Internet Law - Fall 2007

Exceeding Authorization=No authorization

A person accesses a computer "without authorization" if

 (a) the person does not have valid credentials (ie username, password) to use the system and has no reasonable belief that he or she is entitled to credentials from the appropriate authority

 (b) the person exceeds authorization

 1. a person exceeds authorization when he or she is not entitled to access a program, file, network or any other resource on a computer system AND the accessing of such a resource relates to the  cause of action

 OR

  2. a person uses a program for a function not contemplated by the system manager AND it relates to the cause of action

 

(c) the person is told by the system manager or owner or any agent of an appropriate authority that he or she does not have and should not attempt to access a computer resource.

 
Morris: not authorized
Shurgard: authorized
DoubleClick: authorized
Mrs. Bluebeard: not authorized

It's hard to not be authorized in my book

Maybe I am just stubborn but I just don't think the line should be drawn at authorization to use a computer. I think that attaching guilt at this point will work effectively in cases where the wrongdoing is obvious (the bank robber going behind the teller window to transfer funds electronically) but that this methodology falters under more ambiguous situations (An employee using a company computer for uses other than what their boss intended, but which may serve to better the company in the long run).  For this reason I am going with a very strict definition for "without authorization."

A person accesses a computer "without authorization" if in respect to that specific computer or network their authorization is not present in the form of
a) express permission to use or access by the system's owner; or 
b) implied permission to use or access based on the necessity or reasonableness of use of the computer by someone in the defendant's position within the home, organization, institution, etc.; or
c) Implied permission based on the programming and arrangement of the computer or network in a manner that allows access by users not physically present; or
d) Implied permission to use or access based on the actions of the owner or other users of the computer or network as perceived from the standard of a reasonable person in the position of the defendant.

Morris: authorized
Shurgard: authorized
DoubleClick: authorized
Mrs. Bluebeard: authorized 
Bank Robber: unauthorized

Authorization

A person accesses a computer "without authorization" if:

1. The owner of the computer has not authorized said person to access the computer , or

2. The person accesses the computer in bad faith.

Morris- Not authorized
Shurgard- Not authorized
Doubleclick- Not authorized
Bluebeard- Authorized

Are you authorized?

The purpose test from Morris seems to be the best definition of "without authorization" - access is "unauthorized" if the person uses the computer for a purpose the owner has not intended.

Morris: unauthorized
Shurgard: unauthorized
Doubleclick: unauthorized
Bluebeard: unauthorized.

Without authorization

A person accesses a computer "without authorization" if:

a) the person accesses a computer without consent of the owner; or

b) the person breaks a condition of their access

Morris: without authorization

Shurgard:without authorization

DoubleClick: without authorization

Mrs. Bluebeard:  without authorization

Shurgard Test is the most practical

A person accesses a computer "without authorization" if they used computer in a way disapproved by authorizer. (Shurgard test)

    Morris: not authorized
    Shurgard: not authorized

    DoubleClick: authorized
    Mrs. Bluebeard: not authorized

CFAA "Without authorization"

A person accesses a computer without authorization if he:

1. Directly or Indirectly uses, accesses, or modifies the existing code of a computer or network;

a. with which he lacks ownership, license or permission either express or implied, or

b. with which he has ownership, license or permission, but which recklessly, negligently, or intentionally causes harm to or modifies another computer or network in a manner which was not objectively intended by its owner(s)

2. Has been granted a license or permission of use and directly or indirectly uses, accesses, or modifies existing code of a computer, network or program in a manner which was not objectively intended by the owner(s) or which exceeds the scope of the license granted.

Morris: unauthorized
Shurgard: unauthorized
DoubleClick: unauthorized
Mrs. Bluebeard: unauthorized

 

Rewriting the CFAA

A person accesses a computer "without authorization" if he

a) uses a computer for a purpose other than what a reasonable person believes the computer is intended to be used for or

b) uses a computer for a purpose he knows or has a reason to know that the owner of the computer would disapprove of

Morris: unauthorized

Shurgard: unauthorized

DoubleClick: unauthorized

Mrs. Bluebeard: unauthorized

"Without Authorization"

A person accesses a computer “without authorization” if: without an account or without permission (express or implied) such person intentionally accesses confidential information from any protected computer, and uses, alters, distributes or discloses such information for a purpose for which they were not granted access.

Morris: unauthorized

Shurgard: unauthorized

DoubleClick: unauthorized

Mrs. Bluebeard: authorized; under the facts, Bluebeard did not use, alter, distribute or disclose the information.

Authorize This

Of the three authorization tests my favorite is the purpose test. It comes the closest to an access grant that the owner intended but it should not be so harsh that personal email from a work computer is criminalized. I am okay with the no account test but not in the alternative. “No account” means you are not authorized but having an account does not allow you to do anything you want with that account. While the intended function test is just wrong - just because software allows it should not mean it was authorized.

New CFAA “without authorization” definition:
A person accesses a computer without authorization when that person uses a computer without the permission of the owner or party with the authority to grant permission. Unless permission has been granted to gain access to a computer through (a) guessing a password or (b) port-scanning or (c) spamming then access is without authorization.

Legislative History:
An authorization balancing test was considered but ultimately rejected. The factors to balance became too unwieldy aside from some sort of perfunctory “substantial justice” clause which was also ultimately rejected by the legislature.

Morris, Shurgard, DoubleClick & Mrs. Bluebeard:
not authorized