Unauthorized Access of Email Accounts

Recently, the New York Post covered the arrest of a man who is accused of unauthorized access of his wife’s email accounts. In this post we take a brief look at the laws in question and discuss both potential charges and defenses in the unauthorized access of an email account.

Where an individual accesses an email account he is not authorized to access, he can be charged with both Computer Trespass and Unauthorized Use of a Computer under Penal Law §§ 156.10 and 156.05.

§ 156.10 Computer trespass.

A person is guilty of computer trespass when he or she knowingly uses, causes to be used, or accesses a computer, computer service, or computer network without authorization and:

1. he or she does so with an intent to commit or attempt to commit or further the commission of any felony; or
2. he or she thereby knowingly gains access to computer material.

Computer trespass is a class E felony.

§ 156.05 Unauthorized use of a computer.

A person is guilty of unauthorized use of a computer when he or she knowingly uses, causes to be used, or accesses a computer, computer service, or computer network without authorization.

Unauthorized use of a computer is a class A misdemeanor.

In evaluating charges above, an understanding of certain definitions in Penal Law § 156.00 is important.

§ 156.00 Offenses involving computers; definition of terms.

The following definitions are applicable to this chapter except where different meanings are expressly specified:

1. “Computer” means a device or group of devices which, by manipulation of electronic, magnetic, optical or electrochemical impulses, pursuant to a computer program, can automatically perform arithmetic, logical, storage or retrieval operations with or on computer data, and includes any connected or directly related device, equipment or facility which enables such computer to store, retrieve or communicate to or from a person, another computer or another device the results of computer operations, computer programs or computer data.
2. “Computer program” is property and means an ordered set of data representing coded instructions or statements that, when executed by computer, cause the computer to process data or direct the computer to perform one or more computer operations or both and may be in any form, including magnetic storage media, punched cards, or stored internally in the memory of the computer.
3. “Computer data” is property and means a representation of information, knowledge, facts, concepts or instructions which are being processed, or have been processed in a computer and may be in any form, including magnetic storage media, punched cards, or stored internally in the memory of the computer.
4. “Computer service” means any and all services provided by or through the facilities of any computer communication system allowing the input, output, examination, or transfer, of computer data or computer programs from one computer to another.
5. “Computer material” is property and means any computer data or computer program which:

(a) contains records of the medical history or medical treatment of an identified or readily identifiable individual or individuals. This term shall not apply to the gaining access to or duplication solely of the medical history or medical treatment records of a person by that person or by another specifically authorized by the person whose records are gained access to or duplicated; or

(b) contains records maintained by the state or any political subdivision thereof or any governmental instrumentality within the state which contains any information concerning a person, as defined in subdivision seven of section 10.00 of this chapter, which because of name, number, symbol, mark or other identifier, can be used to identify the person and which is otherwise prohibited by law from being disclosed. This term shall not apply to the gaining access to or duplication solely of records of a person by that person or by another specifically authorized by the person whose records are gained access to or duplicated; or

(c) is not and is not intended to be available to anyone other than the person or persons rightfully in possession thereof or selected persons having access thereto with his, her or their consent and which accords or may accord such rightful possessors an advantage over competitors or other persons who do not have knowledge or the benefit thereof.

6. “Computer network” means the interconnection of hardwire or wireless communication lines with a computer through remote terminals, or a complex consisting of two or more interconnected computers.
7. “Access” means to instruct, communicate with, store data in, retrieve from, or otherwise make use of any resources of a computer, physically, directly or by electronic means.
8. “Without authorization” means to use or to access a computer, computer service or computer network without the permission of the owner or lessor or someone licensed or privileged by the owner or lessor where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission. It shall also mean the access of a computer service by a person without permission where such person knew that such access was without permission or after actual notice to such person, that such access was without permission.

Proof that such person used or accessed a computer, computer service or computer network through the knowing use of a set of instructions, code or computer program that bypasses, defrauds or otherwise circumvents a security measure installed or used with the user’s authorization on the computer, computer service or computer network shall be presumptive evidence that such person used or accessed such computer, computer service or computer network without authorization.

9. “Felony” as used in this article means any felony defined in the laws of this state or any offense defined in the laws of any other jurisdiction for which a sentence to a term of imprisonment in excess of one year is authorized in this state.

In the case discussed in the article above, Evan Zimmermann was charged under both Penal Law §§ 156.10(2) and 156.05. Presumably, the charge of Computer Trespass was for accessing “computer material” which consisted of information intended only for his wife’s access under the definition of computer material in subparagraph 3. Additionally, the charge of Unauthorized use of a computer was for accessing the computer system that was hosting the email. It’s important to note that the charge of unauthorized use of a computer system can be maintained in virtually any email hosting scenario: In the case of a local system that was storing email downloaded from a POP3 server it would be unauthorized use of a computer; In the case of a web-based email system such as G-Mail, Hotmail or Yahoo! Mail or in the case of an Exchange Server or IMAP server, the charge would be based on the unauthorized access to a computer service.

As discussed in the article, the primary defense offered by Mr. Zimmermann was that the access was not unauthorized as defined in the statute. If Mr. Zimmermann’s wife provided him with the password to her email account and gave him carte blanche to access the accounts, the charges in the instant case should be dropped.

It is important to note that charges of Computer Trespass, Unauthorized use of a computer or any of the other crimes under Penal Law § 156 are not limited merely to the activities discussed above. If you or anyone you know is being investigated or has been charged with a crime under Penal Law § 156, please contact the experienced criminal defense attorneys at The Law Office of Matthew Galluzzo.