(1) It is unlawful for a person to:

1. (a) without authorization, or in excess of the person's authorization, access or attempt to access computer technology if the access or attempt to access results in:

   1. (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure of computer technology;

   2. (ii) interference with or interruption of:

      1. (A) the lawful use of computer technology; or
      2. (B) the transmission of data;
   3. (iii) physical damage to or loss of real, personal, or commercial property;
   4. (iv) audio, video, or other surveillance of another person; or
   5. (v) economic loss to any person or entity;

2. (b) after accessing computer technology that the person is authorized to access, knowingly take or attempt to take unauthorized or unlawful action that results in:

   1. (i) the alteration, damage, destruction, copying, transmission, discovery, or disclosure of computer technology;

   2. (ii) interference with or interruption of:

      1. (A) the lawful use of computer technology; or
      2. (B) the transmission of data;
   3. (iii) physical damage to or loss of real, personal, or commercial property;
   4. (iv) audio, video, or other surveillance of another person; or
   5. (v) economic loss to any person or entity; or
3. (c) knowingly engage in a denial of service attack.

(2) A person who violates Subsection (1) is guilty of:

1. (a) a class B misdemeanor when:

   1. (i) the economic loss or other loss or damage caused or the value of the money, property, or benefit obtained or sought to be obtained is less than $500; or
   2. (ii) the information obtained is not confidential;
2. (b) a class A misdemeanor when the economic loss or other loss or damage caused or the value of the money, property, or benefit obtained or sought to be obtained is or exceeds $500 but is less than $1,500;
3. (c) a third degree felony when the economic loss or other loss or damage caused or the value of the money, property, or benefit obtained or sought to be obtained is or exceeds $1,500 but is less than $5,000;
4. (d) a second degree felony when the economic loss or other loss or damage caused or the value of the money, property, or benefit obtained or sought to be obtained is or exceeds $5,000; or

5. (e) a third degree felony when:

   1. (i) the property or benefit obtained or sought to be obtained is a license or entitlement;
   2. (ii) the damage is to the license or entitlement of another person;
   3. (iii) the information obtained is confidential or identifying information; or
   4. (iv) in gaining access the person breaches or breaks through a security system.

(3)

1. (a) A person who intentionally or knowingly and without authorization gains or attempts to gain access to a computer, computer network, computer property, or computer system under circumstances not otherwise constituting an offense under this section is guilty of a class B misdemeanor.
2. (b) Notwithstanding Subsection (3)(a), a retailer that uses an electronic product identification or tracking system, or other technology, to identify, track, or price goods is not guilty of a violation of Subsection (3)(a) if the equipment designed to read the electronic product identification or tracking system data and used by the retailer to identify, track, or price goods is located within the retailer's location.

(4)

1. (a) A person who, with intent that electronic communication harassment occur, discloses or disseminates another person's identifying information with the expectation that others will further disseminate or use the person's identifying information is subject to the penalties outlined in Subsection (4)(b).

2. (b) If the disclosure or dissemination of another person's identifying information results in electronic communication harassment, as described in Section 76-9-201, of the person whose identifying information is disseminated, the person disseminating the information is guilty of:

   1. (i) a class B misdemeanor if the person whose identifying information is disseminated is an adult; or
   2. (ii) a class A misdemeanor if the person whose identifying information is disseminated is a minor.
3. (c) A second offense under Subsection (4)(b)(i) is a class A misdemeanor.
4. (d) A second offense under Subsection (4)(b)(ii), and a third or subsequent offense under this Subsection (4)(b), is a third degree felony.

(7) It is an affirmative defense to Subsection (1), (2), or (3) that a person obtained access or attempted to obtain access:

1. (a) in response to, and for the purpose of protecting against or investigating, a prior attempted or successful breach of security of computer technology whose security the person is authorized or entitled to protect, and the access attempted or obtained was no greater than reasonably necessary for that purpose; or
2. (b) pursuant to a search warrant or a lawful exception to the requirement to obtain a search warrant.

(8)

1. (a) An interactive computer service is not guilty of violating this section if a person violates this section using the interactive computer service and the interactive computer service did not knowingly assist the person to commit the violation.

2. (b) A service provider is not guilty of violating this section for:

   1. (i) action taken in relation to a customer of the service provider, for a legitimate business purpose, to install software on, monitor, or interact with the customer's Internet or other network connection, service, or computer for network or computer security purposes, authentication, diagnostics, technical support, maintenance, repair, network management, updates of computer software or system firmware, or remote system management; or

   2. (ii) action taken, including scanning and removing computer software, to detect or prevent the following:

      1. (A) unauthorized or fraudulent use of a network, service, or computer software;
      2. (B) illegal activity; or
      3. (C) infringement of intellectual property rights.