Texas Penal Code 33.02: Breach of Computer Security

Texas Penal Code Section 33.02, the state’s breach of computer security law, makes it a crime to knowingly access another person’s computer, network, or system without the owner’s effective consent. The baseline charge is a Class B misdemeanor, but penalties climb fast when the access involves an intent to defraud or harm, when a dollar value is attached, when identifying information is taken, or when the target is a government or critical infrastructure system. At the top of the ladder sits a first-degree felony carrying up to 99 years in prison.

Two Separate Offenses in One Statute

Section 33.02 creates two offenses, and the gap between them is the single most important thing to understand about the law.

Subsection (a) is the simple version. You commit the offense if you knowingly access a computer, computer network, or computer system without the effective consent of the owner.¹ That is the whole element. No theft, no financial motive, no damage required. Knowing access plus no permission equals an offense.

Subsection (b-1) adds intent. The access must be made with the purpose of defrauding or harming someone, or altering, damaging, or deleting property.¹ It also reaches a quieter scenario: accessing a government or business system in violation of a clear posted prohibition or a contractual agreement you signed, where your goal is to obtain files or proprietary information to defraud someone or destroy property. Breaking a terms-of-service agreement on a commercial system can become a crime in Texas if the right intent is behind it.

What “Knowingly” and “Effective Consent” Mean

The state has to prove you acted knowingly. That means you were aware of what you were doing when you connected to the system. An accidental connection, a mistyped URL that lands on a restricted server, or a software routing glitch does not satisfy the standard. Prosecutors have to show a conscious choice.

“Effective consent” is defined in Section 33.01, and the definition is broader than a plain yes or no. Permission from someone legally authorized to speak for the owner counts. But consent is not effective if it was induced by deception or coercion, given by someone you knew lacked authority, given by someone you knew could not make reasonable decisions because of age, mental illness, or intoxication, or given only as a trap to detect a crime.² Consent also loses its force when you use the access for a purpose outside what the consent covered. If an employer gives you login credentials to update a database and you use them to copy customer records, you no longer have effective consent for what you did.

Penalties for Simple Unauthorized Access

A standalone subsection (a) charge is a Class B misdemeanor. The maximum is 180 days in county jail, a fine up to $2,000, or both.¹³

Two things turn that misdemeanor into a state jail felony:

Two or more prior convictions under any part of Chapter 33, not just 33.02.
The computer, network, or system belongs to the government or a critical infrastructure facility.

A state jail felony means 180 days to two years in a state jail facility and a possible fine up to $10,000.⁴ Someone who pokes around a city server out of curiosity, with no financial motive, is already in felony territory.

The Penalty Ladder When Intent to Defraud or Harm Exists

Subsection (b-1) charges are graded by the aggregate dollar amount involved:¹

Less than $100: Class C misdemeanor, fine only, up to $500.
$100 to less than $750: Class B misdemeanor, up to 180 days in jail, up to $2,000 fine.³
$750 to less than $2,500: Class A misdemeanor, up to one year in jail, up to $4,000 fine.⁵
$2,500 to less than $30,000: state jail felony, 180 days to 2 years, up to $10,000 fine.⁴
$30,000 to less than $150,000: third-degree felony, 2 to 10 years, up to $10,000 fine.⁶
$150,000 to less than $300,000: second-degree felony, 2 to 20 years, up to $10,000 fine.⁷
$300,000 or more: first-degree felony, 5 to 99 years or life, up to $10,000 fine.⁸

The first-degree threshold is $300,000, not $150,000. The $150,000 to $300,000 band is a second-degree felony. The distinction is often misstated and matters directly to sentencing exposure.

Automatic Bumps for Identifying Information and Government Targets

The dollar ladder has built-in shortcuts that override the value tiers.

If you obtain someone’s identifying information by accessing even a single computer, network, or system, the charge jumps to a second-degree felony regardless of dollar amount. If you obtain identifying information by accessing more than one computer, network, or system, it becomes a first-degree felony.¹ A data breach touching personal information can carry decades in prison even when the measurable financial loss is small.

Any (b-1) offense that targets a government or critical infrastructure computer is at least a second-degree felony when the aggregate amount is under $300,000.¹ The usual value tiers do not pull the charge down. If the target is a government system and the conduct fits (b-1), the floor is a second-degree felony.

What Counts as Critical Infrastructure

“Critical infrastructure facility” has a specific statutory definition under Section 33.01, and it is narrower than the term suggests. The list covers chemical manufacturing plants, refineries, electrical power facilities including substations and transmission lines, water and wastewater treatment plants, natural gas compressor stations, LNG terminals, telecommunications switching offices, freight transportation hubs such as ports and rail yards, gas processing plants, broadcast transmission facilities for licensed radio and TV stations, and cable TV headends.²

Hospitals, schools, and financial institutions are not on the list. The federal government recognizes 16 critical infrastructure sectors, which do include healthcare and education,⁹ but the Texas statute uses its own narrower definition. Accessing a private hospital’s system is still serious under 33.02, but the critical infrastructure enhancement will not apply. The separate government-system enhancement would, however, reach a public university or a state-run hospital, because those are government-owned.

Defenses Available Under Chapter 33

Section 33.03 contains one affirmative defense. If you are an officer, employee, or agent of a telephone company or electric utility, and your conduct was a necessary part of providing service or protecting the carrier’s rights or property, you have a defense to prosecution under Sections 33.02 and 33.022.¹⁰ Nothing else is written into the statute. There is no safe harbor for security researchers, academic study, or good-faith vulnerability testing. A penetration tester working without a clear written agreement from the system owner is taking a real risk under Texas law, even where federal computer crime doctrine has softened in recent years.

Related Chapter 33 Offenses Often Charged Together

Section 33.02 is frequently paired with two neighboring statutes.

Electronic access interference under Section 33.022 covers intentionally interrupting or suspending access to a computer system or network without the owner’s consent. Denial-of-service attacks and account lockouts fit here. It is a third-degree felony, meaning 2 to 10 years in prison, with no dollar ladder.¹¹

Electronic data tampering under Section 33.023 covers intentionally altering data in transit between two computers through deception and without a legitimate business purpose. The same statute separately criminalizes ransomware, defined as a contaminant or lock that restricts access and comes with a demand for payment.¹² Ransomware that restricts access to privileged information triggers harsher penalties, starting at a state jail felony even when the amount involved is under $2,500. If a patient or client suffers serious bodily injury or death as a result of a ransomware attack, the offense is a first-degree felony.

Federal Overlap With the Computer Fraud and Abuse Act

A single incident of unauthorized access can violate both Texas Penal Code 33.02 and the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030. Federal prosecutors usually step in when the intrusion crosses state lines, targets a federal computer, or involves certain categories of protected information. A first-time CFAA violation for simple unauthorized access carries up to one year in federal prison, rising to five years if the access was for commercial advantage, furthered another crime, or involved information valued over $5,000.¹³ Repeat CFAA offenders face up to ten years, and more serious federal computer crimes carry maximums of ten to twenty years.

A state prosecution does not block a federal one, and the reverse is also true. Dual sovereignty means both governments can punish you for the same intrusion. Most routine unauthorized access cases stay in state court unless federal agencies have a specific interest or the breach clearly reached across state lines.

1
State of Texas. Texas Penal Code 33.02 – Breach of Computer Security
2
State of Texas. Texas Penal Code 33.01 – Definitions
3
State of Texas. Texas Penal Code 12.22 – Class B Misdemeanor
4
State of Texas. Texas Penal Code 12.35 – State Jail Felony Punishment
5
State of Texas. Texas Penal Code 12.21 – Class A Misdemeanor
6
State of Texas. Texas Penal Code 12.34 – Third Degree Felony Punishment
7
State of Texas. Texas Penal Code 12.33 – Second Degree Felony Punishment
8
State of Texas. Texas Penal Code Chapter 12 – Punishments
9
CISA. Critical Infrastructure Sectors
10
State of Texas. Texas Penal Code 33.03 – Defenses
11
State of Texas. Texas Penal Code 33.022 – Electronic Access Interference
12
State of Texas. Texas Penal Code 33.023 – Electronic Data Tampering
13
Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers