Minnesota computer and electronic-data theft guide
Computer or Electronic Data Theft under Minnesota Statutes § 609.89
A Minnesota computer or electronic-data-theft case is not resolved by proving that somebody downloaded a file or used a computer account. Section 609.89 has four different conduct alternatives. They ask different questions about authorization, claim of right, purpose, deprivation, copying, later use, and retention beyond authority. The state must identify the approach, prove its mental state and act requirements, connect the activity to the accused person, and prove the statutory loss used to select a penalty tier. The alleged offense date is especially important: Minnesota added the two electronic-data copying and retention alternatives effective August 1, 2023, only for crimes committed on or after that date.
I trace the alleged data event from permission to person to loss.
If you hire me, I compare the complaint with the exact statutory approach and offense-date version. I review authorization records, notices, account history, native logs, exports, repositories, devices, hashes, file metadata, retention systems, communications, expert methods, and every component of claimed loss. A security incident, policy violation, employment dispute, or copied file is not automatically proof of every element of § 609.89.
Subdivision 1 does not create one undifferentiated computer-theft offense
Current § 609.89 lists four alternatives. A precise review should label the charged clause and match the state’s evidence to every verb and mental-state phrase in that clause.
Access to obtain
Intentional access, or causing access, without authorization or claim of right, for the purpose of obtaining services or property.
Take or retain to deprive
Intentional taking, transfer, concealment, or retention without claim of right and with intent to deprive the owner of use or possession.
Access or copy
Intentional access or copying of software or electronic data without authorization or claim of right.
Then act on it
The same software or data must then be used, altered, transferred, retained, or published under the clause’s text.
Keep copies
The person must intentionally retain copies of computer software or electronic data.
Beyond authority
The retention must continue beyond the individual’s authority; timing and the actual scope of authority therefore matter.
approach 1 focuses on purpose, not only outcome
The first approach reaches a person who intentionally and without authorization or claim of right accesses, or causes access to, a computer, system, network, or any part of one for the purpose of obtaining services or property. The text directs attention to why the access occurred. A completed transfer may be powerful evidence, but the clause says “for the purpose of obtaining,” not “successfully obtains.” The defense should identify the resource allegedly sought, whether it is statutory services or property, how the access allegedly advanced that purpose, and what evidence proves purpose rather than mere presence in a system.
“Causes to be accessed” can matter where the alleged activity used an automated process, another account, a scheduled job, an application interface, or an instruction executed by someone or something else. That wording does not erase attribution or intent. The state still must connect the accused person to the instruction and the prohibited purpose, and it must address legitimate automation, delegated tasks, compromised credentials, shared service accounts, testing, and routine background processes.
approach 2 requires deprivation intent and one of four possession verbs
The second approach requires intentional conduct without claim of right, an intent to deprive the owner of use or possession, and taking, transferring, concealing, or retaining possession of the listed computer property. Those are separate requirements. Evidence that data moved does not alone prove an intent to deprive; evidence of intent does not identify who performed the transfer; and proof that a person viewed information does not automatically establish taking, transfer, concealment, or retained possession.
Digital information can be copied without making the owner’s original copy disappear. That technical fact does not resolve the statute, but it makes the words “deprive,” “use,” and “possession” important. The state should explain the exact property, the owner, the act, the alleged deprivation, and the intended effect. A physical laptop, a virtual machine, source code, a customer export, credentials, and a database present different possession and use questions. The page does not invent a universal rule for them.
approach 3 is a compound act added in 2023
The third approach requires that the person intentionally and without authorization or claim of right “accesses or copies” computer software or electronic data and “uses, alters, transfers, retains, or publishes” that software or data. The conjunction matters. A prosecution should identify both sides of the theory and connect them to the same charged software or data. A download log may address copying; it does not by itself establish later use or publication. A public post may address publication; it does not by itself identify who originally accessed or copied the source.
Each downstream verb points to different evidence. Use may involve deployment, analysis, incorporation, execution, or another claimed utilization. Alteration requires a before-and-after comparison. Transfer requires destination and transmission evidence. Retention requires proof that the material remained under the accused person’s control. Publication requires evidence of dissemination or making material available. Because the statute does not separately define those verbs, the guide does not replace the enacted language with an invented categorical test.
approach 4 turns on when authority ended or narrowed
The fourth approach reaches intentional retention of copies beyond the individual’s authority. It can put the chronology of permission at the center of the case: when did the person lawfully receive or create the copy, what allowed possession, what event ended or narrowed that authority, what notice was given, what copies remained, and what shows intentional retention after that point? Employment termination, contract expiration, completion of a project, revocation of a license, a return-or-destroy demand, account offboarding, or a changed role may be relevant, but none answers the statutory question without the governing agreement, authority record, and proof of continued intentional retention.
Modern devices create local caches, synchronized folders, email attachments, backups, snapshots, archives, thumbnails, version history, and managed replicas. A forensic image may reveal bytes long after a user stopped actively using a file. The state should identify the charged copy, location, accessibility, retention mechanism, relevant time, and evidence of intentional keeping. Automatic persistence, an inaccessible backup, or a copy unknown to the user raises different questions from a curated archive opened after revocation.
August 1, 2023 separates the older two-approach statute from the current four-approach statute
The 2023 Legislature added the definition of electronic data, retitled § 609.89, and added current alternatives 3 and 4. The session law states that the § 609.89 amendment is effective August 1, 2023 and applies to crimes committed on or after that date. A complaint alleging earlier conduct cannot simply borrow the new copying and beyond-authority-retention language.
| Alleged conduct date | Statutory structure to check | Why it matters |
|---|---|---|
| Before August 1, 2023 | The then-effective computer-theft statute used the access-to-obtain and take/transfer/conceal/retain-to-deprive alternatives. | The current standalone copying/use and retention-beyond-authority alternatives did not yet exist. |
| On or after August 1, 2023 | Current four-approach § 609.89 may apply, subject to later amendments and the exact offense date. | The complaint may rely on the new software/electronic-data alternatives, but every requirement still needs proof. |
| Conduct spanning the date | Map each charged act, copy, use, transfer, retention period, and alleged loss to a date. | A continuing factual story does not permit automatic retroactive use of a later criminal statute. |
The statute has an earlier history too
Minnesota enacted computer theft in 1982 with two alternatives. The original deprivation approach referred to intent to permanently deprive the owner of possession. A 1994 amendment changed that language to intent to deprive the owner of use or possession. Fine amounts were later revised. An older allegation therefore requires the statute and definitions in force when the act occurred, not just a current webpage. That is especially important in investigations based on archived repositories, old employee data, long-running access, or delayed discovery.
A retention allegation needs a defensible time marker
For current approach 4, the state should identify when authority supposedly ended and when intentional retention allegedly occurred. If the charging period straddles August 1, 2023, the timeline cannot be left vague. Relevant records may include agreements, license terms, policy acknowledgments, offboarding notices, return demands, deletion certifications, account activity, file opens, exports, backup creation, device custody, and forensic timestamps. Timestamps themselves require time-zone, clock-drift, server, and metadata analysis.
The law applied at trial must match the charged period
The complaint, probable-cause statement, amendments, jury instructions, verdict form, and sentencing theory should use the correct version. A broad date range can create notice and unanimity questions when the state relies on different acts, copies, or statutory alternatives. Those issues are case-specific. They should be researched against the actual count rather than answered with a generic statement that computer conduct is “continuous.”
Access, authority, electronic data, property, services, and loss have statutory meanings
Section 609.89 sits inside Minnesota’s computer-crime provisions and uses definitions from § 609.87. Those definitions shape what the state must prove. They are not optional technical background.
Access is broader than logging in
Current law defines access to include instructing or communicating with a computer, system, or network; storing data in it; retrieving data from it; or otherwise making use of its resources. A login may be part of proof, but access can occur through an application, script, service, remote terminal, automated job, cloud console, repository client, or other communication. Conversely, possession of credentials or appearance in an access-control list does not prove the person used them at the charged time.
Computer, system, and network are distinct covered objects
A computer is an electronic device that performs logical, arithmetic, or memory functions by manipulating signals. A computer system includes related, connected, or unconnected computers and peripheral equipment. A computer network covers specified interconnections between communication systems and computers or among computers and systems, including private and public telecommunications networks. The charging theory should identify the object and evidence instead of using “the system” as an all-purpose phrase.
Software, programs, data, and property overlap but are not identical
A computer program is an instruction or series of instructions in a form acceptable to a computer that directs system functioning. Computer software includes programs, procedures, and associated documentation concerning operation. Property expressly includes electronically processed or produced data and information contained in a computer or software in machine- or human-readable form. Since 2023, electronic data has its own definition: records or information in digital form on a computer, network, system, or in software that can be stored, transmitted, or processed.
Those categories can cover source code, executables, scripts, databases, configuration files, documents, credentials, models, logs, images, exports, and other artifacts depending on the facts. A label from an employer or investigator—“confidential data,” “trade secret,” “customer list,” or “company property”—does not substitute for matching the charged object to the statutory language and proving ownership and the prohibited act.
Services include computer time and functions
Section 609.87’s services definition includes computer time, data processing, and storage functions. That matters to approach 1. The alleged object may be processing capacity, cloud storage, hosted computing, or another function rather than a physical device or file. The state should identify what service was allegedly sought, who provided it, the permission terms, the access event, and the evidence of the purpose to obtain it.
Loss is a defined grading fact
“Loss” means the greatest of three measures: retail market value of the property or services involved; reasonable repair or replacement cost, whichever is less; or reasonable value of damage created by unavailability or lack of utility until repair or replacement can be effected. The definition does not say that every incident-response invoice, projected commercial value, security budget, lost opportunity, or civil-damages theory automatically counts. Each amount needs a statutory category, reliable source, causal connection, reasonable method, and protection against duplication.
A log event is a clue; proving a person, act, object, intent, and date requires a connected record
Computer cases can contain enormous quantities of apparently precise data. Precision is not the same as reliability or legal sufficiency. A defense review should preserve native evidence, learn how each system generates it, test collection and interpretation, and connect—or disconnect—the event from a human actor.
Attribution begins with identity architecture
Map accounts, authentication, federation, single sign-on, multifactor methods, tokens, service principals, API keys, shared credentials, privileged access, remote tools, and device enrollment. An account name may show which credential was accepted, not who supplied it. An IP address may identify a connection or network, not the individual at the keyboard. A device can be shared, remotely controlled, compromised, or executing automation. Attribution may require login history, factor approvals, device custody, endpoint telemetry, location, command history, communications, behavior, and exclusion of reasonable alternatives.
Copying must be proved at the right layer
A file-access event is not necessarily a copy. A browser may cache data; a synchronization client may create a local replica; an email system may generate attachments or previews; a backup agent may duplicate content; a repository client may clone objects; an application may export records; and an operating system may produce temporary files. Identify the source, destination, method, scope, initiating process, user context, and whether the log records an attempted, completed, or inferred transfer.
Downstream conduct needs its own evidence
For approach 3, the state must connect access or copying with use, alteration, transfer, retention, or publication. Use may be shown through execution, integration, queries, derived output, or other activity, depending on the theory. Alteration should be supported by versions or hashes. Transfer should identify destination and receipt. Retention should identify a persistent copy and control. Publication should identify what was made available, to whom, when, and by what account or service.
Hashes and metadata support questions, not conclusions
A cryptographic hash can help show that two file sets are identical or that a forensic image remained unchanged. It does not prove who created or copied a file, whether access was authorized, or what the person intended. Creation, modification, access, synchronization, upload, download, and ingestion timestamps may reflect different clocks and processes. Time zones, daylight-saving changes, clock drift, server normalization, metadata copying, and tool interpretation must be documented.
Collection and chain of custody matter
Preserve forensic images, snapshots, logs, exports, cloud audit records, repository history, database audit tables, identity-provider records, endpoint alerts, network flow, data-loss-prevention alerts, ticketing records, and configuration history. Record who collected them, how, when, with what tool, from which source, using which filters, and whether the source continued to change. Screenshots and summaries can omit context. Native data, schemas, field definitions, retention policies, query parameters, and validation are often necessary.
Evidence rules frame admissibility
Minnesota Rules of Evidence 401 and 403 address relevance and the balance between probative value and specified risks. Rule 901 requires authentication or identification sufficient to support a finding that the item is what its proponent claims. Rule 1002 generally requires an original to prove content, subject to other rules. Rule 1006 governs summaries of voluminous writings, recordings, or photographs and includes access requirements. Criminal Procedure Rule 9.01 governs prosecution disclosure. The application of those rules depends on the evidence and purpose; a guide cannot decide admissibility in advance.
Expert conclusions should be reproducible
A forensic report should identify sources, acquisition methods, tools and versions, validation, filters, time handling, assumptions, exclusions, and limitations. Ask whether the examiner distinguished active files from deleted remnants, user acts from automated processes, local copies from synchronized replicas, file content from metadata, and observed facts from inferences. Preserve materials needed for independent review, including images, exports, hashes, logs, queries, notes, and tool output where discoverable.
The penalty tier depends on § 609.87 loss—not the largest number in an incident file
Subdivision 2 uses loss to the owner, owner’s agent, or lessee. The incorporated loss definition selects the greatest of three measures, but each measure has limits. The state should disclose its theory early enough to test it.
| Defined measure | Questions to test | Common proof |
|---|---|---|
| Retail market value of property or services involved | What property or service, in which market, on what date, and in what quantity? Is the figure retail value rather than internal development cost or projected strategic value? | Transactions, comparable sales, invoices, rate schedules, licensing terms, usage and market evidence. |
| Reasonable repair or replacement cost, whichever is less | Was repair possible? Were both figures considered? Which tasks restored the affected object, and which improved security or investigated unrelated risk? | Work orders, invoices, time records, vendor scope, restoration logs, backups, replacement quotes and expert allocation. |
| Reasonable value of damage from unavailability or lack of utility until repair or replacement can be effected | What was unavailable, for how long, because of what act, and how was the value calculated without duplicating repair or market value? | Uptime records, service metrics, operating data, affected-user evidence, restoration chronology and valuation method. |
Confidentiality and development cost do not automatically equal statutory loss
A company may have spent substantial money creating software or collecting data. It may value confidentiality, competitive advantage, customer trust, or future revenue. Those facts can matter to other claims and to the story of a case, but § 609.87 specifies loss measures. The state should explain how an asserted amount fits retail market value, reasonable repair or replacement cost subject to the lesser-cost rule, or reasonable unavailability/lack-of-utility damage.
Incident response requires allocation
After a suspected data incident, an organization may retain counsel, forensic consultants, public-relations specialists, notification vendors, monitoring services, security engineers, and replacement providers. Some work may investigate what happened; some may repair; some may improve systems; some may respond to regulatory or civil risk. A total invoice is not self-classifying. Review task descriptions, time entries, scope, causation, reasonableness, preexisting projects, upgrades, duplication, and whether the work repaired or replaced charged property.
The statute does not state an express aggregation rule
Section 609.89 sets tiers by loss but does not contain the six-month aggregation language found in parts of Minnesota’s general theft statute. This page therefore does not tell readers that separate § 609.89 incidents may always be aggregated. Multiple acts may present unit-of-prosecution, continuing-offense, joinder, notice, unanimity, and sentencing questions, but those require authority tied to the actual charges.
Restitution is a separate inquiry
Minnesota restitution statutes give a victim a right to request restitution after conviction and require itemized loss information supported by affidavit or other competent evidence. The court considers economic loss caused by the offense and the defendant’s income, resources, and obligations under the governing provisions. A restitution request may overlap with § 609.87 loss, but the legal purposes and procedures are not identical. A grading finding does not make every requested restitution item automatic, and a restitution claim should not silently establish the offense tier.
Exact dollar boundaries determine whether the current statutory maximum is ten years, five years, or 90 days
| Current proven statutory loss | Maximum imprisonment | Maximum fine | Boundary note |
|---|---|---|---|
| More than $2,500 | 10 years | $50,000 | The text requires loss in excess of $2,500. |
| More than $500 but not more than $2,500 | 5 years | $10,000 | Exactly $2,500 falls here. |
| All other cases | 90 days | $1,000 | Exactly $500 falls here because the middle tier requires more than $500. |
The statute states ceilings, not automatic outcomes
The prosecution must first prove a § 609.89 approach and the loss fact selecting the tier. For a felony conviction, the Minnesota Sentencing Guidelines provide a presumptive framework based on the applicable Guidelines version, severity level, criminal-history score, custody status, and other lawful considerations. The current offense-severity reference ranks computer theft over $2,500 at severity level 3 and computer theft of $2,500 or less at level 2. That reference does not convert an all-other-cases misdemeanor into a felony and does not replace the offense-date Guidelines.
No universal minimum custody term does not eliminate the minimum-fine framework
Section 609.89 itself does not state one mandatory minimum jail or prison term for every conviction. Section 609.101 nevertheless makes 30 percent of the applicable fine ceiling the current starting figure: $15,000 for the over-$2,500 felony, $3,000 for the over-$500-through-$2,500 felony, and $300 for the all-other-cases misdemeanor. The misdemeanor amount is subject to a lower uniform Judicial Council fine schedule. Qualifying public-defender status, indigence, or undue hardship permits reduction to at least $50; the court may allow community work service instead of a fine and may authorize installments. The fine remains distinct from restitution and the statutory surcharge.
Other statutes, criminal history, probation status, consecutive-sentencing rules, departures, and case-specific facts can affect custody exposure. A lawyer should obtain the complaint, criminal-history worksheet, Guidelines version, plea terms, and any enhancement notice before calculating a presumptive result.
Consequences extend beyond jail and fines but are not uniform
A conviction can create restitution, probation, record, employment, professional-licensing, security-clearance, immigration, civil, contractual, and data-access concerns. Those consequences depend on the conviction level, facts, sentence, person, license, status, and governing law. Section 609A.02 includes § 609.89 in a felony-expungement eligibility list, but eligibility, waiting periods, disqualifications, procedure, judicial findings, and the effect of an order must be analyzed individually. Inclusion on a list is not a promise of expungement.
A disciplined review tests the approach, date, authority, digital event, person, intent, and loss in that order
1. Which statutory approach is charged?
Do not accept “data theft” as a complete theory. approach 1 requires access to obtain services or property. approach 2 requires a deprivation intent and a possession verb. approach 3 requires access or copying plus a downstream act. approach 4 requires intentional retention beyond authority. The complaint, discovery, instruction, and verdict theory should remain aligned.
2. Which law applied on the date?
Current alternatives 3 and 4 apply to crimes committed on or after August 1, 2023. Identify every alleged access, copy, transfer, use, publication, and retention period. Retrieve the statute, definitions, and Guidelines applicable then. Challenge a theory that relies on later wording for earlier conduct.
3. What exactly is the computer property or service?
Name the device, system, network component, software, program, file set, database, export, account resource, storage, or processing service. Determine who owned it, where it resided, how it was accessed, whether it fits a statutory definition, and whether the state’s terminology matches technical reality.
4. What authority and claim of right existed?
Collect permission grants, agreements, notices, policies, role history, access requests, approvals, tickets, past practice, termination records, return demands, and deletion obligations. Identify the owner and authorized decision-maker. Separate a contractual dispute, policy breach, or overbroad credential from proof of the criminal element.
5. What digital event actually occurred?
Distinguish access, retrieval, copy, cache, synchronization, backup, export, transfer, use, alteration, retention, and publication. Review native logs and system architecture. Confirm the source, destination, method, object, timing, completeness, and whether the record shows a completed event or only an alert or inference.
6. Can the event reliably be attributed to the accused?
Test shared accounts, compromised credentials, remote access, service accounts, automation, device custody, multi-factor records, addresses, sessions, time zones, command history, and communications. Require a reasoned chain from system event to a particular person rather than treating the username as identity.
7. Can the state prove the approach-specific mental state?
Purpose to obtain, intent to deprive, intentional access or copying, and intentional retention are not interchangeable. Examine what the person knew, was told, sought, did afterward, and contemporaneously communicated. Mistake, automation, misunderstanding, routine work, authorized transfer, accidental persistence, and later discovery of a copy present different intent questions.
8. Does the loss calculation fit § 609.87?
Identify the selected measure and audit every component. Compare retail evidence, repair and replacement, outage duration, utility, causation, allocation, upgrades, duplication, and victim status. Preserve the exact $500 and $2,500 boundaries and do not import another statute’s aggregation rule without authority.
9. Were evidence and expert methods reliable?
Demand native sources, schemas, acquisition details, hashes, queries, filters, tool versions, time handling, chain of custody, and limitations. Compare summaries with the underlying record. Assess authentication, completeness, hearsay, original-content, voluminous-summary, relevance, prejudice, and discovery issues under the applicable rules.
10. What outcome protects the client’s actual priorities?
After the proof is tested, evaluate motions, investigation, negotiation, trial, sentencing, restitution, device return, employment, licensing, immigration, civil exposure, and record relief. A technically sophisticated defense still must give the client a clear comparison of risk, timing, cost, collateral effect, and available choices.
The first weeks can determine whether transient digital evidence survives
Cloud logs, identity records, security alerts, repository events, messaging content, surveillance, and device telemetry may have short retention periods. A preservation request should identify providers, accounts, tenants, repositories, endpoints, date ranges, and data types. It should not alter devices or violate orders. Counsel can evaluate subpoenas, discovery, expert imaging, protective orders, confidentiality, and whether business records must remain operational.
Do not “clean up” devices or accounts
Deleting files, wiping devices, revoking others’ access, changing logs, contacting witnesses, editing messages, or asking someone to remove data can create new factual and legal problems. Preserve the current state and obtain advice before acting. Ordinary automatic deletion and retention policies may also need prompt attention through lawful preservation steps.
Do not assume a company owns every copy on a personal device
Ownership and authority can be complicated by bring-your-own-device programs, personal accounts used for work, jointly created materials, open-source components, licenses, client data, and mixed folders. Preserve the agreements and file history. Avoid making categorical ownership claims until the controlling terms and facts are reviewed.
Separate criminal defense from parallel disputes
The same event may produce employment, contract, trade-secret, privacy, regulatory, insurance, or civil litigation. Statements, device access, return agreements, deletion certifications, or settlements in one matter can affect another. Coordination may be necessary, but § 609.89’s elements and burden remain distinct.
Preserve original evidence and the records that define authority
Legal and authority records
- Complaint, probable-cause statement, search warrants, inventories, subpoenas, notices, release conditions, and court dates.
- Employment, contractor, customer, license, intellectual-property, confidentiality, acceptable-use, data-use, and return-or-destroy agreements.
- Role descriptions, access requests, approvals, tickets, policy acknowledgments, warnings, termination or reassignment notices, and return demands.
- Messages showing purpose, permission, instructions, project scope, ownership claims, or disputes.
Technical records
- Native identity, multifactor, endpoint, server, cloud, repository, database, application, network, data-loss-prevention, and device-management logs.
- Forensic images, snapshots, backups, exports, hashes, metadata, file versions, sync history, caches, archives, and retention configuration.
- System diagrams, account inventories, role history, service accounts, API keys, automated jobs, collection notes, tools and versions, time-zone settings, and clock information.
- Repair, restoration, outage, replacement, market-value, licensing, usage, vendor, invoice, and time-entry records supporting or contradicting loss.
Questions about Minnesota computer or electronic-data theft
Is downloading a work file automatically computer or electronic-data theft?
No automatic conclusion follows from a download. The state must prove a current § 609.89 approach, including its specific authorization or claim-of-right language, act, object, and mental state. A approach 3 theory requires access or copying plus use, alteration, transfer, retention, or publication. approach 4 requires intentional retention beyond authority. The offense date, agreements, owner permission, purpose, destination, later conduct, and digital evidence matter.
Does the 2023 electronic-data amendment apply to older conduct?
The session law says the § 609.89 amendment is effective August 1, 2023 and applies to crimes committed on or after that date. The new alternatives 3 and 4 should not be silently applied to earlier conduct. If the alleged activity spans the date, map each act and charged period and research notice, retroactivity, unanimity, and the applicable statutory version.
Can a person be charged even if no file was successfully obtained?
approach 1 is written around intentional unauthorized or claim-of-right-free access for the purpose of obtaining services or property. Its text does not make successful acquisition the stated act. The state still must prove access or causing access, the prohibited authority status, the covered computer object, and the purpose. Other alternatives have different act requirements.
What does “retains copies beyond authority” mean?
Current approach 4 requires intentional retention of copies of software or electronic data beyond the individual’s authority. The statute does not supply a universal rule for caches, backups, synchronized files, inaccessible remnants, or personal archives. Determine when authority ended, what copy remained, where it was, whether the person knew of and controlled it, and what evidence shows intentional retention after that point.
Do valid credentials prove authorization?
No. Working credentials show technical capability, not necessarily owner permission for the charged time and purpose. Conversely, a policy violation does not automatically prove a criminal lack of authorization. Review the owner’s grant, delegation, notices, agreements, role, actual practice, approvals, technical controls, and changes over time.
How is loss calculated?
Section 609.87 defines loss as the greatest of retail market value of the property or services involved; reasonable repair or replacement cost, whichever is less; or reasonable value of damage from unavailability or lack of utility until repair or replacement can be effected. The state should identify its measure, evidence, victim, causation, and calculation and avoid duplication or unrelated improvement costs.
What are the current maximum penalties?
Loss over $2,500 carries up to ten years and/or $50,000. Loss more than $500 but not more than $2,500 carries up to five years and/or $10,000. All other cases carry up to 90 days and/or $1,000. Exactly $2,500 is in the middle tier; exactly $500 is in the all-other-cases tier. These are maximums, not predictions.
Can separate incidents be added together?
Section 609.89 does not state an express aggregation rule. This guide does not import the general-theft statute’s express aggregation language into computer theft. Multiple acts may raise other charging and unit-of-prosecution issues, but aggregation, joinder, unanimity, and sentencing must be researched for the actual case.
Can computer-theft records be expunged?
Minnesota’s felony-expungement statute includes § 609.89 in a listed category, but that does not make relief immediate or automatic. Eligibility, conviction level, waiting periods, subsequent offenses, excluded records, notice, burden, judicial findings, and the practical effect of an order all require case-specific analysis under the law then in force.
What should be preserved first?
Preserve the complaint and warrants; agreements and notices defining authority; original messages; native account, identity, device, cloud, repository, database, application, network, and security logs; forensic images and hashes; file versions and metadata; sync, cache, backup, and retention records; and itemized loss support. Do not delete, alter, access without permission, or contact witnesses contrary to an order.
Continue with the adjacent charge and process guides
- Minnesota theft, burglary, and fraud defenseStart with the broader property-offense framework and charging distinctions.
- Minnesota theft chargesCompare § 609.89 with the many separate theories in the general theft statute.
- Unauthorized computer accessSeparate penetration of a security system or terminal from computer or data theft.
- Computer damageReview damage, destruction, alteration, destructive programs, authorization, and statutory loss.
- Minnesota criminal court processUnderstand charging, discovery, motions, plea, trial, sentencing, and appeal stages.
A lawyer’s file review of Computer or Electronic Data Theft in Minnesota
Most bad early advice comes from answering the charge label instead of reading the charging clause. I begin with the operative count and work outward: definitions, exceptions, enhancement facts, evidence, procedure, and only then possible outcomes.
Read the count as a set of propositions the State must prove
The right starting point for Computer or Electronic Data Theft in Minnesota is Minn. Stat. §§ 609.89 and 609.87; 2023 Minn. Laws ch. 52, art. 5, §§ 47–48, read as it existed when the conduct allegedly occurred. I break the charge into the facts the law truly requires instead of treating the offense name as proof. Any fact that raises the degree or punishment gets its own question: who says it happened, what record supports it, and does the evidence satisfy the definition the statute uses?
I then place those answers on a timeline and test them against the complete record. A police summary may describe a witness, video, message, test, or prior conviction, but the underlying source matters more than the summary. Gaps, inconsistencies, and legal objections should be evaluated separately so that a real weakness is not confused with a technical complaint that has no remedy.
The evidence I would ask for first
For Computer or Electronic Data Theft in Minnesota, I would not begin with a canned list of defenses. I would begin with the source file: ownership and authorization records, contracts, receipts, valuation material, surveillance video, access logs, account and device records, messages, witness interviews, inventory and loss calculations, restitution support, and the evidence offered to prove identity, intent, entry, possession, value, force, or lack of consent. A police summary can identify what an officer or witness says happened, but it cannot substitute for the recording, photograph, data, or document being summarized. The same is true of a complaint. It identifies the prosecution’s theory at the start of the case; it does not prove the theory.
I put those materials on one chronology. That lets me see what was known at each decision point, which account was contemporaneous, what appeared only after people spoke with one another, and where the record is silent. It also keeps an admissibility question separate from a factual one. A fact can be disputed even if the evidence was lawfully obtained. Evidence can also be accurate yet inadmissible for a particular purpose. Those are different arguments and should not be blurred together.
Read the charging document against the offense date
The alleged date matters because statutes, penalty thresholds, definitions, sentencing rules, and published decisions change. I save the version in force on that date and read the session-law history when the current online text is different. I also check whether a later amendment was merely clarifying or made a substantive change; that is a legal question, not an assumption. The same discipline applies to prior convictions and administrative events. A prior must fit the definition the charged statute actually uses, fall within any stated lookback period, and be proved by a reliable record.
I then compare the formal count with the probable-cause narrative and the discovery. If the prosecution’s theory shifts, I want the amended pleading and enough detail to prepare. If several factual alternatives are alleged, I identify whether they are separate elements, alternative means, enhancement facts, or merely evidentiary details. That distinction affects notice, motions, jury instructions, unanimity arguments, and how a verdict form should be read.
Separate an evidentiary weakness from a suppression issue
Not every troubling fact produces a motion to suppress. Suppression ordinarily requires a constitutional, statutory, or rule-based violation with a remedy that reaches the evidence at issue. A weak identification, an incomplete investigation, or a witness inconsistency may be powerful at trial without making evidence inadmissible. By contrast, a stop, search, interrogation, identification procedure, warrant, or test can raise a legal issue even when the resulting evidence appears incriminating. I analyze both tracks and do not promise dismissal simply because one problem exists.
For a search issue, I reconstruct what officers knew before each intrusion and what authority they claimed. For a statement, I examine custody, questioning, warnings, voluntariness, recording, and the complete context. For scientific or technical evidence, I request the method, underlying data, quality-control material, uncertainty information, and chain of custody. For hearsay or confrontation questions, I identify the actual statement, its purpose, the declarant, and the proposed foundation. Specificity matters; “the evidence is bad” is not a motion.
Prepare negotiation and trial at the same time
A plea decision should be compared with the case the State could present at trial, not with the complaint’s maximum penalty in isolation. I want to know the strongest admissible proof, the weakest required element, the realistic motion practice, the likely instructions, and the consequences of every proposed disposition. That includes custody, probation, treatment, restitution, driving, firearm restrictions, registration, employment or licensing, immigration consultation, family-court effects, and record consequences when they are actually triggered. I avoid telling a client that every collateral consequence applies to every conviction.
Trial preparation gives negotiation its credibility. Witness interviews, exhibit review, motions in limine, expert consultation, demonstrative evidence, jury instructions, and a clean theory of the case force both sides to confront what can be proved. Negotiation can continue while that work is underway. The two tracks are not opposites.
A case-law point worth keeping in its proper place
Appellate decisions matter, but a quotation should not be detached from the issue the court was deciding. In State v. Fleck, 777 N.W.2d 233, 236 (Minn. 2010), the Minnesota Supreme Court described sufficiency review as viewing the evidence “in the light most favorable to the conviction.” That is an appellate-review rule, not a reduction of the State’s trial burden. At trial, the prosecution still must prove every element beyond a reasonable doubt. I cite the case for the proposition it actually decided and then return to the charged statute, the jury instructions, and the admissible evidence in the present file.
What I would want you to understand before choosing an outcome
You should be able to identify the exact charge, the facts that set its level, the disputed elements, the evidence that matters most, the motions that have a legal basis, the realistic trial issues, and the concrete effect of each proposed resolution. If an answer depends on a missing report, recording, expert opinion, or certified record, I will say so. An honest answer about what remains unknown is more useful than a confident guess.