State Supreme Court Rolls Back Decision That Would Have Made Violating Company Computer Policies A Crime

from the penalties-range-from-'written-reprimand'-to-'years-in-prison' dept

The Oregon Supreme Court has handed down a ruling that should help prevent the state's computer crime laws from turning into a local level CFAA -- something that can be easily abused by prosecutors to, say, toss someone in jail for two years for 40 minutes of headline altering at a news website.

Caryn Nascimento was arrested for theft after using a convenience store's lottery machine to print off thousands of dollars of tickets she never paid for. But rather than settle for the theft charges, the state chose to charge her with unauthorized use under Oregon's broadly-interpreted computer crimes statute.

The state appeals court upheld the conviction, prompting the EFF to intervene in her case when it headed to the state supreme court. The EFF pointed out that the appeals court decision would criminalize a lot of behavior normally only subject to companies' internal disciplinary processes.

[T]he Court of Appeals’ decision transforms millions of unsuspecting individuals into criminals on the basis of innocuous, everyday behavior—such as checking personal email or playing solitaire on a work computer. Such restrictions, frequently included in employers’ computer policies, are no different than the restriction imposed on Nascimento. They're ultimately all computer use, not access, restrictions. Upholding Nascimento’s conviction on the basis of a violation of a computer use restriction expands Oregon’s computer crime statute to criminalize violations of any computer use restriction.

The Supreme Court has found that, contrary to the lower court's decision, Nascimento did not exceed her authorization when she printed out lottery tickets she never paid for. She did steal, but she was fully authorized to perform every step up to the point of not paying for the tickets.

It is difficult to square the state’s position with the text of ORS 164.377(4). The text establishes a binary division between those who are "authorized" to access or use a computer and those who are not. The text does not distinguish between use that is authorized for certain purposes (such as those permitted by employer policies) and use that otherwise would be authorized but that is inconsistent with those policies. Indeed, subsection (4) of the statute does not focus on the purpose or manner of use at all, but only on whether the access or use is "authorized."

[...]

Viewed in that light, the text supports defendant’s assertion that her use of the lottery terminal to print Keno tickets—as she was trained and permitted by her employer to do—was "authorized" use. The fact that she printed the tickets for her own use and did not pay for them may have violated company policies and other parts of the computer crime statute (in addition to the theft statute), but her use was not "without authorization" as that term is used in ORS 164.377(4).

Nascimento was not allowed to print out tickets for herself or do so without paying, but those were violations of company policy, not state law. The theft of funds -- via the unpaid-for lottery tickets -- was a criminal act, but the acquisition of the tickets via a machine she was authorized to use was not.

The court points out [PDF] that reading the state statute in the way prosecutors (and the lower court) interpreted it means adding words that aren't there to the existing law.

As noted, “access” is defined in the computer crime statute as “retriev[ing] data” or “mak[ing] use of any resource on a computer.” ORS 164.377(1)(a). If a person is “empowered” or “permitted”—the dictionary synonyms of “authorized”—by the appropriate authority to “retrieve data” or “make use” of the computer, then that use is “authorized.” Applying those words in their ordinary senses, it is a stretch to suggest that an employee who uses her work computer to send a private email during the work day— or check Facebook or buy a movie ticket—contrary to her employer’s policy against personal use, has “accessed” or “used” the computer “without authorization,” although she may have violated her employer’s policy. Nothing in the text of the statute suggests that the legislature intended such a result. As defendant argues, the state’s interpretation would criminalize not only “unauthorized” use of a computer, but also “authorized use for an impermissible purpose.” Such an interpretation would require adding words to the text of the statute that the legislature did not use. See ORS 174.010 (court may not add words to statute).

It's a good decision that rolls back the lower court's unfortunate expansion of a law already prone to abusive interpretation. This should keep people from being saddled with extra charges just because their criminal activities were committed on a computer.

Filed Under: caryn nascimento, cfaa, hacking, lottery tickets, oregon

EFF Asks Court To Reconsider Ruling That Would Make Violating Work Computer Policies A Criminal Act

from the surfing-on-the-clock?-that's-a-jailing dept

The EFF is asking the Oregon Supreme Court to take a look at a disturbing opinion issued by the state's appeals court -- one that could see employees face fines and prison time simply for violating company policies.

The case prompting the filing of an amicus brief on behalf of the defendant does contain an element of criminality, but the court's decision should have been limited to the end result of the defendant's actions, rather than the actions taken to reach that point.

Caryn Nascimento worked as a cashier at the deli counter of a convenience store. As part of her job, she was authorized to access a lottery terminal in the store to sell and validate lottery tickets for paying customers. Store policy prohibited employees from purchasing lottery tickets for themselves or validating their own lottery tickets while on duty. After a store manager noticed a discrepancy in the receipts from the lottery terminal, it was discovered that Nascimento had printed lottery tickets for herself without paying for them. She was ultimately convicted not only of first-degree theft, but also of computer crime on the ground that she accessed the lottery terminal “without authorization.”

Nascimento appealed the computer crime conviction. She argued that because she had permission to access the lottery terminal as part of her work duties, she did not access the terminal without authorization—as required under the Oregon's computer crime statute. Unfortunately, the Oregon Court of Appeals affirmed Nascimento’s conviction, finding she had only “limited authorization” to access the lottery terminal for purposes of printing and validating lottery tickets for paying customers, and acted without authorization when she printed them for herself.

At first glance, it almost seems like a reasonable application of the law simply because the end result was theft. But it's the specifics that make it troublesome. "Without authorization" is far too broad a term to be used in this context. With this reading of Oregon's law, the appeals court has basically criminalized a wide variety of corporate computer-related policy violations. Actions that would normally be met (in a corporate setting) with warnings and reprimands could now be viewed as criminal acts.

[T]he Court of Appeals’ decision transforms millions of unsuspecting individuals into criminals on the basis of innocuous, everyday behavior—such as checking personal email or playing solitaire on a work computer. Such restrictions, frequently included in employers’ computer policies, are no different than the restriction imposed on Nascimento. They're ultimately all computer use, not access, restrictions. Upholding Nascimento’s conviction on the basis of a violation of a computer use restriction expands Oregon’s computer crime statute to criminalize violations of any computer use restriction.

The broad reading of Oregon's criminal statute also poses potential problems outside of the work environment.

The court’s holding that a person acts “without authorization” if she violates a policy regarding the use of a computer that she is otherwise authorized to access could be extended to an Internet user who accesses a website in violation of a written terms of service. For example, Facebook’s terms of use provide that “[y]ou will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission.” But as the Ninth Circuit noted en banc, “[l]ying on social media websites is common: People shave years off their age, add inches to their height and drop pounds from their weight.” Under the Court of Appeals’ expansive reading of ORS 164.377, if a user shaves a few years off her age in her profile information, asserts that she is single when she is in fact married, or seeks to obfuscate her current physical location, hometown or educational history for any number of legitimate reasons, she violates the computer crime law. The court’s decision thus opens the door to turning millions of individual Internet users—not just millions of individual employees—into criminals for typical and routine Internet activity.

The EFF points out that rolling back this "unconstitutionally vague" reading of Oregon's computer crime law doesn't leave the state without options to punish Nascimento for her actions. She still faces one count of aggravated first-degree theft -- a charge the EFF is not disputing. Pointing to previous decisions by the Fourth and Ninth Circuit courts, the EFF states that similarly broad readings of the rightfully-maligned CFAA (Computer Fraud and Abuse Act) have been rejected for potentially criminalizing violations of workplace computer use policies.

The Supreme Court should have no problem rolling back this broad reading and the attendant charge brought against Nascimento. The theft may have been facilitated by improper access that violated company policy, but this access doesn't rise to the level of a criminal act -- even if it ultimately resulted in a criminal action.

Filed Under: caryn nascimento, cfaa, company policies, computer access, computers, hacking, oregon