A man in Ohio was convicted under Ohio’s state anti-hacking laws and received fifteen months in jail and a $5,000 fine; his conviction was recently upheld by a court of appeals. However, his crime was not breaking into a system he was not allowed to access via a buffer overflow, or using social engineering to get the password to a root account. He simply used his work computer, which he was allowed to use, to look at porn and upload naked pictures of himself. Apparently, the court’s logic is that he was not authorized to use the computer to look at porn, and the Ohio law prohibits using a computer ” …without the consent of, or beyond the scope of the express or implied consent of, the owner of the computer….”

While I agree that the guy was a total moron for browsing porn at work, I think that the court is way out of line here. At most, he should have been fired (which he was, of course). It’s not like the law only applies to explicit conduct: under this precedent, browsing an Internet forum at work could earn you a lengthy jail sentence and a felony charge on your record.

This isn’t the first time courts have used hacking charges in cases most reasonable people wouldn’t consider hacking. Remember the case of Megan Meier, the teenager who committed suicide after a woman created a fake Myspace account and used it to tease and bully her? Lori Drew, the woman in question, was indicted on three counts of hacking. She had created Myspace profiles under a fake identity, thereby violating Myspace’s TOS, making her visits to Myspace under these accounts ‘hacking’ according to the prosecution. Fortunately, the hacking charges were ultimately downgraded to other misdemeanor charges; she was only convicted on the misdemeanor charge of gaining unauthorized access to Myspace’s servers, not the full felony hacking charges.

What we are seeing here is a new manifestation of an already-existing pattern: if state prosecutors cannot find a specific crime to indict or accuse someone of, they will stretch the law until it fits; alternately, the hacking charge might be brought up in cases like Drew’s, where there are no clear-cut legal violations, but the act itself is so shocking that we think that there just has to be a law that was violated. I don’t think we’re going to start seeing trolls arrested en masse, but I do think that the threat of felony hacking charges is going to be part of every prosecutor’s arsenal of means to get defendants to plead guilty or of finding a crime to accuse someone of in the first place.