What Is Georgia’s Computer Systems Protection Act?

The Georgia Computer Systems Protection Act, found at O.C.G.A. 16-9-90 through 16-9-94, defines five computer-related crimes and sets penalties as high as 15 years in prison and a $50,000 fine.¹ The Act also lets anyone injured by a violation file a civil lawsuit for damages, and it operates alongside the federal Computer Fraud and Abuse Act when the same conduct reaches a protected computer.

The statute uses a broad definition of “computer.” Any electronic, magnetic, or optical device that automatically performs operations on data and communicates results to another computer or person qualifies, along with connected equipment that stores or transmits data, and mail servers and email networks are specifically included.² A standalone device that never communicates with another computer sits outside the Act, but in practice almost any internet-connected device — phones, tablets, networked office equipment — falls within it.

The Five Crimes

Each offense in O.C.G.A. 16-9-93 targets a different kind of harm, and the elements the state must prove are not interchangeable.¹

Computer Theft

Using a computer or network, knowing the use is unauthorized, with intent to take someone’s property, obtain property by deception, or convert property in violation of a legal obligation. This is the typical charge in fraud schemes, including employees who reroute electronic funds and anyone who uses stolen credentials to make purchases.

Computer Trespass

Knowingly using a computer without authorization and intending to delete or remove data (even temporarily), obstruct or interfere with a program or data, or alter, damage, or cause a malfunction. The statute catches disruption “regardless of how long” it lasts, so even a brief outage qualifies. Ransomware, malware deployment, and intentional database corruption all land here.

Computer Invasion of Privacy

Using a computer to examine another person’s employment, medical, salary, credit, or other financial or personal data when you know the examination is unauthorized. This offense is unusual in that it does not require any intent to steal or damage. Snooping is enough.

Computer Forgery

Creating, altering, or deleting data in a computer where the same act done to a physical document would be forgery. The statute specifically forecloses the defense that no paper writing existed; manipulating digital data is treated the same as manipulating a tangible document.

Computer Password Disclosure

Disclosing a password, access code, or other means of accessing a computer or network, knowing the disclosure is unauthorized, when the disclosure results in damages exceeding $500. The $500 figure includes the fair market value of services consumed and the victim’s costs of responding. Posting a co-worker’s login on a forum can trigger the offense once losses cross that line.

What the Penalties Look Like

The penalty structure splits sharply between the first four offenses and password disclosure.

Computer theft, trespass, invasion of privacy, and forgery each carry a fine of up to $50,000, imprisonment of up to 15 years, or both. Because the possible sentence runs beyond 12 months, all four are felonies under Georgia law.¹³
Computer password disclosure carries a fine of up to $5,000, up to one year of incarceration, or both. It is a misdemeanor, though the fine ceiling is five times the standard misdemeanor cap of $1,000.¹

The Act is not exclusive. Section 16-9-93(f) preserves every other criminal law that might apply to the same conduct, so a single scheme can draw charges under the Act alongside fraud, theft, or identity crime statutes.¹

One adjacent offense sits in a separate section rather than inside the Act’s five core crimes. O.C.G.A. 16-9-93.1 makes it a misdemeanor to transmit data over a computer or telephone network using someone else’s name, trademark, logo, official seal, or copyrighted symbol to misidentify the sender or imply permission that does not exist. Phishing emails that impersonate a bank are a typical example. Internet service providers that simply carry data for customers are exempt, and victims can bring a separate civil action.⁴

Suing for Damages as a Victim

Anyone whose property or person is injured by a violation can file a civil suit and recover damages plus the costs of bringing the action.¹ The statute defines “damages” to include lost profits and victim expenditures, and the list is not exhaustive. A business can pursue lost revenue, forensic investigation costs, and the expense of restoring compromised systems.

The deadline is four years from when the violation was discovered or should have been discovered through reasonable diligence. A continuing violation of any single subsection counts as one violation for limitations purposes.¹ If a party asks, the court must take steps to protect the secrecy of any computer system, data, or program involved in the case, both to prevent a repeat attack and to shield trade secrets.

Nothing in the Act limits remedies available under other laws, so a victim can combine a claim under the Act with breach of contract, trade secret misappropriation, or negligence theories.¹

Defenses That Can Defeat a Charge

Authorization is the most direct defense. Every major offense requires that the accused acted “without authority” and knew it. Explicit permission from the system owner — in an employment agreement, a contract, or a direct consent document — undercuts that element. The Act contains no specific safe harbor for cybersecurity professionals, so authorized penetration testers rely on written agreements that spell out scope, timing, and methods.

Lack of intent is the next line. Computer theft requires intent to steal or deceive; computer trespass requires intent to delete, interfere, or cause malfunction. Accidental access or inadvertent alteration does not meet the mental state the statute demands, and the burden of proving intent sits with the state.

For password disclosure, the $500 damage figure is an element of the crime, not a sentencing factor. If total damages — the fair market value of services consumed plus the victim’s response costs — stay under $500, the conduct is not a crime under that subsection.¹

When Federal Charges Also Apply

The same conduct can draw federal prosecution under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, if it involves a “protected computer.” That category covers computers used by financial institutions, the U.S. government, and any computer used in or affecting interstate or foreign commerce. Almost every internet-connected device qualifies.⁵

Federal penalties can run higher. Unauthorized access to obtain information from a protected computer carries up to one year for a first offense, rising to five years if the access was for financial gain, in furtherance of another crime, or if the information’s value exceeds $5,000. Repeat offenders face up to ten years, and offenses involving national security information carry up to ten years for a first offense and twenty for a subsequent one.⁵

Federal reach is narrower in one important way. In Van Buren v. United States, the U.S. Supreme Court held that someone “exceeds authorized access” under the CFAA only by reaching areas of a computer that are off-limits to them, not by using authorized access for an improper purpose.⁶ An employee who uses a work computer to browse social media violates policy but does not commit a federal crime. Georgia’s Act has no equivalent judicial narrowing, so conduct that escapes federal prosecution can still be charged under state law.

Practical Steps for Georgia Businesses

The Act creates exposure on both sides. A business is a potential victim, and it is also responsible for employees whose conduct could trigger liability. A few habits lower the risk considerably.

Define each employee’s authorization level in writing and match it to their job. When someone leaves or changes roles, revoke or adjust access the same day. An ex-employee who uses old credentials is accessing a system without authority, but if the company never disabled the login, proving the access was unauthorized becomes harder, and defense counsel will press on that gap.

Put every third-party security test under a written contract. Because the Act has no statutory exception for penetration testing, the authorization has to come from an agreement that spells out scope, timing, and permitted methods. Without that paperwork, the tester faces criminal exposure for the exact work the business hired them to do.

Investigate suspicious activity promptly. The four-year civil clock starts running when the violation is discovered or reasonably should have been.¹ Delay narrows the window for recovery. Preserving system logs, access records, and network traffic data early strengthens both criminal referrals and civil claims.

1
Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties
2
Justia. Georgia Code 16-9-92 – Definitions
3
Justia. Georgia Code 17-10-3 – Punishment for Misdemeanors
4
Justia. Georgia Code 16-9-93.1 – Misleading Transmittal and Use of Individual Name, Trade Name, Registered Trademark, Logo, Legal or Official Seal, or Copyrighted Symbol Over Computer or Telephone Network; Criminal Penalty; Civil Remedies
5
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
6
Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021)