Wednesday, April 25, 2012

Unlawful Access and Taking Confidential Data From a Computer

After being convicted of unlawfully accessing a computer database in violation of Florida Statutes §§ 815.06(1) and 815.06(2) and obtaining trade secret or confidential data in violation of Florida Statutes §§ 815.04(3)(b) and 814.04(4)(a), Maria Chung Willoughby appealed.  Willoughby v. State, __ So.3d __, 2012 WL 1192139 (Florida Court of Appeals 2012). 

This is how the prosecution arose:

Willoughby was hired as a financial specialist with Our Kids of Miami–Dade and Monroe Counties, an agency which works with the Department of Children and Families to provide services to abused and neglected children. Willoughby was provided access to Our Kids' and the Department's confidential computer network after agreeing to her employer's computer security requirements.

When she complained that the employer-provided computer was too slow, Willoughby's personal laptop computer was connected to Our Kids' computer network. Willoughby was told that she was authorized to use her laptop to access her employer's network but that she could not transfer any data from the employer's computer system into her laptop.

Subsequently, Willoughby's supervisor became aware that Willoughby had written a ten-page email outlining perceived inefficiencies in Our Kids' operation. The supervisor also suspected that Willoughby may have transferred confidential data to her laptop.

The supervisor asked to search Willoughby's computer, and Willoughby allowed the search. During the search, however, when she saw that her personal files were being accessed, Willoughby took back her laptop, stated that she was resigning, and left the premises.

Willoughby v. State, supra.

Willoughby’s employer apparently went to the authorities, because police “subsequently obtained a warrant to search [her] home and seized the laptop.” Willoughby v. State, supra.  When they examined the laptop, officers discovered “Willoughby had emailed her employer's client trust fund master list to her laptop.”  Willoughby v. State, supra. 

Willoughby was arrested and charged with the crimes noted above, i.e., “unlawfully accessing a computer database” and unlawfully “obtaining trade secret or confidential data”.  Willoughby v. State, supra.

At her trial, Willoughby’s attorney moved for a judgment of acquittal on both charges  “based on the State's failure to prove [she] was not authorized to access the computer database.” Willoughby v. State, supra.  The motion was presumably made pursuant to Florida Rules of Criminal Procedure Rule 3.380(a), which provides that

[i]f, at the close of the evidence for the state or at the close of all the evidence in the cause, the court is of the opinion that the evidence is insufficient to warrant a conviction, it may, and on the motion of the prosecuting attorney or the defendant shall, enter a judgment of acquittal.

The judge who presided over Willoughby’s trial denied both motions and the “jury returned a verdict of guilty as to both counts”, i.e., as to both charges.  Willoughby v. State, supra.  He put Willoughby on probation for four years, after which she appealed her conviction to the Court of Appeals.  Willoughby v. State, supra. 

On appeal, Willoughby again relied on her argument that the prosecution did not prove beyond a reasonable doubt that she was not authorized to access her employer’s database.  Willoughby v. State, supra. 

The Court of Appeals began its analysis of this argument by outlining the applicable law and the elements the prosecution was required to prove in order to lawfully obtain a conviction:

[As] to count one, section 815.06(1)(a) of the Florida Statutes provides that anyone who `willfully, knowingly, and without authorization . . . [a]ccesses or causes to be accessed any computer, computer system, or computer network . . . commits an offense against computer users.’

Access is defined as `to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network.’ [Florida Statutes] § 815.03(1).

Subsection (6) of section 815.06 clarifies that the section `does not apply to any person who accesses his or her employer's computer system . . . when acting within the scope of his or her lawful employment.’

Therefore, to prove this offense, the State must show that: (a) the defendant willfully, knowingly, and without authorization, (b) accessed a computer system, and (c) if the employer's system, that defendant acted outside the scope of his or her lawful employment.

Willoughby v. State, supra. 

After reviewing the evidence in the case, the Court of Appeals agreed with Willoughby:

Here, the State failed to show that Willoughby was not authorized to access Our Kids' computer network. The evidence demonstrated that Willoughby's supervisor authorized Willoughby to access Our Kids' computer network to perform her job.

Additionally, Willoughby's personal laptop was connected to the Our Kids computer network by the employer's network administrator.

Willoughby v. State, supra. 

The court therefore held that “because Willoughby received authorization to access Our Kids' computer network, count one is reversed as the State failed to prove that Willoughby's conduct violated section 815.06.”  Willoughby v. State, supra.  So she succeeded in getting one of her convictions reversed.  Willoughby v. State, supra. 

The Court of Appeals then took up Willoughby’s conviction on Count II.  Willoughby v. State, supra. This count charged her with (and she was convicted of)

a violation of section 815.04(3)(b) of the Florida Statutes which states, `Whoever willfully, knowingly, and without authorization discloses or takes data, programs, or supporting documentation which is a trade secret ... or is confidential as provided by law residing or existing internal or external to a computer, computer system, or computer network commits an offense against intellectual property.’

Willoughby v. State, supra. 

The Court of Appeals explained that “to prove this crime the State must show that the defendant willfully, knowingly, and without authorization disclosed or took a trade secret or confidential data from a computer network.”  Willoughby v. State, supra.  It found that in this instance, the prosecution had succeeded:

Here, the State proved that Willoughby did not have authorization to download any data from her employer's computer system to her personal laptop. The State also proved that Willoughby transferred confidential data from her employer's system to her laptop. Thus, the State proved all the elements of the crime.

Willoughby argues that she committed no crime because she did not have a malicious purpose in transferring the confidential information to her personal laptop, but rather, that her purpose was to work from her home. 

However, section 815.04(3)(b) does not include a requirement that the defendant have a malicious purpose. Rather, the statute requires only that the defendant's conduct be willful, knowing, and without authorization.

Willoughby repeatedly was informed that she could not obtain any of the data from her employer's network system. Willoughby, nonetheless, emailed her employer's client trust fund master list to her laptop. Because Willoughby transferred confidential files to her personal computer without authorization, she was properly charged with the taking of intellectual property.

Willoughby v. State, supra. 

The court therefore affirmed her conviction on Count II and remanded the case to the trial judge, presumably for resentencing in light of the reversal of her conviction on Count I, the unauthorized access charge.  Willoughby v. State, supra. 


Unknown said...

Ms. Brenner, I am Maria Chung Willoughby, and though I was distressed to see your posting as the majority of the information whether provided by the court system or not is untrue. There are a lot of misconceptions about the legal system. I will not go into them here,but I never had a job title or description with that company, the document of inefficiencies was a two page excel spreadsheet that list 25-33 inefficiences with action that I could take to improve them and a column for management approval. One of the inefficiencies coincidentally was that I did not have a job title or description or a direct report other than Patrick and it was causing at first curiosity then hostile harassment/bullying. I made Patrick Leger, Director aware that if the inefficiencies were not addressed, especially the job title and description (I pleaded with him just list me as document processor ...anything) I would have to resign due to not only inefficiency but I was in the onset of hostile bullying and I definitely did not need or deserve that. I do want to say thank you for taking the time to post the matter and to be as objective as you were able to. I admit that I did not read it in its entirety because quite frankly I did not feel like reliving it all again and actively refuting each refutable point only to be completely ignored, silenced, disregarded and put on mute . . . but I felt it to be my responsibility to at least address this not only for myself but for others that have been falsely accused and convicted as well. Thanks for your posts, please continue (I'm saying this in good faith, because I haven't read it all) to be objective and as time permits perhaps investigate the stories of those whose voices have been taken away. Much luck and success to you in the future. Sincerely, Maria C. Willoughby

Unknown said...

Maria Willoughby here again. (please copy and paste the below link for more details)

I did take the time to review the remainder of your blog regarding this matter.

I was authorized to email the document to myself, (the emailing back and forth was another issue on the inefficiencies list that I discussed previously) ironically, that was why I was networked by the Director and IT in the first place, because I expressed that it was inefficient to continue emailing the document back and forth, as it was taking up space on my personal computer.

Once again, that was also one of the inefficiencies that was listed -me emailing the document back and forth instead of simply being networked. Approval was granted verbally and via email to myself with copies to IT (or it may have been vice versa to IT with copies to me). So I definitely DID have authorization and the networking was just a more efficient way of getting the job done which I expressed to them and they acted based on that.

No one told me numerous times anything because we were all in agreement and knowledgeable of what was taking place. Further according to Patrick Leger, I had “carte blanche . Thankfully, I had more common sense than that because if I am suffering false accusations based on what he did specifically and distinctly authorize me to do, God only knows what would have happened if I followed his instruction on the inefficiency list and did EVERYTHING that I felt needed to be done. –mcw