Crime to Use Coffee Shop Wi-Fi Without Entering the Coffee Shop?:
CNET news has a story of a Michigan man who apparently pled guilty to violating Michigan's computer crime statute for sitting outside a coffee shop and using the shop's wi-fi to surf the web:
But did Peterson actually commit a crime? The answer hinges on Michigan's somewhat unique computer crime law, and in particular on its definition of the meaning of "authorization." Like every state — and like the federal government — Michigan has an unauthorized access statute that serves as the basic computer crime law. (For my take on these statutes, see this article.) Here's Michigan's law, Section 752.795(a):
As best I can tell, though, these arguments weren't tried. But then it's hard to tell from the news articles, which seem pretty sketchy on the legal side of this. If you happen to know more details about the case, please consider explaining them in the comment thread.
Each day around lunch time, Sam Peterson would drive to the Union Street Cafe, park his car and--without actually entering the coffee shop--check his e-mail and surf the Net. His ritual raised the suspicions of Police Chief Andrew Milanowski, who approached him and asked what he was doing. Peterson, probably not realizing that his actions constituted a crime, freely admitted what he was doing.Peterson was charged and apparently pled guilty and was sentenced for violating Michigan's computer crime statute. According to this story, Peterson's actual punishment was very light: he was given a $400 fine and 40 hours of community service, with the understanding that if he stays out of trouble the conviction will be erased from his record.
"I knew that the Union Street had Wi-Fi. I just went down and checked my e-mail and didn't see a problem with that," Peterson told a WOOD reporter.
Milanowski didn't immediately cite or arrest Peterson, mostly because he wasn't certain a crime had been committed. "I had a feeling a law was being broken," the chief said. . . .
Milanowski, who eventually swore out a warrant for Peterson, doesn't believe Milanowski knew he was breaking the law. "In my opinion, probably not. Most people probably don't."
Indeed, neither did Donna May, the owner of the Union Street Cafe. "I didn't know it was really illegal, either," she told the TV station. "If he would have come in (to the coffee shop), it would have been fine."
But did Peterson actually commit a crime? The answer hinges on Michigan's somewhat unique computer crime law, and in particular on its definition of the meaning of "authorization." Like every state — and like the federal government — Michigan has an unauthorized access statute that serves as the basic computer crime law. (For my take on these statutes, see this article.) Here's Michigan's law, Section 752.795(a):
A person shall not intentionally and without authorization or by exceeding valid authorization . . . Access or cause access to be made to a computer program, computer, computer system, or computer network to acquire, alter, damage, delete, or destroy property or otherwise use the service of a computer program, computer, computer system, or computer network.So far, this is a pretty standard unauthorized access statute. But Michigan does something that is pretty unique; it has a statutory presumption against access being authorized:
It is a rebuttable presumption in a prosecution for a violation of section 5 that the person did not have authorization from the owner, system operator, or other person who has authority from the owner or system operator to grant permission to access the computer program, computer, computer system, or computer network or has exceeded authorization unless 1 or more of the following circumstances existed at the time of access:If I had been Peterson's attorney, I would have had a bunch of arguments in his defense. First, I would argue that having a statutory presumption is unconstitutional under Sandstrom v. Montana, 442 U.S. 510 (1979). A presumption that a material element of a criminal statute has been satisfied violates the Due Process clause, which requires the government to provide each element beyond a reasonable doubt. Id. at 524. Second, I would argue that even if the presumption is constitutional, it doesn't apply here: under (c), "[a]ccess was achieved without the use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents the pre-programmed access procedure for the computer program, computer, computer system, or computer network." And finally, the access was not unauthorized or in excess of authorization because the coffee shop intentionally made the wi-fi available to anyone. What's the rule — no hopping on wifi from a coffee shop unless you enter the shop? Unless you actually buy something? What if you're outside waiting for a friend to join you for a latte, but you haven't gone in yet? Where do such rules come from, and what notice does a defendant have before being held criminally liable? I've written before about how unauthorized access statutes threaten to punish an incredible amount of conduct online, and this seems like the latest evidence in support of the point.
(a) Written or oral permission was granted by the owner, system operator, or other person who has authority from the owner or system operator to grant permission of the accessed computer program, computer, computer system, or computer network.
(b) The accessed computer program, computer, computer system, or computer network had a pre-programmed access procedure that would display a bulletin, command, or other message before access was achieved that a reasonable person would believe identified the computer program, computer, computer system, or computer network as within the public domain.
(c) Access was achieved without the use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents the pre-programmed access procedure for the computer program, computer, computer system, or computer network.
As best I can tell, though, these arguments weren't tried. But then it's hard to tell from the news articles, which seem pretty sketchy on the legal side of this. If you happen to know more details about the case, please consider explaining them in the comment thread.
This statute is so broad that one could easily imagine a scenario where all of the coffee shop's customers could also be prosecuted unless they each specifically received oral or written authorization to use the Free WiFi.
I take it you don't do any work in the criminal system. Innocent or not, if you can get out of the "justice" system by paying $400 and doing some community service, you got off light, indeed.
Of course, Orin's post implies other problems in the system. Namely, that it's too costly to retain a qualified lawyer. To hire someone with Orin's expertise and skill would cost several hundred dollars an hour. So do you pay the fine and cop to something you didn't do; or do you take out a second mortgage to "vindicate" yourself in court?
Our justice system encourages innocent people to plead guilty by making it too expensive to fight charges. And, of course, there's always a chance the courts would have rejected Orin's arguments. A conviction at trial would have led to a substantially greater fine, chance of jail time, and would have made it unlikely that the conviction would have ever been expunged.
Orin's post, though this most likely was not his intent, simply illustrates everything that is wrong with the justice system.
Well it may not be a robbery, but it is a theft. Should they have told the coffee shop their not important enough and they should go pound sand?
What's most bizarre is that no one (including the cop!) knew that what the defendant was doing was illegal. (In fairness, the cop had a hunch something was wrong. But that he did not in fact know for sure indicates the "seriousness" of the crime.)
So instead of solving real crimes, police and prosecutors are devoting their time to stuff like this.
Someone tell me why we need more police on the streets?
Orin, feel like any Pro Bono work, I'm heading up this weekend!!
Good point. According to the story, the police chief arrested the defendant after receiving a complaint from the coffee shop. Oh, wait, that's not what happened at all.... Did you even read the story?
According to the story (which could be full of lies, as many media stories are; but for purposes of this discussion we'll accept the story as true), the coffee shop owner didn't even know she was a "victim" of a crime.
Also, what is the marginal cost of having a freeloader on a public wi-fi? It's pretty low. Prosecuting this guy would be like going after someone who took a nickel from the "Give a Penny, Take a Penny" jars at gas stations. "But you took a nickel, which is not a penny!"
I would much rather see scarce law enforcement resources devoted to less trivial crimes.
My theory is that it is so easy to restrict use of a wireless network, that the fact that the person didn’t bother proves that they consented to others using their connection.
—- This is what happens when police officers are bored and don't have anything to do. —-
Check out the story from the Post linked to below, for a much worse story of what happens when police officers are bored, or worse, malicious.
COPS INFLICTED HERNIA HELL: SUIT
www.adbmich.org
http://www.agcmi.com/pages/RequestInvestigation.html
Kent County Assistant Prosecutor Lynn Hopkins
Village President
Leonard R. "Skip" Meyer II
spartapresident@charter.net
156 E. Division
Sparta, MI 49345
I'd submitted this story to slashdot earlier today,no luck.
OK makes excellent points--as do several other posters, particularly William Spieler and MikeC&F. If a router is "open," then it seems the world is being invited to use it.
By the way, I have a completely open network. You can get it from my parking lot. Come on over!
If I may quibble, one freeloader may not change much but considering everyone is using wireless access, which means speeds won't be that great anyway, as the number of freeloaders increase the marginal cost has the potential to increase fairly quickly (obviously depending on what people are doing). I'm not agreeing with the result, for the many reasons already noted, but assuming what he did was a crime, it was not by definition a victimless crime.
It mattered not at all whether the Union Street Cafe saw itself as a crime victim and wanted the case prosecuted? What is the maximum penalty that could have been imposed upon him for violation of this statute? Ought we assume that the "perp" bargained with the prosecutor and knew what he would get before he entered a guilty plea?
If the initial screen doesn't say something like "enter username and password", then the exception of section (b) applies.
Since light duty WEP encryption is built into most wireless routers, if the business owner didn't enable it, then the inference that they intended to make general public access available is more than reasonable.
The boneheads that filed the case should be Nifonged.
You are wrong for the following reasons:
(1) You can easily limit access to WiFi to paying customers if you want to. There is one Starbucks that I know of that gives you a little card that gives you 15-minutes of WiFi if you buy a drink. Also, other Starbucks and Borders Bookstores limit WiFi use to those who subscribe through T-Mobile.
(2) In general, one can easily make WiFi signals public or not public. If they are made non-public, one can take simple measures to ensure that only you or your customers have access.
The coffee shop here is not a victim.
This however seems even worse to me, are the authorities here trying to protect for pay networks?
We could take this into law-school-hypo-la-la land: What if a bus full of people jumped onto the network?
But, as applied to the actual case we are discussing, there was not a problem. One dude jumped onto the network for a limited time. Instead of running the guy through the justice system, it would have been easier (and cheaper for taxpayers) to tell the guy: "Next time, buy a bagel." The coffee shop could have been instructed to a) lock up its network or b) post a sign saying you must buy coffee before jumping onto the network. Easy enough.
We rightfully expect police officers (especially the chief of police!) to exercise discretion. Why arrest someone for a crime when the "victim" (what did she lose, 1% of her bandwidth?) didn't even know she was a victim? There were much better ways to handle this case.
Just curious... Would you have paid his legal fees? I consider it indecent to tell other people how to spend their money.
In any event, I would not have caved - but I know a thing or two about the law. And it would have been a good blog post. But if I would have had to pay $5,000 or more to fight the case, I would have caved just as easily.
I've learned that in our criminal justice system, even if you win, you lose.
In other words, if he accidentally accessed the network, or thought he was accessing his own network (or some network that gave him the required authorization) but in reality was accessing the coffee shop, THEN he'd have a mens rea defense (other than the one implied under Sandstrom).
As a general rule, it's enough that you intended to do the act that was a violation of the law; whether you knew of or intended to violate the law was irrelevant. Here, the defendant intended to log onto the network. That's all it takes to prove intent under the statute.
He had the intent to use (or, more accurately, he knowingly used--rarely do criminal statutes require a showing of specific intent) wireless internet to check his e-mail. "Intent to break the law" is not part of the analysis.
The linked articles don't mention an attorney, so I don't know if the "criminal" hired one. But I can tell you why *I* wouldn't raise those potentially winning arguments in my prosecution: it would cost more to pay the attorney to raise them than I'd be paying in the fine, and the violation is going to be expunged anyway. What good is it, as the defendant in a case that will be expunged, to avoid a $400 fine by paying $2000 (e.g.) to raise a winning legal argument? None.
Slashdot has more.
Except, since the coffee shop was transmitting some distance beyond its walls, this case is more analogous to someone with a pair of binoculars sitting on a hill overlooking a drive-in theater. Should that person be prosecuted for stealing a viewing of the movie, notwithstanding that they weren't on the theater's property and the theater owner failed to take steps to shield the screen?
fwiw, i think the sentence is WAY too harsh for a crime that the guy didn't even know he was committing. i realize that one does not have to know the act IS illegal, but imo that does (and should) make a difference. admittedly, i would not have believed i was breaking the law by doing the same thing he did.
the statute is also (imo) ridiculously broad.
once again, though, cops are blamed for bad law. cops don't pass stupid laws - legislators do.
it also seems probable that the "victim" in this case did not even know what the defendant did was a crime. did THEY seek prosecution? i have a big problem with prosecutors who always want to seem to prosecute crimes when the victim doesn't desire prosecution. i can understand it in certain crimes (like where the victim is dead ... :0 ) but it's not like the VICTIM came forward and desired prosecution.
why not just give the guy a frigging WARNING and move on with it.
the charging decision ultimately lies with the prosecutor and i cannot understand what "interest of justice" he thought he was pursuing for prosecuting this crime.
again, my biggest problem is with the law itself. the presumption is ridiculous.
What does it take for you to realise that we all have to take some responsibility for what the lawmakers do in our name as well as what the justice system does in our, the citizens' name?
Officials of any kind are at a minimum open to criticism for the actions they take. And the cops in this case certainly deserve the criticism.
I agree with most everything you wrote, but do you really believe that the arresting office deserves no scrutiny in this matter? Doesn't the officer have the discretion to inform the violator of the law and then merely issue a warning? If the officer does have discretion, it seems like a warning would be warranted here, especially in light of the fact that the law is somewhat vague and that most citizens--including, apparently, the officer himself--were unaware of the law.
From the article it is clear that the police officer went out of his way to research the law to find a crime he believed the prosecutor could charge. That says he bears some responsibility for the particular charges being brought. I don't think that's "blaming the police." I think it's a statement of fact.Absolutely. The prosecutor is a bonehead, or has a surplus of political ambitions, or a deficit of ethics, or all three. The prosecutor could have told the police officer to find something else to worry about, like catching real criminals, instead of seeing how far he could press a flawed statute against a clueless defendant.
But the prosecutor had an obvious temptation. He could get a major felony conviction to brag about, just by charging a clueless defendant under a flawed statute, then offering an apparently sweet plea bargain.
So, it's win-win-win from the prosecutor's point of view.
Prosecutor gets political bragging rights for cracking down on high tech crime. Police get praise for shoehorning the facts to fit the the statute if nobody looks too close. Citizen Shmoe doesn't even know he's been shafted because he doesn't know the state can hold the conviction against him later even if it has been expunged.
The only problem is that a prosecutor's ethical duty is not to get convictions at expense of justice. Prosecutor's ethical duty is to pursue justice, even at the expense of a conviction. This prosecutor didn't. This one went for an easy conviction under a statute that he knew or should have known was seriously flawed, supported by facts he knew or should have know were flimsy at best.
That's why I said the prosecutor should be Nifonged.I agree the statute is a big problem. But I think the biggest problem is the prosecutor who should have known the state of the law, should have asked the "victim" if they really wanted a prosecution (although prosecutor has no legal duty to do that, but it's the decent thing to do) and who takes legal advice from a cop who thinks he's a lawyer.
my point is that over and over again, the tactic is blame the cops for enforcing stupid laws.
stupid laws are COMPLETELY the fault of the legislators that pass them.
i don't recall anybody in this thread giving the legislators the kind of criticism they gave the cop.
the law is stupid, especially with the presumpion in it. the prosecutor is the one who is supposed to dispassionately decide whether or not to prosecute.
i find the primary fault lies with the legislators, the 2ndary fault with the prosecutor (since he was the one who decided to charge - which is the only way this stupid case would have gotten to court), and the tertiary fault lies with the cop, who was enforcing (dumb) law.
i am most disturbed by the proscutor because it seems pretty apparent that the "victim" in this case did not pursue the pressing of charges, and that would give him a good reason not to pursue them himself.
i'd love to read the PC cert in this case.
my jurisdiction recently passed one of the stupidest and liberty encroaching anti-smoking laws i have ever seen. would i ever enforce it WITHOUT a complaint from a "victim?" no.
it just never ceases to amaze me how many stupid laws legislators pass.
Perhaps people have really given up on the legislators. They hold the police and the prosecutors to a higher standard of common sense than "If it's the law it must be enforced."
I understand how one can lack criminal intent but have mens rea and the adage that "ignorance of the law is no excuse". What I was thinking of, but did not make clear, is that the defendant had no intention of damaging the shop's computers, obtaining access to any of the shop's information, etc., the sorts of things that statutes barring unauthorized access are typically about. What I did not realize was that the Michigan statute includes mere use of a network even if no special measures were taken to obtain access.
Bill
as i have said, i think it's a stupid law (blame the legislator) and a mistake to charge him (blame the prosecutor) but it's hardly bad policy for the police to "burden" the court system by presenting violations of the law to the prosecutor's office. if i was the cop, i would have given a warning, if that, but again - the problem is the stupid law.
maybe the legislator will REALIZE it's a stupid law and repeal/change it. fat chance, but that would be nice.
Having said that, the realm of ethics may suggest something else. Yes, the coffee shop is offering this free, and yes, it even spills out into a parking lot.
Nonetheless, the reason the cafe offers free wifi is to attract customers. If everyone did what this man did, ie, use the free service without buying any coffee or other sale items, then the cafe will eventually go out of business, and everyone loses the free wifi. So, the cafe, and the real coffee buyers are subsidizing the man who refuses to buy cafe. (Some might even call this socialism, whereby the people with money are subsidizing the man who refuses to pony up).
If I were a cafe owner, I would prefer a system whereby I can limit the wifi access to just inside my store, and not into the parking lot. But that day hasn't come
Therefore, I suggest that the ethical thing is for the man to buy a coffee from time to time -- it doesn't even have to be every day -- but often enough as a way to help pay for the convenience that everyone benefits from.
Perhaps instead of paying a fine, the man could have agreed to buy a coffee from the shop every day for one year. At least he would beneti materially (he gets coffee AND free wifi) and the store gets the money.
On the other hand, the LEO could see exactly what was involved in the instant case and how trivial an offense he had stumbled upon, one he was not even sure was an offense until he had done some research on the subject. Why not be critical of the LEO for his role in this unfortunate folly, since he was exercising discretion in charging the fellow? Granted, the prosecutor was probably the most blameworthy of anyone.
As William Spieler writing at 5.23.2007 4:01pm pointed out: just don't broadcast SSID. That's usually a trivial router setting. Once done, anybody who wants to use your network must find out the SSID from a source besides your router. It's trivial for anyone to sniff traffic to your router and obtain the SSID, but they won't get it from your router's broadcast. It would rebut any future argument that your router invited them in.
It's the rough analog of leaving your front door closed but unlocked. Anybody who really wants in has to at least move the latch and open the door (and therefore "break" in the common law sense of the burglary element) in order to enter.
There are other more effective and approximately equally simple means to discourage or prevent unwanted access, but that is a totally trivial first step.Yes, that would be an ethical thing to do. But charging a crime for being a boor is just foolish, or worse, it engenders disrespect for law and law enforcement.How about this, as other comments here have suggested: the cop just says "be a mensch and buy some coffee sometime, it's good and you'll like it", and lets it go at that?
That way everybody would win. The inadvertant felon gets a valuable lesson in kindergarten ethics. The coffeeshop sells more coffee. The cop makes a friend and more time to look for real crime. The DA doesn't look like a jackass. The legislators don't look like clueless fools. The fourth estate doesn't get to hopelessly garble yet another story. And the learned denizens of VC don't waste their valuable time blabbering about it.
Oh wait!
I think "Just Dropping By" has it about right from a technical standpoint. If you don't want others on your WiFi, don't broadcast (broadcasting is a key issue - ref: Communications Act of 1934) the SSID. Over the air broadcasts covered by the act may be a Federal pre-emption of this Michigan law.
Another note - the law was written in the pre-wireless days of networking. When written, a physical connection was necessary to access computer systems and/or networks. The wireless aspect of this case makes me wonder if the Communications Act applies...
How ridiculous it is to hear the argument that "if it lets me in, they must want me there."
Try going to Wal-mart. See if they let you in. Note that the door is open, and there is a sign saying "Open".
Now try unsecured wifi. Your computer ASKS it is you may use the access - it says, "YES." That's actually MORE explicit permission than you have when you go into Wal-Mart.
Sure, prison time wouldn't be reasonable, but not all trial judges are reasonable. And in my experience, small town judges are more likely to impose prison than judges in bigger cities.
I've also had clients take pleas over my advice that they had an extremely strong legal defense because they didn't want the risk, and they just wanted to get the case behind them.
That makes sense for some defendants. I once got a client's conviction permanently vacated on appeal because the prosecutor didn't allege or prove an element of the offense (oops!). The problem was, the guy had already completed his prison term by the time I "won."
Bottom line: If the plea was to a misdemeanor, it appears to make sense. If the plea was to a felony, it makes less sense, but there are too many variables we don't know.
Before accusing others of not reading the account, please try reading yourself. My post correctly recites the very facts that you claim I missed. The cop wasn't sure what the law was and had to check. As I said, the appropriate thing to do would have been to raise the issue with the defendant and then, after checking, let him know the outcome.
Bill
We're both wrong. He charge bargained to a misdemeanor. According to the article that Professor Kerr's post links to:
This means he got a misdemeanor. Also, in most diversion programs, your record is wiped clean after successful completion.
The defense didn't have a slam dunk argument. The offense was minor. The defendant will likely have a clean record at the end of this. The deal seems reasonable to me.
The question is, what exactly did he plead guilty to? They probably had to look to something else, like misdemeanor theft or some kind of disorderly conduct charge.
Part of the problem with the wireless statute is that it doesn't have gradations of punishment for gradations of wrongful conduct.
A felony wrap may be fair for a defendant who hacks into private parts of the host's server or the hard drives of fellow wi-fi users. A felony may also be fair for a defendant who uses public wi-fi to hide illegal activity. But non-disruptive, otherwise legal use should not be a felony.
>The coffee shop should have at least taken minimal security measures.
>>The community's money should be used for real issues.
>>>People who steal are criminals.
>>>>Laws are written to be interpreted by any one in a self serving manner if they can get away with it.
So...
1) Lock your doors/networks... It helps keep honest people honest, especially if they know better.
2) Spend community money on hmmmm... Free public Wifi? It's cheep and easy if you keep the evil greedies out. It's being done all over the world.
3) Don't steal stuff and you won't be a criminal.
4) Help pay an attorney's Lexus payment and he/she will interpret the law in your best interest.
Think about this.
If you intentionally "click connect" to someone else's Wifi network that you don't have permission to access... that's stealing. Also you may click on a network designed to steal YOUR stuff... Or better yet some guy/girl might come out and beat the crap out of you for getting on his/her network. (That would be very cool in some cases... for repeat offenders of course.)
I don't condone violence ;)>
If you ask nicely you may use my wifi network. I'll gladly add your mac address.