law of computer technology fall 2015 copyright © 2015 michael i. shamos apple v. samsung news all...

LAW OF COMPUTER TECHNOLOGY FALL 2015 COPYRIGHT © 2015 MICHAEL I. SHAMOS

Apple v. Samsung News

• All claims of Apple’s patent 7,844,915 (scroll v. gesture) were found invalid when re-examined by the Patent Office.

• On November 23, 2015, Apple appealed to the Federal Circuit.

• On December 3, 2015, Samsung agreed to pay Apple $548 million by December 14.

• However, Samsung may get a partial refund depending on the result in the Federal Circuit.


Computer Crime

Michael I. Shamos, Ph.D., J.D.Institute for Software ResearchSchool of Computer ScienceCarnegie Mellon University

N.Y. Constitution, § 9.1


Computer Crime

• Interfering with the use of computers– trespass into a computer system or database– manipulation or theft of data– sabotage of equipment and data– extortion by threat to a computer system

• Using computers to commit other crimes– harassment– fraud– hate crimes– promoting terrorism


Civil v. Criminal Law Comparison

Civil (Tort) Criminal

Standardof proof

Preponderance of the evidence

Beyond reasonable doubt

PenaltyMoney damages,

injunctionFines, imprisonment

LawyersPrivate (parties hire their own

attorneys)

Public (public prosecutor, public

defender)


Felonies Misdemeanors

Serious crimes, punishable by death or prison for more than one (1) year and/or fines.

Non-serious (petty) crimes punishable by jail for less than one(1) year and/or fines.

Classification of Crimes

• An act can have both civil and criminal consequences, e.g. O.J. Simpson.Acquitted of murder but liable for wrongful death


Federal Computer Crime Laws

• Computer Fraud and Abuse Act of 1986 (CFAA)• Electronic Communications Privacy Act of 1986 (ECPA)• Electronic Espionage Act of 1996 (EEA)• Communications Decency Act 1996 (CDS)• Child Pornography Prevention Act (CPPA)• Digital Millennium Copyright Act of 1998• Children's Online Privacy Protection Act (COPPA)• Health Insurance Portability And Accountability Act

(HIPAA)• USA Patriot Act• and others …


State Computer Crime Laws• Often versions of federal laws where interstate

commerce is not involved (so federal prosecution would not be possible)

• Specialized crimes– spam (e.g. West Virginia)

– “deceiving a machine” Alaska Stat. §11.46.985

– computer trespass (Washington)

– tampering with an electronic voting machine (Texas)

– introduction of false data into a bank computer (Idaho)

– cyberstalking (Rhode Island)


Criminal Jurisdiction

• When can a state exercise criminal jurisdiction?– Conduct in the state that is an element of the offense

– Conduct outside that is an attempt to commit inside

– Conduct outside that is conspiracy to commit inside the state + an overt act in the state

– Omission to perform a legal duty imposed by the state

– Offense is based on a state statute that prohibits conduct outside the state that bears a reasonable relation to a legitimate interest of the state and the actor knows or should know that his conduct is likely to affect that interest.

18 Pa. C.S. § 102


Hageseth v. Sup. Ct of San Mateo, Cal. App. (1st Dist., May 21, 2007)

• Hageseth was a licensed physician in Colorado• McKay, a California resident, visited

www.usanetrx.com, an online pharmacy, and ordered generic Prozac, a prescription drug

• usanetrx is located outside the U.S.• McKay was asked to fill out an online questionnaire

about his health• The answers were sent to JRB Health Solutions

which had headquarters in Florida and a server in Texas

• JRB fowarded the answers to Hageseth in Colorado


Hageseth v. Sup. Ct of San Mateo, Cal. App. (1st Dist., May 21, 2007)

• Hageseth reviewed the answers and issued an online prescription to JRB’s server in Texas

• JRB sent the prescription to Gruich Pharmacy in Mississippi, which mailed the drug to McKay in California

• McKay took the drug, drank alcohol and committed suicide by carbon monoxide poisoning

• Investigation revealed the drug in his blood• Hageseth was charged in California with practicing

medicine without a license, a felony

Hageseth v. Sup. Ct of San Mateo, • At all material times, Hageseth was in Colorado and never

communicated with anyone in California

• Hageseth moved to dismiss for lack of person jurisdiction over him

• [NOTE: the question here is NOT whether he practiced medicine in California without a license, but whether California has jurisdiction to try him. He might not be found guilty.]

• The appeals court refused to dismiss the case

• Commission of a public offense within California, commenced outside the state, consummated within its boundaries by someone outside the state, creates liability for punishment

Hageseth v. Sup. Ct of San Mateo, • The Court of Appeals relied on the “detrimental effect”

theory of jurisdiction, articulated by Justice Holmes, in Strassheim v. Daily, 221 U.S. 280 (1911):

• “If … Daily did the acts that led Armstrong to betray his trust, … and induced by fraud the payment by the State, the usage of the civilized world would warrant Michigan in punishing him, although he never had set foot in the State until after the fraud was complete. Acts done outside a jurisdiction, but intended to produce and producing detrimental effects within it, justify a State in punishing the cause of the harm as if he had been present at the effect, if the State should succeed in getting him within its power.”



Strict Construction

• Problem: criminal statutes are “strictly construed.”• If the act is not expressly made criminal by statute, it

is not criminal (exception: “common law crimes,” like murder)

• The words of a criminal statute are not expanded to cover related or analogous behavior (Soviet Union has a “law of analogy”)

Commonwealth v. Lund• Lund was charged with the theft of keys, computer cards, computer

printouts and using computer time without authority at Virginia Polytechnic Institute (VPI)

• Statutes reads: “Any person who: … commits simple larceny not from the person of another of goods and chattels of the value of $100 or more, shall be deemed guilty of grand larceny …"

• Lund was found guilty at trial• He appealed on the grounds that computer time is not “goods” or

“chattels”• Virginia Supreme Court agreed. 232 N.E.2d 745 (Va. 1977)• “The phrase "goods and chattels" cannot be interpreted to include

computer time and services in light of the often repeated mandate that criminal statutes must be strictly construed.”

Can Software Commit a Crime?

• Jayson Reynoso wanted to declare bankruptcy• To save legal costs, he licensed a program from Frankfort

Digital Services that prepared bankruptcy forms for $219• Reynoso used Frankfort’s “Ziinet Bankruptcy Engine” to

prepare his bankruptcy filing

• Frankfort advertised that:“Ziinet is an expert system and knows the law. Unlike most bankruptcy programs which are little more than customized word processors the Ziinet engine is an expert system. It knows bankruptcy laws right down to those applicable to the state in which you live. Now you no longer need to spend weeks studying bankruptcy laws.”


In re Reynoso• Where the bankruptcy forms provided a space for the

signature and social security number of any non-attorney petition preparer, the software generated the response: “Not Applicable.”

• The bankruptcy trustee found errors in the forms and learned that Reynoso had used Ziinet

• The trustee began legal proceedings against Frankfort (One of many around the country, as it turned out)

• The bankruptcy court found that Frankfort, through its software, was a petition preparer, imposed fines and enjoined further use of Ziinet

In re Reynoso477 F.3d 1117 (9th Cir. 2007)

• Frankfort appealed to the 9th Circuit, arguing that “creation and ownership of a software program used by a licensee to prepare his or her bankruptcy forms is not preparation of a document for filing under the statute”

• The appeals court stated, “We hold that the software at issue in this case qualifies as such”

• “Frankfort’s system touted its offering of legal advice and projected an aura of expertise concerning bankruptcy petitions; and, in that context, it offered personalized – albeit automated – counsel. … We find that because this was the conduct of a non-attorney, it constituted the unauthorized practice of law

People ex rel. Vacco v. World Interactive Gaming Corp. et al.

• “ex rel.” (ex relatione, upon relation) means“acting through.” Vacco was the NY Attorney General

• no lottery or … book-making, or any other kind of gambling, … except pari-mutuel betting on horse races as may be prescribed by the legislature … shall hereafter be authorized or allowed within this state. NY Const. Art. 1, Sec. 9

• World Interactive Gaming Corp. (WIGC) is a Delaware corp. with offices in NY.

• Golden Chips Casino, Inc. (GCC) is an Antigua corp. wholly owned by WIGC.

• GCC operated an Internet casino using servers in Antigua.• GCC advertised in the US; ads were seen in NY


Antigua

People ex rel. Vacco v. World Interactive Gaming Corp. et al.

• Users had to enter a home address; GCC checked for Nevada• Users transferred money to a bank in Antigua. They could

gamble. Gambling is legal in Antigua.• NYers could gamble by lying about their address• NY Attorney General sought an injunction against WIGC, GCC

to stop their activities• Held, NY has jurisdiction. When New Yorkers transfer money to

GCC, they are gambling in NY. Doesn’t matter where GCC is.• "traditional jurisdictional standards have proved to be sufficient

to resolve all civil Internet jurisdictional issues"• Injunction issued

714 N.Y.S.2d 844 (N.Y.Sup. 1999)


Computer Fraud and Abuse Act• Prohibits certain acts against “protected computers”

that affect interstate commerce. 18 U.S.C. § 1030. • ''protected computer'' means a computer -

– exclusively for the use of a financial institution or the United States Government … ; or

– which is used in interstate or foreign commerce or communication

• including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States

• Also provides for a civil action (private lawsuit) by anyone injured by a violation


What’s a Computer?

• an “electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device,

but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device.

18 U.S.C. §1030(e)


Acts Prohibited on Protected Computers, 18 U.S.C. §1030

• OBTAINING INFORMATIONAccessing a computer without authorization or exceeding authorized access, and obtaining

• information contained in a financial record of a financial institution;

• information from any department or agency of the United States; or

• information from any protected computer if the conduct involved an interstate or foreign communication;



• USE IN FRAUDKnowingly and with intent to defraud, accessing a protected computer without authorization, or exceeding authorized access, to further the intended fraud and obtain anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period

• crimes investigated by FBI and Secret Service• PA: “Unlawful use of computer” 18 Pa. C.S. § 3933



• DAMAGING A COMPUTER

• knowingly causing the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causing damage without authorization, to a protected computer;

• intentionally accessing a protected computer without authorization, and as a result of such conduct, causing damage

• “damage” means any impairment to the integrity or availability of data, a program, a system, or information (covers viruses, denial of service)


CFAA as a Civil Tool

• PharMerica, Inc. v. Arledge (M.D. Fla. Mar. 21, 2007)• PharMerica is a huge pharmaceutical company• Arledge was a top member of its management team• On March 9, 2007, Arledge resigned to become VP at

Omnicare, PharMerica’s main competitor• Omnicare is three times the size of PharMerica• Two days before leaving, Arledge deleted 475 files from

his hard drive• He copied the files to a USB drive and emailed them to

his own AOL account


Major Ideas

• Criminal statutes are strictly construed• Computers can be used at a great distance to commit

crimes• This causes jurisdictional problems if the original

statutes did not contemplate out-of-state acts• In general, crimes committed by computer have been

treated jurisdictionally in the same manner as other crimes

• The Computer Fraud and Abuse Act prohibits acts against certain computer systems, particularly those used in interstate commerce, e.g. the Internet


QA&

law of computer technology fall 2015 copyright © 2015 michael i. shamos apple v. samsung news all...

Documents

abuse act

overt act

computer systemusing

eeacommunications decency

ecpaelectronic espionage

state statute

federal prosecution

federal circuit