Slashdot Mirror
Clerk Printed Lottery Tickets She Didn't Pay For But Didn't Break Hacking Law (arstechnica.com)
Violating a company rule is not -- and should not be -- a computer crime, that was the ruling of the Oregon Supreme Court in State v. Nascimento file. The Oregon's highest court ruled that while a convenience store clerk was guilty of stealing lottery tickets through the store's computer system, she did not violate the state's anti-hacking law while doing so. ArsTechnica shares more details: The Electronic Frontier Foundation, which appeared on Caryn Nascimento's behalf during the case as an amicus curae (friend of the court), announced the narrow victory on Tuesday. According to the Supreme Court's decision, the case dates back to 2007, when Nascimento began working at Tiger Mart, a small convenience store in Madras, Oregon, about 120 miles southeast of Portland. In late 2008 and early 2009, a company vice president began investigating what appeared to be cash shortages at that store, sometimes about $1,000 per day. After reviewing video recordings that correlated with Nascimento's work schedule, this executive began to suspect that she was buying lottery tickets but not paying for them. Eventually, Nascimento was charged not only with aggravated first-degree theft but also of violating the state's computer crime law, which includes language that "any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime." She was convicted on both charges at trial. On appeal before the Oregon Supreme Court, Nascimento's lawyers argued that while their client may have violated a company policy to not print lottery tickets that she did not receive payment for, she was, in fact, authorized to access the lottery printing computer.
Look, when someone breaks the law, punish them for what they did, not things that are SIMILAR to what they did.
excitingthingstodo.blogspot.com
And someone just "investigated"?
Was the boss asleep? Whenever I've worked retail, a report was required for more than $20 missing from a cash drawer...
$1,000 would have been unthinkable!
Violating a company rule means that the access done in violation was unauthorized. It would be just like loaning a vehicle to someone stipulating that they were not to go off-road, some security camera shows them mud-bogging, and then nailing the car borrowers with grand theft, because authorization to drive was revoked.
"I told them they could not have any more cheese then they went and opened the fridge. Throw the book at them that was unauthorized access to the computer. Then they went and used the microwave!!!"
Even though the law as written seems pretty clear
"any person who knowingly and without authorization uses, accesses or attempts to access any computer"
this is a very good precedent to be set when we are proceeding towards where there are computers in everything.
There are two common-sense readings, and the court took one of them.
The other common-sense reading is that the employee was only authorized to access the device to do things that complied with company policy, and that her authorization to accessed it was implicitly suspended during the time she was violating company policy.
Since the court went the way they went, expect some companies in Oregon to go back and spell out very clearly that when you are using company equipment in violation of company policy, your authorization to use the equipment is immediately suspended for the duration of your out-of-policy use and, as a result, you are violating Oregon state law and that the company reserves the right to press charges.
Personally, I think the court made the right decision, because 1) it's very easy for companies to "work around it" by modifying their policies, and 2) the court's ruling prevents "gotcha" situations where the law was ambiguous and, prior to a judge ruling on the issue to remove the ambiguity, a reasonable person could read the law as not applying.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
She was authorized to access the computer system she used as part of her job responsibilities. The fact she abused her access to it is beside the point. She didn't hack into it in the slightest.
Kinda like how you can be charged with breaking an entering in a home you did not break into and were already authorized to be in even if you do something you aren't allowed to do while you are in.
Her lawyers were correct in that regard.
Really, it's no different than loading up you car with merchandise that you did not pay for.
Don't most places have the lotto system with it's own cash door and she may be looking at hard time for stealing lotto.
She had the authorization for it, it's not hacking, it's just theft.
Tollroads can try this BS on speeding by go over the limit you are not authorization to use the ETC / camera / coin counting system so you are now looking at hard time under the computer crime law.
They can try that but in IL they will need to build a lot of court rooms and jails to handle the case load. Also good luck finding people to fill all the jury's.
It's about time someone set the right precedent. Now there's finally some good case law for every count of "crime...but on a computer" to NOT count as a violation of CFAA.
... executive began to suspect that she was buying lottery tickets but not paying for them.
how does one "buy" something without paying for it?
She was printing them – without paying for them. She was stealing. She was a lot of things, but she wasn't buying them.
And yes, there are ways of paying for things other than with money.
I've only ever seen those in California. In every other state where I've been (certainly not all of them), there is a lotto printing machine. The clerk prints the request number of tickets and rings up the sale. Once the ticket is printed, they owe the lottery the money for the purchase. The clerks manufacture (print) the tickets, sell them, and collect the money. What she did here was manufacture and steal tickets. She didn't do anything to alter the behavior of the ticket printing machine nor of the cash register.
In some states (like Maryland for example), that is optional. Large supermarkets usually have the separate drawer, but places like 7-Eleven use the regular cash register drawer.
What was the value of the lottery tickets stolen ? Was it valued at the $1.00 per pick or the value if you won ? It was only $1.00 at the time of the theft, can they retroactively apply appreciation to the value of the item ? If you stole $10.00 from the till and one of the dollars turned out to be a rare silver certificate, but that fact was unknown to any party involved at the time of the crime, I wonder if the crime is still a $10.00 theft ?
errr....umm...*whooosh* *whoosh* Is this thing on ?
She was convicted on both charges at trial.
Presumably her lawyers raised the obvious point at her trial, so why was she convicted of a 'break and enter' that she didn't commit?
I get that they think the CFAA is overbroad and this is a prosecutorial pile-on. And maybe it is.
At the same time (and to be fair), this may have a negative impact on privacy.
Consider a scenario where an individual (say, a police dispatcher) has authorization to use a computer system (say, court records, warrants, DMV records) for legitimate purpose (in dispatching the police). Now she goes and uses her access to that computer beyond the bounds of that authorization: to help a friend that is a PI, to stalk her ex, to get juicy leads so she can paparazzo some douchy D-list actor when he gets out of his DUI.
Once you think about it this way -- how many people need access to systems with personal information to do their jobs but for which it's not feasible to have technical solutions -- you wonder how to create a workable legal solution that doesn't need to be re-done for every possible use-case. CFAA may be a poorly drafted attempt, but the goal of criminalizing exceeding your authorization (if not your access) to a computer system makes sense and, I would argue, is privacy protecting.
Can't be Lucifer, but maybe Lilith ?
https://en.wikipedia.org/wiki/...
errr....umm...*whooosh* *whoosh* Is this thing on ?
Sure she stole many thousands of dollars. On the other hand the lottery commision was stealing billions of dollars from poor people to raise the salaries of rich entitled politicians. Sorry I did not mean that. I meant the lottlery is being used to raise money so that rich entitled politicians can send their kids to private schools. Sorry didn't mean that I really meant the lottery is being used to raise money so that poor disadvantaged students can receive a decent education.
Yea that is it; rich people are buying tons of lottery tickets so they can send give poor people a decent education.
Come to think of it this convenience store clerk is truly evil. She was stealing the future away from poor people THE STATE SHOULD FRY HER!
this executive began to suspect that she was buying lottery tickets but not paying for them
So not buying them, then? Perhaps we could call this thing "stealing."
systemd is Roko's Basilisk.
And prosecutors, having (hopefully) studied Law, should know this.
If the clerk was printing tickets for purposes other than to sell then it's still unauthorized access.
When referring to the US State, it's just "Oregon", not "The Oregon".
Would she then be entitled to the winnings? I would think not.
The day Microsoft creates a product that doesn't suck, it will be known as the Microsoft Vaccuum Cleaner!