Computer crimes in Georgia are governed by the Georgia Computer Systems Protection Act, codified at O.C.G.A. 16-9-90 through 16-9-93. The Act defines five separate offenses, and four of them are felonies carrying up to 15 years in prison, fines of up to $50,000, or both. The fifth, computer password disclosure, is a misdemeanor. Anyone facing one of these charges also has to reckon with the federal Computer Fraud and Abuse Act, which often covers the same conduct and can be prosecuted alongside the state case.
The Five Offenses in Georgia’s Computer Crime Statute
Every offense in the Act shares one element: the person must act “without authority.” Georgia defines that phrase to include using a computer or network in a way that goes beyond whatever access the owner actually granted.1Justia. Georgia Code 16-9-92 – Definitions That common thread runs through each of the five offenses below.
Computer Theft
Computer theft covers using a computer or network without authorization to take someone else’s property, obtain property through deception, or convert property in violation of a known legal obligation. Nothing has to be physically removed. Siphoning funds through unauthorized transfers, taking digital assets, or using deception to acquire data all qualify.
Computer Trespass
Computer trespass targets unauthorized access aimed at deleting or removing data (even temporarily), interfering with the use of programs or data, or damaging a computer or network in any way. Duration does not matter. A brief interference counts.
Computer Invasion of Privacy
This offense applies when someone knowingly accesses a computer or network without authorization to examine another person’s sensitive information, including employment records, medical records, salary data, credit information, and other financial or personal data. The prohibited conduct is looking at the data, not changing or destroying it.
Computer Forgery
Computer forgery mirrors traditional forgery in a digital setting. It applies when someone creates, changes, or deletes data in a way that would be forgery if done to a physical document. The statute cuts off one obvious defense: the absence of a tangible writing does not matter when the manipulation involved digital data.
Computer Password Disclosure
Sharing passwords, access codes, or other login credentials without authorization is a separate offense when the disclosure causes more than $500 in damages to the computer or network owner. Damages include the fair market value of any services used and the owner’s out-of-pocket costs.
Penalties
Georgia’s penalty structure draws a sharp line between password disclosure and every other offense in the Act.
Felony Offenses
Computer theft, computer trespass, computer invasion of privacy, and computer forgery all carry the same maximum: a fine of up to $50,000, imprisonment for up to 15 years, or both.2Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties Under Georgia’s general definitions, any crime punishable by more than 12 months of imprisonment is a felony.3Justia. Georgia Code 16-1-3 – Definitions Judges have discretion within the range, so the actual sentence depends on factors such as the scope of the intrusion, the financial harm caused, and the defendant’s criminal history.
Misdemeanor Offense
Computer password disclosure is the only offense in the Act with a lighter penalty. A conviction carries a fine of up to $5,000, incarceration for up to one year, or both.2Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties Password disclosure often accompanies one of the four felony offenses, though. If someone shares credentials and then uses them to steal data, prosecutors can charge both.
When Federal Charges Enter the Picture
The federal Computer Fraud and Abuse Act (18 U.S.C. ยง 1030) covers much of the same ground, and prosecutors sometimes pursue both. Federal jurisdiction typically kicks in when the offense crosses state lines, targets a federal government computer, or involves a “protected computer,” a term broad enough to include essentially any device connected to the internet.
Federal penalties vary by offense. Unauthorized access to obtain information from a protected computer carries up to one year for a first offense, rising to five years if the access was for financial gain or in furtherance of another crime, and up to ten years for a repeat offender. Offenses involving damage to a protected computer can bring five to ten years. Accessing classified national defense information carries up to ten years on a first offense and twenty on a second.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Defenses Against a Computer Crime Charge
Each offense in the Act requires the prosecution to prove specific mental states and circumstances. That creates several openings.
Lack of Intent
Every offense requires the person to act with a particular intention. Computer theft requires intent to take or obtain property. Computer trespass requires intent to delete, interfere with, or damage data. Computer invasion of privacy requires intent to examine someone else’s personal information.2Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties Accidentally stumbling into restricted files while performing legitimate work, or unintentionally triggering data deletion, can undermine the prosecution’s proof on the mental state.
Authorization
Because every offense hinges on acting “without authority,” showing that you had permission to access the system is often the most direct defense. The statutory definition matters most in workplace cases, where an employee has some level of access but allegedly crosses a line. Vague or poorly documented access policies can create enough ambiguity to raise reasonable doubt.
The U.S. Supreme Court’s 2021 decision in Van Buren v. United States added a wrinkle at the federal level that Georgia courts may look to. The Court held that “exceeding authorized access” under the CFAA means accessing areas of a computer that are off-limits, not simply using legitimately accessible information for an improper purpose. As the Court put it, the statute “does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them.”5Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021) While Van Buren interpreted the federal statute, the reasoning is relevant in Georgia because the state’s definition of “without authority” similarly focuses on exceeding granted rights rather than misusing information you were allowed to see.
Mistaken Identity and Forensic Challenges
Computer crimes rarely happen in front of witnesses. Prosecutors rely almost entirely on digital evidence linking a specific person to the unauthorized activity. When multiple people share access to the same system, or when the intrusion was routed through anonymizing tools, identifying the actual person responsible gets complicated. Defense attorneys frequently retain digital forensic experts to challenge attribution, question whether IP addresses were spoofed, or show gaps in the chain of custody for seized devices.
Deadlines to Bring Charges or Sue
Georgia’s general statute of limitations for felonies is four years from the commission of the crime.6Justia. Georgia Code 17-3-1 – Generally Because the four main computer offenses are felonies, prosecutors generally have four years to bring charges. The clock can be tricky in practice, since Georgia courts have recognized that the limitations period may not start running until the victim discovers the unauthorized activity, particularly where the intrusion was concealed.
The Act also gives victims a civil right of action. Any person whose property or person is injured by a violation can sue to recover damages, including lost profits and out-of-pocket costs, and the civil suit can proceed even if the district attorney declines to bring charges.2Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties The civil statute of limitations is four years from the date the violation is discovered or should have been discovered through reasonable diligence. A continuing violation of any single subsection is treated as one violation, which stops plaintiffs from resetting the clock by pointing to repeated instances of the same conduct.
Other Charges That Can Stack
The Act explicitly states that it does not preclude prosecution under any other applicable law.2Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties Prosecutors can stack charges. Someone who uses a computer to commit identity fraud, theft by deception, or a financial transaction card offense can face those charges alongside a computer crime charge, with each offense carrying its own separate penalty.