Computer Forgery

This post is about computer forgery . . . or, more accurately, about what is not computer forgery.

Like many of my posts, this one is inspired by a case: People v. Carmack, 34 A.D.3d 1299, 827 N.Y.S.2d 383 (Supreme Court of New York 2006). In 2003, an Erie County Grand Jury

charged [Howard Carmack] with three counts of Forgery in the Second Degree, arising out of [his] actions in sending electronic mail messages (`e-mail’) purporting to have originated from three different e-mail accounts without permission from the accounts' owners. The Grand Jury also charged [Carmack] with one count of Criminal Possession of Forgery Devices for using a computer software program to send these e-mail messages that was specifically designed to alter or create false written instruments.

Respondent’s Brief in People v. Carmack, supra.

The forgery charge against Carmack was brought under § 170.10[1] of the New York Penal Law. Under § 170.10[1], someone commits forgery

when, with intent to defraud, deceive or injure another, he falsely makes, completes or alters a written instrument which is or purports to be, or which is calculated to become or to represent if completed . . . [a] deed, will, codicil, contract, assignment, commercial instrument, credit card . . . or other instrument which does or may evidence, create, transfer, terminate or otherwise affect a legal right, interest, obligation or status.

The other charge against Carmack was brought under New York Penal Law § 170.40[1]. Under this statute, one commits the crime of possessing forgery devices if he “makes or possesses with knowledge of its character any plate, die or other device, apparatus, equipment, or article specifically designed for use in counterfeiting or otherwise forging written instruments”.

Carmack went to trial and was convicted on both charges. More precisely, he was convicted of 3 counts of forgery and 1 count of possessing forgery devices. On appeal, his attorney noted that the prosecution was brought by the New York Attorney General’s Office under the

novel theory . . . that [Carmack] committed a number of white-collar Penal Law crimes through the sending of bulk commercial e-mail (also known as `spam’), using already existing computer domain (i.e., e-mail) names without permission and creating other domain names after obtaining identification information without permission. No money was stolen. The computer said to be used was located in a residence on Parkridge Avenue in Buffalo, owned by appellant's mother

Appellant’s Brief in People v. Carmack, supra. This is how Carmack’s attorney described what he had actually done:

Some people received returned commercial advertisements in their e-mail boxes; sent by someone else in their own unique e-mail names. When not going to a proper address, this e-mail was returned to where the Internet server believed it originated. Others had their names and addresses used to create new e-mail accounts to send out ads. The ads were for spy software, dietary supplements and cable television descrambling kits.. Contact information in the ads mostly included a common phone number, 716-812-2144, the name, CSC Quick Products, and the addresses, 266 Elmwood Avenue, #172, and 341 Parkridge Avenue, both in Buffalo. . . .

The supposed motive . . . was to mass market products for free - - avoiding Internet service fees - - and hiding where the ads came from. . . . Accounts were opened and passwords were obtained using the legally purchased `Stealth’ mass mailer software program, allowing one to send out multiple e-mail advertisements at a time. These ads were made to look like they came from a different sender.

Appellant’s Brief in People v. Carmack, supra. Based on this, Carmack was apparently known in some circles as the “Buffalo Spammer.” Appellant’s Brief in People v. Carmack, supra.

Carmack challenged his conviction on the charges, claiming that the evidence presented at trial did not prove he’d committed either forgery or possession of forgery devices. The New York Supreme Court agreed. After noting the definition of forgery quoted above, it explained that at trial the Attorney General’s office presented evidence that Carmack

sent multiple e-mails from his computers but used a computer program that made it appear that they were sent from the e-mail address of another person or entity. The e-mails at issue, i.e., commercial solicitations for computer programs, dietary supplements, and other products, do not constitute deeds, wills, codicils, contracts, assignments, commercial instruments or credit cards, nor do they `evidence, create, transfer, terminate or otherwise affect a legal right, interest, obligation or status. Thus, the e-mails do not constitute instruments that may be the subject of the crime of forgery . . . under Penal Law § 170.10(1).

People v. Carmack, supra. The court also found that the evidence presented at trial did not prove Carmack possessed a forgery device:

Similarly, the People failed to establish that the computer program used to send the e-mails was a forgery device within the meaning of Penal Law § 170.40(1). That Penal Law section criminalizes possession of any `device, apparatus, equipment, or article specifically designed for use in counterfeiting or otherwise forging written instruments’ and, here, the People's expert testified that the program at issue `can be used for very legitimate purposes absolutely,’ thus negating an essential element of the crime.

The Supreme Court therefore reversed Carmack’s convictions on both charges.

Seems like a no-brainer, doesn’t it? What Carmack allegedly did so clearly does not fit within the definition of forgery (and, consequently, of the possession of forgery devices) it seems peculiar that the New York Attorney General’s office would have brought the charges. All I can assume is that they were using them as a substitute for the criminal spam statute New York did not have (and, as far as I know, may still not have).

As to what constitutes computer forgery, well, it’s just using digital technology to commit traditional forgery. Forgery, as the New York statute illustrates, has traditionally been falsifying a document in order to obtain money or other property to which the forger is not lawfully entitled. A few states have adopted statutes designed to make it clear that digital modifications of data or documents constitutes forgery. Here’s Georgia’s statute:

Any person who creates, alters, or deletes any data contained in any computer or computer network, who, if such person had created, altered, or deleted a tangible document or instrument would have committed forgery [under the general forgery statute], shall be guilty of the crime of computer forgery. The absence of a tangible writing directly created or altered by the offender shall not be a defense to the crime of computer forgery if a creation, alteration, or deletion of data was involved in lieu of a tangible document or instrument.

Georgia Code § 169-9-93(d). Virginia and West Virginia have statutes that are almost identical to Georgia’s computer forgery provision. Virginia Code § 18.2-152.14; West Virginia Code § 61-3C-15.

I keep looking for computer forgery prosecutions, but Carmack’s is the only one I have found. I wonder if that means people aren’t committing computer forgery or if it means they’re committing it but not getting caught . . . .