Intellectual Property Law

Transmission of a Malicious Program under the Computer Fraud and Abuse Act and Circumstantial Evidence

By Martha L. Arias

The Computer Fraud and Abuse Act- CFAC, 18 USC § 1030, regulates fraud and related activities in connection with computers.  This United States federal statute lists several criminal conducts committed through the use of a computer.  For instance, one of the criminal conducts the CFAC sanctions is the damage caused to a computer system through violation of programs or passwords. 

The Computer Fraud and Abuse Act, 18 USC § 1030(a)(5)(A), punishes any person who knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer. This specific computer fraud crime requires ?proof that the defendant knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer.? 18 USC § 1030(a)(5)(A)(i).  This definite computer fraud conduct is mainly committed by trusted employees; that is, those entrusted with the company?s computer system or main database.  

Thus, one of the essential elements of this crime is the ?transmission? of a program or code that intentionally causes damage to a protected computer.  Proving the transmission of such program, code, or information is difficult and requires expensive computer forensic evaluations.  How does the prosecution know who transmitted the criminal program or command? Also, disparity in prosecution of this crime may arise among the U.S. court of appeals.  Under the 9^th Circuit Court of Appeals, ?to prosecute crimes involving the element of "transmission," the government must offer sufficient proof that the person charged is the same person who sent the transmission. Circumstantial evidence is sufficient to prove that the transmission has occurred.?   United States v. Shea, 493 F.3d 1110, (Ct. App. 9^th Cir. 2007).

In the Shea case, the defendant was an employee of a debt collection company, who managed the company?s database operating system. Defendant?s relation with the company deteriorated and defendant was fired.  Later, the company realized its database had mismatch information, and social securities were deleted or altered.  The company discovered, after two months of technical investigation and the payment of high expert fees, that the company?s database was corrupted by the transmission of a malicious program.  The malicious program was related to passwords associated with defendant when he was employed by this company.  Defendant denied corruption of the company?s database and claimed that the court had insufficient evidence to find him guilty.  On appeal, the court held that there was sufficient evidence to support defendant?s conviction, despite the possibility that other person might have accessed the company?s computer system.   

The court of appeals acknowledged that analysis of the ?transmission? element and its required proof was a novel issue for the court under the specific provisions of 18 USC § 1030(a) (5) (A).  Yet, the court interpreted the word transmission under this provision by assimilating this term with the wire fraud crime, which also requires the element of transmission. Thus, the court used the Wire Fraud Act interpretation of the word transmission and held that ?circumstantial evidence is sufficient to prove that the transmission has occurred.?  Therefore, the analysis concentrated on the prosecution proof that transmissions were associated to defendant?s passwords, despite the employee?s claim that the network was not secured and that other employees could have accessed those passwords.

This specific computer crime requires careful analysis of the word transmission under the specific jurisdiction a defendant is accused. Specifically, whether the weigh that given to circumstantial evidence under a particular jurisdiction.

Full post as published by IBLS Internet Law Blog on July 13, 2009 (boomark / email).