Porn Leads To Conviction Under 'Hacker Law'

Did you know that by looking online for an "adult friend" and uploading nude pictures of yourself while at work, you could be convicted using the same law that was designed for prosecuting malicious hackers?Talk about a tale of woe: Richard Wolf, a lonely guy looking for love in all the wrong places, used his work computer to visit the Adult Friend Finder website and upload personal nudes to prospective "friends."

I've read through the commentary from the Wired article "Court Upholds Hacking Conviction of Man for Uploading Porn Pics from Work Computer," and the appellate court's upholding (PDF) of Wolf's conviction of Richard. In my opinion, what appears to have been a normal violation of acceptable usage policies that should have been handled by the HR department quickly devolved, leading to a questionable use of state laws based on the federal Computer Fraud and Abuse Act when law enforcement was involved instead.

More specifically, Wolf is being charged for "exceeding the scope of authorization to access a computer," an amendment that was targeted at employees stealing data or accessing information they shouldn't. Wolf was also convicted of soliciting a dominatrix and theft of service for doing an estimated 100 hours of personal Internet browsing during work hours. The last conviction was overturned.

Besides being what I consider a blatant misuse of computer criminal law, there was a major failure on the employer's part for not having a documented policy on Internet usage, as well as the manager who did not follow (what should be) standard practices of contacting HR for an issue involving employee conduct and possible computer misuse. While the Wired article contained an update from Wolf's appeal attorney who said policy was created regarding Web browsing, it also said the policy had not been published.

I'm sure if you check with Wolf's former employer, it will now have a published policy, but does it cover the process for handling violations? For example, does it state that the person who finds or observes a violation should go to HR to handle the issue and not involve law enforcement? The obvious exemption here is child pornography, but that is clearly not the case here.

Please don't get the wrong idea. I'm not condoning Wolf's actions. Instead, I'm criticizing how his activities were disclosed and to whom, the conviction under a "hacking" law, and the lack of an Internet usage policy by his former employer. How many times have you heard myself and others preach about policy and awareness?

This case is a example of the failure of both, so take heed and make sure your policies address these issues -- and that employees are aware of them. You don't want to be caught with your pants down, digitally or legally!

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.