Monday, October 21, 2013

The Contractor, the Login and Computer Trespass

This post examines an opinion the Georgia Court of Appeals recently issued in a civil suit:  Ware v. American Recovery Solution Systems, Inc., 2013 WL 5542794 (“Ware v. American Recovery”). The opinion begins by explaining that

American Recovery Solution Services, Inc. (ARSS) sued Christopher Ware for computer theft and computer trespass under the Georgia Computer Systems Protection Act, Georgia Code § 16–9–90 et seq. . . . 

Following a bench trial, the court found that Ware committed computer trespass under Georgia Code § 16–9–93(b) and awarded ARSS damages totaling $70,225.

Ware v. American Recovery, supra.

Ware appealed, claiming the trial judge “erred in imposing liability under the Act” and “in assessing damages”.  Ware v. American Recovery, supra.  The Court of Appeals began its analysis of his arguments by outlining how the case arose:

ARSS is a collection agency which entered into a written contract with Ware on August 30, 2009. Ware agreed to work as an independent contractor to `design, develop, and implement applications software’ according to specifications attached to the contract as `Exhibit A.’ The contract provided that the software, `including all versions in either source code or object code form,’ was to be delivered to ARSS no later than February 1, 2010. . . .

If he could not do so, ARSS could elect either to withdraw the change request or require Ware to deliver the software with the change, `subject to the delay and/or additional expense.’ The contract further stated that the software would be the property of ARSS, that the software development was ‘”work for hire’ within the meaning of the Copyright Act of 1976,” and that Ware ‘assign[ed] to [ARSS], without further compensation, all of [his] right, title and interest in and to the Software’ and any related intellectual property.

Ware developed software for ARSS that allowed employees to access the company's database using a web-based application. When the parties entered into the August 2009 contract, Ware had already completed about 85 percent of the web-based application. He completed and installed it on ARSS's system at some point before February 2010, as provided in the contract. 

After the application was installed and working, ARSS and Ware discussed building a faster program, and at some point after February 2010 ARSS accepted Ware's proposal to build a second application based on Windows.

Ware v. American Recovery, supra.

This is where things began to become more complicated:

ARSS was still paying Ware for the completed web-based application when he began developing the Windows-based application, and for a time ARSS was paying Ware for both the completed first application and the developing second application. Ware and ARSS's chief financial officer (CFO), who was also a part-owner and the operations manager, worked out a schedule for completing the new application and making payments. 

ARSS agreed to pay Ware an initial $700 on September 1, 2011, of a total fee of $1,905 due September 30, 2011, but when Ware arrived to pick up the deposit, the check was for $350 instead of $700.

Ware agreed to wait two weeks for the second half of the down payment, and on Tuesday, September 13, the CFO told him he would leave the second $350 check at the front desk for Ware to pick up two days later. On Thursday, September 15, 2011, Ware came to ARSS's offices and corrected some bugs in the program, but when he asked for his check, he was told the COO had taken it. 

The COO explained she took the check so she could `ask [Ware] where were we on the remaining portion of what he had.’ The COO sent Ware an email the next afternoon, Friday September 16, 2011, asking him about the status of the corrections, which Ware had already fixed.

Ware responded with what he later described as a `rash reaction,’ admitting he `mishandled’ the situation. First, he logged into ARSS's server remotely, using the CFO's login and password, and `disabled the login.’ On Friday, September 16, 2011, ARSS could not access its database of 36,000 accounts, and had to adapt temporarily to a manual method of operation. 

That evening, Ware emailed the company owners, demanding the immediate receipt of the rest of his agreed-upon fee for the latest upgrades before he would allow them access to the application and database.

Ware v. American Recovery, supra.  ARSS responded by calling

in a software expert who restored access to the server and files. Then on September 23, 2011, Ware again logged into the ARSS server with the CFO's credentials and, according to him, `restored the application and gave them the previous package they had paid for.’ 

When ARSS employees tried to log into the database, they only had access to a previous version of the program which did not include data from 8,000 to 10,000 records that had been input into the newer version.

Ware v. American Recovery, supra. 

On September 30, 2011, ARSS filed a complaint against Ware, claiming he “remotely accessed ARSS's server, disabled the software he developed under the contract, and deleted files.”  Ware v. American Recovery, supra.  ARSS also accused him of computer theft in violation of Georgia Code § 16–9–93(a) and computer trespass in violation of Georgia Code § 16–9–93(b) and alleged he was liable for damages and the costs of suit under Georgia Code § 16–9–93(g). Ware v. American Recovery, supra.  And ARSS  “claimed to be losing $20,000 a day while its software was down and sought an injunction against Ware requiring him to make all ARSS servers and software operable and provide it with software itself and training manuals as outlined in the August 2009 contract.” Ware v. American Recovery, supra. 

On November 28, 2012, the trial judge held the bench trial noted above and issued an “order and final judgment” finding Ware had committed computer trespass and awarding ARSS “$22,000 in lost profits, $15,000 reimbursement of all fees it had paid Ware for his services, $15,000 for repairs, $17,875 attorney fees, and $350 punitive damages.” Ware v. American Recovery, supra. 

On appeal, Ware argued that “the trial court erred in imposing liability under the Act because he was an `authorized user’ and retained ownership rights in the software.” Ware v. American Recovery, supra.  The Court of Appeals began its analysis of his argument by noting that Georgia Code § 16-9-93(b) defines computer trespass as follows:

Any person who uses a computer or computer network with knowledge that such use is without authority and with the intention of:

(2) Obstructing, interrupting, or in any way interfering with the use of a computer program or data; or

(3) Altering, damaging, or in any way causing the malfunction of a computer, computer network, or computer program, regardless of how long the alteration, damage, or malfunction persists

shall be guilty of the crime of computer trespass.

Ware v. American Recovery, supra (quoting Georgia Code § 16-9-93(b)).

The court also noted that Georgia Code § 16–9–92(18) “defines `without authority’ as including `the use of a computer or computer network in a manner that exceeds any right or permission granted by the owner of the computer or computer network.’” Ware v. American Recovery, supra.  And it explained that Georgia Code § 16–9–93(g) “clarifies that someone who is injured due to the violation of any part of the Act has a civil cause of action and can sue for damages, including lost profits.” Ware v. American Recovery, supra. 

The Court of Appeals then addressed Ware’s argument, which was that

he did not access the server `without authority’ because he owned the software that he tampered with and because he `restored the application and gave them the previous package that they had paid for.’

Ware v. American Recovery, supra. 

The Court of Appeals, however, rejected Ware’s argument:

But whether Ware `owned’ the upgraded version or not is irrelevant to whether he committed computer trespass. The statute only requires that the intruder use a computer or a network knowing he was without authority and either temporarily or permanently remove data, interfere with the use of a computer program, or cause a computer program to malfunction. Georgia Code § 16–9–93(b)(1)–(3).

The CFO, whose login and password Ware used to access the server, testified that he had not authorized Ware to disable an administrative login or alter the program, and ARSS presented substantial evidence that Ware's actions first completely shut down the company and then hampered its ability to operate for a significant length of time while hired experts attempted to diagnose and restore the application.

Ultimately, the company stopped using Ware's software and purchased the use of off-the-shelf software to conduct its operations because, the CEO testified, it could not risk being shut down again.

Ware v. American Recovery, supra. 

The Court of Appeals therefore held that, “[g]iven these facts, the trial court was authorized to conclude that Ware committed computer trespass by accessing ARSS's server without authority and interfering with the use of a computer program.” Ware v. American Recovery, supra. 

As noted above, Ware also argued, on appeal, that the trial judge erred in awarding damages to ARSS.  Ware v. American Recovery, supra.  The Court of Appeals began its analysis of this argument by noting that Georgia Code § 16-9-93(g)(1) states that

[a]ny person whose property or person is injured by reason of a violation of any provision of this article may sue therefor and recover for any damages sustained and the costs of suit. Without limiting the generality of the term, `damages’ shall include loss of profits and victim expenditure[, as well as] any additional civil remedy otherwise allowed by law.

Ware v. American Recovery, supra.  The court also noted that Georgia Code § 16-9-92(17) defines “victim expenditure” as

any expenditure reasonably and necessarily incurred by the owner to verify that a computer, computer network, computer program, or data was or was not altered, deleted, damaged, or destroyed by unauthorized use. 

Ware v. American Recovery, supra. 

Ware argued that the trial judge “erred in awarding ARSS $15,000 `for [his] services’” because “this sum was not a permissible `victim expenditure’ as defined in Georgia Code  § 16–9–92(17)”.  Ware v. American Recovery, supra.  Ware claimed it was not a legitimate victim expenditure because

ARSS received the value of Ware's services during those two years, during which Ware developed, installed, and modified the software and provided on-call technical assistance to company employees, as well as the use of the software to operate a large portion of its business.

Additionally, Ware argues, he gave ARSS the source code to the second application in response to the trial court's order, which ARSS now owns exclusively, even though the parties' contract only covered the first application. According to Ware, requiring him to pay back all of the money ARSS paid him during this time period would mean it obtained both his services and the software he developed for free.

Ware v. American Recovery, supra. 

ARSS argued, in response, that the trial judge “properly awarded it $15,000 `for [Ware's] services’ because Ware's actions deprived it of its full `use and enjoyment’ of the software it had paid Ware to develop.”  Ware v. American Recovery, supra.  The Court of Appeals, though, did not agree:

But the trial court did not award this sum to compensate for the software that Ware developed and which ARSS now possesses; it awarded it as refund of money paid to Ware for his past services, for which the company had already received the benefit of the bargain. ARSS used the applications to run its business and Ware provided technical support and maintenance services to ARSS.

The company received value in exchange for the money it paid to Ware, and its cost of compensating Ware during that time period was not an element of damages that resulted from Ware's computer trespass.

Ware v. American Recovery, supra. 

So it reversed “the award of $15,000 for Ware's services.”  Ware v. American Recovery, supra.  The Court of Appeals therefore affirmed the judgment and damage award for ARSS, except with regard to this $15,000.  Ware v. American Recovery, supra. 

No comments: