Friday, February 27, 2015

The Lottery Terminal, Computer Crime and "Authorization"

After Caryn Aline Nascimento was “convicted of one count of aggravated first-degree theft and one count of computer crime”, she appealed.  State v. Nascimento, 2015 WL 465188 (Court of Appeals of Oregon 2015).  On appeal, Nascimento raised a
single assignment of error to the trial court's denial of her motion for judgment of acquittal of the computer-crime count. Defendant argues that she did not access the lottery terminal `without authorization,’ as required by Oregon Revised Statutes 164.377(4), because, as part of her duties at the store, she was authorized by the store manager to access the machine to sell lottery tickets to paying customers. 
State v. Nascimento, supra.
The Court of Appeals began its analysis of Nascimento’s argument by explaining that in
October 2007, [she] was hired to work at the deli counter in a convenience store. The store had a touch-screen lottery terminal that produced draw-game tickets and was connected by phone line to the Oregon Lottery network. From the terminal, a clerk could print out a ticket for a selected game, and also could print ticket-sales reports.

The store manager trained [Nascimento] on the use of the lottery terminal and authorized [her] to sell lottery tickets to, and validate tickets for customers, because deli clerks would assist at the counter when the counter employee was busy or on break, even though it was not their job. The general manager testified, however, that operating the lottery terminal and cash register was not part of [Nascimento’s] job description as a deli clerk and that [she] did not have authorization to use the terminal. Store policy prohibited employees from purchasing lottery tickets or validating their own lottery tickets while on duty.

About a year after [Nascimento] was hired, the store manager fell a few months behind in reconciling daily lottery ticket sales with the store's cash receipts. In February 2009, she discovered shortfalls in cash receipts for lottery sales of Keno tickets between November 2008 and February 2009, which prompted the general manager to investigate his records and involve the police.

The investigation uncovered that large shortfalls and high-dollar wagers on Keno occurred only during [Nascimento’s] shifts. The store's surveillance video showed that, when no one was around, [she] would leave the deli counter and print out and pocket lottery tickets from the lottery terminal. One of the high-dollar winning tickets printed during [Nascimento’s] shift was redeemed by her by mail, and others were redeemed by her at a local grocery store. 
State v. Nascimento, supra.
The prosecution’s brief on appeal provides more detail on the facts, noting that
[Nascimento] worked as a clerk at the deli counter of the Tiger Mart, a gas station mini-mart. . . . Under her job description set by the store owner, deli clerks were not authorized to operate the store cash registers or the Oregon lottery machines located behind the counter in the store. . . .Unknown to the store owner, the store manager allowed deli clerks occasionally to operate the cash registers and lottery machines as backups when register clerks took breaks or when the store was unusually busy. . . . Company policy prohibited on-duty employees from purchasing or redeeming lottery tickets during their shift. . . .

About one year after [Nascimento] began working, her store manager fell significantly behind in reconciling the daily lottery sales with store cash receipts. . . . Eventually, internal auditing revealed significant shortages in receipts from Keno lottery games - a total of $16,923 between November 2008 and February 2009. . . . Before that period, the store experienced occasional shortages in lottery receipts, but they typically were for less than $20. . . . During the 11/08 to 2/09 span, daily shortages just from Keno sales ranged from $150 to $1300. . . .

The store owner reviewed employee timecards and some store video surveillance tapes and determined that the `severe shortages’ occurred only on Keno lottery receipts during shifts when [Nascimento] had been working. . . . Several of the surveillance videos showed [her] go from her work station behind the deli counter to the cash register and lottery machine (only at times when the register cashier was absent), use the lottery machine, and pocket the tickets. . . . The store owner confronted [Nascimento] with his suspicions and the surveillance videos, and she denied stealing any tickets; the store owner immediately fired her. . . .

The store owner contacted police to investigate these suspected thefts. . . . [Oregon State Police] Detective Owren, of the lottery security section, examined lottery records, store records, and store surveillance videotapes. . . . Lottery records showed an unusually large number of Keno ticket sales during [Nascimento’s] shifts - many of them maximum individual wages of $100 per ticket. . . .

Many of those tickets were printed out back-to-back within seconds of each other, indicating that the same person had printed them. . . . All 82 of the $100 Keno tickets in this 4-month period were printed during [her] shifts. . . . No pattern of large sales of Keno tickets was seen during the times [Nascimento’ was not working at the store. . . .

Detective Owren determined that some of the Keno tickets from the Tiger Mart were redeemed by mail, with the redeemer listing [Nascimento’s] name, address, and Social Security number. . . . Winning tickets paying out more than $600 must be redeemed by mail or in person from the lottery office; those with smaller prizes can be redeemed from any lottery retailer. . . . Clerks at a local Thriftway store near [her] home (and where [Nascimento’s] daughter formerly worked) reported that [she] cashed large lottery tickets at their store several times. (Tr 217, 253, 257). Based on his investigation, Detective Owren believed the loss in lottery sales to the Tiger Mart was $10,030.
Respondent’s Answering Brief, State v. Nascimento, 2012 WL 6892903.
Nascimento was, as noted above, later charged with “one count of computer crime under Oregon RevisedStatutes 164.377(4),” which say that
[a]ny person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime.
State v. Nascimento, supra.
At her trial, when the prosecution rested its case, Nascimento
moved for a judgment of acquittal on the computer-crime count, arguing that her use of the lottery terminal was not `without authorization,’ because she had `implied if not direct authorization to use the machine * * *. And clearly [her] use of the lottery machine itself was with authorization.’ The trial court denied [her] motion.
State v. Nascimento, supra.
As the Court of Appeals noted, in Nascimento’s appeal she
reprises her argument that she was `authorized,’ as that word is used Oregon Revised Statutes 164.377(4), `to use the lottery computer at [the store] because she was specifically given permission to do so by her direct supervisor, trained to do so by her supervisor, and expected to do so as part of her work duties.’

[Nascimento] argues that the statute cannot be applied to her conduct because `Oregon Revised Statutes 164.377(4) does not criminalize committing theft on a computer which a person is otherwise authorized to access’; rather, Nascimento asserts that that act is criminalized only under Oregon Revised Statutes 164.377(2)(c), a crime for which [she] was not charged. [Nascimento] argues that subsection (4) is expressly directed at unauthorized use or access of a computer, that is, the use of the device itself is unauthorized -- it is not directed at taking unauthorized actions on a computer that the person otherwise has authorization to access.
State v. Nascimento, supra (emphasis in the original).
The court went on to explain that the prosecution
does not deny that [Nascimento] had limited, implicit authorization from the store manager to access the lottery terminal to sell tickets to paying customers. However, the state responds that a jury could reasonably conclude that [her] use of the lottery machine was `without authorization’ because `she had no authorization to use the lottery computer to purchase a lottery ticket for herself during her work shift—much less to steal a lottery ticket by printing it and not paying for it.’

The state also points to the legislative history of § 164.377, which it argues demonstrates that the legislature intended to `criminalize instances where someone had authorization to use part of a computer system for some legitimate purpose but instead accessed other portions of the system.’ Citing Tape Recording, House Committee on Judiciary, Subcommittee 1, HB 2795, May 6, 1985, Tape 576 (statement of Sterling Gibson, General Telephone Co.).
State v. Nascimento, supra.
The Court of Appeals goes on the explain that the case,
as argued by [Nascimento], boils down to whether Oregon Revised Statute 164.377(4) encompasses conduct that (1) only involves a person accessing a device itself without authorization or (2) also encompasses using a device, which the person otherwise has authorization to physically access, in a manner contrary to company policy or against the employer's interests.

Under the circumstances of this case, however, we need not resolve that issue. There is evidence in the record that [Nascimento’s] store manager gave [her] limited authorization to physically access the lottery terminal to only sell tickets to, and validate tickets for, paying customers and only when the counter employee was not available to do so.

This is not the case that [Nascimento] tries to make it out to be. This is not a case where [she] had general authorization to be on a computer to carry out her duties, but then used that computer in a manner that violated company policy—such as, to use [her] example, by playing solitaire during work hours.

For [Nascimento’s] duties, the lottery terminal had but one function: to sell and validate lottery tickets. There was evidence from which the jury could conclude that she was authorized to access the physical device itself—the lottery terminal—only to serve paying customers. Thus, even taking [her] construction of the statute, there was sufficient evidence in the record from which the jury could rationally conclude that [Nascimento] accessed the lottery terminal without authorization.
State v. Nascimento, supra.

You can, if you are interested, see a photo of Nascimento in the news story you can access here, which also explains that she was sentenced to “32 months in prison for stealing from two separate local employers.”

No comments: