STATE OF OREGON, Respondent on Review, v. CARYN ALINE NASCIMENTO, Petitioner on Review.
CC 09FE0092, CA A147290, SC S063197
Supreme Court of Oregon
July 21, 2016
360 Or. 28, 379 P.3d 484
Argued and submitted November 12, 2015, decision of Court of Appeals reversed, judgment of circuit court affirmed in part and reversed in part, and case remanded to circuit court for further proceedings July 21, 2016
Daniel C. Bennett, Deputy Public Defender, Salem, argued the cause and submitted the brief for the petitioner.
With him on the brief was Ernest G. Lannet, Chief Defender, Office of Public Defense Services.
Patrick M. Ebbett, Assistant Attorney General, Salem, argued the cause and filed the brief for the respondent. With him on the brief were Ellen F. Rosenblum, Attorney General, and Anna Joyce, Solicitor General.
J. Ashlee Albies, Creighton & Rose PC, Portland, filed the brief for amicus curiae Electronic Frontier Foundation. With her on the brief was Jamie L. Williams, Electronic Frontier Foundation, San Francisco, California.
Before Balmer, C. J., and Kistler, Walters, Landau, Baldwin, Brewer, JJ.**
BALMER, C. J.
The decision of the Court of Appeals is reversed. The judgment of the circuit court is affirmed in part and reversed in part, and the case is remanded to the circuit court for further proceedings.
** Linder, J., retired December 31, 2015, and did not participate in the decision. Nakamoto, J., did not participate in the consideration or decision of this case.
BALMER, C. J.
The narrow but potentially far-reaching issue in this case is the scope of
Defendant was convicted of theft and computer crime for using a computer terminal at work, which was linked to the Oregon State Lottery, to print and steal lottery tickets. She appealed the conviction for computer crime, arguing that the trial court erred in denying her motion for judgment of acquittal on that count because, she argued, she was “authorized” to use the computer terminal and therefore had not violated
Defendant was employed as a deli clerk at Tiger Mart, a convenience store in Madras, beginning in 2007. In February 2009, Masood, the vice-president of the store‘s parent company, investigated issues relating to the sale of lottery tickets at the Tiger Mart. He found that, between November 2008 and February 2009, there were unexplained
cash shortages well beyond the amount expected in the operation of such a store, sometimes exceeding $1,000 a day. He soon determined that the store also showed a surprisingly large number of sales of Keno lottery tickets, including sales of an unusual number of high-priced tickets. The total shortages between November 2008 and February 2009 exceeded $16,000. After examining cash register receipts and lottery reports, he concluded that the shortages related to the sale of Keno tickets and that they occurred on days when defendant was working. Masood also reviewed video recordings and observed occasions when defendant would move from the deli area to the cash register area and print out and pocket Keno tickets from the lottery terminal. Masood suspected that defendant was printing and taking but not paying for those Keno tickets. Although Masood did not work in the store himself and did not train defendant, he testified at one point that defendant was not authorized to use the lottery terminal to dispense Keno tickets, and at another point, in response to a question about whether defendant was supposed to be operating the lottery terminal, stated “Not as far as I know.” He further indicated that, to the best of his knowledge, defendant had not been trained to operate the lottery terminal that dispensed Keno tickets.
Donelly, the manager of the Tiger Mart and defendant‘s direct supervisor, testified that she had trained defendant and other deli employees to use the cash register and the lottery terminal, and that they routinely were required to use them when other employees were busy or taking breaks. She testified that she had authorized defendant to use the lottery terminal and the cash register. She indicated that that practice had been in place before the current owners took over the convenience store and that she did not recall there being any policy prohibiting deli clerks from operating the cash register or the lottery terminal. Another deli employee confirmed Donelly‘s testimony about deli workers’ regular use of the cash register and lottery terminal. Both Masood and Donelly, as well as the other employee, testified that the store had a policy that employees were not to purchase or redeem lottery tickets on their own behalf while on duty.
The state presented evidence about the lottery terminal itself and how defendant was trained to use it. The lottery terminal is a touchscreen machine that is networked to the Oregon State Lottery. The terminal has only three functions: It can print lottery tickets, it can scan lottery tickets to validate whether they are winning tickets, and it can produce reports. It is not networked with the store‘s cash register. A manager needed to sign in once a day to activate the terminal, but the terminal did not otherwise require any sort of password to operate. Tiger Mart employees received training that, when they sold lottery tickets, they were to collect payment from customers and put the payment in the cash register before using the touchscreen on the lottery terminal to dispense the ticket or tickets.
The state also presented video evidence that, when no one else was around, defendant
Defendant was charged with one count of aggravated first-degree theft, as well as computer crime. The computer crime statute,
“(2) Any person commits computer crime who knowingly accesses, attempts to access or uses, or attempts to use, any computer, computer system, computer network or any part thereof for the purpose of:
“(a) Devising or executing any scheme or artifice to defraud;
“(b) Obtaining money, property or services by means of false or fraudulent pretenses, representations or promises; or
“(c) Committing theft, including, but not limited to, theft of proprietary information or theft of an intimate image.
“*****
“(4) Any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime.”
It is of particular significance in this case how the computer crime count was charged. The caption of the indictment cited
“The defendant, on or between November 11, 2008 and February 6, 2009, in Jefferson County, Oregon, did knowingly and without authorization use and access a computer system operated by Tiger Mart Convenience Store, an entity, under contract to and at the direction of the Oregon State Lottery Commission; contrary to statute and against the peace and dignity of the State of Oregon.”
(Emphasis added.)
After the state‘s evidence was presented, defendant moved for a judgment of acquittal, arguing that the state had not presented sufficient evidence to create a jury question as to whether defendant used the lottery terminal “without authorization,” noting the evidence that deli clerks were, in fact, authorized to use the lottery terminal. The prosecutor did not dispute that point, but argued instead that
“the access alone is not what makes this criminal. It‘s that the access is for the purpose of under three different categories, devising or executing any scheme or artifice to defraud obtaining money, property, or services through fraudulent pretenses or committing theft—
“*****
“That‘s under—from the statute itself,
ORS 164.377 , and under State v. Schwartz, 173 Or App 301 [21 P3d 1128 (2001) (discussing subsections (2) and (3) of the statute)].“*****
“So therefore, Your Honor, the fact that she did have some apparent authority to operate the machine to sell tickets and to conduct business of Tiger Mart [does not affect] the fact that she then also used the terminal to print out tickets for which she did not pay. That is the unauthorized the knowing unauthorized use of the terminal. Such that she committed theft while she was doing that and therefore the State has met its elements on that crime.”
The trial court denied defendant‘s motion for judgment of acquittal without explanation. In her closing argument, the prosecutor described the case as involving “a simple issue of did someone steal lottery tickets
“[Defendant] went onto the computer, the computer was part of the Oregon State Lottery System, she printed out those tickets, and she did so with the purpose of stealing those tickets. So the theft of the tickets counts as the purpose that is that she is authorized [sic], that she was accessing a computer. We‘re not talking about the time when she was acting as an employee and actually selling tickets to customers who were paying for them. That‘s not the kind of behavior we‘re talking about. We‘re talking about her printing those tickets out for herself so that she could [indiscernible].”
In instructing the jury on computer crime, the trial court followed the wording in the indictment. That is, it instructed that the jury needed to find that defendant used or accessed a computer “without authorization.”
As noted, the jury found defendant guilty of computer crime, as well as aggravated first-degree theft, and defendant appealed the computer crime conviction, arguing that the trial court erred in denying her motion for judgment of acquittal. In particular, she argued that
does not criminalize theft by means of a computer—rather, subsection (2) of the statute criminalizes that conduct. Defendant contended that subsection (4) relates only to using or accessing a computer without authorization, and the evidence in this case, while it could have supported a conviction under subsection (2), did not support a conviction under subsection (4). The Court of Appeals rejected that argument, concluding that “[t]here was evidence from which the jury could conclude that [defendant] was authorized to access the physical device itself—the lottery terminal—only to serve paying customers.” State v. Nascimento, 268 Or App 718, 722, 343 P3d 654 (2015). It therefore concluded that the record was sufficient for the jury to have found that defendant used the computer “without authorization.” Id.
In this court, defendant maintains that she did not use the lottery terminal “without authorization.” She again acknowledges that the evidence could have been sufficient to establish a violation of subsection (2) of
The state makes two arguments in response. First, it asserts that defendant used the lottery terminal for a purpose not permitted by her employer. Specifically, the state introduced evidence that Tiger Mart‘s policy was that deli clerks like defendant were authorized to use the terminal only when a customer wanted to buy or validate a ticket and the cashier was unavailable, and that defendant‘s use of the terminal to print tickets for herself therefore was “without
authorization,” as that term is used in
We first address—and reject—the state‘s proffered alternative basis for affirmance. As the narrative above demonstrates, the prosecutor apparently was confused about how the computer crime offense had been charged in the indictment. That is, her argument in opposition to defendant‘s motion for judgment of acquittal focused on whether the state had provided adequate evidence to satisfy the requirements of
expressly prohibited by
We agree with the state‘s general proposition that, at least in the abstract, a prosecutor in that circumstance could have argued that Masood‘s equivocal evidence about whether or not defendant was authorized to use the lottery terminal at all was sufficient to defeat a motion for judgment of acquittal on that point, given that the court was required to view all of the evidence in the light most favorable to the state, and not to weigh the evidence. But the prosecutor did not make that argument, and in fact conceded the point.2 As noted, one of the criteria for our discretionary review of alternative bases for affirmance is whether, had an argument been made in the trial court, the record could have developed in a materially different way. Outdoor Media, 331 Or at 659-60. In this case, we have no doubt that, had the prosecutor made the argument that the state now makes, the record might well have developed differently.
The evidence on which the state now relies for affirmance on that ground was equivocal and weak, at best. Had the state relied on it in opposition to a motion for judgment of acquittal rather than disavowing it as the basis for its legal argument, defendant easily could have countered that evidence in her own case-in-chief, as there appears to have been no shortage of witnesses who would have confirmed that defendant was, in fact, trained by her supervisor to use the lottery terminal to print lottery tickets and was expected to do so as part of her job. See, e.g., State v. Dickerson, 356 Or 822, 826-27, 345 P3d 477 (2015) (rejecting state‘s alternative basis for affirmance of denial of motion for judgment of acquittal on different factual theory than pursued by state
at trial, in part because record might have developed differently had state raised theory below). As we observed in State v. Burgess, 352 Or 499, 504, 287 P3d 1093 (2012), based on the circumstances of that case, “it would be fundamentally unfair to defendant to sustain defendant‘s conviction on a separate factual and legal theory that has been proffered by the state for the first time on appeal.” That is even more so in a circumstance such as this, where the state conceded in the trial
We thus return to the issue that was litigated in the lower courts: Whether defendant‘s use of the lottery terminal to print Keno tickets for herself—tickets that she did not pay for—constituted “computer crime” under
“Any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime.”3
Although
computer system or printer.”
As to the meaning of “without authorization,” the state proposes an extremely broad definition, arguing that any time a person uses or accesses a computer for a purpose not permitted by the computer‘s owner, the person does so “without authorization” and commits computer crime. For that reason, the state contends, even though defendant was authorized to physically use the terminal to print Keno tickets, because she violated her employer‘s policy by using it to print Keno tickets for her own use (and also by not paying for them), her use was “without authorization,” in violation of
Defendant, on the other hand, notes that the 1985 Legislative Assembly that enacted subsection (4) was concerned with remote “hacking” of computers by persons with no right to access those computers. Defendant suggests that the statute therefore was not meant to reach conduct such as hers, which she characterizes as “authorized use for an impermissible purpose.” Rather, she argues, when a person is permitted to use an employer‘s computer system, and when the person uses the computer as permitted—here, to print lottery tickets—the person‘s use is “authorized,” even if the use is for an impermissible purpose. She asserts that
Amicus curiae Electronic Frontier Foundation contends that the Court of Appeals and the state‘s reading of the statute—which arguably criminalizes any computer use in violation of an employer‘s personnel or computer use policies—is unworkably broad because it gives private
entities the power to decide what conduct in the workplace is criminal and what is not. Amicus argues that “without authorization” should be construed narrowly, as federal courts have construed somewhat similar provisions in the Computer Fraud and Abuse Act,
As noted, the parties agree that defendant “accessed” and “used” a “computer network.” The question is whether she did so “without authorization.” The meanings of “authorization” and “authorize” are not obscure. “Authorization” is simply “the state of being authorized.” Webster‘s Third New Int‘l Dictionary 146 (unabridged ed 2002). “Authorize,” in turn, means “to endorse, empower, justify, or permit by or as if by some recognized or proper authority.” Id. We agree with defendant that her employer “empowered” and “permitted” her to use the lottery terminal. The actual use that she made of the lottery terminal—to print lottery tickets—was a use “authorized” by her employer.
The state does not disagree that defendant was authorized to use the lottery terminal to print lottery tickets, but contends that her use of the terminal became “unauthorized” when she used it to print tickets for herself without paying for them. That use was “unauthorized” within the meaning of
not paying for them) violated her employer‘s personnel or computer use policies.
It is difficult to square the state‘s position with the text of
As noted, “access” is defined in the computer crime statute as “retriev[ing] data” or “mak[ing] use of any resource on a computer.”
Viewed in that light, the text supports defendant‘s assertion that her use of the lottery terminal to print Keno tickets—as she was trained and permitted by her employer to do—was “authorized” use. The fact that she printed the tickets for her own use and did not pay for them may have violated company policies and other parts of the computer crime statute (in addition to the theft statute), but her use was not “without authorization” as that term is used in
The legislative history of
who had obtained access to business computers that lacked security systems and had altered business documents, as well as individuals who had made their way remotely into telephone company computers and obtained and then publicly posted confidential telephone billing codes. Id.
In response to a legislator‘s concern that the amendment might restrict computer hobbyists who used telephone modems to connect with other computers, Marion County District Attorney Dale Penn emphasized that the law would apply to only third parties who had no authority to access the remote computer:
“There we get into the definition of ‘access.’ I think *** if you call up to a computer system and you‘re not authorized you‘re probably not even going to be able to get the menu up. If you‘re calling to a bulletin board you‘re going to see the menu. And that‘s not what we‘re addressing here. We‘re addressing a computer system in which you‘re not authorized to dial. You won‘t know the codes.”
Id. (Emphasis added.) Testimony before the Senate Judiciary Committee was to the same effect. General Telephone‘s representative, Overstreet, again testified in support of the computer crime provisions, which he described as addressing “computer hackers—persons who use computers to defraud.” Tape Recording, Senate Judiciary Committee, June 7, 1985, Tape 180, Side A; Minutes, Senate Judiciary Committee, HB 2795, June 7, 1985, 18.
The legislative history thus shows that the computer crime provisions were intended to address the unauthorized access of a computer by “hackers” or by others who had no authority whatsoever to use the computer—who, in the context of the technology of the time, were “not authorized to dial.” There is no indication at all that the bill would reach the conduct of a person, such as defendant here, who was authorized by a computer owner to use the computer, but did so in violation of the owner‘s policy or for a purpose not permitted by the owner.
legislature adopted “is not so limited,” and that it prohibits all “access” that is “without authorization.” As both parties recognize, “[t]he legislature may and often does choose broader language that applies to a wider range of circumstances than the precise problem that triggered legislative attention.” South Beach Marina, Inc. v. Dept. of Rev., 301 Or 524, 531, 724 P2d 788 (1986). But that important teaching does not mean that we necessarily interpret statutes in the broadest possible sense that the text might permit. Indeed, as we recently noted in Walker, 356 Or at 17, “[i]f, in fact, the legislative history reveals that the legislature had a narrower understanding of the term in mind, and if that narrower meaning is consistent with the text, even if not compelled by it, the legislative history would be a basis on which we appropriately may construe the text more narrowly.”
Here, the legislative history supports defendant‘s view that the legislature intended
In summary, we conclude that the phrase “without authorization” applies to the “use” or “access” of the computer. A person‘s “authorization” to access or use a computer may be restricted by a password or other authentication or security procedures—but defendant‘s employer here did not so restrict her use. Nor was defendant‘s use of the computer—to print lottery tickets—inconsistent with the scope of her authorized use. We disagree with the state‘s position that an employee‘s authorized use of an employer‘s computer becomes “without authorization” for purposes of
computer use policies.5 Such impermissible use, of course, may lead to personnel actions or other private discipline or to possible proceedings under other statutes, but it does not violate
Applying that interpretation of
The decision of the Court of Appeals is reversed. The judgment of the circuit court is