Clerk Printed Lottery Tickets She Didn't Pay For But Didn't Break Hacking Law (arstechnica.com)

Violating a company rule is not -- and should not be -- a computer crime, that was the ruling of the Oregon Supreme Court in State v. Nascimento file. The Oregon's highest court ruled that while a convenience store clerk was guilty of stealing lottery tickets through the store's computer system, she did not violate the state's anti-hacking law while doing so. ArsTechnica shares more details: The Electronic Frontier Foundation, which appeared on Caryn Nascimento's behalf during the case as an amicus curae (friend of the court), announced the narrow victory on Tuesday. According to the Supreme Court's decision, the case dates back to 2007, when Nascimento began working at Tiger Mart, a small convenience store in Madras, Oregon, about 120 miles southeast of Portland. In late 2008 and early 2009, a company vice president began investigating what appeared to be cash shortages at that store, sometimes about $1,000 per day. After reviewing video recordings that correlated with Nascimento's work schedule, this executive began to suspect that she was buying lottery tickets but not paying for them. Eventually, Nascimento was charged not only with aggravated first-degree theft but also of violating the state's computer crime law, which includes language that "any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime." She was convicted on both charges at trial. On appeal before the Oregon Supreme Court, Nascimento's lawyers argued that while their client may have violated a company policy to not print lottery tickets that she did not receive payment for, she was, in fact, authorized to access the lottery printing computer.

Comments

Typical abusive prosecution

[gurps_npc]

Look, when someone breaks the law, punish them for what they did, not things that are SIMILAR to what they did.

Re:Typical abusive prosecution

[gweihir]

Naaa, In a police-state you always prosecute people to the maximum possible, no matter how stupid and unjust. After all, you have to send a message to the population who the masters are! Were would we be if the serfs could just break the law and get away with anything below a life-sentence for it.

On a completely unrelated thought, that this even needs a court decision shows how very badly out of control the US "legal" system is these days.

Re:Typical abusive prosecution

[mysidia]

What we need to do is stipulate a rule: If the defendant is proven not-guilty of any one of the charges presented,
then they are automatically released of all charges related to their chain actions that some have been deemed criminal.

Afford the defendant the CHOICE regarding which charge or charge(s) will be decided upon first, and in what order for the subsequent ones.

Any further charge for the same chain of actions would be double jeopardy.

So if one of the charges is bogus, the Defendant will have that charge heard first, and once found innocent, be cleared of all the others.

That should encourage prosecutors to only charge the offense for a certain series of actions that they actually have evidence for, And only make the high-quality charges, not specious or dubious ones "To hope something sticks"

Re: Typical abusive prosecution

[david_thornley]

The cases are not comparable. Nishimura deliberately put classified material on his personal systems. Clinton had insufficient safeguards against classified material being on her systems. There's a difference in intent here, which is why Nishimura was prosecuted and Clinton wasn't. I'm not saying what's legal or illegal here, just that nobody's found me a case like Clinton's where there was criminal prosecution.

(Intent, in US law, in general means intent to commit an act that is illegal. Nishimura had intent in putting classified material on his systems. Clinton did not.)

Re:$1,000 a DAY was missing?

[gmack]

The money wouldn't have been missing from the cash register. It would have shown up when the store gets it's bill from the lottery company for purchased tickets that were never actually purchased.

Re:This could've gone either way

[silas_moeckel]

Because the physical world equivalent is she went into the store room and stole stuff while working there and having access to said store room. It would not seem reasonable to charge a store clerk with breaking and entering etc for going into the back room and stealing stuff and this is no different.

Re: $1,000 a DAY was missing?

[ShaunC]

But she is authorized to use the register. I don't see why she can't take all the money and claim the same defense she used here.

Because it's still aggravated first-degree theft even if you're authorized to use the register. She stole, and was convicted for stealing. There's no need for any more charges to be piled on.

It's about time

[omnichad]

It's about time someone set the right precedent. Now there's finally some good case law for every count of "crime...but on a computer" to NOT count as a violation of CFAA.