Slashdot Mirror
Court Rules Workers Did Not Overstep On Stealing Data
MikeatWired writes "In a somewhat startling decision, the U.S. Court of Appeals for the Ninth Circuit has ruled that several employees at an executive recruitment firm did not exceed their authorized access to their company's database when they logged into the system and stole confidential data from it. The appellate court's decision affirms a previous ruling made by the U.S. District Court for the Northern District of California. The government must now decide if it wants to take the case all the way to the U.S. Supreme Court. The judge wrote that the Computer Fraud and Abuse Act, under which they were charged, applies primarily to unauthorized access involving external hackers. The definition of 'exceeds authorized access' under the CFAA applies mainly to people who have no authorized access to the computer at all, the judge wrote. The term would also apply to insiders who might have legitimate access to a system but not to specific information or files on the system Applying the language in the CFAA any other way would turn it into a 'sweeping Internet-policing mandate,' he wrote."
That doesn't mean they can't be charged under other statutes.
From TFA, it sounded like there was a separate charge of trade secret theft that continued on independently of the CFAA charge. Does anyone know how that turned out?
There are some judges who have a clue.
Leave the gun, take the cannoli -- Clemenza, The Godfather
So the court says that the CFAA is not written to encompass unauthorized use, merely unauthorized access. They explicitly say that Congress should modify the statute if they want it to cover use.
It was asked earlier what has happened to the other, non-CFAA counts. It doesn't look like those have gone forward yet, but the 9th Cir. says that the government is free to prosecute on those counts.
For anyone that cares, the case can be found at 2012 WL 1176119.
If there's one thing I learned from Slashdot, it's that data cannot be stolen.
Only physical goods that can be manufactured (usually more cheaply in the Far East or Latin America than in the US) can be stolen.
What's interesting about this ruling is that it's interpreting the CFAA in a manner that's similar to how the DMCA has been interpreted for years: The use of a computer to circumvent restrictions is separate from improper use of the material obtained via circumvention. The difference is that the DMCA is being used to make it illegal to access material which can then be used in a legal manner (i.e., Fair Use). Here, the court is saying that the CFAA says only that it's illegal to access the material if you're circumventing access controls, and that even if you use the material illegally you're not violating the CFAA if you didn't have to circumvent access to get it.
For what it's worth, I think that this ruling gets it 100% correct. There are already laws in place governing the improper appropriation/use of information regardless of how it was obtained. Why should it be more improper if it was obtained using your computer to get it from the company's servers than if you walked into the file room and copied some files? At the rate computer (mis)use is being criminalized, pretty soon everyone in the US will be a criminal by default, as there won't be anything that can be done without violating some rule or another, not matter how innocuous. Mistype your password? Oops, that's illegally attempting to access a computer, better throw you in jail to be safe...
He didn't violate the CFAA. I'm sure he violated a ton of other laws.
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
Of course data "can" be stolen. You make a copy on your system and delete it from the original and all backups. But nobody actually does this.
Is it just my observation, or are there way too many stupid people in the world?
The judge compared this more to giving somebody the key to your house. If I give you the key to my house, and find out you were taking pictures of yourself in my underwear and posting them all over the police are not going to charge you with B&E or Home invasion... Because you didn't ILLEGALLY break in... You had a key. You don't get to RETROACTIVELY call B&E when they left a mess on your kitchen or something that upsets you later.
In the same way, taking a car that you were allowed to drive is still stealing the car, but it's not carjacking or B&E because they GAVE you the key. It's still breaking "A" law, but it's your word against theirs for your "level of access" to the car... You didn't "rob" them of the car... Robbery is very specific.
The judge is also pointing out that authorized people borrow computers from coworkers and share passwords with other authorized people all the time... The law has to be applied uniformly, fairly, and predictably... Not IGNORED until the boss finds something else you did wrong.
Nobody says what they did isn't illegal (presumably, under other laws).
They're saying it's like having a law making it illegal for someone off the street to walk into a bank vault and take money, then trying to charge the teller under that same law even thoug she has legitimate access.
It wasn't the taking, but the taking when you don't have access. The law is poorly written and was rejected. Good.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Wrong. The court did not say that there was no harm nor that there was no crime: just that there was no CFAA violation. This is a reasonable and proper decision.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Physically, it seems that there are some parallels between breaking+entering and theft.
Similar to your file-cabinet example, if Bob the janitor has a key to the office for cleaning purposes, but uses it to rifle through the boss's drawers and steal stuff, then it's theft, but not B&E.
If Bob doesn't have key to an office or secure area, but he picks the lock then steals stuff, it's B&E+theft.
In this case, nobody broke in. Bob had a computer account with legitimate access which he logged in with, so there's no B&E (hacking).
Theft of trade secrets, industrial espionage, or other such things may apply though.
No, the last two paragraphs of the article clearly explain why Judges Silverman and Tallman disagree with the majority ruling.
It's funny that you seem to have overlooked the third-to-last paragraph, where the Judge Kozinski offered this: "Basing criminal liability on violations of private computer use polices can transform whole categories of otherwise innocuous behavior into federal crimes simply because a computer is involved," he said. "Employees who call family members from their work phones will become criminals if they send an email instead."
What the minority opinion is saying - and you seem to be agreeing with - is that corporate Acceptable Use Policies should be given the weight of Federal criminal statute. If the corporate AUP says "You may not use work email for personal use," the scenario above would create a whole new class of *criminals* - not just an HR issue. There are already laws against misuse / misappropriation of confidential data.
So this would be "conversion" rather then "theft".
Cheap storage VM.
No, it is not wrong, and Silverman's analogy is dissimilar. And stupid.
Information is not money. Information is not similar to money. Information is not similar to a car, either.
It's more like, you have permission to test drive a new car, but you would "exceed your authority" by opening the glove compartment and finding the dealership's master sales plan carelessly left there. No, that's not right. In no way would you be "exceeding your authority" by opening the glove compartment, or by finding it.
You would be breaking the law if you copied that information and contacted the dealership's competition with an offer to sell it to them. But you would not be breaking the law by accessing the information, nor would you be overstepping your authority.
If there's one thing I learned from Slashdot, it's that data cannot be stolen.
Only physical goods that can be manufactured (usually more cheaply in the Far East or Latin America than in the US) can be stolen.
Also, Data is an active agent, struggling for it's own freedom. It may manipulate people or try to get itself marked executable to achieve freedom. That's why we need to fight against DEP -- it's just unfair to the data.
tomorrow who's gonna fuss
If the solicitor is basically employed as an independent contractor, then they legitimately take their information with them when they leave.
In this case the database belonged to the company, NOT to the person managing it.
If there's one thing I learned from Slashdot, it's that data cannot be stolen.
This is correct. However, private data can be illegally accessed.
You're conflating hard goods with digital goods.
Theft is the unlawful transferring of an asset between two parties - it requires a taking, a possession, and a deprivation. In the case of information, there is no "original," merely copies or instances, all identical. By removing the instance from one party and depositing it into the control of a second party, against the first party's will, theft has occurred.
It's a necessary distinction only because in nearly all cases (such as this one) that is not what happens.
Is it just my observation, or are there way too many stupid people in the world?
This seems to be the heart of a lot of the confusion in this thread. Basically, whether or not they stole data (or whether it's possible to steal data) isn't relevant, because that isn't the crime they were charged with.
What they WERE charged with was trying to get system access they weren't authorized for, which they didn't do; they just logged in and took what was within the purview of their own authorized account access. That's what the judge pointed out.
Whether they're guilty of some other crime or not remains to be seen. But the judge is saying you can't charge someone with a random crime that sounds related, you have to charge them with whatever crime they committed, if you want it to stick. Just because a computer was involved doesn't make it hacking. It's like someone used a crane to drop a car on top of something to destroy it, and the person responsible got charged with wreckless driving.
Once again, if the legislature doesn't want their intent to misinterpreted, they should write the law the way they intended.
The fact that the 9th circuit has again, applied the law rather than legislate from the bench is to me, the only thing startling.