Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Crime Electronic Frontier Foundation Your Rights Online

Clerk Printed Lottery Tickets She Didn't Pay For But Didn't Break Hacking Law (arstechnica.com) 110

Violating a company rule is not -- and should not be -- a computer crime, that was the ruling of the Oregon Supreme Court in State v. Nascimento file. The Oregon's highest court ruled that while a convenience store clerk was guilty of stealing lottery tickets through the store's computer system, she did not violate the state's anti-hacking law while doing so. ArsTechnica shares more details: The Electronic Frontier Foundation, which appeared on Caryn Nascimento's behalf during the case as an amicus curae (friend of the court), announced the narrow victory on Tuesday. According to the Supreme Court's decision, the case dates back to 2007, when Nascimento began working at Tiger Mart, a small convenience store in Madras, Oregon, about 120 miles southeast of Portland. In late 2008 and early 2009, a company vice president began investigating what appeared to be cash shortages at that store, sometimes about $1,000 per day. After reviewing video recordings that correlated with Nascimento's work schedule, this executive began to suspect that she was buying lottery tickets but not paying for them. Eventually, Nascimento was charged not only with aggravated first-degree theft but also of violating the state's computer crime law, which includes language that "any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime." She was convicted on both charges at trial. On appeal before the Oregon Supreme Court, Nascimento's lawyers argued that while their client may have violated a company policy to not print lottery tickets that she did not receive payment for, she was, in fact, authorized to access the lottery printing computer.
This discussion has been archived. No new comments can be posted.

Clerk Printed Lottery Tickets She Didn't Pay For But Didn't Break Hacking Law

Comments Filter:
  • by gurps_npc ( 621217 ) on Tuesday August 02, 2016 @04:52PM (#52631067) Homepage

    Look, when someone breaks the law, punish them for what they did, not things that are SIMILAR to what they did.

    • by gweihir ( 88907 ) on Tuesday August 02, 2016 @06:25PM (#52631733)

      Naaa, In a police-state you always prosecute people to the maximum possible, no matter how stupid and unjust. After all, you have to send a message to the population who the masters are! Were would we be if the serfs could just break the law and get away with anything below a life-sentence for it.

      On a completely unrelated thought, that this even needs a court decision shows how very badly out of control the US "legal" system is these days.

      • Naaa, In a police-state you always prosecute people to the maximum possible, no matter how stupid and unjust. After all, you have to send a message to the population who the masters are!

        It's not a police-state problem, it's a for-profit prison system problem. Gotta pay those lobbyists to push for harsher sentencing laws.

        • by gweihir ( 88907 )

          These go hand-in-hand.

        • Very few prisoners in Oregon are in private institutions, so probably not.

          You gotta know your head from a hole in the ground before you can decide who the "masters" are, unless you're just going to point in the shadows all the time.

          This is a typical case for Oregon. Our cops and prosecutors suck the same as everywhere, but we have pretty good laws and pretty good courts.

      • It's a matter of an unclear law. I'd bet you could find unclear and badly written laws anywhere.

    • Prosecutors are in love with piling on extra extra charges. It's a shotgun approach. If one charge gets remove maybe other ones will stick. It's also done as a way to pile on the maximum sentence and then intimidate the defendant into a plea bargain. Unauthorized computer access, hate crime, using a gun will committing a robber, being under the influence of drugs while committing a robbery, under the influence of drugs and using a gun while committing a hate crime on a computer, etc.

      It's also due in par

      • by mysidia ( 191772 ) on Tuesday August 02, 2016 @11:38PM (#52633285)

        What we need to do is stipulate a rule: If the defendant is proven not-guilty of any one of the charges presented,
        then they are automatically released of all charges related to their chain actions that some have been deemed criminal.

        Afford the defendant the CHOICE regarding which charge or charge(s) will be decided upon first, and in what order for the subsequent ones.

        Any further charge for the same chain of actions would be double jeopardy.

        So if one of the charges is bogus, the Defendant will have that charge heard first, and once found innocent, be cleared of all the others.

        That should encourage prosecutors to only charge the offense for a certain series of actions that they actually have evidence for, And only make the high-quality charges, not specious or dubious ones "To hope something sticks"

        • by Archfeld ( 6757 )

          So if a prosecutor tries for 1st degree murder and fails to prove premeditation the murderer should go free ? That logic leaves a lot to be desired in reality.

        • by AmiMoJo ( 196126 )

          I like this idea, it will stop prosecutors throwing in things like sexual assault and child pornography charges as a way of painting the defendant as some kind of monster and piling up the potential years on them as a way to pressure them into taking a plea deal.

          The only down side I can see is that juries might be tempted to convict people of things they didn't do in order to get the them convicted of other things they did. Say there was an accused rape-murder, but it turns out it was just some consensual s

    • "Nulla poena sine lege." - No punishment without an appropriate law.

      And prosecutors, having (hopefully) studied Law, should know this.

      • Public schools violate this principle all the time. Kid breaks a "zero tolerance" policy by drawing a picture of a gun? Expulsion. Unfortunately, nothing changes because it's mostly parents who can't afford bringing a lawsuit who have to send their kids to public school.
    • Just like patent trolls taking prior art and appending "on a computer", the justice system now takes old laws and appends "on a computer".
  • by FlyHelicopters ( 1540845 ) on Tuesday August 02, 2016 @04:53PM (#52631073)

    And someone just "investigated"?

    Was the boss asleep? Whenever I've worked retail, a report was required for more than $20 missing from a cash drawer...

    $1,000 would have been unthinkable!

    • was really just a couple of weeks before somebody investigated. Things are a bit looser in small towns than in the big city. Still, it took 7 years for the case to wind its way up to the Oregon Supreme Court. Would have been faster if she had been a lesbian.

    • by gmack ( 197796 ) <gmackNO@SPAMinnerfire.net> on Tuesday August 02, 2016 @05:12PM (#52631207) Homepage Journal
      The money wouldn't have been missing from the cash register. It would have shown up when the store gets it's bill from the lottery company for purchased tickets that were never actually purchased.
      • It would have shown as a sale on the daily receipts to the lotto company, but the cash for the sales would not have been in the cash drawer - hence it was 'missing'.

        My question is, how long did she think she could get away with it? Maybe she was hoping she could hit it big and disappear before she was caught? But then she would have had to collect the money from the same employer she was stealing from....

        • Addicts aren't engaged in long-term planning, that is well known. Gambling is one of the most addictive things known.

        • by hlavac ( 914630 )
          She was probably hoping to win and then return the missing money from that :) Too bad she didn't understand the odds of winning...
  • by Anonymous Coward

    Violating a company rule means that the access done in violation was unauthorized. It would be just like loaning a vehicle to someone stipulating that they were not to go off-road, some security camera shows them mud-bogging, and then nailing the car borrowers with grand theft, because authorization to drive was revoked.

    • Right, it would be exactly like that, except that in Oregon we don't have "grant theft auto" we have "unauthorized use of a motor vehicle" and unlike the computer law, it uses an analog measurement where the intended use is taken into consideration. If you borrow a car and say you're going to the library, and you go to a concert, that is actually a felony in Oregon.

  • by Anonymous Coward

    "I told them they could not have any more cheese then they went and opened the fridge. Throw the book at them that was unauthorized access to the computer. Then they went and used the microwave!!!"

    Even though the law as written seems pretty clear
    "any person who knowingly and without authorization uses, accesses or attempts to access any computer"
    this is a very good precedent to be set when we are proceeding towards where there are computers in everything.

  • There are two common-sense readings, and the court took one of them.

    The other common-sense reading is that the employee was only authorized to access the device to do things that complied with company policy, and that her authorization to accessed it was implicitly suspended during the time she was violating company policy.

    Since the court went the way they went, expect some companies in Oregon to go back and spell out very clearly that when you are using company equipment in violation of company policy, you

    • by fnj ( 64210 )

      Earth to commenter. The clerk DID NOT use the machine without authorization. This is crystal clear. The EFF is absolutely correct, end of story. The clerk is guilty of theft, not some trumped-up "computer crime". Jesus save us from this SHIT. It is criminal justice CORRUPTION, plain and simple.

    • Tollroads can try this BS on speeding by go over the limit you are not authorization to use the ETC / camera / coin counting system so you are now looking at hard time under the computer crime law.

      They can try that but in IL they will need to build a lot of court rooms and jails to handle the case load. Also good luck finding people to fill all the jury's.

    • The other common-sense reading is that the employee was only authorized to access the device to do things that complied with company policy, and that her authorization to accessed it was implicitly suspended during the time she was violating company policy.

      While that may be a common-sense reading, it's a horrible precedent to set. Especially when it's not a company-employee relationship but rather manufacturer-customer. The DMCA is bad enough without the CFAA being shoehorned onto every crime too.

    • by DRJlaw ( 946416 )

      Since the court went the way they went, expect some companies in Oregon to go back and spell out very clearly that when you are using company equipment in violation of company policy, your authorization to use the equipment is immediately suspended for the duration of your out-of-policy use and, as a result, you are violating Oregon state law and that the company reserves the right to press charges.

      Personally, I think the court made the right decision, because 1) it's very easy for companies to "work around

  • Really, it's no different than loading up you car with merchandise that you did not pay for.

    • by Lisias ( 447563 )

      Really, it's no different than loading up you car with merchandise that you did not pay for.

      What's completely different from loading a stolen car with merchandise that you did not pay for.

  • Don't most places have the lotto system with it's own cash door and she may be looking at hard time for stealing lotto.

    • I've only ever seen those in California. In every other state where I've been (certainly not all of them), there is a lotto printing machine. The clerk prints the request number of tickets and rings up the sale. Once the ticket is printed, they owe the lottery the money for the purchase. The clerks manufacture (print) the tickets, sell them, and collect the money. What she did here was manufacture and steal tickets. She didn't do anything to alter the behavior of the ticket printing machine nor of the
    • by yakatz ( 1176317 )
      In some states (like Maryland for example), that is optional. Large supermarkets usually have the separate drawer, but places like 7-Eleven use the regular cash register drawer.
  • It's about time (Score:4, Insightful)

    by omnichad ( 1198475 ) on Tuesday August 02, 2016 @05:45PM (#52631441) Homepage

    It's about time someone set the right precedent. Now there's finally some good case law for every count of "crime...but on a computer" to NOT count as a violation of CFAA.

  • by Archfeld ( 6757 ) <treboreel@live.com> on Tuesday August 02, 2016 @06:53PM (#52631919) Journal

    What was the value of the lottery tickets stolen ? Was it valued at the $1.00 per pick or the value if you won ? It was only $1.00 at the time of the theft, can they retroactively apply appreciation to the value of the item ? If you stole $10.00 from the till and one of the dollars turned out to be a rare silver certificate, but that fact was unknown to any party involved at the time of the crime, I wonder if the crime is still a $10.00 theft ?

    • It's possible the store (her employer) still had to pay the State Lottery board (or whatever) the money for the tickets she 'bought'
      • The store did have to pay. For each ticket that is printed, the store gets a bill. The local printers are dumb terminals. They just send a request to a central server, get a response, and print out a ticket. Immediately after a drawing, the lottery knows whether there is a winner and where the ticket was purchased. They invoice the stores for all of the tickets sold. I imagine she got away with this because there is some delay from the time she stole the tickets until the store got the bill and knew s
  • I get that they think the CFAA is overbroad and this is a prosecutorial pile-on. And maybe it is.

    At the same time (and to be fair), this may have a negative impact on privacy.

    Consider a scenario where an individual (say, a police dispatcher) has authorization to use a computer system (say, court records, warrants, DMV records) for legitimate purpose (in dispatching the police). Now she goes and uses her access to that computer beyond the bounds of that authorization: to help a friend that is a PI, to stalk

    • Your concern is about someone using authorized access in unauthorized ways. There are laws against at least some applications. If your doctor's office reveals confidential information without permission, that's illegal under HIPAA, no matter whether a computer was even involved. There are doubtless other laws that apply in some circumstances.

      Throwing CFAA at people who violated terms of service is really, really dangerous. Having general laws so you can make up a reason why someone committed a felony

  • this executive began to suspect that she was buying lottery tickets but not paying for them

    So not buying them, then? Perhaps we could call this thing "stealing."

  • When referring to the US State, it's just "Oregon", not "The Oregon".
  • Would she then be entitled to the winnings? I would think not.

"Say yur prayers, yuh flea-pickin' varmint!" -- Yosemite Sam

Working...