Perimeter
5/11/2009
02:28 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Porn Leads To Conviction Under 'Hacker Law'

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?Talk about a tale of woe: Richard Wolf, a lonely guy looking for love in all the wrong places, used his work computer to visit the Adult Friend Finder website and upload personal nudes to prospective "friends."

I've read through the commentary from the Wired article "Court Upholds Hacking Conviction of Man for Uploading Porn Pics from Work Computer," and the appellate court's upholding (PDF) of Wolf's conviction of Richard. In my opinion, what appears to have been a normal violation of acceptable usage policies that should have been handled by the HR department quickly devolved, leading to a questionable use of state laws based on the federal Computer Fraud and Abuse Act when law enforcement was involved instead.

More specifically, Wolf is being charged for "exceeding the scope of authorization to access a computer," an amendment that was targeted at employees stealing data or accessing information they shouldn't. Wolf was also convicted of soliciting a dominatrix and theft of service for doing an estimated 100 hours of personal Internet browsing during work hours. The last conviction was overturned.

Besides being what I consider a blatant misuse of computer criminal law, there was a major failure on the employer's part for not having a documented policy on Internet usage, as well as the manager who did not follow (what should be) standard practices of contacting HR for an issue involving employee conduct and possible computer misuse. While the Wired article contained an update from Wolf's appeal attorney who said policy was created regarding Web browsing, it also said the policy had not been published.

I'm sure if you check with Wolf's former employer, it will now have a published policy, but does it cover the process for handling violations? For example, does it state that the person who finds or observes a violation should go to HR to handle the issue and not involve law enforcement? The obvious exemption here is child pornography, but that is clearly not the case here.

Please don't get the wrong idea. I'm not condoning Wolf's actions. Instead, I'm criticizing how his activities were disclosed and to whom, the conviction under a "hacking" law, and the lack of an Internet usage policy by his former employer. How many times have you heard myself and others preach about policy and awareness?

This case is a example of the failure of both, so take heed and make sure your policies address these issues -- and that employees are aware of them. You don't want to be caught with your pants down, digitally or legally!

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3586
Published: 2015-04-21
The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2014-5361
Published: 2015-04-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx.

CVE-2014-5370
Published: 2015-04-21
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDragon before 7.1.1.18527 allows remote attackers to read or possibly delete arbitrary files via a .. (dot dot) in the QUERY_STRING to cfchart.cfchart.

CVE-2014-8111
Published: 2015-04-21
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.

CVE-2014-8125
Published: 2015-04-21
XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.