Has anyone ever turned on your computer, smart phone, or tablet and looked at your emails, text messages, pictures or financial information? Instinctively, you feel like that person did something wrong, violated your privacy, took something personal, caused you to be embarrassed. And then you wondered, "shouldn't there be a law against something like this."
Well, yes, in Florida there is a law prohibiting the unauthorized access to computers or electronic devices.
Under Section 815.06 of the Florida Statutes, a person commits an offense if he or she willfully, knowingly, and without authorization or exceeding authorization, accesses or causes to be accessed any computer, computer system, computer network, or electronic device with knowledge that such access is unauthorized or the manner of use exceeds authorization.
A person who violates this provision commits a felony of the third degree. But, if a person commits the offense for the purpose of devising or executing any scheme to defraud or obtain property, then that person commits a felony in the second degree.
If the person is convicted, then the statute allows you to bring a civil action against the person for compensatory damages.
Is this Statute Actually Used by Law Enforcement?
There are not many reported cases where someone was prosecuted under 815.06. That may change as more people resort to remote work and companies rely on digital platforms to compete. Interestingly, Graham Ivan Clark, the infamous17-year old mastermind behind the recent twitter hack is being charged under 815.06, along with various other statutes.
One case that tested the applicability of 815.06 was when charges were brought against Joel Umhoefer for accessing a Facebook account.
Joel Umhoefer developed an online relationship with M.B., who was 14 years old. Eventually, M.B. began a relationship with E.C., a person her age, and Umhoefer became jealous. Umhoefer sent M.B.'s mother an e-mail that attached sexually explicit Facebook messages between M.B. and E.C., claiming he had been monitoring M.B. and was trying to protect her.
The State filed charges against Umhoefer for unauthorized access of a computer network or electronic device in violation of 815.06(2)(a). Umhoefer was ultimately convicted and he appealed his conviction.
On appeal, Umhoefer argued that the State failed to prove that he accessed a computer network without authorization. The Second District Court of Appeal disagreed. The Court decided that there was sufficient evidence that Umhoefer accessed a computer network by accessing M.B.'s social media account.
An expert in computer forensics testified that Umhoefer accessed both M.B.'s account and the social media network. Also, there was sufficient evidence that Umhoefer's access to M.B.'s social media account was unauthorized. Although Umhoefer claimed that M.B. had given him her password, M.B. testified that by the time Umhoefer accessed her account she had changed her password and that she did not give Umhoefer the password to access her account. A detective testified that Umhoefer used an application for bypassing password protections to access M.B.'s accounts.
What is Unauthorized Access?
One of the critical questions is what does it mean to have authority to access a computer. What if you don't protect your computer with a password. Are you somehow authorizing the world to access your computer or electronic device? The answer is probably "of course not". Just because your electronic device does not have a password does not mean everyone has permission to turn on your device, and dig through emails, file folders, or pictures. A password is probably a smart move, but it's not required to show that someone did not have authority to access your electronic device.
This is further bolstered by the fact that the statute does not mention password or any form of security. It simply states "unauthorized" access. So, if someone accessed an electronic device without specific permission to do so, the statute should be triggered. But, there are good defense attorneys who might argue the opposite . . . and win!
~ Florida Cyber Lawyer, Robert Stines, Esq., CIPP
