Commonwealth v. CockeCommonwealth v. Cocke
This is аn appeal from an opinion and order entered by the Jefferson Circuit Court dismissing several counts of an indictment and declaring
Appellee was employed by Universal Uniforms, Inc. in 1991 as a computer programmer. He had access to all of the company’s computers, both at work and at home. Several times after appellee notified his employer that he had decided to terminate his employment, Universal’s computer system was accеssed and data, software and computer programs were altered, damaged and destroyed. Specifically, it was alleged that after his employment terminated and he had no authority to do so, appellee used the modem on his home computer to access Universal’s computer system, and then to delete certain data from the system, stop an accounting program in progress, and change a password. Shortly after these events occurred, a search warrant was issued for appellee’s residence and police seized ap-pellee’s personal computer as well as certain documents, programs, and disks.
On October 15, 1998, a five-count indictment was returned against apрellee. Three counts of the indictment charged that in January 1998 appellee committed the felony offense of first-degree unlawful access to a computer by knowingly and willfully accessing Universal’s computer, as well as related data, programs and systems, for the purpose of altering, damaging or destroying them.
The allegations are basicаlly that Defendant used the modem on his home computer to access Universal’s computer system on the three occasions in question, resulting in certain data being deleted, an accounting program in progress being stopped and a password being changed. As said alleged conduct falls under the prohibition in subsection (l)(c) ofKRS 434.845 , the vagueness analysis will focus on the language of this subsection.
Defendant maintains thatKRS 434.845(l)(c) has too broad a sweep in that a prosecutor could indict any person for most normal activities that are conducted on a comрuter. Defendant argues that this is so because the statute lacks the essential requirement that the crime be committed without authorization. Defendant gives the example that any time infоrmation is added or deleted from a computer, the person has accessed the computer with the intent to alter its data or one of its programs, and thus could be charged with violatingKRS 434.845(l)(c) . Defendant further argues that the statute’s’lack of guidelines as to its application makes possible criminal prosecutions by employers as retribution against an emplоyee.
The Commonwealth argues that whileKRS 434.850 (Unlawful Access to a Computer in the Second Degree) contains the language that the access or attempt must be “without authorization,” the legislature intended to leave said language out ofKRS 434.845 , so it would apply across the board to all persons regardless of whether or not they are authorized users. Defendant, however, is not questioning whether thе access to the computer must be “without authorization.” His argument as to “without authorization” relates to the conduct in subsection (l)(c), i.e., altering, damaging, destroying or attempting same.
If an employee with proper access to a work computer accesses it for the purpose of altering a computer program, which for example оccurs when an updated version of a program is installed, or for the purpose of destroying data stored in the computer, which occurs for example when an e-mail messаge is deleted, hasKRS 434.845(l)(c) been violated? The conduct of altering, damaging, destroying or attempting same listed in subsection (l)(c) must be considered “unauthorized” or without permission of the owner bеfore it can reasonably [be] said that a violation of the subsection has occurred. The indictment or bill of particulars does not allege that defendant’s conduct under subsection (l)(c) was unauthorized by Universal.
As stated in Commonwealth v. Foley, Ky.,798 S.W.2d 947 (1990):
“We reject the argument that a criminal statute facially unconstitutional can be ‘authoritatively construed’ by the courts to render it constitutional, if this is takеn to mean the court can introduce an additional concept not present in the statute as written by the Legislature.” Musselman v. Commonwealth, Ky.,705 S.W.2d 476 , 478 (1986).
While our decisions require construction in favor of constitutiоnality (citations omitted), an oft-quoted admonition from Hatchett v. City of Glasgow, Ky.,340 S.W.2d 248 (1960), remains a guiding principle:
“But where a statute on its face is intelligible, the courts are not at liberty to supply words or insert something or make additions which amount, аs sometimes stated, to providing a casus omissus, or cure an omission, however just or desirable it might be to supply an omitted provision.” Id. at 251.
The court finds that the language inKRS 434.845(l)(c) , without any differentiation between authorized and unauthоrized altering, etc., does not provide explicit standards for the people who must apply the statute (i.e., police officers, prosecuting attorneys, juries and judges), seе Foley,798 S.W.2d at 951 , nor does it provide sufficient notice or warning about what conduct is prohibited. An ordinary person could not determine with reasonably [sic] certainty whether his or her contemplated conduct would amount to a violation of subsection (l)(c) of the statute. “Unquestionably, criminal statutes must be sufficiently specific that an individual has fair notice of what conduct is forbidden.” Kash,967 S.W.2d at 43 . Consequently, the Court holdsKRS 434.845(l)(e) to be unconstitutionally vague.
The court denied appellee’s pending motion to dismiss the remaining two counts of
First, the Commonwealth argues that the trial court erred by agreeing with ap-pellee’s contention that the statute, as enacted, lacks an essential requirement mandating that the offense of unlawful access to a computer cannot occur unless the alteratiоn, damage or destruction at issue is committed without authorization. The Commonwealth urges that the legislature intentionally omitted a requirement that the access be without authorization, and that such a requirement in any event is not necessary. We disagree with the Commonwealth’s arguments.
True enough, as the Commonwealth notes,
Upholding the Commonwealth’s argument would result in a situation in which both authorized and unauthorized persons could be prosecuted for first-degree unlawful access as a result of the alteration, damage, or destruction of a computer and/or related components and systems, even though the alteration, damage or destruction may have been caused by an authorized person with the permission or at the request оf the computer’s owner. Indeed, as noted by the trial court, absent a requirement that the actor’s alteration, damage or destruction must occur without authorization, the statute litеrally permits the prosecution of an authorized user for an alteration as innocuous and innocent as the deletion of an e-mail message. We decline to interpret thе statute in such a manner. Clearly, the statute is void for vagueness as an authorized user cannot, from a reading of the statute, ascertain specifically what alteration, damage or destruction is prohibited.
Moreover, we are not persuaded by the Commonwealth’s argument that the statute is intended only to criminalize the act of altering, damaging, or destroying the computer after access is gained, rather than the act of accessing the computer for the purpose of obtaining information. Contrary to the Commonwealth’s argument, the language of subsection (2) of
The court’s judgment is affirmed.
All concur.