For the small group sessions, we will do the following problem (to download in WP format, click here).

I strongly suggest that you write out your answer as you would for an actual exam question (this was a midterm problem in 1992) so you can assess how you're doing.

COMPUTER ACCESS PROBLEM

The Computer Security Division at the State Department of Family Services (DFS) just had a busy night. At 10:15 p.m., they discovered an unauthorized user obtaining information from the Department's computer system, and at 11:00 p.m., they discovered a virus implanted in the system set to "go off" at midnight.

The unauthorized user was Geraldo Herrera, an investigative journalist who was found in the Deputy Director's office printing information about the state's child abuse investigation practices. Investigation revealed that Herrera had been called by Dave Dep, the Deputy Director of DFS, who was angry about policy decisions made at the Department which ignored his recommendations for dealing with child abuse allegations. Dep provided Herrera with some information about policies in effect and why he believed them not to be in the public interest, and encouraged Herrera to do an expose on the Department. Herrera told Dep that such an expose would require data, and Dep agreed to provide it. They agreed to meet at Dep's office that night.

When Herrera arrived, Dep gave him some written materials and indicated that the rest of the information could be found in the Department's computer files. He added that he had been called to a family emergency and could not get the data for Herrera from the computer. He told Herrera that he would give him his computer access number and that Herrera could work on the computer from Dep's office to get the data. Herrera was a bit surprised that Dep would allow him access to the computer. He asked Dep "Are you sure it's OK for me to be on the computer myself?" Dep responded that, as Deputy Director, he had authority to authorize access to anyone he chose. He then gave his access number and password to Herrera, told him to get what he needed, turn off the computer and lock up before he left. Dep then left the office.

Herrera remained a bit skeptical of being in the office without Dep present, but, as an investigative reporter with the chance for a hot story, he decided not to worry about it. He turned on the computer, entered Dep's access number and password, and figured out from the materials he had already received what files to look at. He found some interesting information he thought might help in making a good story, and he began to print it. Unbeknownst to him, his use of the computer so late at night triggered an inquiry in the main computer center, and security was dispatched to check on who was in the office. Herrera was found on the computer and was arrested. As it turns out, state law specifically allows only the Director of the Department herself or the Director of State Computer Operations to authorize anyone but a state employee to have access to the computer system. Thus, Herrera was not an authorized user.

Shortly after discovering Herrera, the security people noticed what appeared to be an attempt to enter the computer system by one not having an access number. As is their policy, security began monitoring the activity and attempted to trace where the attempted access was coming from. Just as they were completing the trace, access was obtained and a computer virus was installed in the system. Upon analysis, it appeared that the virus was designed to make minor alterations in data, run bizarre graphics and prevent access to the system for a short time. They were able to disable the virus before it actually activated.

The investigation and trace by Computer Security revealed that the virus had been "planted" by Steve Soph, a local college student. It appears that Steve and several of his friends are computer afficionados who play games with each other by means of computers, modems and other sophisticated equipment. Their most recent "game" entailed the development of viruses, most of which were creative but relatively harmless, that they attempted to sneak into each other's systems. As the game progressed, each "player" attempted to develop more sophisticated security for his own system, which frequently involved making his system appear to be someone else’s. It also involved frequent change of access numbers and codes.

On the night in question, Soph developed a cute virus that made bizarre graphics, briefly blocked access and made minor alterations in data. He then attempted to "plant", or install, that virus onto the computers of his friends. In doing so, he dialed the number of his friend Rick's computer, which had recently been changed. Unfortunately, he misdialed the number, dialing instead the number for the DFS computer. When he reached the number, he saw a warning screen telling him that he had reached a restricted access state computer, and that unauthorized access would constitute a crime. He chuckled, thinking that his friend had gotten more creative in his security efforts.

Soph began efforts to break security and enter the system. He found it more difficult to do so than expected, and remarked to himself that he was surprised that Rick had been able to so significantly improve his security ability. As he worked, the security screen began to flash, and Soph again thought it was odd that Rick could do such a good job of keeping him out. After considerable effort, Soph broke the code, entered the system, installed the virus and signed off. Shortly thereafter, police arrived at his door.

The prosecutor is considering charging Herrera and Soph under the following statute:

Chapter 525 - Offenses Against Public Administration

525.300 Whoever knowingly accesses a computer system of any department or agency of this state, without authorization, shall be guilty of a Class D felony.

Discuss their potential criminal liability under both the Common Law and Model Penal Code.