What Are Computer Crime and Hacking Charges in Colorado?

Colorado prosecutes hacking under C.R.S. 18-5.5-102, a statute the legislature renamed “cybercrime” in 2018. Cybercrime offenses can range from a  a class 2 misdemeanor for simply accessing a computer, network, or system without authorization, carrying up to 120 days in jail, to class 2 felony carrying 8 to 24 years in prison.   Cybercrime scales with the dollar value of the loss or damage, running from a petty offense under $300 all the way to a class 2 felony at $1 million or more. The felony line sits at $2,000.

The statute is written broadly enough to reach conduct most people would not call hacking at all. Exceeding authorized access counts, which means that using credentials you legitimately have, but for a purpose your employer did not permit, can support a charge.

What Conduct Does the Colorado Cybercrime Statute Cover?

Section 18-5.5-102(1) lists several distinct ways to commit the offense. A person commits cybercrime if they knowingly:

• Access a computer, network, or system without authorization, exceed authorized access, or use one without authorization or in excess of authorized access
• Access a computer or system to devise or execute a scheme to defraud
• Access a computer or system to obtain money, property, services, passwords, or similar information by false or fraudulent pretenses
• Damage, interrupt, or cause the malfunction of a computer, network, or system
• Use a computer or system to commit theft
• Take, transfer, conceal, or retain possession of a computer or system without authorization

There are also provisions covering the use of automated software to purchase event tickets, which is a class 2 misdemeanor and where each ticket purchased is a separate offense.

The “exceeds authorized access” language is the sleeper. An employee with valid credentials who downloads a client list before resigning has arguably exceeded authorized access. Employment disputes turn into criminal referrals this way with some regularity.

What Are the Penalties for Cybercrime in Colorado?

Two separate schemes apply depending on which subsection is charged.

Unauthorized access alone, under subsection (1)(a), is a class 2 misdemeanor, up to 120 days in jail. If the person has a prior conviction under the section, it becomes a class 6 felony.

Everything else runs on the value ladder in subsection (3)(a), measured by the loss, damage, value of services, value of the thing taken, or the cost of restoration or repair:

Certain subsections carry a class 5 felony regardless of value. Colorado felony sentences also carry mandatory parole periods after release, ranging from one year for a class 6 felony to three or five years for class 2 or 3, depending on the type of offense.

Could the Same Conduct Be a Federal Crime?

Frequently, and this is the exposure that matters most in serious cases.

The Computer Fraud and Abuse Act, 18 U.S.C. Section 1030, covers unauthorized access to a “protected computer,” a term broad enough to include essentially any computer connected to the internet. CFAA penalties reach up to 10 years for a first offense on certain violations and up to 20 years for a subsequent violation.

Because almost any hacking case involves interstate communication, federal jurisdiction is usually available. What determines the forum is prosecutorial interest: loss amount, whether critical infrastructure or a financial institution was involved, and whether multiple states or countries are implicated.

Related federal statutes often charged alongside the CFAA include wire fraud under Section 1343, identity theft, and aggravated identity theft, which carries a mandatory consecutive prison term. When federal charges are on the table, the state case becomes a secondary concern.

How Is the Loss Amount Calculated, and Why Does It Decide the Case?

Because the offense level is frequently a pure function of the number, the valuation fight is often the case.

The statute measures loss, damage, value of services, value taken, or cost of restoration or repair. That last category is where alleged amounts inflate fastest. A company responding to an intrusion may claim:

• Outside forensic investigation and incident response fees
• A complete infrastructure rebuild rather than remediation of the affected systems
• Security upgrades the company needed anyway
• Employee time valued at full billing rates
• Speculative lost revenue or reputational harm
• Notification and credit monitoring for individuals who may not have been affected

Not all of that is properly attributable to the defendant’s conduct. Pushing a claimed $22,000 loss below $20,000 moves the charge from a class 4 to a class 5 felony. Pushing $5,200 below $5,000 moves it from a class 5 to a class 6.

An independent technical expert who can separate genuine remediation from opportunistic accounting is often a valuable defense investment.

What Are the Defenses to a Colorado Hacking Charge?

Authorization. This is the central battleground. If you had permission, or reasonably believed you did, the access element fails. Shared passwords, informal practices tolerated by an employer, and vague or absent computer use policies all support this. A company with no written access policy has a harder time proving what was unauthorized.

Attribution. The State must prove you were at the keyboard. An IP address identifies a connection, not a person. Shared networks, shared devices, unsecured Wi-Fi, malware turning a machine into a proxy, and stolen credentials all create genuine doubt.

Knowingly. The statute requires a knowing mental state. Accidental access, misconfigured permissions, and automated processes are not knowing conduct.

Loss valuation. As above, and it is the most reliably productive defense.

Search and seizure. Digital evidence cases live and die on warrants. Overbroad warrants that authorize seizure of every device, searches that exceed the warrant’s scope, and problems with cell site or provider data are all litigable. A successful suppression motion frequently ends the case.

Civil dispute in criminal clothing. Where the real conflict is a departing employee, a business partner falling out, or a family dispute over a shared account, that context matters to a prosecutor.

Colorado Cybercrime FAQs

Is accessing my spouse’s email a crime in Colorado?

It can be. Accessing an account without authorization fits subsection (1)(a) even between spouses, and it comes up regularly in divorce cases. Federal wiretap and stored communications laws may also apply.

What if I found a security flaw and reported it?

Good faith research is not a statutory defense in Colorado. Coordinated disclosure programs and written authorization are what protect researchers. Testing without written permission carries real risk.

Is taking company files when I quit a computer crime?

Potentially, under the “exceeds authorized access” and theft provisions. These cases often begin as civil trade secret disputes and get referred for prosecution.

Can a cybercrime conviction be sealed in Colorado?

Some convictions become eligible for sealing after a waiting period that depends on the offense level. Felony eligibility is narrower and the timelines are longer.

Your Next Step If You Are Under Investigation

Digital cases are decided by evidence you may still control.

1. Do not touch the devices. Deleting files or wiping a drive creates a separate obstruction charge and destroys your own exculpatory evidence
2. Do not consent to a device search. Require a warrant, which creates something your lawyer can challenge
3. Say nothing about access or authorization. “I still had my password” is an admission on the central element
4. Preserve evidence of authorization, including policies, credential-sharing practices, emails granting access, and prior tolerated conduct
5. Retain a technical expert early, both for attribution and to attack the loss calculation
6. Ask whether federal charges are being considered, because that changes the entire strategy

Flatiron Legal Advisors defends technology and white-collar allegations through our Colorado criminal defense team, and handles federal matters as well. Because these cases so often begin as workplace or partnership disputes, we can address the civil litigation side in parallel. If a conviction is already behind you, see our guide on record sealing eligibility in Colorado.

Schedule a confidential consultation before you speak with investigators.