Perimeter
5/11/2009
02:28 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Porn Leads To Conviction Under 'Hacker Law'

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?Talk about a tale of woe: Richard Wolf, a lonely guy looking for love in all the wrong places, used his work computer to visit the Adult Friend Finder website and upload personal nudes to prospective "friends."

I've read through the commentary from the Wired article "Court Upholds Hacking Conviction of Man for Uploading Porn Pics from Work Computer," and the appellate court's upholding (PDF) of Wolf's conviction of Richard. In my opinion, what appears to have been a normal violation of acceptable usage policies that should have been handled by the HR department quickly devolved, leading to a questionable use of state laws based on the federal Computer Fraud and Abuse Act when law enforcement was involved instead.

More specifically, Wolf is being charged for "exceeding the scope of authorization to access a computer," an amendment that was targeted at employees stealing data or accessing information they shouldn't. Wolf was also convicted of soliciting a dominatrix and theft of service for doing an estimated 100 hours of personal Internet browsing during work hours. The last conviction was overturned.

Besides being what I consider a blatant misuse of computer criminal law, there was a major failure on the employer's part for not having a documented policy on Internet usage, as well as the manager who did not follow (what should be) standard practices of contacting HR for an issue involving employee conduct and possible computer misuse. While the Wired article contained an update from Wolf's appeal attorney who said policy was created regarding Web browsing, it also said the policy had not been published.

I'm sure if you check with Wolf's former employer, it will now have a published policy, but does it cover the process for handling violations? For example, does it state that the person who finds or observes a violation should go to HR to handle the issue and not involve law enforcement? The obvious exemption here is child pornography, but that is clearly not the case here.

Please don't get the wrong idea. I'm not condoning Wolf's actions. Instead, I'm criticizing how his activities were disclosed and to whom, the conviction under a "hacking" law, and the lack of an Internet usage policy by his former employer. How many times have you heard myself and others preach about policy and awareness?

This case is a example of the failure of both, so take heed and make sure your policies address these issues -- and that employees are aware of them. You don't want to be caught with your pants down, digitally or legally!

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio