Friday, May 08, 2009

Viewing Porn At Work Is Hacking?

Wired's Threat Level has a very interesting article about Richard Wolf, an Ohio man who was convicted under the state's hacking law as a result of viewing pornographic material while at the office. Wolf lost his appeal of this particular charge.

Wired quotes part of the statute as follows:
No person, in any manner and by any means, including, but not limited to, computer hacking, shall knowingly gain access to, attempt to gain access to, or cause access to be gained to any computer, . . . without the consent of, or beyond the scope of the express or implied consent of, the owner of the computer, . . . or other person authorized to give consent.
First, keep in mind the original intent of hacking statutes - it's the digital equivalent of breaking & entering. A person gains access to someone's computer and noses around where their nose doesn't belong. For instance, you certainly need the power to prosecute strangers who hack into your personal computer and review your private files. And while perhaps not quite as clear cut, perhaps it should also be criminal for an employee to get into his employer's 'trade secrets file' where that employee has no authorization to do so (though one might think there are plenty of private actions available in such a situation without relying on hacking laws).

What happened in Wolf's case, however, appears to turn the intent of the law on its head. He did not gain unauthorized access to his employer's computer; he did not even gain unauthorized access to the porn site's computer. His access was legitimate - it was only Wolf's use of the computer that exceeded his authorization.

Think about it: The statute prevents people from getting access to a particular computer that is either unauthorized or exceeds the authorization regarding that same computer. Wolf might have exceeded his authorized use of the computer, but what access to that computer did he get as a result of the unauthorized use? NONE!

Wolf was allowed to use his computer. He exceeded that authorization by using his computer to check out an adult website. However, the adult website was not owned by his employer and the adult website owner presumably had no problem's with Wolf's visits. Therefore, there was nothing that he accessed that was unauthorized. The state wholly failed to establish a predicate to the crime: There was unauthorized use but no unauthorized access.

Wolf may be a freakish dude or an average joe caught in a bad circumstance. Regardless, he is getting railroaded by a law that is in no way intended to punish his sort of activity. I hope that his attorneys appeal to the Ohio Supreme Court and that the justices have some greater understanding of the laws they are interpreting.