United States v. Morris (1991)
| United States v. Morris | |
|---|---|
| Court | United States Court of Appeals for the Second Circuit |
| Full case name | United States v. Robert Tappan Morris |
| Argued | December 4 1990 |
| Decided | March 7 1991 |
| Citation | 928 F.2d 504 |
| Holding | |
| The Government does not need to prove that the defendant intentionally prevented use of federal interest computers, thereby causing loss. Furthermore, Morris acted "without authorization" according to section (a)(5)(A). The decision is therefore affirmed. | |
| Court membership | |
| Judges sitting | Jon Newman, Ralph Winter, T.F. Daly |
| Case opinions | |
| Majority | Jon O. Newman |
| Laws applied | |
| 18 U.S.C. § 1030(a)(5)(A) | |
United States v. Morris was an appeal of the conviction of Robert Tappan Morris for creating and releasing the Morris worm, one of the first Internet-based worms. This case resulted in the first conviction under the Computer Fraud and Abuse Act. In the process, the dispute clarified much of the language used in the law, which had been heavily revised in a number of updates passed in the years after its initial drafting. Also clarified was the concept of "unauthorized access," which is central in the United States' computer security laws.[1] The decision was the first by a U.S. court to refer to "the Internet",[2] which it described simply as "a national computer network."[1]
Case background
Robert Tappan Morris was a Cornell student, who began work in 1988 on an early Internet worm. He had been given explicit access to a Cornell computer account upon entering the school, and used this access to develop his worm. Morris released the worm from MIT, in an attempt to disguise its source. The worm spread through four mechanisms:[3]
- Through a bug in Sendmail, an email program.
- Through a bug in Finger, a program used to find out information about other users on networked computers.
- Through a "trusted hosts" feature, which allows users from one system to use another system without a password.
- Through a password brute-force attack.
The worm was designed so that it would not spread to computers that it had already infected. To prevent computers from defending against this by pretending to have the worm, however, it would still infect an already infected computer one out of seven times. The worm was also designed so that it would be erased when an infected computer was shut down, thus preventing multiple infections from becoming problematic. Morris' underestimation of the rate of reinfection causing this safeguard to be ineffective, and "tens of thousands" of computers were rendered catatonic by repeated infections.[3][4] It was estimated that between $200 and $53,000 was required per infected facility to clean up after the worm.[3]
Morris was found guilty by the United States District Court for the Northern District of New York of violating 18 U.S.C. 1030(a)(5)(A), sentenced to three years of probation, 400 hours of community service, a fine of $10,050, and the cost of his supervision.[3]
Discussion
Legal discourse took place on three main issues: whether Morris had to have intended to cause damage, whether Morris really had gained unauthorized access, and whether the District Court had properly informed the jury of the subtleties of the case.
Intent to cause damage
As it read in 1991, 18 U.S.C. § 1030(a)(5)(A), part of the Computer Fraud and Abuse Act, covered anyone who:[3]
(5) intentionally accesses a Federal interest computer without authorization, and by means of one or more instances of such conduct alters, damages, or destroys information in any such Federal interest computer, or prevents authorized use of any such computer or information, and thereby
(A) causes loss to one or more others of a value aggregating $1,000 or more during any one-year period;
Morris argued that this did not apply to him, as the Government could not conclusively prove that he had intended to cause damage to a Federal interest computer. Federal interest computers are defined as any that participate in national or international commerce, or that are used in a federal or governmental institution.[5] The Government disagreed, stating that since a comma separated the "intentionally" phrase from the rest of the section, it did not necessarily apply. This use of punctuation to separate adverbs has precedents in Burlington No. R. Co. v. Okla. Tax Comm'n and Consumer Product Safety Comm'n v. GTE Sylvania, Inc.[6]
The court also took into consideration the language used in previous versions of the law to determine the intent of Congress. In the 1986 amendment to the law, section 1030(a)(2) had its mental state requirement changed from "knowingly" to "intentionally." This was done in order to disallow purposeful unauthorized access, not "mistaken, inadvertent, or careless" acts.[7] The court reasoned that since this "intentionally" phrase was inserted into the law in order to avoid punishing users that had accidentally accessed a computer they did not have authorization to, it applied strictly to the "accesses" clause, not the "damages" one. There is no evidence that Congress intended to make it legal to accidentally damage another computer, therefore the "intentionally" specification was not made there. Additionally, the Government suggested that many other subsections of 1030, specifically (a)(1), continue to repeat the mental state requirement before each clause, indicating that the lack of such repetition in (a)(5)(A) is indicative of the short reach of the "intentionally" adverb.[8]
To contest this claim, Morris cited a different section of the Senate Report: "[t]he new subsection 1030(a)(5) to be created by the bill is designed to penalize those who intentionally alter, damage, or destroy certain computerized data belonging to another."[9] The court however, found the Government's evidence of the changing language of the statute to be more convincing.[8]
Unauthorized access
Morris argued that, since he was given access to computers at Cornell, Harvard, and Berkeley, by releasing the worm he had simply exceeded authorized access, not gained unauthorized access. For this reason, he theorized that section (a)(3), not (a)(5)(A), properly covered him.[10] This defense is based in another section of the Senate report, which stated that the Computer Fraud and Abuse Act would be aimed at "outsiders" (people not authorized to use federal interest computers).[9] Because Morris did have access to computers of this nature, he stated that his actions were not completely unauthorized. However, the aforementioned Senate report also states that the law applies "where the offender's act of trespass is interdepartmental in nature." The court reasoned that since Morris' worm reached computers spanning U.S. government departments, including military ones,[4] 18 U.S.C. 1030 properly applied to him.
The court also pointed out that since Morris used the sendmail and finger programs in a way they were not intended to be used, his "exceeded authorization" defense was further weakened. Since Morris only used these programs because they had security holes he could exploit to gain access to computers he could not otherwise access, this use exemplifies "unauthorized access". The fact that the worm guessed passwords to break into other systems further highlights this point.[10]
Proper instruction of the jury
Morris claimed that the District Court improperly educated the jury on the specifics of his case. First, he complained that the District Court had not provided a definition of "authorization" to the jury. The Court had stated that "authorization" was of common usage and not required to be defined. The Appellate Court in this case agreed, citing precedent.[11] Morris also contended that the District Court wrongly did not instruct the jury on "exceeding authorized access" using his proposed definition. Again, the Appellate Court agreed with the District Court's decision, stating that extra definition would be potentially confusing, and that Morris's proposed instruction was incorrect. Additionally, the term "exceeding authorized access" implies that it is less serious than "unauthorized access," but even if this was the case, Morris was liable under many parts of the Computer Fraud and Abuse Act.[10]
Court's decision
The US Court of Appeals, Second Circuit affirmed the decision of the lower District Court, in which Morris was found guilty of violating 18 U.S.C. 1030(a)(5)(A), which is a felony.[1]
Case reception
In 1996 the Computer Fraud and Abuse Act was amended again to clarify the intent problems that made up the majority of U.S. v. Morris. The adverbs "knowingly" and "intentionally" were inserted in more places in the statute, in an attempt to make litigation with the law simpler in the future.[12]
This case affirmed the strength of the Computer Fraud and Abuse Act.[13] Prior to this decision, it had been assumed that the Act required intent to cause damage - which was thought to be very hard to prove.[13] The ruling here demonstrated that this was not the case.
References
- ^ a b c United States v. Morris (1991), 928 F.2d 504, 505 (2d Cir. 1991).
- ^ The Path of Internet Law: An Annotated Guide to Legal Landmarks. 2011 Duke L. & Tech. Rev. 12
- ^ a b c d e United States v. Morris (1991), 928 F.2d 504, 506 (2d Cir. 1991).
- ^ a b Elmer-Dewitt, Philip (14 Nov. 1988). "Technology: The Kid Put Us Out Of Action". Time.
- ^ Prosecuting Computer Crimes Manual Archived 2010-08-01 at the Wayback Machine. U.S. Department of Justice.
- ^ United States v. Morris (1991), 928 F.2d 504, 507 (2d Cir. 1991).
- ^ S.Rep. No. 99-432, 99th Cong., 2d Sess. 5 (1986), reprinted in 1986 U.S.Code Cong. & Admin.News 2479, 2483
- ^ a b United States v. Morris (1991), 928 F.2d 504, 508 (2d Cir. 1991).
- ^ a b Senate Report at 10, U.S.Code Cong. & Admin.News at 2488
- ^ a b c United States v. Morris (1991), 928 F.2d 504, 510 (2d Cir. 1991).
- ^ United States v. Chenault, 844 F.2d 1124, 1131 (5th Cir. 1988).
- ^ Staples, William. Encyclopedia of Privacy: A-M. Greenwood Publishing Group, 2007. Page 108. ISBN 0-313-33477-3.
- ^ a b Mello, Susan M. Administering the Antidote to Computer Viruses: A Comment on United States v. Morris 19 Rutgers Computer & Tech. L.J. 260 (1993)