), or (c). Treating all three as “hacking” loses distinctions that can decide authorization, intent, proof, and penalty.
Damage or destroy
The person must intentionally and without authorization damage or destroy a computer, computer system, computer network, computer software, or property defined in § 609.87, subd. 6.
Unauthorized alteration
The person must intentionally alter covered property without authorization. The current wording does not add intent to injure or defraud to this branch.
Injurious or fraudulent alteration
The person must intentionally alter covered property with intent to injure or defraud. The paragraph’s “or” makes this an alternative to the unauthorized-alteration branch.
Distribution
The accused must distribute a destructive computer program. Possession, creation, study, receipt, or ordinary software distribution is not the same verb.
Without authorization
The destructive-program distribution must be unauthorized. Examine owner permission, approved time and purpose, notices, scope, delegation, and the distribution theory.
Intent to damage or destroy
Paragraph (c) also requires intent to damage or destroy covered property. A program’s capability or harmful result does not automatically prove the distributor’s intent.
The grammar of paragraph (b) matters
The current text prohibits intentionally altering covered property “without authorization or with intent to injure or defraud.” The word “or” separates alternative theories. A page that says every alteration requires both lack of authorization and intent to injure or defraud misstates the statute. Conversely, a prosecution still must prove intentional alteration and the selected alternative; an accidental change is not made intentional by calling it unauthorized.
Unauthorized access alone is not computer damage
Section 609.891 separately addresses unauthorized computer access. Section 609.88 requires damage, destruction, alteration, or the specified destructive-program distribution. A login or access event may explain opportunity, but it does not by itself prove that the accused altered or damaged anything. The state should connect the charged act to a system change through reliable forensic evidence and causation.
Each object must fit the statute
The listed objects are a computer, computer system, computer network, computer software, or other property specifically defined in § 609.87, subd. 6. That property definition includes electronically processed or produced data and information contained in a computer or software in machine- or human-readable form. Identify the exact server, endpoint, account, virtual machine, database, file, program, configuration, network component, or data alleged to have been affected and explain how it fits the incorporated definitions.
Section 609.87 supplies the vocabulary for property, authorization, loss, and destructive programs
The definitions are not background glossary entries. They determine what conduct and loss the statute reaches. The relevant version must be retrieved for the alleged offense date because § 609.87 has been amended over time.
Computer, system, and network are separate defined objects
A “computer” is an electronic device performing logical, arithmetic, or memory functions through manipulation of signals. A “computer system” includes related, connected, or unconnected computers and peripheral equipment. A “computer network” covers an interconnection of a communication system with a computer through a remote terminal, or two or more interconnected computers or systems, and includes private and public telecommunications networks. A charging theory should identify the object instead of using “system” as an all-purpose label.
Property includes data and information
Subdivision 6 states that property includes, but is not limited to, electronically processed or produced data and information contained in a computer or software in machine- or human-readable form. Deleting or changing a database record, configuration file, source code, document, account setting, virtual resource, or other data may therefore present a property question even when no physical device is broken. The state must still prove the prohibited act, mental state, authorization, causation, and penalty facts.
Computer program and computer software are defined differently
A computer program is an instruction, statement, or series of instructions or statements, in a computer-acceptable form, directing the functioning of a system to provide appropriate products. Computer software includes a program or procedures, or associated documentation concerning computer operation. Those definitions can matter when the alleged object is source code, an executable, a script, a procedure, documentation, or a configuration artifact.
Electronic data is now separately defined
Current § 609.87 defines electronic data as records or information in digital form on a computer, network, system, or in software that can be stored, transmitted, or processed. That definition was added long after the original 1982 act. Its existence reinforces why offense-date versions matter. A current definition should not be silently imported into an earlier prosecution.
The loss definition chooses the greatest of three measures
“Loss” means the greatest of retail market value of the property or services involved; reasonable repair or replacement cost, whichever is less; or reasonable value of damage created by unavailability or lack of utility until repair or replacement can be effected. The prosecution should identify the measure used and provide source evidence. A total invoice, cybersecurity budget, claimed business impact, or expert conclusion is not self-proving and may include items outside those categories.
A changed or unavailable system requires a precise technical and legal description
The statute uses three verbs before the destructive-program approach. “Damage,” “destroy,” and “alter” are not separately defined in the current computer-crime definitions. This guide does not invent controlling definitions. It identifies the system state before and after, the action said to cause the change, functionality, reversibility, duration, and evidence tying the accused to it.
Damage may exist without physical breakage
Because covered property includes software, data, and information, the allegation may involve corrupted files, disabled accounts, changed permissions, encrypted data, degraded performance, unavailable services, erased logs, altered configurations, damaged backups, or other functional effects. The state should show what condition existed, what changed, why that change qualifies, and who caused it.
Destruction and deletion are not always synonymous
A user can delete a visible file while recoverable copies, snapshots, replicas, backups, or version history remain. The existence of recovery does not automatically defeat every damage or alteration theory, and a deletion event does not automatically prove destruction. Determine the object, retention layer, recovery process, downtime, integrity, and resulting loss. Forensic language such as “deleted,” “wiped,” “unallocated,” “overwritten,” and “unrecoverable” should be used accurately.
Alteration can be small but still must be intentional
A changed password, permission, database value, configuration, routing rule, account status, log, source-code line, or metadata field may constitute an alteration if the statutory conditions are proved. Routine software updates, authorized administration, automated processes, synchronization, corruption, user error, testing, or rollback can produce changes without the charged intent or lack of authorization. Logs and change-management evidence are central.
Results do not prove the actor
System records may show that an account, token, process, device, or address performed an action. Attribution to a person may require authentication records, device custody, session evidence, multi-factor events, location, commands, communications, behavior, administrator testimony, and exclusion of shared access, compromise, automation, or another user. An IP address or account name is a lead, not necessarily the full identity proof.
Causation must connect act and consequence
Complex incidents can involve preexisting defects, concurrent users, vendor outages, malware, hardware failure, bad updates, misconfiguration, capacity limits, backup problems, and response actions. A temporal sequence does not establish that the accused’s action caused every outage, repair, or claimed loss. Compare system health, alerts, timestamps, dependencies, logs, expert testing, and alternative causes.
Intent must be proved for the charged act
Paragraphs (a) and (b) require intentional action; paragraph (b)’s alternative branch adds intent to injure or defraud; paragraph (c) adds intent to damage or destroy. Accidental commands, misunderstood instructions, unexpected software behavior, testing mistakes, negligent administration, or an unforeseen cascade require a different analysis from purposeful action. The prosecution may use circumstances, but should not reason backward from a serious outcome to the required intent.
Paragraph (c) requires a defined program, distribution, lack of authorization, and destructive intent
Current § 609.87, subd. 12, defines a destructive computer program by function or product. A destructive function degrades performance, disables a computer, peripheral, or program, or destroys or alters programs or data. A destructive product includes unauthorized data that makes memory unavailable, unauthorized alteration of data or programs, or production of another destructive program, including a self-replicating program.
Capability and actual behavior should be analyzed separately
Static code review may identify instructions capable of deletion, encryption, resource consumption, propagation, disabling, or alteration. Dynamic analysis may show what the sample did in a controlled environment. Configuration, permissions, environment, command-line arguments, keys, network connectivity, triggers, and target conditions can determine behavior. Preserve the exact sample and cryptographic hash; do not assume that a family name or vendor detection proves what the charged file was or did.
Distribution is a distinct act
Paragraph (c) criminalizes distribution under specified conditions, not simply writing, possessing, receiving, testing, researching, or discussing code. Identify the file or program, source and destination, method, time, recipient, transmission record, and person responsible. Email attachment, repository push, download link, package publication, removable media, remote deployment, automated update, or peer-to-peer transfer can present different proof.
Legitimate tools can perform destructive functions
Administrative scripts, deployment systems, remote-management tools, security tests, backup utilities, disk tools, and proof-of-concept code may alter, erase, encrypt, disable, or propagate under some conditions. A harmful capability does not automatically establish that the program meets the definition as used in the case, that distribution was unauthorized, or that the accused intended damage or destruction. Examine design, configuration, documentation, authorized purpose, target, testing controls, statements, and actual use.
Malware labels require foundation
Terms such as virus, worm, ransomware, wiper, trojan, logic bomb, and malware can be useful technical descriptions but are not substitutes for the statutory definition. Ask who acquired the sample, how it was preserved, whether the hash matches, what analysis was performed, whether source or binary was examined, which signatures or behavior supported the label, and whether the expert can distinguish the charged program from related variants.
The penalty wording deserves separate attention
Subdivision 2’s felony tiers apply when “damage, destruction or alteration” results in specified loss. Paragraph (c), by contrast, criminalizes distribution with intent to damage or destroy. If the state seeks a felony tier for a distribution count, the complaint, instruction, and proof should identify how the penalty language applies to the facts, including actual damage, destruction, or alteration and resulting statutory loss. This guide does not resolve an unlitigated interpretation in the abstract.
Loss is the greatest of three defined measures—not every expenditure after an incident
The loss number can change a current case from an all-other-cases misdemeanor to a five- or ten-year felony maximum. It therefore deserves the same evidentiary discipline as the conduct elements. Section 609.87, subd. 10, identifies three measures and selects the greatest qualifying amount.
| Loss measure | Statutory formulation | Evidence to examine | Common questions |
|---|---|---|---|
| Market value | Retail market value of the property or services involved | Comparable sales or services, licenses, contracts, invoices, product age, condition, and market | What item or service was involved? Is the value retail, supported, and tied to the affected property? |
| Repair or replacement | Reasonable repair or replacement cost, whichever is less | Work orders, invoices, labor records, parts, vendor quotes, backups, restore method, scope, and alternatives | Were costs reasonable, necessary, and actually for repair or replacement? Which of repair or replacement is less? |
| Unavailability or lost utility | Reasonable value of damage from unavailability or lack of utility until repair or replacement can be effected | Outage records, service metrics, normal usage, lost capacity, duration, workaround, dependencies, and valuation method | What was unavailable, for how long, because of what act, and how was the reasonable value calculated? |
Start with the owner, agent, or lessee
Subdivision 2 requires resulting loss to the owner, the owner’s agent, or lessee for the felony tiers. Identify the claimant’s relationship to the affected property and avoid combining losses from entities without explaining statutory fit. In a cloud or managed-service incident, the equipment owner, customer, data owner, vendor, tenant, insurer, and downstream business may claim different amounts.
Repair records can include nonqualifying work
An incident-response invoice may include investigation, containment, legal advice, public relations, compliance, upgrades, redesign, monitoring, training, travel, and preventive work along with restoration. Some amount may fit a statutory measure; some may not. Require task-level detail, time records, rates, invoices, scope, causation, and expert explanation. Avoid double-counting the same labor under repair and unavailability.
Replacement cannot ignore the “whichever is less” phrase
The second measure is reasonable repair or replacement cost, whichever is less. A claimant cannot automatically select complete replacement when repair was feasible and cheaper. Conversely, repair cost can be unreasonable compared with replacement. Examine actual condition, compatibility, supported alternatives, depreciation where legally relevant, emergency constraints, and whether replacement added capacity or features beyond restoration.
Unavailability requires duration and reasonable value
The third measure ends when repair or replacement can be effected, not necessarily when every organizational project ends. Determine the earliest reasonable restoration point, actual downtime, partial service, workarounds, redundancy, backup recovery, and whether unrelated decisions prolonged the outage. A claimed revenue number may not equal the reasonable value of damage from unavailability, and avoided costs or displaced activity may matter to the calculation.
The thresholds are strict boundaries
Current paragraph (a) requires loss “in excess of $2,500.” Exactly $2,500 falls in paragraph (b), which covers more than $500 but not more than $2,500. Exactly $500 does not satisfy “more than $500” and falls in all other cases if the offense is proved. Estimates and rounded totals near a boundary should be tested item by item.
Aggregation is not stated in § 609.88
The section does not expressly provide a multi-incident aggregation rule. A prosecution involving several devices, users, dates, or acts must identify the charged unit and how losses correspond to it. Counsel should research unit of prosecution, joinder, unanimity, multiple punishment, and any applicable general law on the actual facts rather than assuming all incident costs can be pooled.
Forensic integrity, attribution, causation, and loss require the underlying data
System and forensic evidence
- Forensic images, snapshots, backups, file-system records, hashes, chain of custody, acquisition notes, and tool versions.
- Operating-system, security, application, database, cloud, identity-provider, network, endpoint, source-control, and audit logs.
- Commands, scripts, executables, source code, packages, configuration, scheduled tasks, tokens, keys, and malware samples.
- Before-and-after states, change tickets, deployments, rollback, restoration, outage, monitoring, and dependency records.
Human and authorization evidence
- Contracts, policies, owner notices, role descriptions, permissions, delegation, training, and accepted practices.
- Emails, chats, tickets, calls, meeting records, warnings, instructions, disputes, termination, and offboarding.
- Account history, shared-access practices, authentication, multi-factor, device custody, location, and session evidence.
- Witness knowledge about ownership, system operation, changes, effects, restoration, and claimed loss.
Rule 901 requires authentication
Minnesota Rule of Evidence 901 requires evidence sufficient to support a finding that the matter is what its proponent claims. In a computer case, that can involve a knowledgeable witness, distinctive characteristics, or proof describing a process or system and showing it produces an accurate result. A log export needs context: system, collection method, field definitions, retention, time zone, integrity, administrator access, and what the record can and cannot show.
Rule 1002 focuses attention on original content
When a party seeks to prove the content of a writing, recording, or photograph, Rule 1002 generally requires the original subject to exceptions in the rules or legislation. Screenshots and narrative reports may omit metadata, filters, rows, formulas, hidden fields, versions, and context. Counsel should request native exports, images, source files, and underlying records and then litigate original, duplicate, loss, and admissibility issues under the actual circumstances.
Rule 1006 permits summaries but preserves access to the foundation
Voluminous logs and cost records may be presented through a chart, calculation, or timeline. Rule 1006 requires that originals or duplicates be made available for examination or copying at a reasonable time and place and permits the court to order production. Test every query, filter, exclusion, deduplication, time conversion, category, and formula behind a summary.
Relevance does not eliminate unfair-prejudice review
Rules 401 and 403 require analysis of relevance, probative value, unfair prejudice, confusion, misleading the jury, delay, waste, and cumulative proof. A dramatic cybersecurity label, unrelated files, prior disputes, or the scale of a victim organization can distract from the charged act. Motions and limiting instructions may be appropriate depending on the proffer.
Criminal discovery should include the expert foundation
Minnesota Rule of Criminal Procedure 9.01 governs prosecution disclosure, including reports, documents, tangible objects, and scientific-test materials. A digital-forensics or loss opinion cannot be evaluated from its conclusion alone. Seek the examiner’s qualifications, lab or agency records, images, hashes, notes, tool versions, settings, scripts, exports, validation, peer review, underlying data, calculations, exhibits, and information tending to negate guilt or reduce culpability. Apply the rule and any case-specific scheduling order as currently in force.
The offense approach comes first; statutory loss selects the current tier
| Current tier | Loss finding | Maximum imprisonment | Maximum fine |
|---|---|---|---|
| Top felony approach | Damage, destruction, or alteration results in loss exceeding $2,500 to owner, owner’s agent, or lessee | 10 years | $50,000 |
| Middle felony approach | Resulting loss is more than $500 but not more than $2,500 | 5 years | $10,000 |
| All other cases | The offense is proved but neither felony loss threshold is proved | 90 days | $1,000 |
No universal minimum custody term does not eliminate the statutory minimum-fine analysis
Section 609.88 states no universal mandatory minimum jail or prison term. Under current § 609.101, the 30-percent minimum-fine starting figure is $15,000 for the top felony approach with its $50,000 ceiling, $3,000 for the middle felony approach with its $10,000 ceiling, and $300 for the all-other-cases misdemeanor with its $1,000 ceiling. The misdemeanor figure is subject to a lower amount on the uniform Judicial Council fine schedule. The court may reduce the minimum to at least $50 for qualifying public-defender status, indigence, or undue hardship; permit community work service instead of a fine; and authorize installments. The fine is separate from restitution and the statutory surcharge.
The current Minnesota Sentencing Guidelines Offense Severity Reference Table ranks computer damage over $2,500 at severity level 3 and computer damage of $2,500 or less at severity level 2. That second entry concerns the felony middle approach; it does not turn the all-other-cases misdemeanor into a felony. The felony maximum is an outer limit, not the presumptive sentence. A felony case requires the Guidelines version applicable to the offense date, the conviction offense, loss finding, criminal-history score, applicable Grid, any mandatory statute, and grounds for departure. The all-other-cases misdemeanor does not use the felony grid.
Restitution is not automatically the statutory loss figure
The amount used to classify the offense and a restitution request may involve overlapping facts but different legal questions. Restitution requires its own victim, causation, documentation, notice, procedure, and scope analysis under controlling law. A court should not simply adopt a broad incident-response total because the same number appears in a police report.
Collateral consequences depend on the conviction and person
A felony conviction can affect firearms, immigration, employment, licensing, contracts, security access, public benefits, housing, and future sentencing; a misdemeanor can also have serious employment and trust consequences. None should be stated categorically without reviewing the conviction record, sentence, status, role, agency rules, and governing state and federal law. Immigration advice should be obtained before a plea.
The offense date can change fines, definitions, and conduct alternatives
The original statute took effect August 1, 1982. The destructive-program approach took effect August 1, 1989 for crimes committed after that date. The statute and incorporated definitions have other amendments, and archived law shows earlier lower misdemeanor fines. For every case, verify the actual § 609.88 text, § 609.87 definitions, general penalty law, and Guidelines in effect on the alleged date.
The defense should test the paragraph, permissions, technical causation, attribution, and every dollar
Which paragraph is actually charged?
Demand clarity about damage/destruction, unauthorized alteration, injurious-or-fraudulent alteration, or destructive-program distribution. The complaint, probable-cause statement, discovery, instruction, and verdict theory should not drift among alternatives with different elements.
Was the act intentional?
Compare the alleged command or action with tickets, instructions, training, interface, warnings, expected behavior, test environment, automation, error messages, and response. An intended administrative act can have an unintended result; the legal question is not answered solely by the seriousness of the outcome.
What permission applied?
Identify the owner, person authorized to grant permission, approved time and purpose, oral or written notice, displayed notice, role, technical privileges, historical practice, emergency authority, and any revocation. Separate a policy breach from the statutory definition while accounting for paragraph (b)’s alternative intent-to-injure-or-defraud branch.
What was damaged, destroyed, or altered?
Name the specific device, system, network, software, data, or information and document its before-and-after condition. Test whether the reported change was normal operation, authorized maintenance, an automated process, synchronization, corruption, vendor action, another user, preexisting failure, or the accused’s act.
Can the state reliably identify the actor?
Examine account sharing, credential compromise, tokens, sessions, devices, addresses, multi-factor events, timestamps, time zones, physical access, remote administration, service accounts, and automated tasks. Require a complete chain from system event to person.
Does the destructive-program evidence satisfy every condition?
Identify the exact sample and hash, statutory destructive function or product, distribution act, recipient, authorization, and intent to damage or destroy. Challenge family labels, variant assumptions, incomplete samples, unvalidated tools, and conclusions that confuse capability, execution, effect, and the distributor’s intent.
Did the charged act cause the claimed effect?
Build a dependency-aware timeline. Investigate hardware failure, vendor outage, software defect, capacity, malware, concurrent changes, response decisions, and backup problems. Require the state’s expert to explain method, excluded alternatives, uncertainty, and how each conclusion follows from preserved data.
Is the felony loss calculation statutory and supported?
Sort every dollar into market value, reasonable repair-or-replacement cost with the lesser alternative, or reasonable unavailability/lack-of-utility damage until repair or replacement can be effected. Exclude or challenge unsupported, duplicative, preventive, upgraded, speculative, downstream, or unrelated amounts. Pay particular attention near $500 and $2,500.
Were searches, seizures, statements, and data demands lawful?
Depending on the investigation, review warrants, affidavits, particularity, scope, forensic search methods, consent, workplace devices, third-party records, cloud accounts, subpoenas, compelled credentials, custodial questioning, Miranda, privilege, and preservation. A digital investigation still operates within constitutional, statutory, and procedural limits.
Resolve these questions before evaluating a plea, motion, or trial
- Charge theory: Which paragraph and alternative does each count use?
- Covered object: What computer, system, network, software, data, or other defined property is involved?
- Intent: What act was intentional, and what additional intent does the selected approach require?
- Authorization: Who owned the property, who could grant permission, and what time/purpose limits or notices applied?
- Attribution: What proves a person—not merely an account, address, token, or process—performed the act?
- Causation: What technical evidence connects that act to the alleged change, damage, destruction, outage, or loss?
- Loss: Which statutory measure is used, which records support it, and where does the total fall relative to $500 and $2,500?
- Evidence integrity: Are native data, images, hashes, logs, samples, versions, time zones, tool settings, and expert materials preserved?
- Other counts: How do access, theft, facilitation, fraud, and general property theories differ?
- Consequences: What sentencing, restitution, immigration, employment, licensing, security-access, and record effects actually apply?
Only then can counsel compare dismissal, motion practice, expert review, charge reduction, a nonconviction resolution, plea, or trial. The statute’s ten-year ceiling does not describe every case, and a misdemeanor label does not make a technical or professional consequence trivial.
Preserve evidence without changing the disputed system
- The complaint, warrant, inventory, subpoenas, court notices, release order, discovery, and property receipts.
- Devices, storage media, backups, snapshots, logs, account records, permissions, notices, tickets, code, program samples, and communications lawfully in your possession.
- Original filenames, alternatives, timestamps, hashes, exports, reports, invoices, work orders, outage records, and repair documentation.
- Contracts, job duties, policies, authorization, delegation, training, termination, offboarding, and owner or administrator communications.
- A private chronology identifying systems, accounts, actions, people, dates, instructions, and observed effects.
Do not log back into a disputed account, contact another user for credentials, delete or “clean” a device, run recovery or anti-malware tools, reinstall software, change passwords unless necessary for current safety and advised, or contact witnesses in violation of an order. Counsel can coordinate defensible preservation and qualified forensic collection.
Questions about Minnesota computer damage
Is unauthorized access automatically computer damage?
No. Unauthorized access is addressed separately in § 609.891. Section 609.88 requires damage, destruction, alteration, or destructive-program distribution under its approach-specific conditions.
Does every alteration require intent to injure or defraud?
No. Current paragraph (b) covers intentional alteration that is without authorization or with intent to injure or defraud. The prosecution must identify and prove the selected alternative.
Can changed or deleted data qualify even if hardware is intact?
Potentially. Section 609.87’s property definition includes electronically processed or produced data and information in a computer or software. The act, mental state, authorization, causation, and loss still require proof.
What is a destructive computer program?
Section 609.87, subd. 12, defines it through destructive functions or products, including degradation, disabling, destruction or alteration, unauthorized data consuming memory, unauthorized alteration, and self-replicating programs.
Does possessing or writing harmful code prove paragraph (c)?
Not by itself. Paragraph (c) requires distribution, lack of authorization, and intent to damage or destroy covered property, as well as a program satisfying the statutory definition.
How does Minnesota define loss?
Section 609.87 uses the greatest of retail market value; reasonable repair or replacement cost, whichever is less; or reasonable value of damage from unavailability or lack of utility until repair or replacement can be effected.
What happens at exactly $500 or exactly $2,500?
Current law requires more than $500 for the middle tier and more than $2,500 for the top tier. Exactly $500 is in all other cases; exactly $2,500 is in the middle tier if the offense and loss are proved.
Is every incident-response cost part of statutory loss?
Not automatically. Each amount must fit a statutory measure, be reasonable, result from the charged conduct, and avoid duplication. Investigation, prevention, upgrades, legal work, and downstream claims require separate scrutiny.
Is there a mandatory minimum sentence?
Section 609.88 states no universal mandatory minimum jail or prison term. Section 609.101 separately creates current minimum-fine starting figures of $15,000, $3,000, or $300 depending on the proved tier, with the uniform-schedule and hardship qualifications explained above. Felony sentencing requires the applicable Guidelines and any separate mandatory law; the misdemeanor approach does not use the felony grid.
What should be preserved first?
Preserve native system data, images, hashes, backups, logs, permissions, notices, account history, tickets, code or samples, communications, repair and outage records, loss documentation, charging papers, and a private timeline. Do not alter the disputed system.
Computer, cybercrime, evidence, and court-process resources
A lawyer’s file review of Computer Damage in Minnesota
The first pass through a criminal file should be exact, not dramatic. I want the statute and subdivision, the alleged date, the conduct the State says satisfies each element, and the source for every fact that raises the degree or punishment.
Read the count as a set of propositions the State must prove
A careful review of Computer Damage in Minnesota begins with Minn. Stat. §§ 609.88 and 609.87; 1982 Minn. Laws ch. 534; 1989 Minn. Laws ch. 159 and the precise theory alleged in the complaint. The legal label may suggest a level of seriousness, but it cannot replace proof of the conduct, mental state, result, status, relationship, value, injury, prior event, or other circumstance the chosen provision requires.
I organize the evidence around those requirements instead of reading the police narrative as a finished story. Each proposition should lead to a source, and each source should be checked for context, reliability, and admissibility. This makes it easier to see what is genuinely disputed, what information is still missing, and which legal issue could produce a meaningful remedy.
The evidence I would ask for first
For Computer Damage in Minnesota, I would not begin with a canned list of defenses. I would begin with the source file: the charging paper, every police report, uncut recordings, witness interviews, warrants and returns, device and account records, photographs with metadata, expert or laboratory material, certified prior records, court orders, and any document the prosecution relies on to prove an element or increase the classification. A police summary can identify what an officer or witness says happened, but it cannot substitute for the recording, photograph, data, or document being summarized. The same is true of a complaint. It identifies the prosecution’s theory at the start of the case; it does not prove the theory.
I put those materials on one chronology. That lets me see what was known at each decision point, which account was contemporaneous, what appeared only after people spoke with one another, and where the record is silent. It also keeps an admissibility question separate from a factual one. A fact can be disputed even if the evidence was lawfully obtained. Evidence can also be accurate yet inadmissible for a particular purpose. Those are different arguments and should not be blurred together.
Read the charging document against the offense date
The alleged date matters because statutes, penalty thresholds, definitions, sentencing rules, and published decisions change. I save the version in force on that date and read the session-law history when the current online text is different. I also check whether a later amendment was merely clarifying or made a substantive change; that is a legal question, not an assumption. The same discipline applies to prior convictions and administrative events. A prior must fit the definition the charged statute actually uses, fall within any stated lookback period, and be proved by a reliable record.
I then compare the formal count with the probable-cause narrative and the discovery. If the prosecution’s theory shifts, I want the amended pleading and enough detail to prepare. If several factual alternatives are alleged, I identify whether they are separate elements, alternative means, enhancement facts, or merely evidentiary details. That distinction affects notice, motions, jury instructions, unanimity arguments, and how a verdict form should be read.
Separate an evidentiary weakness from a suppression issue
Not every troubling fact produces a motion to suppress. Suppression ordinarily requires a constitutional, statutory, or rule-based violation with a remedy that reaches the evidence at issue. A weak identification, an incomplete investigation, or a witness inconsistency may be powerful at trial without making evidence inadmissible. By contrast, a stop, search, interrogation, identification procedure, warrant, or test can raise a legal issue even when the resulting evidence appears incriminating. I analyze both tracks and do not promise dismissal simply because one problem exists.
For a search issue, I reconstruct what officers knew before each intrusion and what authority they claimed. For a statement, I examine custody, questioning, warnings, voluntariness, recording, and the complete context. For scientific or technical evidence, I request the method, underlying data, quality-control material, uncertainty information, and chain of custody. For hearsay or confrontation questions, I identify the actual statement, its purpose, the declarant, and the proposed foundation. Specificity matters; “the evidence is bad” is not a motion.
Prepare negotiation and trial at the same time
A plea decision should be compared with the case the State could present at trial, not with the complaint’s maximum penalty in isolation. I want to know the strongest admissible proof, the weakest required element, the realistic motion practice, the likely instructions, and the consequences of every proposed disposition. That includes custody, probation, treatment, restitution, driving, firearm restrictions, registration, employment or licensing, immigration consultation, family-court effects, and record consequences when they are actually triggered. I avoid telling a client that every collateral consequence applies to every conviction.
Trial preparation gives negotiation its credibility. Witness interviews, exhibit review, motions in limine, expert consultation, demonstrative evidence, jury instructions, and a clean theory of the case force both sides to confront what can be proved. Negotiation can continue while that work is underway. The two tracks are not opposites.
A case-law point worth keeping in its proper place
Appellate decisions matter, but a quotation should not be detached from the issue the court was deciding. In State v. Fleck, 777 N.W.2d 233, 236 (Minn. 2010), the Minnesota Supreme Court described sufficiency review as viewing the evidence “in the light most favorable to the conviction.” That is an appellate-review rule, not a reduction of the State’s trial burden. At trial, the prosecution still must prove every element beyond a reasonable doubt. I cite the case for the proposition it actually decided and then return to the charged statute, the jury instructions, and the admissible evidence in the present file.
What I would want you to understand before choosing an outcome
You should be able to identify the exact charge, the facts that set its level, the disputed elements, the evidence that matters most, the motions that have a legal basis, the realistic trial issues, and the concrete effect of each proposed resolution. If an answer depends on a missing report, recording, expert opinion, or certified record, I will say so. An honest answer about what remains unknown is more useful than a confident guess.