The Volokh Conspiracy

Violating Yahoo's TOS maybe?

Recently Lori Drew was charged with violating the Computer Fraud and Abuse Act for signing up for a MySpace account under a fake name. While the larger circumstances were quite shocking (and have been covered enough I don’t think I need to go into them), she was charged for nothing more than pretending to be someone else on the Internet. The indictment calls this a felony, under title 130 section (a) (2) (c) of the US Code, which criminalizes anyone who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer if the conduct involved an interstate or foreign communication.” The access to MySpace was unauthorized because using a fake name violated the terms of service. The information from a “protected computer” was the profiles of other MySpace users. Read more...

Also, he could be charged with a class A under Tenn. law.

Did they go on to steal her credit card password or something?

Or did the prosecutors forget to leave out the part where they were trying to commit some sort of political blackmail/interfere with an investigation/somesuch?

Occam's razor suggests this is part of the generalized inflation of criminal charges for purposes of intimidation/plea-bargaining (more of the former in this case).

In this case, the indictment alone is probably sufficient punishment. It'll cost the young man's family at least $50-$100,000 in legal fees to get the case dismissed, if indeed the judge is inclined to accept that argument before trial - plus there's always the risk of losing and going to jail. In the end, he'll plead out to a misdemeanor. Justice served.

"18USC1030 seems to be the only statute which covers posting passwords, what else could you charge someone with who posts passwords?"

Surely it's tortious, if nothing else. Invasion of privacy - some exotic form of trespass - or something. It's the equivalent of stealing the key to someone's home and leaving it in a public place with a note identifying the corresponding address.

The problem Orin is pointing out is not the lack of plausible theories, but that the government appears not to have identified any of them.

Orin:

We both know that the indictment's defect (I agree) is, in the scheme of the case, a minor blip. The grand jury can reindict and return a proper indictment alleging that the defendant hacked for the purpose of invading Palin's right of privacy under Alaska civil law.

Pyrrhic victory for the defense if a motion to dismiss is filed and granted . . . unless no re-indictment follows.

Orin

> It makes no sense to allow a felony enhancement for a crime committed in furtherance of the crime itself;

I think you are being maybe a little inartful here. after all, if a person shot someone in the furtherance of the crime of bank robbery, I don’t think you would object to using the shooting to enhance the robbery offense or vice versa.

I think what you are trying to get at is that the crime committed in furtherance should have some separation. Like if a state punished both breaking and breaking and entering, then breaking should not be an enhancement for breaking and entering.

Also, to the poster above, aiding and abetting in federal law - 18 U.S.C. 2 - is not a separate crime, but rather a separate means of indicting a particular crime. That's why indictments say "... in violation of [statute] and 18 U.S.C. section 2." There is never a separate count of an indictment based solely on 18 USC 2. This indictment is no different, it's a one count indictment (though it never actually cites 18 USC 2).

They could have made it a two count indictment, I suppose, one count based on 18 USC 2701 and the second count based on 18 USC 1030. But I'd argue that such an indictment would be duplicitous. Regardless, as Orin notes, it would mean a felony enhancement for a crime committed in furtherance of the crime itself.

The legislature would not have written a misdemeanor form of the crime into law if it intended all such charges of the crime to be only felonies.

runape,

I don't think you get it. Something as broad as "invasion of privacy" would be a tort that is always committed when this particular act is committed. Once again, the problem is that this would make all violations of this law a felony, not a misdemeanor. What you need is a violation of criminal or tort law that is not always committed when the underlying crime is itself committed. Otherwise the distinction in the statute between when misdemeanor charges and when felony charges can be brought is meaningless.

I agree with One more Matt. The person stole the information and then offered the information to other people, suggesting that they also go and peruse the email accounts in an attempt to find info. In so much as those people would be breaking the same laws, we would expect the reference to the same statute.

In other words: The accused broke the law against unlawful intrusion in pursuance of the crime of allowing other people to break the exact same law against unlawful intrusion.

A different analogy would be breaking into a guard house to disable an alarm so that other people could break and enter a museum- Breaking and Entering in order to commit a Breaking and Entering crime.

It doesn't matter. He's a democrat and so he won't be punished.

Different worlds we live in, DM, you and I.

DM- It must be rough being a poor persecuted Republican...

The only purpose of this indictmenet is to placate Palin and to minimize the impact of her blatant stupidity in having an easily accessible password. Having the person who so easily hacked her account under indictment for doing so makes him appear to be a serious, skillful, dangerous computer hacker. In reality, he figured out her birthday and the name of her first school, or whatever other dumb "security" questions her webmail used, and was able to reset her password to the password of his choice ("popcorn" according to the indictment).

Were this guy not indicted, Palin would appear like she allowed her account to be easily accessed. Now that the guy has been indicted, Palin can come across as a crime victim, and therefore it's not her fault (American victim culture abhores blaming victims for contributing to their harm, even if they are 99% liable, comparatively).

This is a political indictment, handed down by republicans a month before the presidential election to help get McCain/Palin into the white house. If ruining someone's life and costing the taxpayers hundreds of thousands of dollars to prosecute a crime and incarcerate a citizen will save McCain/Palin just one vote, it will be done by the Bush DOJ.

The form of this indictment doesn't trouble me, as there's nothing that can't be clarified in the inevitable Bill of Particulars, or at worst can't be cured with a superseding indictment that more fully explicates what's already been averred.

I think One more Matt hit one possible nail on the head:

Paragraph 6 answers this. He posted the new password so that others could repeat the intrusion. So the intrusion was done in furhterance of subsequent intrusions by other people, hence the apparently circular reference to the same crime.

May sound circular at first, but on the facts it makes sense. This also explains the aiding and abetting language of the charging paragraph in light of what at first blush was a solo crime. The factual predicate for A&A is in ¶7.

A superseding indictment could also rely on the existing averments to charge wire fraud. And ¶8 lays the possible groundwork for a §1519 obstruction allegation as well, although I don't think after-the-fact attempts at a cover up count as the enhancing predicate crime or tort under §1030. And then there's the wild and wacky universe of tortious conduct, which surely encompasses low-grade identity theft of this sort.

My main reaction upon reading the indictment? It's actually a straightforward, reasonable charging document that doesn't pile on the defendant. If the grand jury wanted to be harsh, this kid could have been charged up with separate counts for each access incident, each downloaded item or screen capture, each subsequent BBS post of the information, etc. And he would have been in much deeper trouble if he'd also been charged with something like §1519 obstruction, which would ratchet up the Sentencing Guidelines calculations on him (the USSG offense grouping issues are too complicated for a pinhead like me to explain, but trust me, they wouldn't help the defendant).

Fearless prediction: Odds of this pretty straightforward case pleading out are 99.44% If my quick off-the-cuff math is right and I haven't missed some USSG factor or another, even charged as a felony it may be possible for the defendant to land in Zone A of the Sentencing Guidelines' offense level chart with acceptance of responsibility. Zone A makes him eligible for straight probation, assuming no criminal history or other naughty things that strike the sentencing Judge's fancy.

I believe the intention was to damage the govenor of Alaska.


Thats not tortious?

Does motive come into play in looking for furtherance of criminal or tortious activity?
I haven't dug back, but believe that the hacking was done on the heels of news reports -- about the Palin Administration in Alaska not releasing her work emails -- pointed out that she apparently had used private email accounts, such as Yahoo, to conduct some of her government business. The inference would be that she did not want them subject to sunshine laws.
It may well be that this young man wanted to expose a corrupt practice by the governor of Alaska at least equally as much as he was enjoying a good hack.

I increasingly suspect DangerMouse is my father-in-law.

Clear thread-winner there.

How twisted and malicious do you have to be to blame a crime victim for being a crime victim?

No matter what The Other Side does, it is ill-intended. No matter what is done to The Other Side it is justified.

It doesn't matter which side The Other Side is, as long as that side opposes Your Side.

I really hate humans sometimes.

Let's try this again.
Here is what Orin Kerr noted at the top when he wondered if the indictment is flawed: The statute, 18 U.S.C. 1030, states that the intrusion is a felony if the intrusion "was committed in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State."
My question was based on that. If the man who hacked Palin's private email account did so because of some reports that she used the account improperly to hide some her official communications, does that mitigate?
My question in effect asked whether the "furtherance" must be intentional -- meaning that he intended to hack the account to further a crime or tortious act other than the hacking itself.
So, again, would the defendant's actual motive come in to play?
I don't believe that in rational discourse it is twisted, malicious or partisan to raise the matter.

Away from this question about the law and how it is interpreted, there indeed is a controversy in Alaska over various Palin email accounts and how they were used. And the issues are being pressed by various organiations seeking to have them released.

(b) Punishment.— The punishment for an offense under subsection (a) of this section is—
(1) if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State—
(A) a fine under this title or imprisonment for not more than 5 years, or both, in the case of a first offense under this subparagraph; and
(B) a fine under this title or imprisonment for not more than 10 years, or both, for any subsequent offense under this subparagraph; and

I think people may be focusing on the "furtherance" part, when it's the "malicious damage" -- the gossipy public disclosure of the password(s) -- that may be bringing the felony charge.

BruceM:

That you need to take so long to prove your point means you were wrong in the first place.

This kid's a first-time offender so he should just pay a fine and grow-up. No election, not even "the most important election of our lifetime," is worth doing something this stupid.

That said, the indictment should be dismissed. It's impossible to say what extra crime or tort the grand jury agreed on.

How twisted and malicious do you have to be to blame a crime victim for being a crime victim?

I don't see what's twisted or malicious about it at all.

Let's forget about Palin for a moment. If someone uses (say) his own name for a password, that's stupid.

We don't condone hacking his account, but we recognize his stupidity nonetheless.

More broadly: I buy a Mercedes convertible and park it downtown with the key in the ignition while I'm inside eating lunch. I come out, &my car -- sacre bleu! -- is gone!

Is anyone "twisted" or "malicious" in holding me partly responsible (tho not criminally liable) for my car's being stolen? I think not.

So the question is, if Palin's account could be hacked on the basis of readily available info, was that very clever of her? We can discuss that without thinking it's any exculpation at all of the guy who hacked her account.

Didn't he gain unauthorized access to the password reset mechanism in furtherance of gaining unauthorized access to her email?

Correct - he did NOT crack her password. He used the password reset mechanism and answered the "security questions" with google-fu. Essentially, he pretended to be Palin, claiming she forgot her password.

Speaking as someone who has no use at all for Sarah Palin, I still have to say (whatever remedial technical flaws the indictment may have) the prosecution of this person is a good thing. This is a high profile case, and hopefully it will send a message that even "harmless" casual hacking of someone's email (or if you like, their Facebook page or what have you) is illegal and can get you into serious trouble. I think a lot of people out there consider such activity to be merely challenging or else not a big deal. It assuredly is.

I have a friend, an otherwise intelligent and generally law abiding person, who openly brags that she "hacks" personal enemies' email accoutns or webpages in order to get "dirt" on them. She also uses these occasions to imply that her ability to do this means she is a brilliant hacker, notwithstanding the fact she has no relevant technical knowledge of any description. Thus, for example, guessing her husband's ex-wife had a really easy-to-guess password on her MySpace page converts her into Matthew Broderick in WarGames.

Anyway, I warned her that this activity was illegal and could expose her to some moderate-to-severe civil and criminal penalties, but she brushed it all aside as no big deal. An very public example needs to be set on this issue, and I think the Palin case would serve this purpose admirably.

Still voting for Obama though. ;-)

I think posting the passwords to encourage others to go into her account and root around is clearly the furtherance of another criminal act.

Say the kid was trying to hack into a computer that contained credit card numbers for someone else. If all he did was figure out the access information, and then pass on the passwords to the third party, he would be furthering the act. Even if he didn't know specifically what they were after. In this case he got the password, and then posted them and encouraged others to log in and poke around, and make use of anything they found.

"More broadly: I buy a Mercedes convertible and park it downtown with the key in the ignition while I'm inside eating lunch."

Are you contending that she published her log-on information or left it in a place where she knew any member of the public could get it? The level of hatred required to engage in such sophistry is neither normal nor healthy.

Are you contending that she published her log-on information or left it in a place where she knew any member of the public could get it? The level of hatred required to engage in such sophistry is neither normal nor healthy.

I am in no way defending the hacker here, but the answer to your question is yes. The answers to her password recovery questions were public knowledge.

Yeah, that's weird. And I have to think it's coming from the same part of the brain that thinks that downloading pirated songs and movies is A-OK.

I have to admit I used to do that. I justified it, at the time, with the argument that the record label and/or studios were just middlemen making all the money while the creators were getting pitiful returns for their work. Actually, that's true. But the solution is to make sure the artists get a more fair compensation for their work...not to ensure that the artists themselves get precisely nothing. Thus, alas, does iTunes get more money from me than I care to admit.

I would never, however, have entertained the notion of going into Tower Records and shoplifting CDs. A lot of these people who think nothing of "hacking" someone's email address would quail in horror at the notion of walking up to someone's house or car (assuming they were unlocked or easy to get into) and helping themselves, whether they are observed doing so or not. I think we just haven't caught up to the fact that hacking someone's email or webpage is, from a moral standpoint, more or less the same as robbing them or at least breaking and entering and rifling through their possessions. We have not yet reached the point where we have as visceral a reaction to that as, for example, burglary. I think this is the deficit we need to remedy with prosecutions like this.

"The answers to her password recovery questions were public knowledge."

So someone sufficiently motivated to violate her account could do research and find that information out? All identity theft depends on that too. Are victims of identity theft to blame because information necessary to the theft (e.g., names, DOB, SSN, etc.) is discoverable given sufficient will and research necessary to commit the crime?

Question:

Could this be a felony because the intrusion was committed in furtherance of a violation of Sarah Palin's constitutional right to privacy or constitutional 1st Amendment rights?

Says the "Dog"

"The answers to her password recovery questions were public knowledge."

So someone sufficiently motivated to violate her account could do research and find that information out?

Yes.

All identity theft depends on that too. Are victims of identity theft to blame because information necessary to the theft (e.g., names, DOB, SSN, etc.) is discoverable given sufficient will and research necessary to commit the crime?

No. Nor did I suggest that they are.

"So the question is, if Palin's account could be hacked on the basis of readily available info, was that very clever of her?"

As stated, the same could be said about many other forms of identity theft. The fact that information necessary to identity theft is readily accessible given sufficient research does not call the cleverness of the victims of that crime into question.

A Law Dawg:

I know that you did not suggest that Palin is to blame. Other posters here, however, do. The only reason for that blame is irrational hatred for Palin. Had Obama's identity been stolen to break into his email account and publish its contents, those same posters would be screeching in outrage, not blaming him because it was possible to do sufficient research to discover information necessary to commit the crime.

To reiterate the point, it would seem that the feds would have been fine alleging intrusion on seclusion (or something similar) as the triggering tort, because it requires that the gov't prove that the intrusion is offensive to a reasonable person. Some violations of the statute would plainly be inoffensive, so there's no complete overlap between the underlying offense and the triggering offense.

Federal Dog said here that I engaged in twisted, malicous and partisan behavior for asking a question about "futherance" and motive.
Period.
I laid out the facts I saw for a possible motive on the part of the defendant. I did not excuse a stupid act on his part.
My question had to do with any pertinence, under the statute, of the reasons and objectives behind the hacking.

It is Federal Dog who is projecting partisanship into that.

Just the same, if Sarah Palin is emotionally scarred because of this aspect of the debate that I raised, I would hope all those contributing negligently by being here will join me in starting a fund to pay for counseling and any other remedial measures to restore her to full strength.

I would hope all those contributing negligently by being here will join me in starting a fund to pay for counseling and any other remedial measures to restore her to full strength.

Where should I send my nickel?

Felix S.

"Matthew Broderick in War Games." Awesome analogy. Of course, I'm getting old. And I know without looking it up that Dabney Coleman was in that movie, too.

"Matthew Broderick in War Games." Awesome analogy. Of course, I'm getting old. And I know without looking it up that Dabney Coleman was in that movie, too.

The sad thing, Nunzio, is that I debated internally for about a minute as to whether to use "Matthew Broderick" or "David Lightman" in that post. ;-) (It is still a good movie. And Ally Sheedy was adorable back in the day.)

The indictment is likely to be correct, the first aspect of the crime is logging on for himself, but he subsequently made the password available to others on 4chan. For the purposes of the indictment there is evidence that he intended to commit a separate subsequent criminal act or at minimum cause one to happen.

Victimhood is sweet, even when wrong and fleeting.

A windfall, I hear.

Victimhood is sweet, even when wrong and fleeting.

A windfall, I hear.

Obviously we should tax it then.

"I really hate humans sometimes."

Waldensian was wrong. Law Dawg really wins this thread (and he might get the silver medal too, given that I snorted part of my Starbucks' reading his later comment about his wife's satisfaction level in light of the sequencing of certain events).

On to less important topics: Prosecuting this kiddie may be one of the best things the Feds can do for general deterrence of low-end hacking and identity theft (isn't going to deter Russian organized crime syndicates, but it should have some impact on college kids who are paying attention).

This is a high profile case, and hopefully it will send a message that even "harmless" casual hacking of someone's email

The only thing is, this case has zero deterrence value because the only time it will get investigated is if the person is a Pres or VP candidate. Hell, even Lindsay Lohan and Paris Hilton got hacked and couldn't get the authorities to lift a finger to investigate.

This kid is under felony indictment for only one reason: Palin is a VP candidate.

Angus,

He's actually under felony indictment for two reasons:

He hacked a private email account.
The account belonged to a VP candidate.

But the path to justice is to ignore the second fact. Not the first. We should be indicting all the hackers regardless of the victim. So this is a step in the right direction.

all the folks arguing that this misdemeanor is rightly elevated to a felony because the original crime was committed to "invade her constitutional right to privacy" -

are we now saying this right to privacy is in fact a 1st amendment right and not just lurking in the penumbra?

I don't see the connection here. Few of the posters above even mentioned or probably seriously considered any Constitutional right of privacy, regardless of where it might be found (and there are probably better places than the 1st Amdt. for that).

this perp was stupid, did something wrong and got caught - should be punished, but not with felony charges!

I say that for a lot of things. I frankly think that there are a lot of things charged these days as felonies that shouldn't be, including some victimless drug related crimes. But that isn't the country we live in, and this is the one we have to deal with.

The letter of the law seems pretty clear to me. If the intent of the security intrusion was the intrusion itself (as it is in the case of most people who hack into systems 'because they're there', as 'white knights', or as pranksters), then the crime is a misdemeanor. If, on the other hand, if the intent is more serious, then it becomes a felony.

The hacker himself stated that his intent was to "derail [Governor Sarah Palin's] campaign". I'm not a lawyer, so I'm not sure if the time "malicious destruction or damage" has a specific legal meaning, but as a layman, it certainly looks to me that this was the hacker's intent. In addition, he provided the information that he gathered and explicit instructions about breaking into the account to a community of hackers, which facilitated and contributed to additional criminal actions by others. Again, I don't know about legal definitions but, at least to this layman, it certainly seems as though this act was to further "criminal and tortious" acts by others.

So either way you slice it, the hacker committed a felony. So, in my non-professional eyes, it seems as though the felony indictment seems to be on pretty solid ground.

Is this in keeping with the spirit of the law? I think so. Although people keep using the word "prank" to describe what the hacker did, he intended (in his own words) to destroy her political campaign and, when he couldn't do that, he made her personal information available to other hackers. I don't think that anyone reading this would classify those activities as pranks if what happened to Palin happened to them. Nor was this intrusion intended to display the ease with which a hacker could circumvent the security measures on the email account (i.e. hacking into the account because it was there, for bragging rights, or as part of some kind of 'white hat' scenario to highlight effective computer security techniques). That seems to be what the spirit of this law is all about, so the felony indictment seems to be on firm ground there, too.

But we've seen what the account contained -- innocuous personal email.

Didn't she use her Yahoo! account for state business?

“But we've seen what the account contained — innocuous personal email.”

Didn't she use her Yahoo! account for state business?

Not according to the hacker's own postings on the site where he distributed the (changed) key to her account and copies of the contents.

"This kid is under felony indictment for only one reason: Palin is a VP candidate."

Who could have predicted that? Of course, this speaks more to the stupidity of the perp than the seriousness of the crime.

I don't agree this will have "zero deterrence value" with the kids. It will deter some of them, because most don't have the penetration to see that the prosecutors only went after this kid because of the profile of the victim. They just see another kid in bracelets on tee vee.

So there's likely a silver lining to all this.

Kernell has made it clear that his intent was to discover and publicize private information with the intent to harm reputation and peace of mind.

Like the Watergate burglars, he had intent. He, as well, had to 'break in'. Furthermore, he discovered private information, and took unauthorized possession or stole it.

So thus far he is completely on a par with the Watergate guys. Intent, breaking in, getting stuff. He's as guilty as they.

Kernell goes futher though. Unlike the Watergate guys who kept the private for private illegal use, he additionaly makes things public. He invites others to also steal the private to make them public. He facilitates their illegal activity. And he effectively steals everything from its owner by changing the password. There is nothing left for Palin.

Prediction: He's staying for five years. He's going to pay a fine, maybe the maximum. He gets to pay with lawyers.

And maybe, later, he will fall into a room of conservatives who show him the difficulty of using keyboard with hands in casts.

Before Gore, Kneel:
"Like the Watergate burglars, he had intent. He, as well, had to 'break in'. Furthermore, he discovered private information, and took unauthorized possession or stole it.

So thus far he is completely on a par with the Watergate guys. Intent, breaking in, getting stuff. He's as guilty as they are."

Thank you! Precisely the point I've been thinking of since this hit the media, albeit briefly. So where is the interest and the outrage? Oh, yeah, I forgot - apparently it's only felonious when it is a Republican operative breaking into a Democratic property. But you would think the press might be interested. Paging Dan Schorr - oh yeah, he's leaning toward the Dems and reliving his glory days on the 'Enemies List for NPR.' No point waiting for Woodward, either. He's too busy collecting his royalties and looking for more Republican scandals to be outraged about. Pardon my sarcasm, but doesn't anyone else find it rather interesting that this whole thing is being ignored by the media?

Prediction: He's staying for five years. He's going to pay a fine, maybe the maximum. He gets to pay with lawyers.

And maybe, later, he will fall into a room of conservatives who show him the difficulty of using keyboard with hands in casts.

The ironic thing is that this little POS set out to violate Governor Palin’s privacy by hacking her email account but as a result his name, face and home address are published all over the internet. Anyone care to lay odds on how long it takes someone to track him down and beat the **** out of him (or worse)?

Just as we’ve seen that there are plenty of crazies on the left who try to rationalize what he did because they don’t like Governor Palin, you have to figure that there’s more than a couple on the other end of the spectrum who are waiting for just the right moment when the authorities aren’t watching him to enact their own brand of justice. The safest place for him might actually be in a prison.

Maybe they could charge all the participants for conspiring to violate 18 USC 371.

M. McCall,

while I would certainly make that claim were I defending the gentleman, the indictment mentions the posting of the password which is sufficient for the charge to be facially valid. I don't know if it has ever applied to internet activity, but aiding and abetting has been charged successfully even when the crime aided has not been proven (Standefer v. United States, 447 U.S. 10).