Slashdot Mirror
Court Rules Workers Did Not Overstep On Stealing Data
MikeatWired writes "In a somewhat startling decision, the U.S. Court of Appeals for the Ninth Circuit has ruled that several employees at an executive recruitment firm did not exceed their authorized access to their company's database when they logged into the system and stole confidential data from it. The appellate court's decision affirms a previous ruling made by the U.S. District Court for the Northern District of California. The government must now decide if it wants to take the case all the way to the U.S. Supreme Court. The judge wrote that the Computer Fraud and Abuse Act, under which they were charged, applies primarily to unauthorized access involving external hackers. The definition of 'exceeds authorized access' under the CFAA applies mainly to people who have no authorized access to the computer at all, the judge wrote. The term would also apply to insiders who might have legitimate access to a system but not to specific information or files on the system Applying the language in the CFAA any other way would turn it into a 'sweeping Internet-policing mandate,' he wrote."
That doesn't mean they can't be charged under other statutes.
From TFA, it sounded like there was a separate charge of trade secret theft that continued on independently of the CFAA charge. Does anyone know how that turned out?
There are some judges who have a clue.
Leave the gun, take the cannoli -- Clemenza, The Godfather
I thought that's why the government passed the law, to have a sweeping internet-policing mandate!
So the court says that the CFAA is not written to encompass unauthorized use, merely unauthorized access. They explicitly say that Congress should modify the statute if they want it to cover use.
It was asked earlier what has happened to the other, non-CFAA counts. It doesn't look like those have gone forward yet, but the 9th Cir. says that the government is free to prosecute on those counts.
For anyone that cares, the case can be found at 2012 WL 1176119.
If so, they were legitimate users of the information, and didn't exceed their authority....except that they kept it when they left. That's more of an internal procedural problem.
Old news wasn't this already covered a week or so ago here?
In either case it's a good ruling in the limited scope in which it applies, folks in most of these cases though are still likely and rightfully so criminally libel under other statutes both fed and state, not to mention in civil court.
If there's one thing I learned from Slashdot, it's that data cannot be stolen.
Only physical goods that can be manufactured (usually more cheaply in the Far East or Latin America than in the US) can be stolen.
Be careful with that link, best hit it in privacy mode. I have never seen such a long list of trackers on a single webpage - Ghostery must have nearly crashed processing it all.. Seems to be a "feature" of that site. :(
rather than copying the data before he left.
... hasn't committed any wrongdoings at all in the view of US law? He only downloaded data he had access to.
Okay, then gave it to somebody who didn't have military confidential clearance.
If we impose that he has done it all.
What's interesting about this ruling is that it's interpreting the CFAA in a manner that's similar to how the DMCA has been interpreted for years: The use of a computer to circumvent restrictions is separate from improper use of the material obtained via circumvention. The difference is that the DMCA is being used to make it illegal to access material which can then be used in a legal manner (i.e., Fair Use). Here, the court is saying that the CFAA says only that it's illegal to access the material if you're circumventing access controls, and that even if you use the material illegally you're not violating the CFAA if you didn't have to circumvent access to get it.
For what it's worth, I think that this ruling gets it 100% correct. There are already laws in place governing the improper appropriation/use of information regardless of how it was obtained. Why should it be more improper if it was obtained using your computer to get it from the company's servers than if you walked into the file room and copied some files? At the rate computer (mis)use is being criminalized, pretty soon everyone in the US will be a criminal by default, as there won't be anything that can be done without violating some rule or another, not matter how innocuous. Mistype your password? Oops, that's illegally attempting to access a computer, better throw you in jail to be safe...
In a dissenting opinion, Circuit Judges Barry Silverman and Richard Tallman wrote that the majority had taken a clearly written federal statute and parsed it in a manner that distorts the original intent.
"This is not an esoteric concept," Silverman wrote. "A bank teller is entitled to access a bank's money for legitimate banking purposes, but not to take the bank's money for himself." Similarly, while a new car buyer might be entitled to test drive a new car, he would "exceed his authority" to take the car to Mexico. "No other circuit that has considered this statute finds the problems that the majority does," he wrote.
The last two paragraphs of the article clearly explains why the court's finding is wrong ("What, you want me to read the article before commenting?!")
Of course data "can" be stolen. You make a copy on your system and delete it from the original and all backups. But nobody actually does this.
Is it just my observation, or are there way too many stupid people in the world?
I was going to post the same thing. The defendants in this case didn't steal anything, because they didn't remove anyone from having access to it. They made copies of it, which may lead be copyright infringement, unauthorized distribution of trade secrets, or used for extortion. It is not, however, stealing.
except that is still *not* stealing.
If i photocopy a document and then destroy the original I have not stolen the original, I have copy of the original and the original no longer exists.
data privacy not data security.. obvious distinction... shame you have no data privacy laws in america
Wrong. The court did not say that there was no harm nor that there was no crime: just that there was no CFAA violation. This is a reasonable and proper decision.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Damn Pirates
Physically, it seems that there are some parallels between breaking+entering and theft.
Similar to your file-cabinet example, if Bob the janitor has a key to the office for cleaning purposes, but uses it to rifle through the boss's drawers and steal stuff, then it's theft, but not B&E.
If Bob doesn't have key to an office or secure area, but he picks the lock then steals stuff, it's B&E+theft.
In this case, nobody broke in. Bob had a computer account with legitimate access which he logged in with, so there's no B&E (hacking).
Theft of trade secrets, industrial espionage, or other such things may apply though.
They are to bling theil ovelpliced olanges for sair to the suplemium appre coult?
Or you can take the hard drive or other device on which said original is stored.
When you spend three years of your life entering data into a corporate database and using it to manage the relationship with the companys' clients for which you have a responsibility you develop a sense of ownership. Before you leave I can understand wanting to have a copy. Solicitors actively develop a 'following' and take that with them to their next employer. Without it they would be unemployable.
If there's one thing I learned from Slashdot, it's that data cannot be stolen.
Only physical goods that can be manufactured (usually more cheaply in the Far East or Latin America than in the US) can be stolen.
Also, Data is an active agent, struggling for it's own freedom. It may manipulate people or try to get itself marked executable to achieve freedom. That's why we need to fight against DEP -- it's just unfair to the data.
tomorrow who's gonna fuss
If the solicitor is basically employed as an independent contractor, then they legitimately take their information with them when they leave.
In this case the database belonged to the company, NOT to the person managing it.
If there's one thing I learned from Slashdot, it's that data cannot be stolen.
This is correct. However, private data can be illegally accessed.
Then you're stealing the hard drive that holds certain data... there are still backups, records, raw data, etc.
You're conflating hard goods with digital goods.
Theft is the unlawful transferring of an asset between two parties - it requires a taking, a possession, and a deprivation. In the case of information, there is no "original," merely copies or instances, all identical. By removing the instance from one party and depositing it into the control of a second party, against the first party's will, theft has occurred.
It's a necessary distinction only because in nearly all cases (such as this one) that is not what happens.
Is it just my observation, or are there way too many stupid people in the world?
This seems to be the heart of a lot of the confusion in this thread. Basically, whether or not they stole data (or whether it's possible to steal data) isn't relevant, because that isn't the crime they were charged with.
What they WERE charged with was trying to get system access they weren't authorized for, which they didn't do; they just logged in and took what was within the purview of their own authorized account access. That's what the judge pointed out.
Whether they're guilty of some other crime or not remains to be seen. But the judge is saying you can't charge someone with a random crime that sounds related, you have to charge them with whatever crime they committed, if you want it to stick. Just because a computer was involved doesn't make it hacking. It's like someone used a crane to drop a car on top of something to destroy it, and the person responsible got charged with wreckless driving.