Unauthorized Computer Access Defense

What the State must prove

To convict under section 815.06, the State has to show that a person accessed a computer, system, or network, that the access was knowing and willful, and that it was without authorization or exceeded the authorization given. Each piece is a separate hurdle. The access has to be tied to a particular person, not merely a device or an address. The mental state has to be proven, not assumed from the fact that something happened. And the access has to be genuinely unauthorized, which is far less obvious than it sounds.

The grade of the offense depends on what the access was used to do. Simple unauthorized access sits at the lower end; access aimed at defrauding, obtaining property, or interrupting a service is treated more seriously. Where a given case lands on that scale is itself worth contesting, because the difference shapes everything that follows.

Authorization is rarely simple

Most unauthorized-access cases are arguments about a single question: did this person have permission. Credentials are shared all the time, between spouses, business partners, coworkers, and friends. A former employee may still have a working login because no one disabled it, which is a failure of the employer, not a crime by the employee. A family member uses a shared account. A person logs into a service they reasonably believed they were entitled to use. None of that is the clean, deliberate intrusion the statute is aimed at, and the gap between the headline and the facts is where a defense lives.

Exceeding authorization is murkier still. When someone has legitimate access but is accused of using it for the wrong purpose, the line between a policy violation and a crime can be genuinely unclear. That ambiguity is not a weakness in your case. It is a tool.

An IP address is not a person

Computer cases lean heavily on technical breadcrumbs, and an IP address is the most common one. It is also the most misunderstood. An IP address identifies a connection, not a person. Home and business networks are shared. Addresses are handed out dynamically and reassigned from one customer to the next. They can be spoofed. Malware can route activity through a machine whose owner has no idea. Tracing activity to an address is the beginning of an inquiry, not the end of one, and treating it as proof of identity is exactly the leap a careful defense refuses to let the State make.

How a tech-fluent defense helps

Before he practiced law, Graham Syfert owned a technology company, and he is a member of the Technology Law Section of the Georgia Bar. He reads the logs the State relies on, questions how access was reconstructed, and presses on whether the devices were searched lawfully under the Fourth Amendment. When the State's evidence comes from a phone or computer, the validity and scope of the warrant that produced it can decide the case. These issues get raised early, in writing, before they slip away.