What legal defenses exist for unauthorized computer access under Georgia law?
The central question is authority. Georgia’s Computer Systems Protection Act, O.C.G.A. § 16-9-93, requires that a person act “with knowledge that such use is without authority,” and that’s where a defense can begin. Section 16-9-92 defines “without authority” as use exceeding any right or permission granted by the owner.
| Crime | Requires | Possible defense |
|---|---|---|
| Computer theft, (a) | Intent to take property or obtain it by deceit | No such intent |
| Computer trespass, (b) | Intent to delete, obstruct, alter, or damage | No damage intended |
| Invasion of privacy, (c) | Intent to examine personal data, knowing no authority | Job duties covered it |
| Forgery, (d) | Conduct that would be forgery on paper | No intent to defraud |
| Password disclosure, (e) | Disclosure causing damages over $500 | No damage over that amount |
Theft, trespass, invasion of privacy, and forgery carry up to 15 years, a fine of up to $50,000, or both. Password disclosure carries up to one year or a $5,000 fine, § 16-9-93(h).
Employee cases are the hardest. A person may have had a password but used it for an unapproved reason. Policies and login records become evidence, including whether the policy was actually known. Under the federal Computer Fraud and Abuse Act, Van Buren v. United States (2021) narrowed “exceeds authorized access,” but that’s a federal statute, and Georgia’s definition isn’t identical.
Attribution is another line. An IP address identifies an account or connection, not who sat at the keyboard. Searches of phones and computers require a warrant under Riley v. California (2014).
A civil claim can come with this: § 16-9-93(g) allows damages, and a four-year limit runs from discovery.
General information about Georgia law as of November 2026. It is not legal advice and does not create an attorney-client relationship.