Texas Breach of Computer Security — Penal Code § 33.02

Breach of computer security is Texas’s core hacking offense. Under Penal Code § 33.02, knowingly accessing a computer, network, or system without the owner’s effective consent is a Class B misdemeanor — and access with intent to defraud or harm climbs a loss-based ladder that tops out at a first-degree felony. Below: the statute, the full penalty table, verified case law, defenses, and how these cases actually move through Collin, Dallas, Denton, and Tarrant County courts.

Peer Recognition

Martindale-Hubbell® 2026 Honors

Independent peer-review ratings recognizing legal ability and ethical standards.

Awards reflect peer-reviewed ratings only. Past results do not guarantee future outcomes.

What Is Breach of Computer Security Under Texas Law?

Breach of computer security is the Texas Penal Code’s general computer-intrusion offense. Under § 33.02(a), a person commits a crime if the person “knowingly accesses a computer, computer network, or computer system without the effective consent of the owner.” The statute sits in Chapter 33 — the computer-crimes chapter the Legislature created in 1985 — alongside online impersonation, online solicitation of a minor, electronic data tampering, and unlawful decryption. It has been amended repeatedly since, most recently effective September 1, 2015.

Two features make § 33.02 broader than most people expect. First, “access” is defined expansively in § 33.01(1): to approach, instruct, communicate with, store data in, retrieve or intercept data from, alter data or computer software in, or otherwise make use of any resource of a computer, computer network, computer program, or computer system. Opening a folder, running a query, or reading someone’s email all qualify — no technical “hacking” is required. Second, the offense has two distinct pathways: simple unauthorized access under subsection (a), and the far more serious subsection (b-1), which targets access committed with intent to defraud or harm another or to alter, damage, or delete property.

Subsection (b-1) itself splits in two. The first branch mirrors subsection (a) — access without effective consent — with the added fraud-or-harm intent. The second branch, § 33.02(b-1)(2), is the one that surprises defendants: it reaches access to a government or business computer in violation of a clear and conspicuous prohibition or a contractual agreement the person expressly agreed to, when paired with intent to obtain or use files, data, or proprietary information to defraud or harm another. An employee or contractor who is allowed on the system can still commit this offense by violating written policy with the required intent.

Elements the State Must Prove

For the base offense under § 33.02(a), the State must prove every element beyond a reasonable doubt:

1. Knowing access

The defendant knowingly accessed — approached, instructed, communicated with, stored data in, retrieved or intercepted data from, altered, or otherwise made use of — a computer resource. Accidental clicks, automated background processes, and unknowing contact are not knowing access.

2. A computer, computer network, or computer system

The thing accessed must meet the § 33.01 definitions, which sweep in servers, workstations, phones, email and cloud accounts, point-of-sale systems, and connected devices.

3. Without the owner’s effective consent

No one with authority over the system gave valid permission — or the permission that existed fails one of the five tests in § 33.01(12): induced by deception or coercion; given by someone the actor knows lacked authority; given by someone unable to make reasonable decisions; given solely to detect the commission of an offense; or used for a purpose other than the one for which it was given.

4. Knowledge that consent was absent

The knowing mental state reaches the consent element, not just the act of access. In Muhammed v. State, 331 S.W.3d 187 (Tex. App. 2011), the court held that the State must prove the defendant knowingly accessed the computer knowing that the access was without the owner’s effective consent. A genuine belief that permission existed defeats the charge.

A felony case under § 33.02(b-1) adds more: the specific intent to defraud or harm another, or to alter, damage, or delete property — and, on the (b-1)(2) policy-violation branch, proof of a clear and conspicuous prohibition or an express contractual agreement plus intent to obtain or use data to accomplish the fraud or harm. Each added element is another point the defense can attack.

What Are the Penalties for Breach of Computer Security?

Section 33.02 runs on two separate grading tracks. Simple access under subsection (a) starts as a Class B misdemeanor with two built-in state-jail-felony bumps. Fraud-or-harm cases under subsection (b-1) are graded by “aggregate amount” — the total dollar value involved — using the same value bands as Texas theft law:

Two grading traps deserve emphasis. The identity-information bumps: under § 33.02(b-2)(6)(C) and (7)(B), obtaining another person’s identifying information makes the offense a second-degree felony if one computer was accessed and a first-degree felony if more than one was — regardless of dollar amount. A zero-loss intrusion that touches identity data across two systems can be indicted at the same grade as a $300,000 fraud. The ownership bumps: any (b-1) offense against a government or critical-infrastructure computer is at least a second-degree felony under (b-2)(6)(B) whenever the amount falls under $300,000, and even simple no-fraud access to those systems is a state jail felony under (b)(2).

State-jail-felony cases carry one practical safety valve: under Penal Code § 12.44(a), a judge can punish a state jail felony as a Class A misdemeanor in appropriate cases — often the negotiated landing spot for first-time defendants whose alleged loss sits in the $2,500–$30,000 band.

How Do Prosecutors Prove Breach of Computer Security?

These are records cases. The State typically builds them on authentication and server logs, IP-address attribution, device forensics, subscriber records obtained by warrant or subpoena, and — in workplace cases — an affidavit from the employer’s IT staff or an outside incident-response firm. The forensic image of a seized phone or laptop frequently becomes the centerpiece, which is why the search warrant that produced it gets heavy defense scrutiny.

Knowledge is almost always proved circumstantially. Muhammed confirms that a jury may infer knowledge or intent from the acts, conduct, and remarks of the accused and from the surrounding circumstances — in that case, a defendant browsing another student’s university email account in a campus computer lab. Prosecutors lean on context: deleted logs, masked IP addresses, odd login hours, or statements acknowledging the lockout.

On the felony track, the State must also prove the “aggregate amount.” Under § 33.01(2), that figure includes not only direct loss but the victim’s expenditures to investigate whether data was altered or acquired and to restore, recover, or replace it. In practice the number often comes from the complainant company’s own forensic-response invoices — a figure the defense can and should audit line by line, because the invoice total frequently drives the felony grade more than any stolen value does.

A hypothetical illustrates the charging pattern. An IT administrator is terminated on a Friday; her VPN credentials are not deactivated until Monday. Over the weekend she logs in and downloads the vendor pricing sheet she built. Access plainly happened and data was taken — but was consent actually revoked, and did she know it was? The termination letter said nothing about system access, and the company’s own deprovisioning failure left the gate open. Those facts aim straight at the knowledge element the State must prove under Muhammed, and they often mark the difference between a felony indictment and a declined case.

What Defenses Work Against a § 33.02 Charge?

L and L Law Group builds § 33.02 defenses around the statute’s own pressure points:

• No knowledge that consent was absent. The State must prove the defendant knew the access was unauthorized — the Muhammed rule. Shared passwords, never-revoked credentials, family accounts, and vague workplace policies all generate reasonable doubt on this element.
• Effective consent existed. Permission from anyone legally authorized to act for the owner defeats the charge. Scope disputes — what exactly was authorized, by whom, and for how long — are fought on documents, not assumptions.
• The security-assessment defense. § 33.02(f) protects penetration testers and security contractors whose conduct consisted solely of action taken under a contract with the owner to assess or secure the system. The written scope of work is the defense exhibit.
• The law-enforcement defense. § 33.02(e) covers persons acting to facilitate a lawful seizure, search, or access for a legitimate law-enforcement purpose.
• Attribution failure. An IP address identifies a connection, not a person. Shared terminals, open networks, spoofed credentials, and compromised accounts can all break the link between the login and the defendant.
• Suppression. Digital searches must comply with the Fourth Amendment and Texas’s statutory exclusionary rule, CCP art. 38.23. An overbroad device warrant or a warrantless account search can take the forensic centerpiece out of the case. See our guide to the motion to suppress.
• Civil dispute dressed as a crime. Many (b-1)(2) cases are business divorces — departing employees, feuding partners, contractor disputes — where the real fight belongs in civil court. Framing the case that way supports declination, reduction, or restitution-driven resolutions.
• Loss-amount attacks. Because grade follows the aggregate amount, contesting inflated investigation and restoration figures can knock a third-degree felony down to a state jail felony or a misdemeanor.

A second hypothetical, because it is the most common fact pattern we see: during a separation, one spouse logs into the other’s email using a password shared years earlier and forwards messages to a divorce lawyer. The password was given for paying bills — not litigation surveillance — so § 33.01(12)(E)’s purpose limitation defeats the consent that once existed. The defense, in turn, targets knowledge: a spouse who used a password the couple always treated as joint may not have known the consent had ended. These cases routinely turn on text messages about who was allowed to use what, and when.

Can a Breach of Computer Security Charge Be Dismissed or Expunged?

Yes — and the endgame matters as much as the verdict. Weak knowledge evidence, consent ambiguity, or suppression exposure supports outright dismissal or declination. First-time defendants in DFW counties are frequently candidates for pretrial-intervention programs or deferred adjudication under CCP Chapter 42A, and § 12.44(a) misdemeanor-range punishment is a recurring negotiated outcome in low-loss state-jail cases.

Record relief tracks the result. A dismissal or acquittal generally supports expunction under CCP Chapter 55A. Successfully completed deferred adjudication usually supports an order of nondisclosure under Government Code Chapter 411, Subchapter E-1. A final conviction — even Class B — generally stays on the record forever, which is why charge posture early in the case drives everything later.

How Does § 33.02 Differ From the Federal CFAA?

The federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, covers similar conduct — but the two statutes split sharply on misuse of authorized access. In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court adopted a “gates-up-or-down” reading of the CFAA: a person “exceeds authorized access” only by entering areas of a computer — files, folders, databases — that are off-limits to him, and the statute “does not cover those who … have improper motives for obtaining information that is otherwise available to them.”

Texas law is built differently. Section 33.01(12)(E) strips consent that is “used for a purpose other than that for which the consent was given,” and § 33.02(b-1)(2) expressly criminalizes access in violation of a written prohibition or contract when paired with fraud-or-harm intent. The police-database lookup that no longer violates the CFAA after Van Buren can still be charged under § 33.02 in a Texas courthouse — a divergence we analyze in depth in our Van Buren explainer and the CFAA impact brief.

Forum matters too. Intrusions touching interstate systems, financial institutions, or federal agencies can draw a federal indictment in the Northern or Eastern District of Texas, where loss calculations under the sentencing guidelines — not the § 33.02(b-2) bands — control exposure. The same conduct can be prosecuted in both systems, and § 33.02(d) separately allows Texas prosecutors to stack § 33.02 with any other Penal Code section the conduct violates.

Where Are § 33.02 Cases Heard in North Texas?

Collin County. Misdemeanor § 33.02(a) cases are filed in the county courts at law and felonies in the district courts, all sitting at the Collin County Courthouse, 2100 Bloomdale Road in McKinney. The county’s corporate corridor — Frisco, Plano, Allen, McKinney — makes employer-referral cases common: a company’s IT department documents the intrusion, an incident-response firm quantifies it, and the file lands with prosecutors already packaged.

Dallas County. Felony computer-crime cases are heard in the district courts at the Frank Crowley Courts Building, where they typically move alongside the white-collar docket. Misdemeanors run through the county criminal courts. Cases referred by larger institutions — banks, hospital systems, universities — tend to arrive with extensive civil-side forensic work already done.

Denton County. Cases are heard at the Denton County Courts Building in Denton. Family-dispute and small-business fact patterns are the recurring theme, and outcomes often track how cleanly the consent story can be told on paper.

Tarrant County. Filings run through the Tim Curry Criminal Justice Center in Fort Worth, misdemeanors in the county criminal courts and felonies in the district courts. As elsewhere, early defense contact with the assigned prosecutor — before grand-jury presentment on felony tracks — is frequently the highest-leverage window.

L and L Law Group defends § 33.02 cases across all four counties from our Frisco office.

What Happens After a Breach of Computer Security Arrest?

Most § 33.02 cases are investigation-first: by the time an arrest happens, a detective has usually had the forensic report, the IT affidavit, and a search-warrant return for weeks. Some defendants first learn about the case when officers arrive with a device warrant; others get a phone call inviting them “to give their side.” Decline that interview until counsel is present — statements about passwords, permissions, and purposes are exactly what the knowledge element gets built from.

1. Arrest and magistration. Within roughly 48 hours, a magistrate sets bond and reads the charge under CCP art. 15.17.
2. Bond conditions. Expect no-contact orders covering the complainant (often a former employer) and sometimes computer- or internet-use restrictions. Conditions can be negotiated and modified — critical for defendants who work in IT.
3. Charging. Misdemeanors proceed by information; felony grades require a grand-jury indictment. The pre-indictment window is where reductions and declinations are won.
4. Discovery. Under the Michael Morton Act, CCP art. 39.14, the defense obtains the State’s file — including forensic images and examiner notes, which an independent expert should re-examine rather than accept.
5. Pretrial litigation. Suppression motions on device and account searches, loss-amount challenges, and consent-scope disputes shape the plea posture.
6. Resolution. Dismissal, pretrial diversion, deferred adjudication, a § 12.44(a) misdemeanor-range plea, trial — the right endpoint depends on the knowledge evidence and the record-relief consequences of each path.

Enhancements & Collateral Consequences

Beyond the grading bumps above, two prior Chapter 33 convictions make even simple access a state jail felony, and § 33.02(d) lets the State prosecute the same conduct under § 33.02 and any other applicable section — theft, fraudulent use of identifying information, or tampering with a governmental record among them. Victims also hold a parallel civil claim: Civil Practice and Remedies Code Chapter 143 authorizes damages suits for harmful access by computer, so a criminal file is often shadowed by a civil one.

Collateral fallout is heavy for a charge that often starts as workplace drama. A felony conviction forfeits firearm rights under Penal Code § 46.04 and 18 U.S.C. § 922(g). Any conviction involving fraud-type intent invites professional-license scrutiny and is poison for careers in IT, security, finance, and healthcare — fields where background checks specifically flag computer-misuse offenses. Security clearances, employment in regulated industries, and immigration status (fraud-intent offenses raise moral-turpitude issues that require case-specific analysis) can all be affected. These consequences, more than the jail range, usually drive defense strategy in first-offense cases.

How § 33.02 Compares to Neighboring Offenses

Chapter 33 and its neighbors carve up overlapping conduct, and charge selection matters:

• Online impersonation — § 33.07. Using another person’s name or persona online; targets the deception itself rather than the access.
• Online solicitation of a minor — § 33.021. Communications offenses with minors; a different chapter-33 animal entirely.
• Electronic access interference — § 33.022. Denial-of-service-style disruption of access to systems without effective consent.
• Electronic data tampering — § 33.023. Altering data or introducing ransomware; often charged alongside § 33.02 when files were changed rather than just viewed.
• Fraudulent use or possession of identifying information — § 32.51. The usual companion count when identity data was taken; item-count grading stacks fast.
• Credit or debit card abuse — § 32.31. Covers misuse of captured payment credentials.
• Cyberstalking and harassment — § 42.07. When account intrusions are part of a course of conduct against a person.
• Theft — § 31.03. Where the accessed data or funds were appropriated outright.
• Theft of trade secrets — § 31.05. The companion intellectual-property count when the data copied from the system was a protected trade secret rather than money or identity information.

Our Texas computer-crimes defense guide maps the full chapter, and the companion § 33.02 insight brief tracks charging trends under this statute. For the broader practice context, see white-collar & fraud defense and identity-theft defense.