This post examines an
opinion the Georgia Court of Appeals recently issued in a civil suit: Ware v.
American Recovery Solution Systems, Inc., 2013 WL 5542794 (“Ware v. American Recovery”). The opinion
begins by explaining that
American
Recovery Solution Services, Inc. (ARSS) sued Christopher Ware for computer
theft and computer trespass under the Georgia Computer Systems Protection Act, Georgia
Code § 16–9–90 et seq. . . .
Following a bench trial, the court found that Ware
committed computer trespass under Georgia Code § 16–9–93(b) and
awarded ARSS damages totaling $70,225.
Ware v. American Recovery, supra.
Ware appealed,
claiming the trial judge “erred in imposing liability under the Act” and “in
assessing damages”. Ware v. American Recovery, supra. The Court of Appeals began its analysis of
his arguments by outlining how the case arose:
ARSS
is a collection agency which entered into a written contract with Ware on
August 30, 2009. Ware agreed to work as an independent contractor to `design,
develop, and implement applications software’ according to specifications
attached to the contract as `Exhibit A.’ The contract provided
that the software, `including all versions in either source code or object code
form,’ was to be delivered to ARSS no later than February 1, 2010. . . .
ARSS agreed to pay
Ware $1,500 as a `down payment’ and $500 per month `until completion,’ as well
as necessary expenses. The contract provided that ARSS could request changes to
the specifications `or other aspects of the Agreement,’ and that Ware would use
his best efforts to implement the requested changes at no additional expense or
delay.
If he could not do so, ARSS could elect either to withdraw the change
request or require Ware to deliver the software with the change, `subject to
the delay and/or additional expense.’ The contract further stated that the
software would be the property of ARSS, that the software development was
‘”work for hire’ within the meaning of the Copyright Act of 1976,” and that
Ware ‘assign[ed] to [ARSS], without further compensation, all of [his] right,
title and interest in and to the Software’ and any related intellectual
property.
Ware
developed software for ARSS that allowed employees to access the company's
database using a web-based application. When the parties entered into the
August 2009 contract, Ware had already completed about 85 percent of the
web-based application. He completed and installed it on ARSS's system at some
point before February 2010, as provided in the contract.
After the application
was installed and working, ARSS and Ware discussed building a faster program,
and at some point after February 2010 ARSS accepted Ware's proposal to build a
second application based on Windows.
Ware v. American Recovery, supra.
This is where things
began to become more complicated:
ARSS
was still paying Ware for the completed web-based application when he began
developing the Windows-based application, and for a time ARSS was paying Ware
for both the completed first application and the developing second application.
Ware and ARSS's chief financial officer (CFO), who was also a part-owner and
the operations manager, worked out a schedule for completing the new
application and making payments.
ARSS agreed to pay Ware an initial $700 on
September 1, 2011, of a total fee of $1,905 due September 30, 2011, but when
Ware arrived to pick up the deposit, the check was for $350 instead of $700.
Ware agreed to wait
two weeks for the second half of the down payment, and on Tuesday, September
13, the CFO told him he would leave the second $350 check at the front desk for
Ware to pick up two days later. On Thursday, September 15, 2011, Ware came to
ARSS's offices and corrected some bugs in the program, but when he asked for
his check, he was told the COO had taken it.
The COO explained she took the
check so she could `ask [Ware] where were we on the remaining portion of what
he had.’ The COO sent Ware an email the next afternoon, Friday September 16,
2011, asking him about the status of the corrections, which Ware had already
fixed.
Ware
responded with what he later described as a `rash reaction,’ admitting he
`mishandled’ the situation. First, he logged into ARSS's server remotely, using
the CFO's login and password, and `disabled the login.’ On Friday, September
16, 2011, ARSS could not access its database of 36,000 accounts, and had to
adapt temporarily to a manual method of operation.
That evening, Ware emailed
the company owners, demanding the immediate receipt of the rest of his
agreed-upon fee for the latest upgrades before he would allow them access to
the application and database.
Ware v. American Recovery, supra. ARSS responded by calling
in a
software expert who restored access to the server and files. Then on September
23, 2011, Ware again logged into the ARSS server with the CFO's credentials
and, according to him, `restored the application and gave them the previous package
they had paid for.’
When ARSS employees tried to log into the database, they
only had access to a previous version of the program which did not include data
from 8,000 to 10,000 records that had been input into the newer version.
Ware v. American Recovery, supra.
On September 30, 2011,
ARSS filed a complaint against Ware, claiming he “remotely accessed ARSS's
server, disabled the software he developed under the contract, and deleted
files.” Ware v. American Recovery, supra. ARSS also accused him of computer theft in
violation of Georgia Code § 16–9–93(a) and computer trespass in violation
of Georgia Code § 16–9–93(b) and alleged he was liable for damages
and the costs of suit under Georgia Code § 16–9–93(g). Ware v. American Recovery, supra.
And ARSS “claimed to be losing
$20,000 a day while its software was down and sought an injunction against Ware
requiring him to make all ARSS servers and software operable and provide it
with software itself and training manuals as outlined in the August 2009
contract.” Ware v. American Recovery,
supra.
On November 28, 2012,
the trial judge held the bench trial noted above and issued an “order and final
judgment” finding Ware had committed computer trespass and awarding ARSS “$22,000
in lost profits, $15,000 reimbursement of all fees it had paid Ware for his
services, $15,000 for repairs, $17,875 attorney fees, and $350 punitive
damages.” Ware v. American Recovery, supra.
On appeal, Ware argued
that “the trial court erred in imposing liability under the Act because he was
an `authorized user’ and retained ownership rights in the software.” Ware v. American Recovery, supra.
The Court of Appeals began its analysis of his argument by noting that
Georgia Code § 16-9-93(b) defines computer trespass as follows:
Any
person who uses a computer or computer network with knowledge that such use is
without authority and with the intention of:
(1) Deleting or in any
way removing, either temporarily or permanently, any computer program or data
from a computer or computer network;
(2) Obstructing,
interrupting, or in any way interfering with the use of a computer program or
data; or
(3) Altering,
damaging, or in any way causing the malfunction of a computer, computer
network, or computer program, regardless of how long the alteration, damage, or
malfunction persists
shall
be guilty of the crime of computer trespass.
Ware v. American Recovery, supra
(quoting Georgia Code § 16-9-93(b)).
The court also noted
that Georgia Code § 16–9–92(18) “defines `without authority’ as including
`the use of a computer or computer network in a manner that exceeds any right
or permission granted by the owner of the computer or computer network.’” Ware v. American Recovery, supra.
And it explained that Georgia Code § 16–9–93(g) “clarifies that
someone who is injured due to the violation of any part of the Act has a civil
cause of action and can sue for damages, including lost profits.” Ware v. American Recovery, supra.
The Court of Appeals
then addressed Ware’s argument, which was that
he
did not access the server `without authority’ because he owned the software
that he tampered with and because he `restored the application and gave them
the previous package that they had paid for.’
Ware v. American Recovery, supra.
The Court of Appeals,
however, rejected Ware’s argument:
But
whether Ware `owned’ the upgraded version or not is irrelevant to whether he
committed computer trespass. The statute only requires that the intruder use a
computer or a network knowing he was without authority and either temporarily
or permanently remove data, interfere with the use of a computer program, or
cause a computer program to malfunction. Georgia Code § 16–9–93(b)(1)–(3).
The
CFO, whose login and password Ware used to access the server, testified that he
had not authorized Ware to disable an administrative login or alter the
program, and ARSS presented substantial evidence that Ware's actions first
completely shut down the company and then hampered its ability to operate for a
significant length of time while hired experts attempted to diagnose and
restore the application.
Ultimately,
the company stopped using Ware's software and purchased the use of
off-the-shelf software to conduct its operations because, the CEO testified, it
could not risk being shut down again.
Ware v. American Recovery, supra.
The Court of Appeals
therefore held that, “[g]iven these facts, the trial court was authorized to
conclude that Ware committed computer trespass by accessing ARSS's server
without authority and interfering with the use of a computer program.” Ware v. American Recovery, supra.
As noted above, Ware
also argued, on appeal, that the trial judge erred in awarding damages to
ARSS. Ware v. American Recovery, supra. The Court of Appeals began its analysis of
this argument by noting that Georgia Code § 16-9-93(g)(1) states that
[a]ny
person whose property or person is injured by reason of a violation of any
provision of this article may sue therefor and recover for any damages
sustained and the costs of suit. Without limiting the generality of the term,
`damages’ shall include loss of profits and victim expenditure[, as well as]
any additional civil remedy otherwise allowed by law.
Ware v. American Recovery, supra. The court also noted that Georgia Code §
16-9-92(17) defines “victim expenditure” as
any
expenditure reasonably and necessarily incurred by the owner to verify that a
computer, computer network, computer program, or data was or was not altered,
deleted, damaged, or destroyed by unauthorized use.
Ware v. American Recovery, supra.
Ware argued that the
trial judge “erred in awarding ARSS $15,000 `for [his] services’” because “this
sum was not a permissible `victim expenditure’ as defined in Georgia Code § 16–9–92(17)”. Ware v.
American Recovery, supra. Ware claimed it was not a legitimate victim
expenditure because
ARSS
received the value of Ware's services during those two years, during which Ware
developed, installed, and modified the software and provided on-call technical
assistance to company employees, as well as the use of the software to operate
a large portion of its business.
Additionally,
Ware argues, he gave ARSS the source code to the second application in response
to the trial court's order, which ARSS now owns exclusively, even though the
parties' contract only covered the first application. According to Ware,
requiring him to pay back all of the money ARSS paid him during this time
period would mean it obtained both his services and the software he developed
for free.
Ware v. American Recovery, supra.
ARSS argued, in
response, that the trial judge “properly
awarded it $15,000 `for [Ware's] services’ because Ware's actions deprived it
of its full `use and enjoyment’ of the software it had paid Ware to develop.” Ware v.
American Recovery, supra. The Court of Appeals, though, did not agree:
But
the trial court did not award this sum to compensate for the software that Ware
developed and which ARSS now possesses; it awarded it as refund of money paid
to Ware for his past services, for which the company had already received the
benefit of the bargain. ARSS used the applications to run its business and Ware
provided technical support and maintenance services to ARSS.
The
company received value in exchange for the money it paid to Ware, and its cost
of compensating Ware during that time period was not an element of damages that
resulted from Ware's computer trespass.
Ware v. American Recovery, supra.
So it reversed “the
award of $15,000 for Ware's services.” Ware v. American Recovery, supra.
The Court of Appeals therefore affirmed the judgment and damage award
for ARSS, except with regard to this $15,000.
Ware v. American Recovery, supra.
No comments:
Post a Comment