Also known as: illegal accesses · illegally access · illegally accessed · illegally accessing · unauthorized access · unauthorised access
Written by attorneys — see sources below.
Conduct consisting of gaining entry to a protected computer system or confidential information without authorization. The act is complete upon intentional access that exceeds permitted boundaries and may trigger duties to implement safeguards against it.
Ida saved investigative notes on faculty misconduct to a shared firm folder accessible to all staff. A paralegal not assigned to the matter could open the files at any time. The storage choice exposed the client information to potential unauthorized access despite encryption and a general confidentiality policy.
Lori created a fictitious MySpace profile using a minor's name and photo. She used the profile to send messages that prompted the account holder to reveal personal details. The scheme allowed repeated entry into the protected online space without permission from the platform or the user.
In 2006 Lori Drew, a resident of O’Fallon, Missouri, joined others in registering a MySpace profile for a fictitious sixteen-year-old boy named “Josh Evans” and posted a photograph of an actual boy without his knowledge or consent. The conspirators used the profile to contact thirteen-year-old Megan Meier, a classmate of Drew’s daughter, and exchanged flirtatious messages for several days. On October 16, 2006, they sent a final message stating that “the world would be a better place without her in it.” Later that day, after learning of Megan’s suicide, Drew caused the Josh Evans account to be deleted. MySpace required prospective members to check a box affirming agreement to its Terms of Service and Privacy Policy during registration. The full text of the terms appeared only after clicking a separate “Terms” hyperlink and was not mandatory reading. The 2006 Terms of Service prohibited providing false registration information, creating fake profiles, posting photographs without consent, and using the service for harassment or tortious activity. They also reserved to MySpace the unilateral right to restrict or terminate access for any reason. All member data and communications were stored on servers located in Los Angeles County, and every message sent between members was routed through those servers. A three-count indictment charged Drew with one count of conspiracy and three counts of violating the felony provisions of the Computer Fraud and Abuse Act, 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(B)(ii), on the theory that creating and using the fake profile constituted accessing MySpace computers without authorization or in excess of authorization. At trial the jury received instructions on the lesser-included misdemeanor offense under 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(A). The jury deadlocked on the conspiracy count, acquitted Drew of the three felony CFAA counts, and convicted her of the three misdemeanor CFAA counts. Drew thereafter moved under Federal Rule of Criminal Procedure 29(c) for judgment of acquittal, contending that the only evidence of unauthorized access was the deliberate violation of MySpace’s Terms of Service. The court heard testimony from MySpace’s Vice President of Customer Care describing the registration process, the content and enforcement of the terms, and the volume of accounts created daily, then took the motion under submission.
View caseIllegal access occurs when a person intentionally enters a restricted system or file without permission. In a law firm, leaving client materials in a shared folder without access controls creates the risk of such entry by unassigned staff. The duty requires reasonable preventive measures tailored to the sensitivity of the information.
Supporting sources
A prior conviction for illegal access does not bar a later prosecution when the second offense requires proof of an additional fact and addresses a different harm. For example, a conviction for unauthorized file access does not preclude an insider trading charge that requires proof of tipping and trading activity.
Supporting sources
An acquittal bars a subsequent prosecution in another state when both cases rest on the same underlying conduct and no exception applies. The bar does not apply if the later offense was not yet completed when the first trial began.
Supporting sources
…1030(a)(2) to change the scienter requirement from “knowingly” to “intentionally,” for two reasons. First, intentional acts of unauthorized access — rather than mistaken, inadvertent, or careless ones — -are precisely what the Committee intends to proscribe. Second, the Committee is concerned that the “knowingly” standard in the…