Digg this story   Add to del.icio.us   (page 2 of 2 ) previous 
The Vice of Vice Presidential E-Mail
Mark Rasch, 2008-10-06

Story continued from Page 1

This is important because the law requires a higher degree of warrant -- probable cause -- to "seize" an email "in transmission" than it does to subpoena a document that is stored, which is why the government takes the position that read but stored email is like any other stored document. While the DOJ manual is not binding of the government, having taken this position in the past, they would be hard pressed to argue that Rubico’s "reading" of Palin’s already read mail violated at least their interpretation of the Stored Communications Act.

Trespass of more?

A second possibility is to use the old standby, the Computer Fraud and Abuse Act. At its most basic, this makes it a crime to "intentionally access a computer without authorization" or in excess of authorization and to "obtain information" from a computer. This is the electronic equivalent of a trespass statute: a mere break-in.

There is little doubt that Rubico accessed Palin’s Yahoo account, that this account is on a "computer" and that he didn’t have authorization to do so. While he may argue that Palin’s alleged placing of Alaska government communications on her personal account would give him or others the right to read the emails, ultimately, this does not give him the right to break in, any more than O.J. Simpson had the right to allegedly break into someone’s hotel room to retrieve what he believed was his sports memorabilia.

As the Theoffel court noted:

A hacker could use someone else's password to break into a mail server and then claim the server "authorized" his access. Congress surely did not intend to exempt such intrusions—indeed, they seem the paradigm of what it sought to prohibit, cf. United States v. Morris, 928 F.2d at 510 (access gained by guessing someone else's password is not "authorization" under the Computer Fraud and Abuse Act).

So it seems that Rubico is on the hook for at least breaking into Palin’s email account -- assuming that the government can collect admissible evidence linking him to the access -- a likely assumption in light of both his online admissions and the evidence they have already collected.

However, a mere break in is a misdemeanor. As noted with respect to the Lori Drew-MySpace case, this trespass statute can be a felony if committed for commercial advantage, or if the "value of the information taken" exceeds $5,000 or if the crime is committed "in furtherance of any . . . tortious act in violation of the . . . laws of the United States or of any State."

Let’s concede that Rubico had no commercial advantage, and that the emails did not have any true economic value. In order for the government to charge him with a felony, they would have to argue that he was committing some other crime or tort -- in this case that he read the email to further the tort of invading Palin’s privacy.

So what tort? Breaking in is a tort itself. But breaking in just to break in? Sounds circular.

Invasion of privacy is a tort, and misappropriation of an identity is a tort. Was Palin’s Yahoo password her identity? Was the posting of her e-mails an unreasonable intrusion into her private life?

As I have noted previously, by broadly defining such torts -- breaking in to get information for the purpose of committing the tort of breaking in to obtain information -- you have essentially circular logic. Rubico broke in to read and publish Palin’s email, which might constitute the tort of invasion of privacy.

To make matters more confusing, there is the unanswered question of the tort under which state’s law: California where Yahoo is located (like in the MySpace case); Tennessee where Rubico is located; or Alaska where Palin is located. A federal grand jury was convened in Tennessee, so we can presume they may apply Tennessee law, but they are not required to do so.

In addition, the tort of "invasion of privacy" is not well defined. It includes things like unreasonable intrusion upon the seclusion of another, appropriation of the other's name or likeness, malicious, false or unreasonable publicity given to other person's private life, or publicity of an unreasonably nature that places the other person in a false light before the public. In this case, the contents of the emails posted were not particularly intimate or personal and there was not an “unreasonable” publicity given to Palin’s private life.

Distinguish this from the case of Philadelphia television news anchor Larry Mendte, who was charged in July with repeatedly breaking in to the email accounts of his female co-anchor to read salacious details of various civil and criminal cases involving the co-anchor and to read attorney client privileged information.

In another case in San Jose, the government indicted Roman Meydbray, a software executive, for breaking into the email accounts of the president of a competitor "which had not yet been read by the President" and of doing so in order to further the tort of breaking into and damaging the computer.

So as a general rule, just breaking into a computer and reading e-mail is considered a misdemeanor, but the government has the option of making it a felony if it wants to.

With everything at stake, the government will have a hard time resisting the more severe punishment.



Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 2 of 2 ) previous 
Comments Mode:
The Vice of Vice Presidential E-Mail 2008-10-07
Anonymous (2 replies)
Re: The Vice of Vice Presidential E-Mail 2008-10-10
Drafterman (1 replies)
The Vice of Vice Presidential E-Mail 2008-11-18
SpellingNazi


 

Privacy Statement
Copyright 2010, SecurityFocus