EFF Asks Court To Reconsider Ruling That Would Make Violating Work Computer Policies A Criminal Act

from the surfing-on-the-clock?-that's-a-jailing dept

Wed, May 20th 2015 3:44pm — Tim Cushing

The EFF is asking the Oregon Supreme Court to take a look at a disturbing opinion issued by the state's appeals court -- one that could see employees face fines and prison time simply for violating company policies.

The case prompting the filing of an amicus brief on behalf of the defendant does contain an element of criminality, but the court's decision should have been limited to the end result of the defendant's actions, rather than the actions taken to reach that point.

Caryn Nascimento worked as a cashier at the deli counter of a convenience store. As part of her job, she was authorized to access a lottery terminal in the store to sell and validate lottery tickets for paying customers. Store policy prohibited employees from purchasing lottery tickets for themselves or validating their own lottery tickets while on duty. After a store manager noticed a discrepancy in the receipts from the lottery terminal, it was discovered that Nascimento had printed lottery tickets for herself without paying for them. She was ultimately convicted not only of first-degree theft, but also of computer crime on the ground that she accessed the lottery terminal “without authorization.”

Nascimento appealed the computer crime conviction. She argued that because she had permission to access the lottery terminal as part of her work duties, she did not access the terminal without authorization—as required under the Oregon's computer crime statute. Unfortunately, the Oregon Court of Appeals affirmed Nascimento’s conviction, finding she had only “limited authorization” to access the lottery terminal for purposes of printing and validating lottery tickets for paying customers, and acted without authorization when she printed them for herself.

At first glance, it almost seems like a reasonable application of the law simply because the end result was theft. But it's the specifics that make it troublesome. "Without authorization" is far too broad a term to be used in this context. With this reading of Oregon's law, the appeals court has basically criminalized a wide variety of corporate computer-related policy violations. Actions that would normally be met (in a corporate setting) with warnings and reprimands could now be viewed as criminal acts.

[T]he Court of Appeals’ decision transforms millions of unsuspecting individuals into criminals on the basis of innocuous, everyday behavior—such as checking personal email or playing solitaire on a work computer. Such restrictions, frequently included in employers’ computer policies, are no different than the restriction imposed on Nascimento. They're ultimately all computer use, not access, restrictions. Upholding Nascimento’s conviction on the basis of a violation of a computer use restriction expands Oregon’s computer crime statute to criminalize violations of any computer use restriction.

The broad reading of Oregon's criminal statute also poses potential problems outside of the work environment.

The court’s holding that a person acts “without authorization” if she violates a policy regarding the use of a computer that she is otherwise authorized to access could be extended to an Internet user who accesses a website in violation of a written terms of service. For example, Facebook’s terms of use provide that “[y]ou will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.” But as the Ninth Circuit noted en banc, “[l]ying on social media websites is common: People shave years off their age, add inches to their height and drop pounds from their weight.” Under the Court of Appeals’ expansive reading of ORS 164.377, if a user shaves a few years off her age in her profile information, asserts that she is single when she is in fact married, or seeks to obfuscate her current physical location, hometown or educational history for any number of legitimate reasons, she violates the computer crime law. The court’s decision thus opens the door to turning millions of individual Internet users—not just millions of individual employees—into criminals for typical and routine Internet activity.

The EFF points out that rolling back this "unconstitutionally vague" reading of Oregon's computer crime law doesn't leave the state without options to punish Nascimento for her actions. She still faces one count of aggravated first-degree theft -- a charge the EFF is not disputing. Pointing to previous decisions by the Fourth and Ninth Circuit courts, the EFF states that similarly broad readings of the rightfully-maligned CFAA (Computer Fraud and Abuse Act) have been rejected for potentially criminalizing violations of workplace computer use policies.

The Supreme Court should have no problem rolling back this broad reading and the attendant charge brought against Nascimento. The theft may have been facilitated by improper access that violated company policy, but this access doesn't rise to the level of a criminal act -- even if it ultimately resulted in a criminal action.

Nascimento Final Eff Amicus Brief 0 (PDF)Nascimento Final Eff Amicus Brief 0 (Text)

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: caryn nascimento, cfaa, company policies, computer access, computers, hacking, oregon

38 Comments

If you liked this post, you may also be interested in...

Reader Comments

Subscribe: RSS

View by: Time | Thread

radix (profile), 20 May 2015 @ 5:01pm

Who'da thunk it
If you can be sent to prison for violating company policies, then companies are effectively writing criminal codes.

Which means the 'corporatocracy' that certain political extremists have been warning about for years actually starts in Oregon, of all places?

Didn't see that coming.
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 5:06pm

Re: Who'da thunk it
yes, it's a sweet move.
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 5:08pm

The crime committed was theft, does not matter how it was accomplished. Appending things with "done on a computer" is simply stupid and shows a lack of understanding the subject matter. Way to go Oregon!
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 5:28pm

Re: Who'da thunk it
Eh... kind of. If you have trespassing laws, then the company's hours of business help determine whether you are trespassing or not. Similarly, if a business has computer policies, whether those policies are being violated could easily determine whether something is a computer crime.

But that works both ways. A store cannot retroactively say you were trespassing because you were shoplifting and they don't allow shoplifters. Similarly, if you have authorized access to a computer system, then you aren't accessing it without authorization just because you did something you weren't supposed to be doing.
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 5:32pm

It would seem like the "without authorization" wording of the law would obviously be aimed at hackers and others who break into computers without necessarily stealing anything tangible. The common legal term "breaking and entering" doesn't really even apply when a server is accessible to the internet, and programming a client web browser to send a slightly altered line of code might "open things up" in ways the owner never intended.

But as usual, a sloppily-worded law can take on an entirely new meaning, and even the law's original author is powerless to rein-in these distorted interpretations.

But then let's not kid ourselves that those standard disclaimers commonly posted on warez servers, like "You are not authorized to download these files" would automatically turn the copyright cops into criminals.
[ link to this | view in thread ]
RR, 20 May 2015 @ 5:38pm

blame game
We keep asking the courts to bandaid or ignore bad laws, instead of blaming the people who wrote the bad laws.
[ link to this | view in thread ]
OldMugwump (profile), 20 May 2015 @ 7:00pm

Re: blame game
We have little choice.

The courts are the only branch of government that is still uncorrupted. Mostly.
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 7:58pm

Re: Re: blame game
Whoa... you obviously don't know a thing.

The corruption started there and the court and legal system is the #1 corruption. This system has to be taken down before the rest can be corrupted because everyone, including the politicians have to go through it.

It was corrupt FIRST! And remains the MOST corrupt now. Just ask anyone who is on death row or just in prison for something they did not do. The next most corrupt... Congress.... followed by the Executive Branch.
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 8:39pm

Re:
"Computer Crime" is such a ridiculous term ... some folks even think it includes things like altering a URL in a browser. Or worse yet, typing it in yourself - omg - the horror!!!!
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 8:41pm

Re: Re: Re: blame game
What? You can't be serious.
Court system == original sin?
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 8:43pm

Re: blame game
Many times I think the laws were/are written that way intentionally so that they could/can be twisted to fit the desired outcome regardless of original intent.
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 8:55pm

Re: Re: Re: Re: blame game
Being the most corrupt is not the same as being the first sinner.

Lets go over some things. The court system was designed to have a jury with it. Why do you suppose that is? How about you just ask the founding fathers why.

Did you know that if a juror mentions they know anything about the concept of Jury Nullification that you will be told to go home? That's right, if you want to get out of jury duty just say jury nullification.

When you server they will have you swear and oath to uphold the law, which is not why you are there. They will also tell you that you must only decide if they broke it or not. You are there for that & more importantly if that law was justified to begin with. The founding fathers made it clear why a jury should always be required because they already knew how fast a judge and the system can be corrupted. They did not make it so that Congress or the Executive branches required a jury... they did that for the Courts, because that is the place where corruption impacts everyone directly! Congress and write a law, and Executive can try to enforce it upon you, but the courts, they have to find you guilty and that part requires citizens to agree with that, and today those citizens are ignorant and they are also lied too the entire process.

You tell me... a court and a well meaning jury can stop corrupt police from punishing you unjustly... how are they not the most corrupt system running now considering most people work a plea bargain rather than fighting for their rights?

O yes... very corrupt... DAMN CORRUPT! But I guess no more informationally bankrupt than you or the rest of the foul and ignorant electorate that see all as guilty until proven innocent!
[ link to this | view in thread ]
Anonymous Coward, 20 May 2015 @ 9:01pm

Re: Re: blame game
oh yes definitely.

The bible says woe unto you lawyers, you increase the burdens upon the people without lifting even a little finger to help them.

the legal system is nothing more than a farce now because Jurors either refuse to stop corruption from jailing innocents or because they are caught in the guilty until proven innocent nature of humanity. They know next to nothing about how their government operates but they seem to think themselves smart. Justice is for those whom can afford to fight for it.
[ link to this | view in thread ]
1st Dread Pirate Roberts (profile), 20 May 2015 @ 9:46pm

Grounds for dismissal
Violating company policy should be grounds for dismissal, not criminal prosecution. If you venture into criminal behavior *during* your misuse of computer systems, you should be prosecuted, but not for the misuse itself.
[ link to this | view in thread ]
Jay (profile), 20 May 2015 @ 11:10pm

Having recently relocated from Oregon to a better state in which to live, Oregon lawmakers and courts are extremely screwed-up. I do not think for one moment that things like this are going to get any better before they get worse. They seem to be modeling themselves after the USDOJ.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 12:22am

Speaking as someone who WRITES policies...
...this is full-blown batshit insane.

I've written workplace computer policies for decades, and have, during that time, reviewed innumerable others for ideas, wording choices, etc. They are all -- including my own -- unreviewed, error-ridden, incomplete, overbroad, inconsistent disasters that would never survive an hour a competent peer analysis and critique. Giving this garbage the force of law is dangerous and absurd.

(You might be wondering, given that paragraph, why I write them. I write them because the incompetent, bureaucratic, worthless morons above me demand that they be written -- you see, they're too stupid to let me just use my best judgment, which is actually very good -- so I write them rather than sloughing the task off to ignorant newbies who would do an even worse job than I do.)
[ link to this | view in thread ]
toyotabedzrock (profile), 21 May 2015 @ 3:14am

These prosecutors are acting like patent lawyers that think doing something on a computer somehow transforms what actually happened.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 3:45am

Those for profit prisons are not just going to fill themselves now. We need to make everything a crime to keep the tax dollars flowing into the pockets of the corrupt
[ link to this | view in thread ]
fuunu (profile), 21 May 2015 @ 3:58am

Working as IT for the federal government I can see the companies and the legal system point of view. After all working for the federal government I am responsible for monitoring the usage of the computer system by the employees and I see a lot of things that could get people in trouble, most looking at porn, however only twice in the last 5 years have I seen someone get fired and get in legal trouble for the computer activities. Both of them had accessed classified materials without proper clearance. While they didn't leak the material it was still enough to get a massive fine as well as fired.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 4:29am

I suppose it all depends how non-computer-based violations of the law are handled.

If I walk into a hardware store, pick up a sledgehammer and bludgeon someone to death with it, and I'm charged with both murder and improper use of that company's property, then I suppose the computer misuse stuff would make sense.

Pretty sure you don't normally get charged for the second thing, though.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 6:45am

Re: Re: Re: Re: Re: blame game
How naive, isn't that special.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 6:48am

Re: Re: Re: blame game
Many times criminals escape prosecution and are not subject to a jury.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 6:54am

Re:
Why yes indeed. Use of a sledge hammer on a finishing nail should be criminal with sentencing of three to five years hard labor. This is clearly stated in you employee manual, you did read it didn't you?
[ link to this | view in thread ]
nasch (profile), 21 May 2015 @ 9:03am

Re: Re: Who'da thunk it
Similarly, if you have authorized access to a computer system, then you aren't accessing it without authorization just because you did something you weren't supposed to be doing.

Yeah, that's what this case turns on. If the prosecution gets its way, that actually will be a crime in Oregon. Which is radix's point.
[ link to this | view in thread ]
nasch (profile), 21 May 2015 @ 9:08am

Re:
Pretty sure you don't normally get charged for the second thing, though.

If the prosecutor is trying to get you to plea bargain, you'll be changed with six different kinds of homicide, trespassing, theft, jaywalking, conspiracy, destruction of property, and anything else they can think of.
[ link to this | view in thread ]
Uriel-238 (profile), 21 May 2015 @ 9:43am

Pleabargaining in the '80s was illegal
And it probably still should be, for reasons just like that.

In fact, in movies and TV when the DA was trying to get the hero to pleabargain, that's how you knew he was corrupt and on the inside of the conspiracy.
[ link to this | view in thread ]
John Fenderson (profile), 21 May 2015 @ 10:22am

Re: Pleabargaining in the '80s was illegal
"when the DA was trying to get the hero to pleabargain, that's how you knew he was corrupt and on the inside of the conspiracy"

Just like now, outside of the movies. To my ear, a "plea bargain" is pretty much equivalent to the accused being railroaded and indicates a miscarriage of justice on its face.
[ link to this | view in thread ]
Gwiz (profile), 21 May 2015 @ 10:31am

Re: Pleabargaining in the '80s was illegal
Pleabargaining in the '80s was illegal

Is was? Do you have a citation for that?

From what I've read, plea bargaining started happening in the decades following the Civil War. SCOTUS ruled on plea bargaining in three cases from 1968 to 1971 and found plea bargaining to be constitutional.

I know that some states and localities have passed laws making plea bargaining illegal, but on a whole, in the US, plea bargaining has always been legal, so I am interested as to where you got the idea that "Pleabargaining in the '80s was illegal".
[ link to this | view in thread ]
Uriel-238 (profile), 21 May 2015 @ 11:30am

You know, Gwiz, you're absolutely right. Plea bargaining was legal (under qualified circumstances) after the Brady v. US ruling in 1970.

I remember also in the news media during the 80s the notion that plea-bargaining was unethical and procedurally unacceptable. It was implied to be criminal for the prosecution and defense to even negotiate outside the court, even with people getting in trouble for trying. This idea was preponderant in the (Los-Angeles-based) television I consumed. So yeah, I, too, wonder where I got that from.

In fictional media, plea-bargaining was regarded as a device of corrupted agents. A plea-bargain attempt pointed to a PA on the take just as much as secret police and preponderance of security cameras pointed to a dystopian police state.

Some time in the 90s, plea-bargaining became not only acceptable, but the norm. Lampshaded thoroughly by Sorkin (albeit in military courts) in A Few Good Men. It's around the same time as when a handful of SWAT raids made it into the media as a new trend, given that they weren't hostage-barricade situations, and in one case, shot up a family.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 12:47pm

Almost everything is a crime.
[ link to this | view in thread ]
I Want Sovereignty, 21 May 2015 @ 2:25pm

In My Perfect World
Everyone will just stop working for these multi-national corporations and refuse to work for them NO MATTER WHAT. (Period)
[ link to this | view in thread ]
Anonymous Moron, 21 May 2015 @ 2:38pm

Re: Speaking as someone who WRITES policies...
What if you weren't so "anonymous" now? Would you still be calling me Incompetent and worthless even as a moron? Just wondering..
[ link to this | view in thread ]
Gopher Guts, 21 May 2015 @ 2:55pm

Re: Grounds for dismissal
The World, in particular, lawyers from large corporations seemed poised to systematically enact and protect policies that are prerequisite for these corporations resolve for sovereignty which will violate an individual's rights under the law and most in particularly the US Constitution. And it will be protected by the government's claim of National Security that will preempt any claim of individual rights. Its a very dark road ahead for everyone, whether or not you are employed by these multi-national corporations.
[ link to this | view in thread ]
Your English teacher, 21 May 2015 @ 3:33pm

Re: Re: Re: blame game
.. who can afford to fight for it.

Its about prosecutorial bias and convictions, not justice.
[ link to this | view in thread ]
Uriel-238 (profile), 21 May 2015 @ 3:40pm

Re: In My Perfect World
That's the problem.

You get the labor force just the right amount of hungry and they'll suffer a lot of bullshit.

The trick is keeping them the right amount of hungry. If they get too hungry then they burn down the edifices and erect guillotines, and you wind up trying to flee to England.

And the funny thing is that tragedy-of-the-commons will always kill cartels and get the corporates / nobles to push the peasants too far.
[ link to this | view in thread ]
Uriel-238 (profile), 21 May 2015 @ 3:45pm

A Moron
...has an IQ of 51 to 70 and is capable of simple, menial work.
[ link to this | view in thread ]
Anonymous Coward, 21 May 2015 @ 6:11pm

Re: Pleabargaining in the '80s was illegal
Pleabargining is bad enough, but when they do not fund the public defender's office it is criminal. But then who is going to press charges?
[ link to this | view in thread ]
SDN, 22 May 2015 @ 4:13am

Re:
No stupider than "hate crimes" laws, and for the same reason.
[ link to this | view in thread ]