Law note · Oregon
Oregon Computer Crime, without-authorization access and alteration
What it asks of an app
- Do not knowingly access, use, alter, damage, or destroy a computer, computer system, computer network, or its software, programs, documentation, or data without the owner's authorization.
- Using access you already legitimately have for an improper personal purpose is not, by itself, without authorization under Oregon law unless you also circumvent a technical barrier (State v. Nascimento, 2016); this bears on scraping only by analogy, since no Oregon case applies it to outside crawling.
- No Oregon court has decided whether a public, unauthenticated page counts as one you have authorization to access, the way the Ninth Circuit held in hiQ Labs v. LinkedIn; treat this as unsettled rather than resolved in Oregon specifically.
When LexLint raises it
crawls_web
What we found
Subsections (3) and (4) make it a crime to knowingly and without authorization alter, damage, destroy, use, access, or attempt to access any computer, computer system, computer network, or the software, program, documentation, or data it contains.
This tracks the Computer Fraud and Abuse Act (CFAA)'s own without-authorization language closely enough that a court applying it would likely import the federal circuit split, Van Buren v. United States (593 U.S. 374, 2021) and hiQ Labs v. LinkedIn (31 F.4th 1180, 9th Cir. 2022), as the operative framework, though no Oregon court has adopted or rejected the Ninth Circuit's reading that a computer presumptively open to all comers erects no authorization gate at all.
Oregon's own case law construing without authorization comes from the insider-misuse context rather than outside scraping: State v. Nascimento, 360 Or 28, 379 P3d 484 (2016), held that an employee using access already granted for an improper personal purpose does not thereby act without authorization absent technical circumvention, and State v. Schwartz, 173 Or App 301, 21 P3d 1128 (2001), rejected a vagueness challenge to the phrase.
Neither reaches the hiQ fact pattern of unauthenticated, no-login access, so open-web crawling of an Oregon-connected public page is unsettled leaning toward permitted rather than settled by direct authority. Oregon has no ToS-specific statute or case (ordinary contract law governs browsewrap and clickwrap alike), no state text-and-data-mining exception or database right beyond the federal position, and no statute giving robots.txt independent legal weight.
Oregon's Unlawful Trade Practices Act, ORS 646.605 et seq., and common-law trespass to chattels are available in principle for unfair competition and misappropriation claims but remain untested against scraping specifically in Oregon case law.