Index
Previous
Next
Letter from Cybersalem #12
"Oops! There goes another rubber tree plant." [1]
In the last Cybersalem letter [2] we saw a major line item from the Bill of Rights disappear as easily as one of the rubber trees in the Frank Sinatra hit. So when, in the same Washington County, Oregon Circuit Court, the 14th Amendment guarantee of due process comes up against the need for smooth functioning of computers, even money is the suckers' bet.
An obituary for the 14th and due process would be appropriate. It will go fast, so I'll be brief. Due process on the simplest level is what it sounds like: legislatures pass laws, D.A.'s bring charges against people suspected of breaking them, juries decide the facts. Due process is short-circuited by vague laws which cover vast areas of behavior. That puts it up to the D.A. to decide what the actual boundaries of the law are by choosing whom to prosecute, and hands the role the legislature plays in due process over to the D.A. Because the D.A.'s decision takes place after the act, the vague law also acts as an ex post facto law -- a law which makes an act criminal after the fact -- in violation of Article I of the Constitution. The D.A. can look over acts after they are committed, and decide which of the many falling under the vague law he actually thinks should be a crime.
Tom Tintera, prosecuting Randal Schwartz in the Oregon courtroom, points out to Circuit Court Judge Gayle Nachtigal that allowing Randal Schwartz due process under the 14th Amendment is deadly to his prosecution [3]. Admittedly, the law is so vague it allows him to treat a harmless change in screen color as a felony.
"And, you know, Mr. Sussman says well, it could be so much as altering the color of a screen. The fact of the matter is if you want to do that and you're not authorized, I suppose you could be subject to criminal prosecution under this law." [4]
Tintera adds "the prosecutor's office must have an awful lot of time on their hands to pursue that type of thing." [5] This is precisely the central feature of an unconstitutionally vague law -- it bans far more than the D.A. could or would want to prosecute, leaving the decision of the real meaning of the statute up to him.
Judge Nachtigal takes Tintera's point. If computer programmers have a right to due process, some of their actions might not be felonies, and the D.A. would be powerless to prosecute them as such. Instead the D.A. would have to determine if the action was a crime under a law that met due process standards. Such a state of affairs immediately strikes Nachtigal as totally unacceptable.
Nachigal: "But shouldn't the owner-controller, whatever the entity is that is in control of the computer, have the ability to say you can and you cannot do something. And it may be that they want all their computer screens to be blue. That's their trademark. They want that. They don't want it hot pink or yellow or green or any other color, and that the instructions are clear: you are not to change the background color. That's a silly example, perhaps, but -- and then the employee goes ahead and knowingly changes the background color. That's altering --
Sussman [Randal's attorney]: "Mm-hmm."
Nachtigal: "-- it's without authorization. As a society we may not -- we may want that authority there with computers." [6]
And so down goes due process for anyone dealing with a computer [7]. This in full awareness that it sanctions prosecutions which are "silly", and prosecutions which the prosecutor himself says show his "office must have an awful lot of time on their hands".
Note Judge Nachtigal's reference to the person against whom the most trivial disobedience is a felony: "the owner-controller, whatever the entity is that is in control of the computer". She is not sure. Nachtigal's confusion stems directly from the vagueness in the law -- it simply says "without authorization" without further explanation [8].
It could be quite an issue. Who actually owns, fee simple, the computer equipment you work on? The software? What legal arrangements, such as leasing, are there and what degree of control do they give each of the parties? Do you ever visit sites where you simply sit down at a piece of equipment, presuming authority from your job title, the machine's physical location or the receptionist's direction as to where to work?
Take a far from unlikely hypothetical case of a computer owned by one party, running software leased from a second party, and which the sysadmin works on as part of an outsourcing arrangement -- that is, he works for a third party. If one party orders its employee to take some action, such as enabling or disabling disputed software, is that a crime or not [9]? How does the D.A. determine whose authorization should have been gotten?
Note 1: From the song "High hopes" written by Cahn/Van Heusen, and made popular by Frank Sinatra.
Note 3: Without attempting to scare the lawyers out of the business, here is an informal description of the setting. The quoted remarks are from a pre-trial hearing called a demurrer, to argue a motion also called a demurrer. This is a challenge to an action on purely legal grounds, in effect saying "Even if the facts are as the prosecution alleges, ...". In this context, the law is at issue, and what the defendant did or is alleged to have done is not. If the law is struck down, the defendant can always be charged under a constitutionally valid one.
This letter deals with the challenge on "vagueness" grounds. There was also a challenge on "broadness" and this, and the difference between "broadness" and "vagueness", are dealt with in CS10. The demurrer itself is relatively readable and quite helpful on the details of the law: Memorandum of Law Supporting Demurrer.
Note 4: Tr. 7-1-94, page 27, line 1 to page 28, line 4.
Note 5: Tr. 7-1-94, page 28, lines 4 to 5.
Note 6: Tr. 7-1-94, page 32, lines 7 to 21.
Note 7: Those breathing a sigh of relief that they don't work with computers have breathed too soon. The law says:
"Computer means, but is not limited to, an electronic device which performs logical, arithmetic or memory functions by the manipulations of electronic, magnetic or optical signals or impulses, and includes all input, output, processing, storage, software or communication facilities which are connected or related to such a device in a system or network." The Oregon Criminal Code, Title 16, 164.377, 1(b).
Most phone systems easily qualify under this definition, even without the "is not limited to". Indeed, most modern themostats also qualify, and many employers, rightfully and with good reason, forbid changing the setting. But should fiddling with the office thermostat be a felony?
More absurdly, since the cited law also forbids unauthorized "access" to "computers", an employer could make it a crime to look at the thermostat simply by having a rule to that effect.
Note 8: It is because of this that virtually every other Oregon law which talks about authorization gives details on who must authorize and often how as well. See the Memorandum of Law Supporting Demurrer.
Note 9: The law might be interpreted to say that only action can be illegal, never failure to do something. So a sysadmin can simply do nothing and escape prosecution. This does not help much in the common case where contradictory instructions all require action and the sysadmin must defy all parties or face criminal prosecution.
Employers can be sued for ordering a worker to commit a felony and for firing a worker for refusing to commit one. The new, wide range of felonious behavior created in Nachtigal's ruling means employees have lots of opportunity to sue, and that concocting innovative litigation is a far more lucrative and wise course than doing anything on the computer.
Index
Previous
Next