Perimeter
5/11/2009
02:28 PM
John H. Sawyer
John H. Sawyer
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Porn Leads To Conviction Under 'Hacker Law'

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?Talk about a tale of woe: Richard Wolf, a lonely guy looking for love in all the wrong places, used his work computer to visit the Adult Friend Finder website and upload personal nudes to prospective "friends."

I've read through the commentary from the Wired article "Court Upholds Hacking Conviction of Man for Uploading Porn Pics from Work Computer," and the appellate court's upholding (PDF) of Wolf's conviction of Richard. In my opinion, what appears to have been a normal violation of acceptable usage policies that should have been handled by the HR department quickly devolved, leading to a questionable use of state laws based on the federal Computer Fraud and Abuse Act when law enforcement was involved instead.

More specifically, Wolf is being charged for "exceeding the scope of authorization to access a computer," an amendment that was targeted at employees stealing data or accessing information they shouldn't. Wolf was also convicted of soliciting a dominatrix and theft of service for doing an estimated 100 hours of personal Internet browsing during work hours. The last conviction was overturned.

Besides being what I consider a blatant misuse of computer criminal law, there was a major failure on the employer's part for not having a documented policy on Internet usage, as well as the manager who did not follow (what should be) standard practices of contacting HR for an issue involving employee conduct and possible computer misuse. While the Wired article contained an update from Wolf's appeal attorney who said policy was created regarding Web browsing, it also said the policy had not been published.

I'm sure if you check with Wolf's former employer, it will now have a published policy, but does it cover the process for handling violations? For example, does it state that the person who finds or observes a violation should go to HR to handle the issue and not involve law enforcement? The obvious exemption here is child pornography, but that is clearly not the case here.

Please don't get the wrong idea. I'm not condoning Wolf's actions. Instead, I'm criticizing how his activities were disclosed and to whom, the conviction under a "hacking" law, and the lack of an Internet usage policy by his former employer. How many times have you heard myself and others preach about policy and awareness?

This case is a example of the failure of both, so take heed and make sure your policies address these issues -- and that employees are aware of them. You don't want to be caught with your pants down, digitally or legally!

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.