Unlawful Access and Taking Confidential Data From a Computer

After being convicted of unlawfully accessing a computer database in violation of Florida Statutes §§ 815.06(1) and 815.06(2) and obtaining trade secret or confidential data in violation of Florida Statutes §§ 815.04(3)(b) and 814.04(4)(a), Maria Chung Willoughby appealed.  Willoughby v. State, __ So.3d __, 2012 WL 1192139 (Florida Court of Appeals 2012). 

This is how the prosecution arose:

Willoughby was hired as a financial specialist with Our Kids of Miami–Dade and Monroe Counties, an agency which works with the Department of Children and Families to provide services to abused and neglected children. Willoughby was provided access to Our Kids' and the Department's confidential computer network after agreeing to her employer's computer security requirements.

When she complained that the employer-provided computer was too slow, Willoughby's personal laptop computer was connected to Our Kids' computer network. Willoughby was told that she was authorized to use her laptop to access her employer's network but that she could not transfer any data from the employer's computer system into her laptop.

Subsequently, Willoughby's supervisor became aware that Willoughby had written a ten-page email outlining perceived inefficiencies in Our Kids' operation. The supervisor also suspected that Willoughby may have transferred confidential data to her laptop.

The supervisor asked to search Willoughby's computer, and Willoughby allowed the search. During the search, however, when she saw that her personal files were being accessed, Willoughby took back her laptop, stated that she was resigning, and left the premises.

Willoughby v. State, supra.

Willoughby’s employer apparently went to the authorities, because police “subsequently obtained a warrant to search [her] home and seized the laptop.” Willoughby v. State, supra.  When they examined the laptop, officers discovered “Willoughby had emailed her employer's client trust fund master list to her laptop.”  Willoughby v. State, supra. 

Willoughby was arrested and charged with the crimes noted above, i.e., “unlawfully accessing a computer database” and unlawfully “obtaining trade secret or confidential data”.  Willoughby v. State, supra.

At her trial, Willoughby’s attorney moved for a judgment of acquittal on both charges  “based on the State's failure to prove [she] was not authorized to access the computer database.” Willoughby v. State, supra.  The motion was presumably made pursuant to Florida Rules of Criminal Procedure Rule 3.380(a), which provides that

[i]f, at the close of the evidence for the state or at the close of all the evidence in the cause, the court is of the opinion that the evidence is insufficient to warrant a conviction, it may, and on the motion of the prosecuting attorney or the defendant shall, enter a judgment of acquittal.

The judge who presided over Willoughby’s trial denied both motions and the “jury returned a verdict of guilty as to both counts”, i.e., as to both charges.  Willoughby v. State, supra.  He put Willoughby on probation for four years, after which she appealed her conviction to the Court of Appeals.  Willoughby v. State, supra. 

On appeal, Willoughby again relied on her argument that the prosecution did not prove beyond a reasonable doubt that she was not authorized to access her employer’s database.  Willoughby v. State, supra. 

The Court of Appeals began its analysis of this argument by outlining the applicable law and the elements the prosecution was required to prove in order to lawfully obtain a conviction:

[As] to count one, section 815.06(1)(a) of the Florida Statutes provides that anyone who `willfully, knowingly, and without authorization . . . [a]ccesses or causes to be accessed any computer, computer system, or computer network . . . commits an offense against computer users.’

Access is defined as `to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network.’ [Florida Statutes] § 815.03(1).

Subsection (6) of section 815.06 clarifies that the section `does not apply to any person who accesses his or her employer's computer system . . . when acting within the scope of his or her lawful employment.’

Therefore, to prove this offense, the State must show that: (a) the defendant willfully, knowingly, and without authorization, (b) accessed a computer system, and (c) if the employer's system, that defendant acted outside the scope of his or her lawful employment.

Willoughby v. State, supra. 

After reviewing the evidence in the case, the Court of Appeals agreed with Willoughby:

Here, the State failed to show that Willoughby was not authorized to access Our Kids' computer network. The evidence demonstrated that Willoughby's supervisor authorized Willoughby to access Our Kids' computer network to perform her job.

Additionally, Willoughby's personal laptop was connected to the Our Kids computer network by the employer's network administrator.

Willoughby v. State, supra. 

The court therefore held that “because Willoughby received authorization to access Our Kids' computer network, count one is reversed as the State failed to prove that Willoughby's conduct violated section 815.06.”  Willoughby v. State, supra.  So she succeeded in getting one of her convictions reversed.  Willoughby v. State, supra. 

The Court of Appeals then took up Willoughby’s conviction on Count II.  Willoughby v. State, supra. This count charged her with (and she was convicted of)

a violation of section 815.04(3)(b) of the Florida Statutes which states, `Whoever willfully, knowingly, and without authorization discloses or takes data, programs, or supporting documentation which is a trade secret ... or is confidential as provided by law residing or existing internal or external to a computer, computer system, or computer network commits an offense against intellectual property.’

Willoughby v. State, supra. 

The Court of Appeals explained that “to prove this crime the State must show that the defendant willfully, knowingly, and without authorization disclosed or took a trade secret or confidential data from a computer network.”  Willoughby v. State, supra.  It found that in this instance, the prosecution had succeeded:

Here, the State proved that Willoughby did not have authorization to download any data from her employer's computer system to her personal laptop. The State also proved that Willoughby transferred confidential data from her employer's system to her laptop. Thus, the State proved all the elements of the crime.

Willoughby argues that she committed no crime because she did not have a malicious purpose in transferring the confidential information to her personal laptop, but rather, that her purpose was to work from her home. 

However, section 815.04(3)(b) does not include a requirement that the defendant have a malicious purpose. Rather, the statute requires only that the defendant's conduct be willful, knowing, and without authorization.

Willoughby repeatedly was informed that she could not obtain any of the data from her employer's network system. Willoughby, nonetheless, emailed her employer's client trust fund master list to her laptop. Because Willoughby transferred confidential files to her personal computer without authorization, she was properly charged with the taking of intellectual property.

Willoughby v. State, supra. 

The court therefore affirmed her conviction on Count II and remanded the case to the trial judge, presumably for resentencing in light of the reversal of her conviction on Count I, the unauthorized access charge.  Willoughby v. State, supra.