Colorado’s cybercrime statute, C.R.S. § 18-5.5-102, is broad by design — it covers everything from unauthorized computer access to card-skimming devices to using bots to buy up concert tickets. Most of its provisions scale with dollar loss, but a few carry flat penalties regardless of value.
What Counts as Cybercrime
The statute criminalizes knowingly: accessing a computer or network without authorization or in excess of authorized access; accessing a system to devise or execute a scheme to defraud; accessing a system to obtain money, property, services, or passwords through false pretenses; accessing a system to commit theft; altering, damaging, or interrupting a system or its data without authorization; transmitting code or data intending to cause damage; using bots to circumvent ticket-purchase limits; soliciting a minor for prostitution via computer; or using a skimming or re-encoding device to steal payment card information.
How It’s Classified and Sentenced
Most cybercrime violations scale with the loss, damage, or value involved — from a petty offense under $300 up to a class 2 felony at $1 million or more. A few provisions carry flat penalties regardless of value: unauthorized access alone is a class 2 misdemeanor; using a payment-card skimming or re-encoding device, or soliciting a minor online, is a flat class 5 felony; and bypassing ticket-purchase limits with a bot is a class 2 misdemeanor, with each ticket purchased counting as a separate offense.
Case Law That Shapes Cybercrime Defense
People v. Stotz, 2016 COA 16: Deleting the only electronic copies of thousands of a former employer’s documents clearly falls within the statute’s definition of “damage,” and the statute is neither unconstitutionally vague nor overbroad as applied to that conduct. The court also held that “knowingly” applies to every element of the damage-based subsection, not just the access itself.
People v. Rice, 198 P.3d 1241 (Colo. App. 2008): “Access” has a plain, unambiguous meaning — communicating with an automated telephone system by entering data in response to computer-generated questions counts as accessing a computer system.
People v. Galang, 2016 COA 68: A conviction under the “scheme to defraud” provision doesn’t require proof that the victim actually suffered an injury, loss, or damage — when there’s no proven loss, the offense is simply penalized at the lowest dollar-value tier.
Possible Defenses
Authorized access — if you had permission, even informal or since-revoked permission you weren’t clearly told about, that can defeat the “without authorization” element.
No intent to defraud or commit theft — several provisions require a specific fraudulent purpose, not just unauthorized access.
Disputing the loss amount — since most penalties scale with dollar value, challenging how loss or damage was calculated can meaningfully change your exposure.
Someone else’s access — shared devices, compromised credentials, and shared accounts all raise real questions about who actually accessed a system.
Charged With a Cybercrime?
Computer crime charges can carry felony exposure even without a dollar loss attached. Mile High Legal defends cybercrime and fraud charges across Colorado. Call now for a free, confidential case review.
