Cengage Advantage Books: Foundations of the Legal Environment of Business 3rd Edition by Marianne Jennings

تمرين 9

New Jersey v. Riley 988 A.2d 1252 (N.J. 2009)
Pulling Up Videos for the Goods on Your Fellow Officers
Facts
Sergeant Kenneth Riley twice viewed digitally stored videotape from his department's computerized system of the traffic stops of another officer, Sergeant Robert Currier, an officer not in his unit. Sergeant Riley did not like Sergeant Currier. Sergeant Riley then permitted police personnel below sergeant's rank to view the video. The videotapes were not used to train officers in Riley's squad, but to subject Sergeant Currier to embarrassment and discipline.
Under the user terms of the department, an administrative officer or sergeant had a password to the video database that could be used to access the whole database to obtain videos for training purposes. A grand jury returned an indictment against Sergeant Riley for use of computer data without authorization and unlawful access and disclosure of computer data. Sergeant Riley moved to have the indictment dismissed.
Judicial Opinion
OSTRER, Justice
It is uncertain what it means, first, to access computerized data, and second, what it means to do so "without authorization" or "in excess of authorization." It is also unclear whether unauthorized access may be proved solely with evidence that a defendant, who is an employee or other "insider" with current passwordaccess, knowingly violated internal guidelines regarding use of computer-based information.
A hypothetical can demonstrate the uncertainty. One can posit a member of the information technology (I.T.) department of a business who possesses all the employees' passwords in order to maintain the business's computer system, but internal policy directs him not to read employees' documents. In one sense, the I.T. professional is authorized to access every employee's files. If a worker asks the I.T. professional to help retrieve a sensitive trade-secret-related document that the worker accidentally deleted, the I.T. professional can do so, using the passwords already provided to him. In another sense, if the I.T. professional reads the worker's document, he may be acting in excess of his authorization. Reference to the plain language of the statute does not clearly indicate which reading is correct.
Federal law defines the term, "exceeds authorized access," to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to so obtain or alter." That also is not unambiguous, as one may ponder what it means to be "not entitled to obtain or alter" data. Arguably, one is entitled if he has a password or code-based right to obtain or alter the data.
In White v. White , 781 A.2d 85 (Ch. Div. 2001), a wife had retrieved her husband's stored e-mails to a girlfriend from the family computer. The court held that the wife's access was not unauthorized because she did not use her husband's password or code without permission. In other words, unauthorized access meant access by use of another's password or code-based right of entry.
In considering the potential for arbitrary enforcement of the computer crime law, this court recognizes the ubiquity of computers today in the workplace, in schools, public institutions, and in government, and the prevalence of agreements and policies governing such use. Many of these impose unrealistic rules honored in the breach. It takes no imagination to conjure up a multitude of trivial and not so trivial violations that take place every day in the workplace. Workers use workplace computers for personal use in violation of requirements that they use their computers for business only. Workers violate policies prohibiting access to social networking sites. Reportedly, fifty-four percent of companies ban workers from accessing social networking sites like Twitter, MySpace and Facebook, yet seventy-seven percent of workers with a Facebook account use it during work hours.
In sum, assuming that a broad range of the population violates internal workplace computer use policies at one point or another, then deeming such violations a crime would empower the State, unguided by firm definitional standards, to choose to prosecute whomever it wishes from that broad cross-section of the population. The vagueness doctrine is designed to prevent that. In short, the criminal law should not be some pliable material that the State may bend and mold at will to fit an unwarned defendant.
Although there is a split among other jurisdictions, there is ample precedent in federal and state courts for adopting the narrow construction of "without or in excess of authorization" found in the New Jersey law.
The indictment is dismissed.
Case Questions
1. Explain why the purpose of Sergeant Riley's actions became an issue.
2. Discuss how the court uses the I.T. example to illustrate its point.
3. What are the court's fears about a broad interpretation of "unauthorized access"?