EFF Asks Court To Reconsider Ruling That Would Make Violating Work Computer Policies A Criminal Act
from the surfing-on-the-clock?-that's-a-jailing dept
The EFF is asking the Oregon Supreme Court to take a look at a disturbing opinion issued by the state's appeals court -- one that could see employees face fines and prison time simply for violating company policies.
The case prompting the filing of an amicus brief on behalf of the defendant does contain an element of criminality, but the court's decision should have been limited to the end result of the defendant's actions, rather than the actions taken to reach that point.
Caryn Nascimento worked as a cashier at the deli counter of a convenience store. As part of her job, she was authorized to access a lottery terminal in the store to sell and validate lottery tickets for paying customers. Store policy prohibited employees from purchasing lottery tickets for themselves or validating their own lottery tickets while on duty. After a store manager noticed a discrepancy in the receipts from the lottery terminal, it was discovered that Nascimento had printed lottery tickets for herself without paying for them. She was ultimately convicted not only of first-degree theft, but also of computer crime on the ground that she accessed the lottery terminal “without authorization.”At first glance, it almost seems like a reasonable application of the law simply because the end result was theft. But it's the specifics that make it troublesome. "Without authorization" is far too broad a term to be used in this context. With this reading of Oregon's law, the appeals court has basically criminalized a wide variety of corporate computer-related policy violations. Actions that would normally be met (in a corporate setting) with warnings and reprimands could now be viewed as criminal acts.
Nascimento appealed the computer crime conviction. She argued that because she had permission to access the lottery terminal as part of her work duties, she did not access the terminal without authorization—as required under the Oregon's computer crime statute. Unfortunately, the Oregon Court of Appeals affirmed Nascimento’s conviction, finding she had only “limited authorization” to access the lottery terminal for purposes of printing and validating lottery tickets for paying customers, and acted without authorization when she printed them for herself.
[T]he Court of Appeals’ decision transforms millions of unsuspecting individuals into criminals on the basis of innocuous, everyday behavior—such as checking personal email or playing solitaire on a work computer. Such restrictions, frequently included in employers’ computer policies, are no different than the restriction imposed on Nascimento. They're ultimately all computer use, not access, restrictions. Upholding Nascimento’s conviction on the basis of a violation of a computer use restriction expands Oregon’s computer crime statute to criminalize violations of any computer use restriction.The broad reading of Oregon's criminal statute also poses potential problems outside of the work environment.
The court’s holding that a person acts “without authorization” if she violates a policy regarding the use of a computer that she is otherwise authorized to access could be extended to an Internet user who accesses a website in violation of a written terms of service. For example, Facebook’s terms of use provide that “[y]ou will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.” But as the Ninth Circuit noted en banc, “[l]ying on social media websites is common: People shave years off their age, add inches to their height and drop pounds from their weight.” Under the Court of Appeals’ expansive reading of ORS 164.377, if a user shaves a few years off her age in her profile information, asserts that she is single when she is in fact married, or seeks to obfuscate her current physical location, hometown or educational history for any number of legitimate reasons, she violates the computer crime law. The court’s decision thus opens the door to turning millions of individual Internet users—not just millions of individual employees—into criminals for typical and routine Internet activity.The EFF points out that rolling back this "unconstitutionally vague" reading of Oregon's computer crime law doesn't leave the state without options to punish Nascimento for her actions. She still faces one count of aggravated first-degree theft -- a charge the EFF is not disputing. Pointing to previous decisions by the Fourth and Ninth Circuit courts, the EFF states that similarly broad readings of the rightfully-maligned CFAA (Computer Fraud and Abuse Act) have been rejected for potentially criminalizing violations of workplace computer use policies.
The Supreme Court should have no problem rolling back this broad reading and the attendant charge brought against Nascimento. The theft may have been facilitated by improper access that violated company policy, but this access doesn't rise to the level of a criminal act -- even if it ultimately resulted in a criminal action.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: caryn nascimento, cfaa, company policies, computer access, computers, hacking, oregon
Reader Comments
Subscribe: RSS
View by: Time | Thread
Who'da thunk it
Which means the 'corporatocracy' that certain political extremists have been warning about for years actually starts in Oregon, of all places?
Didn't see that coming.
[ link to this | view in chronology ]
Re: Who'da thunk it
[ link to this | view in chronology ]
Re: Who'da thunk it
But that works both ways. A store cannot retroactively say you were trespassing because you were shoplifting and they don't allow shoplifters. Similarly, if you have authorized access to a computer system, then you aren't accessing it without authorization just because you did something you weren't supposed to be doing.
[ link to this | view in chronology ]
Re: Re: Who'da thunk it
Yeah, that's what this case turns on. If the prosecution gets its way, that actually will be a crime in Oregon. Which is radix's point.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
But as usual, a sloppily-worded law can take on an entirely new meaning, and even the law's original author is powerless to rein-in these distorted interpretations.
But then let's not kid ourselves that those standard disclaimers commonly posted on warez servers, like "You are not authorized to download these files" would automatically turn the copyright cops into criminals.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
blame game
[ link to this | view in chronology ]
Re: blame game
The courts are the only branch of government that is still uncorrupted. Mostly.
[ link to this | view in chronology ]
Re: Re: blame game
The corruption started there and the court and legal system is the #1 corruption. This system has to be taken down before the rest can be corrupted because everyone, including the politicians have to go through it.
It was corrupt FIRST! And remains the MOST corrupt now. Just ask anyone who is on death row or just in prison for something they did not do. The next most corrupt... Congress.... followed by the Executive Branch.
[ link to this | view in chronology ]
Re: Re: Re: blame game
Court system == original sin?
[ link to this | view in chronology ]
Re: Re: Re: Re: blame game
Lets go over some things. The court system was designed to have a jury with it. Why do you suppose that is? How about you just ask the founding fathers why.
Did you know that if a juror mentions they know anything about the concept of Jury Nullification that you will be told to go home? That's right, if you want to get out of jury duty just say jury nullification.
When you server they will have you swear and oath to uphold the law, which is not why you are there. They will also tell you that you must only decide if they broke it or not. You are there for that & more importantly if that law was justified to begin with. The founding fathers made it clear why a jury should always be required because they already knew how fast a judge and the system can be corrupted. They did not make it so that Congress or the Executive branches required a jury... they did that for the Courts, because that is the place where corruption impacts everyone directly! Congress and write a law, and Executive can try to enforce it upon you, but the courts, they have to find you guilty and that part requires citizens to agree with that, and today those citizens are ignorant and they are also lied too the entire process.
You tell me... a court and a well meaning jury can stop corrupt police from punishing you unjustly... how are they not the most corrupt system running now considering most people work a plea bargain rather than fighting for their rights?
O yes... very corrupt... DAMN CORRUPT! But I guess no more informationally bankrupt than you or the rest of the foul and ignorant electorate that see all as guilty until proven innocent!
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: blame game
[ link to this | view in chronology ]
Re: blame game
[ link to this | view in chronology ]
Re: Re: blame game
The bible says woe unto you lawyers, you increase the burdens upon the people without lifting even a little finger to help them.
the legal system is nothing more than a farce now because Jurors either refuse to stop corruption from jailing innocents or because they are caught in the guilty until proven innocent nature of humanity. They know next to nothing about how their government operates but they seem to think themselves smart. Justice is for those whom can afford to fight for it.
[ link to this | view in chronology ]
Re: Re: Re: blame game
[ link to this | view in chronology ]
Re: Re: Re: blame game
Its about prosecutorial bias and convictions, not justice.
[ link to this | view in chronology ]
Grounds for dismissal
[ link to this | view in chronology ]
Re: Grounds for dismissal
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Speaking as someone who WRITES policies...
I've written workplace computer policies for decades, and have, during that time, reviewed innumerable others for ideas, wording choices, etc. They are all -- including my own -- unreviewed, error-ridden, incomplete, overbroad, inconsistent disasters that would never survive an hour a competent peer analysis and critique. Giving this garbage the force of law is dangerous and absurd.
(You might be wondering, given that paragraph, why I write them. I write them because the incompetent, bureaucratic, worthless morons above me demand that they be written -- you see, they're too stupid to let me just use my best judgment, which is actually very good -- so I write them rather than sloughing the task off to ignorant newbies who would do an even worse job than I do.)
[ link to this | view in chronology ]
Re: Speaking as someone who WRITES policies...
[ link to this | view in chronology ]
A Moron
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
If I walk into a hardware store, pick up a sledgehammer and bludgeon someone to death with it, and I'm charged with both murder and improper use of that company's property, then I suppose the computer misuse stuff would make sense.
Pretty sure you don't normally get charged for the second thing, though.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
If the prosecutor is trying to get you to plea bargain, you'll be changed with six different kinds of homicide, trespassing, theft, jaywalking, conspiracy, destruction of property, and anything else they can think of.
[ link to this | view in chronology ]
Pleabargaining in the '80s was illegal
In fact, in movies and TV when the DA was trying to get the hero to pleabargain, that's how you knew he was corrupt and on the inside of the conspiracy.
[ link to this | view in chronology ]
Re: Pleabargaining in the '80s was illegal
Just like now, outside of the movies. To my ear, a "plea bargain" is pretty much equivalent to the accused being railroaded and indicates a miscarriage of justice on its face.
[ link to this | view in chronology ]
Re: Pleabargaining in the '80s was illegal
Is was? Do you have a citation for that?
From what I've read, plea bargaining started happening in the decades following the Civil War. SCOTUS ruled on plea bargaining in three cases from 1968 to 1971 and found plea bargaining to be constitutional.
I know that some states and localities have passed laws making plea bargaining illegal, but on a whole, in the US, plea bargaining has always been legal, so I am interested as to where you got the idea that "Pleabargaining in the '80s was illegal".
[ link to this | view in chronology ]
Re: Pleabargaining in the '80s was illegal
[ link to this | view in chronology ]
I remember also in the news media during the 80s the notion that plea-bargaining was unethical and procedurally unacceptable. It was implied to be criminal for the prosecution and defense to even negotiate outside the court, even with people getting in trouble for trying. This idea was preponderant in the (Los-Angeles-based) television I consumed. So yeah, I, too, wonder where I got that from.
In fictional media, plea-bargaining was regarded as a device of corrupted agents. A plea-bargain attempt pointed to a PA on the take just as much as secret police and preponderance of security cameras pointed to a dystopian police state.
Some time in the 90s, plea-bargaining became not only acceptable, but the norm. Lampshaded thoroughly by Sorkin (albeit in military courts) in A Few Good Men. It's around the same time as when a handful of SWAT raids made it into the media as a new trend, given that they weren't hostage-barricade situations, and in one case, shot up a family.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
In My Perfect World
[ link to this | view in chronology ]
Re: In My Perfect World
You get the labor force just the right amount of hungry and they'll suffer a lot of bullshit.
The trick is keeping them the right amount of hungry. If they get too hungry then they burn down the edifices and erect guillotines, and you wind up trying to flee to England.
And the funny thing is that tragedy-of-the-commons will always kill cartels and get the corporates / nobles to push the peasants too far.
[ link to this | view in chronology ]