North Dakota authorization and digital-evidence guide
Computer Fraud and Computer Crime Defense in North Dakota
North Dakota Century Code § 12.1-06.1-08 contains two different crimes. Computer fraud is a class C felony requiring conduct without authorization and a particular fraudulent, deceptive, use-prevention, or property-control purpose. Computer crime is a class A misdemeanor requiring intentional conduct either without authorization or beyond authorization, but not the felony subsection’s additional scheme. Both reach attempts and several kinds of access or interference. A defensible analysis therefore begins with the charged subsection, the precise computer act, the source and limits of permission, the alleged actor, and the evidence of intent—not with the loose conclusion that someone “hacked” an account.
You will work directly with me.
If you hire me, I separate the felony and misdemeanor theories, identify the exact access or interference act, and reconstruct the permission record before evaluating the State’s attribution and intent proof. I compare the complaint, warrant materials, forensic images, provider records, audit logs, device history, policies, communications, loss claim, and the law in force on the alleged date. That approach is more useful than accepting a technical label that does not answer the statutory elements.
Two liability alternatives that should not be blended
| Question | Computer fraud — subsection 1 | Computer crime — subsection 2 |
|---|---|---|
| Classification | Class C felony | Class A misdemeanor |
| Authorization boundary | Conduct must be without authorization | Conduct may be without authorization or in excess of authorization given |
| Mental state | Intent to devise or execute a specified scheme or artifice | Intentional commission of the listed conduct |
| Special purpose | Defraud, deceive, prevent authorized use, or control property or services by false or fraudulent pretenses, representations, or promises | No parallel fraud-scheme language appears in subsection 2 |
| Objects expressly named | Computer, computer system, computer network, or any part | Those items plus software, programs, and data contained in them |
| Conduct expressly unique to theory | The false-or-fraudulent means and special scheme define the felony theory | Introducing a computer contaminant is expressly listed here |
| Attempts | Gaining or attempting to gain access is covered | Gaining or attempting to gain access is covered |
The overlap is substantial, but the differences are consequential. A prosecutor cannot turn every intentional use beyond an employer’s permission into felony computer fraud without proving the additional subsection 1 purpose and means. Conversely, the misdemeanor theory does not become lawful merely because the State cannot prove a fraudulent promise. The factfinder must apply the charged subsection’s text.
The section’s special definition of “access” is broader than logging in. It includes approaching, instructing, communicating with, storing data in, retrieving data from, or otherwise using the resources of a computer, system, or network. That breadth makes factual precision more important. The charging instrument and evidence should identify what resource was used, what operation occurred or was attempted, when it happened, and why the State says it crossed the authorization boundary.
The definitions of property and services are also broad. Property includes financial instruments, information, electronically produced or stored data, supporting documentation, software, programs, and other tangible or intangible things of value. Services include computer time, data processing, storage functions, and other useful computer work. These definitions can matter to the felony purpose theory, but the State still must connect the alleged false pretense, representation, or promise to controlling property or services, or connect the scheme to fraud, deception, or prevention of authorized use.
Which subsection?
Identify whether the State alleges felony computer fraud, misdemeanor computer crime, or both, and keep their mental states separate.
Which act?
Match every count to a specific login, command, copy, alteration, disclosure, deletion, contaminant, attempted access, or interruption.
What permission?
Find who granted access, what resources and purposes it covered, whether it changed, and how any limit was communicated.
Whose conduct?
Separate an account, device, or IP address from the human actor through corroborated forensic and circumstantial evidence.
Authorization is a fact-specific legal question, not a label
Start with the person or entity able to grant permission
An authorization analysis should identify who controlled the computer resource and who had authority to permit its use. In a business, that may involve owners, administrators, managers, written policies, role-based permissions, customer agreements, vendor contracts, and established practices. In a household, it may involve shared devices, family accounts, remembered credentials, prior consent, and later revocation. In a cloud service, the nominal subscriber may not be the only authorized user. The inquiry is not resolved by possession of a password.
Define scope by resource, function, time, and purpose
Permission to view one database does not necessarily authorize downloading the entire database. Permission to work during employment does not necessarily authorize access after termination. A support technician may be allowed to reset a password without being allowed to read private messages. A customer may use a portal without being allowed to alter server-side data. The record should isolate the resource, operation, time window, purpose, and any conditions relevant to the charged event.
Subsection 1 and subsection 2 draw different boundaries
The felony subsection says “without authorization.” The misdemeanor subsection says “either in excess of authorization given or without authorization.” That wording matters. A theory that a person had some permission but exceeded its limits fits the express language of subsection 2; it should not automatically be imported into subsection 1. If the State alleges the felony, the evidence and instructions should address why the relevant conduct was without authorization and why the required fraudulent or deceptive purpose existed.
Revocation must be tied to notice and timing
A password change, termination letter, cease-and-desist demand, administrator message, access-control update, or direct instruction may show revocation. But the analysis should ask when the change occurred, whether the accused knew about it, which credentials or devices remained active, and whether the disputed event happened before or after notice. A later security response does not retroactively define an earlier permission arrangement.
Written policy is evidence, not the entire case
Policies can be important, especially when acknowledgment records show notice. They may also be broad, outdated, inconsistently enforced, or unrelated to the operation charged. Technical permissions and human instructions can conflict. Evidence of ordinary practice may illuminate how access actually worked, but informal tolerance does not necessarily erase an express limit. The defense should compare policy language, onboarding materials, access-control settings, training, prior approvals, administrator conduct, and the particular count.
Credential sharing creates several separate questions
Knowing a password may explain how access occurred without proving it was authorized. Conversely, using another person’s credentials may be within a delegated task in some settings. Shared credentials also weaken attribution: logs may identify an account without identifying the operator. The investigation should establish how credentials were issued, stored, shared, changed, and used, and whether multifactor prompts, device identifiers, location, or contemporaneous communications corroborate the alleged actor.
Access, copying, disclosure, alteration, damage, possession, destruction, and interruption are not interchangeable
Gaining or attempting to gain access
An access allegation may rest on successful login records, failed authentications, password-reset attempts, remote-session history, API calls, commands, or communications with a network resource. Because the statute includes attempts to gain access, failure to reach the data does not end the analysis. But an alert from a security product may represent automated traffic, a blocked request, a misconfiguration, or a shared network. The State still must connect the event to the accused, the authorization boundary, and the required mental state.
Altering, damaging, modifying, or destroying
These verbs require a before-and-after account of what changed. Useful evidence may include backups, version histories, database transactions, audit logs, file metadata, system snapshots, integrity hashes, service tickets, and testimony from a knowledgeable administrator. “Damage” should not be inferred solely from inconvenience or an invoice. The State’s theory should identify the affected resource, the operation, the resulting condition, and the causal link; the defense should test whether routine maintenance, another user, software behavior, or recovery actions explain the change.
Copying, disclosing, or taking possession
A file found on a device may support possession without establishing how it arrived, who copied it, or whether it was disclosed. Cloud synchronization, automatic backup, email caching, shared folders, export tools, and third-party transfers can create copies without the same human act. Disclosure should identify the data communicated, recipient, method, time, and actor. The statutory definition of property includes information and stored data, but proof of value or sensitivity does not substitute for proof of the charged verb and authorization.
Preventing authorized use
Lockouts, changed credentials, encryption, service interruption, resource exhaustion, deleted permissions, disabled accounts, and damaged configurations can prevent use. Subsection 1 treats prevention of authorized use as one possible objective of the fraudulent or deceptive scheme; subsection 2 lists preventing authorized use as conduct. Those are different placements in the statutory structure. Duration and business impact may affect loss and sentencing, but even a brief interruption requires reliable attribution and a proven authorization boundary.
Introducing a computer contaminant
The misdemeanor theory expressly lists introducing a computer contaminant. The page should not assume that every unwanted program, script, macro, extension, or command fits that description. A technical witness should identify the code or mechanism, what it did, how it entered the system, whether it executed, and why the evidence ties introduction to the accused. Antivirus labels can guide investigation but should be tested against the underlying artifact, version, signature, sandbox result, and expert methodology.
One incident may produce multiple counts, but each count needs an identity
A sequence can involve entry, copying, deletion, disclosure, and interruption. The prosecution may allege separate acts or alternative theories. The defense should create a count map listing timestamp, system, account, device, command or file, authorization evidence, intent evidence, and claimed loss for each count. That prevents a broad narrative about a “breach” from concealing gaps in a specific offense and permits a careful merger, unanimity, and double-jeopardy analysis when theories overlap.
How I examine digital attribution, intent, and forensic reliability
1. Preserve native evidence and the collection history
Screenshots and summary reports can omit timestamps, time zones, identifiers, surrounding events, hidden fields, failed operations, and collection settings. I look for forensic images where appropriate, native exports, provider productions, original logs, backup copies, hash values, tool versions, examiner notes, evidence receipts, and chain-of-custody records. Preservation should be lawful and should not involve entering another person’s account, deleting material, or changing the system.
2. Normalize time before drawing a sequence
Devices, servers, security appliances, cloud providers, and applications may record local time, UTC, or different offsets. Clock drift, daylight-saving changes, log ingestion, export conversion, and file copying can move apparent times. A reliable timeline documents each source’s time basis, converts consistently, and distinguishes event time from creation, modification, synchronization, upload, or report-generation time. A few minutes can matter when several people had access or permission changed during the day.
3. Separate subscriber, account, device, session, and human actor
An email address, username, billing record, device serial number, or IP address establishes only part of attribution. Shared networks, carrier translation, VPNs, remote access, linked devices, stolen credentials, service accounts, administrators, and automated processes complicate the inference. Stronger attribution may combine possession, multifactor records, device tokens, browser artifacts, location, work schedule, contemporaneous messages, typing or command patterns, exclusive knowledge, motive, and admissions. Each item has limits and should be tested rather than stacked as repeated labels for the same fact.
4. Read audit logs with their schema and retention rules
A log field may reflect the account requesting an action, a service acting on the account’s behalf, the originating host, a proxy, or the system that recorded the event. “Success” may mean authentication succeeded without proving a later command executed. Retention gaps and overwritten logs can create false beginnings or endings. I seek the data dictionary, logging configuration, retention policy, relevant neighboring events, administrator changes, and testimony or documentation explaining what the product actually records.
5. Test intent against alternatives
The felony purpose can be shown circumstantially, but conduct that looks suspicious after a breakdown may have a different contemporaneous explanation. Work assignments, troubleshooting, data migration, backup, security testing, customer support, litigation hold, ownership dispute, or mistaken account selection may affect intent and authorization. Conversely, concealment, false statements, staged credentials, exfiltration, payment demands, recipient communications, or disabling logs may support the State’s theory. The analysis should identify which inference the actual evidence supports, not assume intent from the seriousness of the result.
6. Compare claimed loss with recoverable evidence
Incident-response invoices, employee time, restoration cost, lost revenue, ransom, replacement hardware, and reputational claims may appear in a victim statement or civil demand. Those figures should be tied to the charged act and separated from upgrades, deferred maintenance, unrelated outages, insurance positions, and precautionary work. Loss can matter to restitution, sentencing, negotiations, and the civil action, but it is not a substitute for proving the criminal elements.
7. Review statements in their full setting
A person may admit using an account but dispute the operation, timing, permission, or purpose. Technical terminology in an interview can be ambiguous. I compare recordings with reports and ask whether questioning was custodial, whether Miranda rights applied and were honored, whether a request for counsel or silence occurred, whether investigators supplied details, and whether language, fatigue, promises, or technical confusion affected the answer. A summarized admission should be checked against the recording.
8. Audit the search from authorization to execution
North Dakota Rule of Criminal Procedure 41 governs warrants and suppression procedure. The review should compare the affidavit, judicial authorization, devices and accounts seized, date limits, categories of data, extraction method, filtering, later searches, returns, and provider process. Issues can include nexus, particularity, stale information, good faith, consent, private searches, and whether investigators exceeded authorized scope. Suppression depends on the actual record; a lawful search makes evidence available but does not establish that the accused committed the charged offense.
9. Use discovery to obtain data, tests, and expert foundations
Rule 16 provides for disclosure of documents, data, objects, scientific-test reports, and expert summaries when its conditions are satisfied, and it imposes a continuing duty to disclose covered material later discovered. In a computer case, the useful request is specific: original and processed logs, forensic images or accessible copies, extraction reports, hash lists, tool output, scripts, alert rules, screenshots, provider productions, examiner notes, test results, loss materials, policies, credentials history, and exculpatory or impeachment information. A static report is not always enough to reproduce an analysis.
10. Distinguish authentication from ultimate proof
Rule 901 asks whether there is evidence sufficient to support a finding that an exhibit is what the proponent claims. State v. Burton, 2025 ND 83, explains in another context that authentication can rest on multiple methods and circumstantial evidence; it did not decide computer-fraud elements or make an account owner the author of every digital act. Rule 902 provides certification theories for certain electronic-process records and copied device or file data, subject to its requirements. Rule 1001 defines electronic originals and duplicates. Authentication does not eliminate hearsay, relevance, completeness, reliability, or attribution disputes.
Common issues are evidence questions, not automatic defenses
The State charged the wrong authorization theory
If evidence shows limited permission rather than no permission, subsection 2’s “in excess of authorization” language may be central. That does not automatically defeat every charge, but it can undermine a felony theory that relies only on exceeded scope without proving the text of subsection 1.
The actor cannot be reliably identified
An account, device, or network address may be associated with the accused while several people or automated systems could act. Attribution should be evaluated with independent corroboration and a time-specific access map.
The required felony purpose is missing
Unapproved use, poor judgment, curiosity, a workplace dispute, or policy violation does not by itself prove intent to execute the specific fraudulent, deceptive, prevention, or control scheme described by subsection 1.
The alleged act did not occur as described
A failed alert may not be a successful alteration; a cached copy may not be a deliberate copy; an outage may have another cause; and a deletion entry may reflect retention software. Original records and expert methodology matter.
The search or statement is suppressible
Warrant scope, consent, custody, Miranda, invocation, voluntariness, and derivative evidence require record-specific analysis. Suppression is not presumed merely because evidence is digital.
The offense-date law differs
The current code should not be applied automatically to older conduct. The enacted language, definitions, classification, penalty law, and procedural posture in force on the alleged date must be checked.
Other issues may include venue, jurisdiction, corporate or agency responsibility, accomplice liability, attempt instructions, multiplicity, unanimity, preservation failures, late discovery, expert admissibility, alternative-perpetrator evidence, and the relationship between this charge and theft, identifying-information, forgery, extortion, or federal allegations. None can be resolved from the title of the charge alone.
No published North Dakota Supreme Court opinion directly construing § 12.1-06.1-08 was located in the official-opinion search rechecked on October 30, 2026. That is a research result, not a promise that no relevant decision exists. Trial decisions, unpublished material, federal cases, decisions construing analogous language, and opinions issued after this check may matter. Final advice requires a fresh offense-date and later-authority search.
Current language should not be projected backward
The 1987 reenactment expanded the operative verbs and attempt language
House Bill 1038, enacted in 1987, reenacted § 12.1-06.1-08 and the special computer definitions. The session law added “attempting to gain access” and expanded the listed conduct beyond the earlier formulation. It also revised the classifications then attached to the two theories. An allegation predating that enactment cannot be analyzed by simply copying today’s list of acts into the earlier period.
The 2003 amendment added contaminant language and the civil action
House Bill 1251, enacted in 2003, added “introducing a computer contaminant into” to the misdemeanor theory and enacted subsection 3. The final text permits an owner or lessee to bring a civil action for damages, restitution, and attorney fees for damages caused by a violation. The enacted version did not retain the introduced bill’s proposed limitation to an action against a person already convicted. That history matters when the parties dispute whether the civil claim depends on a prior criminal judgment.
The current 360-day ceiling is not the historical ceiling for every offense date
House Bill 1269 changed the general Class A misdemeanor maximum from one year to 360 days in 2017. The current computer-crime theory is therefore accurately described as carrying up to 360 days under current § 12.1-32-01, but an older alleged offense requires the penalty statute then in force. The computer-fraud classification remains a Class C felony in the current statute, with the current five-year and $10,000 ceilings supplied by the general sentencing chapter.
A reliable offense-date review preserves three versions
For each count, preserve the version of § 12.1-06.1-08, the special definitions in § 12.1-06.1-01(3), and the general classification statute effective on the alleged date. If conduct spans an amendment, the complaint and bill of particulars should identify the act and date supporting each count. A later statute can illuminate history, but it cannot silently add a verb, remedy, or penalty to earlier conduct.
Criminal penalties, restitution, and the separate civil remedy
| theory or consequence | Current rule | Important qualification |
|---|---|---|
| Computer fraud | Class C felony; up to five years, a $10,000 fine, or both | Requires subsection 1’s no-authorization finding and special scheme or artifice intent |
| Computer crime | Class A misdemeanor; up to 360 days, a $3,000 fine, or both | Expressly includes conduct exceeding authorization and does not repeat the felony’s fraud-scheme language |
| Mandatory minimum | Section 12.1-06.1-08 states no incarceration minimum applicable to every conviction | Actual disposition depends on the case, other charges, history, sentencing law, and any agreement |
| Criminal restitution | May be requested under applicable sentencing law for proven compensable loss | Causation, amount, documentation, insurance, offsets, and the relationship to the offense can be contested |
| Civil action under subsection 3 | Owner or lessee may seek damages, restitution, and attorney fees for damage from a violation | This is a separate remedy; it does not create a third crime or prove the criminal case automatically |
| Collateral effects | A felony conviction can affect employment, licensing, housing, firearms, immigration, and background checks | Consequences are person- and context-specific; the page does not promise that each applies in every case |
The statutory maximum is not a prediction. Sentencing can turn on the conduct, harm, restoration, prior record, acceptance of responsibility, victim input, related counts, negotiations, and available alternatives. A charge involving a former employee and copied records presents different sentencing facts from malware that disables a public system, even if the same subsection appears on the complaint.
The owner-or-lessee civil action deserves separate attention because criminal and civil positions can interact. Preservation demands, insurance communications, employment claims, contract disputes, protective orders, and parallel discovery may affect strategy. A defendant should not destroy data, contact witnesses improperly, enter systems, or attempt self-help restoration. Counsel can coordinate lawful preservation and communication while protecting constitutional and litigation rights.
Frequently asked questions
What is the difference between computer fraud and computer crime?
Computer fraud is a class C felony requiring conduct without authorization plus intent to devise or execute the scheme described in subsection 1. Computer crime is a class A misdemeanor requiring intentional listed conduct without authorization or beyond authorization; it does not repeat the felony’s special fraud-scheme language.
Is using a shared password automatically a crime?
No automatic rule follows from password sharing alone. It can be important evidence, but the State must prove the charged act, authorization boundary, actor, and mental state. The source, scope, duration, revocation, and purpose of permission matter.
Can an unsuccessful login attempt be charged?
Both subsections expressly include attempting to gain access. The State still must prove who made the attempt, which resource was targeted, the applicable authorization facts, and the mental state required by the charged subsection.
Does the State have to prove a financial loss?
The offense text does not make a particular dollar-loss threshold an element of every theory. Loss can matter to restitution, sentencing, negotiation, and the civil action, but it does not replace the statutory conduct, authorization, and intent requirements.
Does an IP address prove who used the computer?
Not by itself. An IP address may identify a connection or subscriber, while shared networks, carrier translation, VPNs, remote access, and multiple users remain possible. Device, session, timing, possession, multifactor, communications, and other corroboration should be examined.
Can my employer’s policy establish lack of authorization?
A clear acknowledged policy can be significant, but it should be compared with technical permissions, job duties, instructions, ordinary practice, exceptions, timing, and the exact operation charged. Subsection 1 and subsection 2 also use different authorization language.
Can the owner sue in addition to the criminal case?
Yes. Subsection 3 permits an owner or lessee to bring a civil action for damages, restitution, and attorney fees for damage from a violation. The civil claim remains separate and must establish its own required proof.
What should I preserve for my lawyer?
Preserve the complaint, release order, warrants, property receipts, policies, contracts, permission messages, termination or revocation notices, device and account list, timelines, complete communications, loss demands, and any copies lawfully in your possession. Do not delete data or enter systems to collect more.
A lawyer’s file review of Computer Fraud and Computer Crime Defense in North Dakota
I do not assume the complaint’s narrative and its statutory citation line up. The practical work is to test that fit, identify what the State can actually prove, and separate a serious allegation from a legally sufficient case.
Read the count as a set of propositions the State must prove
To understand Computer Fraud and Computer Crime Defense in North Dakota, I start with N.D.C.C. §§ 12.1-06.1-01(3), 12.1-06.1-08, 12.1-02-02, and 12.1-32-01 and the version of the law in effect on the alleged date. The offense classification sets the outer framework, but it does not tell us what happened or what the state can prove. I then identify every fact that could change the charge or sentence and look for the record, testimony, or forensic evidence that supports—or contradicts—each one.
From there, I build a proof map. For every required element, I identify the witness, recording, document, test result, or admissible inference the prosecution would rely on, then compare that source with the rest of the file. This separates a disputed fact from a search, statement, or admissibility issue and keeps the analysis focused on problems that can actually affect the case.
The evidence I would ask for first
For Computer Fraud and Computer Crime Defense in North Dakota, I would not begin with a canned list of defenses. I would begin with the source file: ownership and authorization records, contracts, receipts, valuation material, surveillance video, access logs, account and device records, messages, witness interviews, inventory and loss calculations, restitution support, and the evidence offered to prove identity, intent, entry, possession, value, force, or lack of consent. A police summary can identify what an officer or witness says happened, but it cannot substitute for the recording, photograph, data, or document being summarized. The same is true of a complaint. It identifies the prosecution’s theory at the start of the case; it does not prove the theory.
I put those materials on one chronology. That lets me see what was known at each decision point, which account was contemporaneous, what appeared only after people spoke with one another, and where the record is silent. It also keeps an admissibility question separate from a factual one. A fact can be disputed even if the evidence was lawfully obtained. Evidence can also be accurate yet inadmissible for a particular purpose. Those are different arguments and should not be blurred together.
Read the charging document against the offense date
The alleged date matters because statutes, penalty thresholds, definitions, sentencing rules, and published decisions change. I save the version in force on that date and read the session-law history when the current online text is different. I also check whether a later amendment was merely clarifying or made a substantive change; that is a legal question, not an assumption. The same discipline applies to prior convictions and administrative events. A prior must fit the definition the charged statute actually uses, fall within any stated lookback period, and be proved by a reliable record.
I then compare the formal count with the probable-cause narrative and the discovery. If the prosecution’s theory shifts, I want the amended pleading and enough detail to prepare. If several factual alternatives are alleged, I identify whether they are separate elements, alternative means, enhancement facts, or merely evidentiary details. That distinction affects notice, motions, jury instructions, unanimity arguments, and how a verdict form should be read.
Separate an evidentiary weakness from a suppression issue
Not every troubling fact produces a motion to suppress. Suppression ordinarily requires a constitutional, statutory, or rule-based violation with a remedy that reaches the evidence at issue. A weak identification, an incomplete investigation, or a witness inconsistency may be powerful at trial without making evidence inadmissible. By contrast, a stop, search, interrogation, identification procedure, warrant, or test can raise a legal issue even when the resulting evidence appears incriminating. I analyze both tracks and do not promise dismissal simply because one problem exists.
For a search issue, I reconstruct what officers knew before each intrusion and what authority they claimed. For a statement, I examine custody, questioning, warnings, voluntariness, recording, and the complete context. For scientific or technical evidence, I request the method, underlying data, quality-control material, uncertainty information, and chain of custody. For hearsay or confrontation questions, I identify the actual statement, its purpose, the declarant, and the proposed foundation. Specificity matters; “the evidence is bad” is not a motion.
Prepare negotiation and trial at the same time
A plea decision should be compared with the case the State could present at trial, not with the complaint’s maximum penalty in isolation. I want to know the strongest admissible proof, the weakest required element, the realistic motion practice, the likely instructions, and the consequences of every proposed disposition. That includes custody, probation, treatment, restitution, driving, firearm restrictions, registration, employment or licensing, immigration consultation, family-court effects, and record consequences when they are actually triggered. I avoid telling a client that every collateral consequence applies to every conviction.
Trial preparation gives negotiation its credibility. Witness interviews, exhibit review, motions in limine, expert consultation, demonstrative evidence, jury instructions, and a clean theory of the case force both sides to confront what can be proved. Negotiation can continue while that work is underway. The two tracks are not opposites.
A case-law point worth keeping in its proper place
Appellate decisions matter, but a quotation should not be detached from the issue the court was deciding. In State v. Hartson, 2024 ND 78, ¶ 26, the North Dakota Supreme Court explained that, on a sufficiency challenge, “we do not weigh conflicting evidence, or judge the credibility of witnesses.” That is an appellate-review rule, not a reduction of the State’s burden at trial. At trial, the prosecution still must prove every element beyond a reasonable doubt. I cite the case for the point it actually decided and then return to the charged statute, the instructions, and the admissible evidence in the present file.
What I would want you to understand before choosing an outcome
You should be able to identify the exact charge, the facts that set its level, the disputed elements, the evidence that matters most, the motions that have a legal basis, the realistic trial issues, and the concrete effect of each proposed resolution. If an answer depends on a missing report, recording, expert opinion, or certified record, I will say so. An honest answer about what remains unknown is more useful than a confident guess.