Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/11/2009
02:28 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Porn Leads To Conviction Under 'Hacker Law'

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?Talk about a tale of woe: Richard Wolf, a lonely guy looking for love in all the wrong places, used his work computer to visit the Adult Friend Finder website and upload personal nudes to prospective "friends."

I've read through the commentary from the Wired article "Court Upholds Hacking Conviction of Man for Uploading Porn Pics from Work Computer," and the appellate court's upholding (PDF) of Wolf's conviction of Richard. In my opinion, what appears to have been a normal violation of acceptable usage policies that should have been handled by the HR department quickly devolved, leading to a questionable use of state laws based on the federal Computer Fraud and Abuse Act when law enforcement was involved instead.

More specifically, Wolf is being charged for "exceeding the scope of authorization to access a computer," an amendment that was targeted at employees stealing data or accessing information they shouldn't. Wolf was also convicted of soliciting a dominatrix and theft of service for doing an estimated 100 hours of personal Internet browsing during work hours. The last conviction was overturned.

Besides being what I consider a blatant misuse of computer criminal law, there was a major failure on the employer's part for not having a documented policy on Internet usage, as well as the manager who did not follow (what should be) standard practices of contacting HR for an issue involving employee conduct and possible computer misuse. While the Wired article contained an update from Wolf's appeal attorney who said policy was created regarding Web browsing, it also said the policy had not been published.

I'm sure if you check with Wolf's former employer, it will now have a published policy, but does it cover the process for handling violations? For example, does it state that the person who finds or observes a violation should go to HR to handle the issue and not involve law enforcement? The obvious exemption here is child pornography, but that is clearly not the case here.

Please don't get the wrong idea. I'm not condoning Wolf's actions. Instead, I'm criticizing how his activities were disclosed and to whom, the conviction under a "hacking" law, and the lack of an Internet usage policy by his former employer. How many times have you heard myself and others preach about policy and awareness?

This case is a example of the failure of both, so take heed and make sure your policies address these issues -- and that employees are aware of them. You don't want to be caught with your pants down, digitally or legally!

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9667
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction.
CVE-2020-9668
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
CVE-2020-9681
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to rewrite the file of the administrator, which may lead to elevated permissions. Exploitation of this issue requires user interaction.
CVE-2021-26830
PUBLISHED: 2021-04-16
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
CVE-2021-29443
PUBLISHED: 2021-04-16
jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be throw...