Summary
describing legislative declaration regarding the need to deter "unauthorized intrusions into computer systems" as not conclusive of a "legislative intent to deter and punish only browsers and hackers"; concluding instead that the court "cannot be confident that this brief declaration of purpose was intended to summarize every act covered by the statute"
Summary of this case from Weingand v. Harland Fin. Solutions, Inc.Opinion
Docket No. B026004.
April 28, 1987. Page 546
COUNSEL
Edward P. George, Jr., for Petitioner.
No appearance for Respondent.
Ira Reiner, District Attorney, Donald J. Kaplan, Stephen Plafker and Dirk L. Hudson, Deputy District Attorneys, for Real Party in Interest.
Before Roth, P.J., Gates, J., and Fukuto, J.
Petitioner is charged with one count of violating Penal Code section 502, subdivision (c). In this petition for a writ of prohibition (Pen. Code, § 999a) he contends that under a proper interpretation of section 502, the evidence adduced at the preliminary examination does not create a reasonable suspicion he committed the offense.
At the preliminary examination, the evidence tended to establish the following facts. Petitioner (Mahru), an experienced computer programmer, was an employee, director, and 15 percent shareholder of BHI, a data-processing firm. In 1983 BHI contracted to provide onsite computerized data processing services for the Downey Schools Federal Credit Union. The credit union purchased a computer and software and resold them on credit to BHI, retaining a security interest. The computer equipment was located at the credit union, in space the credit union leased to BHI. It was operated by BHI employees, not credit union employees. In a daily routine, BHI employees started the computer and ran a share draft tape containing data received overnight. Then credit union tellers could use their terminals to enter deposits and withdrawals. BHI employees attended the computer all day and, at the end of the day, made backup tapes to be stored in the credit union's fireproof vault and ran closing routines before shutting the computer down. When the equipment needed servicing, BHI had it repaired.
The data processing service agreement between BHI and the credit union provided for termination by mutual consent or upon 182 days' written notice. Upon termination, BHI was required under the contract to deliver a magnetic tape containing all current credit union records.
On February 9, 1985, the credit union told BHI orally that it was terminating the contract because BHI's system was inadequate, and that it was replacing BHI with a different firm, ECOM. (Two days later, it signed a contract with ECOM.)
At that meeting, the credit union said it expected to complete the conversion to ECOM data processing by April 1. It asked BHI to continue doing the credit union's data processing until then and to cooperate with ECOM during the conversion. BHI responded that it had been losing money on its operations at the credit union and would propose a price for continued services during the conversion. The credit union had already paid, under the contract, for BHI's regular services through the end of February. The respective attorneys for BHI and the credit union thereafter attempted to negotiate an agreement covering the conversion period.
By Wednesday, February 20, negotiations had broken down. Hegardt, the head of BHI, instructed codefendant Walker (BHI's chief computer operator) not to bring the tellers on line after running the share draft tape. Mahru, who was a programming expert (Hegardt was not), gave Walker a written instruction to make specified changes in the names of two files in the computer program. One effect of these changes was to make doubly certain that credit union employees, none of whom were computer experts, would be unable to run the credit union's programs without assistance from either BHI personnel or another expert computer software technician. Another effect was to make it more difficult for a non-BHI expert to run these programs.
The computer could also be run using backup tapes kept in the credit union's vault. These tapes contained complete and current credit union accounting data. They also would automatically change the file names back to their original form. Walker told a credit union vice president this, but she did not know enough about computers to be able to use the information.
The file name changes were not entirely concealed; Walker left Mahru's written instruction taped to the computer display screen.
No BHI employees returned to the credit union the next day, Thursday, February 21. Consequently, the credit union was unable to resume automated operations. The record does not show whether credit union employees attempted to run the computer system themselves. At the credit union's request, ECOM sent a programmer and an operator to get the system running. By Monday, February 25, ECOM had the computer running, but it took one more day to restore access to the programs used by the credit union, apparently because of the file name changes ordered by Mahru. The cost of ECOM's services to restore computer operations is not of record. From February 21 to February 26 the credit union did its bookkeeping by hand, as it normally had during briefer periods when the computer was inoperative.
Eventually BHI filed a petition in bankruptcy, and the credit union took possession of the computer pursuant to its security interest.
Hegardt, called by the defense, testified the purpose for changing the file names was to prevent amateurs at the credit union, who might attempt to run the computer without any expert assistance, from putting the system into operation, lest they accidentally destroy or otherwise harm part of the credit union's computerized financial records.
Mahru was charged with violating Penal Code section 502, subdivision (c), which reads, in full: "Any person who maliciously accesses, alters, deletes, damages, destroys or disrupts the operation of any computer system, computer network, computer program, or data is guilty of a public offense." "Maliciously" imports "a wish to vex, annoy, or injure another person, or an intent to do a wrongful act." (Pen. Code, § 7, subd. 4.)
(1) From the evidence, the magistrate had reasonable cause to suspect petitioner accessed, altered, and disrupted the operation of the computer system and programs. Despite the defense's evidence to the contrary, the facts also support a suspicion that petitioner desired to vex and annoy the credit union, and to injure it by putting it to additional expense, in retaliation for its termination of BHI's contract.
The question presented, though, is whether the court should blindly match the literal words of sections 502 and 7 to the facts of the case. We think not. The documentary evidence established that BHI, not the credit union, owned the computer hardware and software, and the credit union had only a security interest in it. (See Cal. U. Com. Code, §§ 1201, subd. (37); 2401, subds. (1)-(3); 9202.) There was no evidence to the contrary. Section 502, subdivision (c) cannot be properly construed to make it a public offense for an employee, with his employer's approval, to operate the employer's computer in the course of the employer's business in a way that inconveniences or annoys or inflicts expense on another person.
The urge to spite others is one of the more miserable concomitants of human intelligence. Compared to human behavior as a whole, relatively few forms of spiteful conduct are actionable in tort, contract, or crime. More often they are merely upsetting and reprehensible. The Legislature could not have meant, by enacting section 502, to bring the Penal Code into the computer age by making annoying or spiteful acts criminal offenses whenever a computer is used to accomplish them. Individuals and organizations use computers for typing and other routine tasks in the conduct of their affairs, and sometimes in the course of these affairs they do vexing, annoying, and injurious things. Such acts cannot all be criminal.
Here, the credit union had informed BHI that it was terminating the contract. The parties devote substantial attention to analyzing the niceties of the contract dispute between BHI and the credit union; they seem to believe it important to establish whether BHI breached the contract by walking off the job. We cannot see what difference it makes who breached first and whether BHI was justified, as a matter of contract law, in abruptly ceasing its performance. Surely whether petitioner's conduct is to be judged criminal cannot turn on whether it constituted a breach of contract by BHI.
Petitioner relies in part on a legislative declaration of findings and purpose accompanying a 1984 amendment to section 502. This declaration speaks of an "increase in the incidence of misuse and intrusions by unauthorized individuals" and the need for "sanctions against unauthorized intrusions into computer systems." This declaration, he says, shows a legislative intent to deter and punish only browsers and hackers — outsiders who break into a computer system to obtain or alter the information contained there. We cannot be confident, however, that this brief declaration of purpose was intended to summarize every act covered by the statute. Hence we have not relied on the legislative declaration in construing subdivision (c) to exclude the acts shown here.
Finally, and in light of the foregoing discussion, petitioner should not be required to wait for an appeal to obtain judicial resolution of his legal contention. The expense and humiliation of trial and possible conviction and sentencing should not be inflicted on him in this case.
This is a proper case for issuance of a peremptory writ in the first instance. (Code Civ. Proc., § 1088; Palma v. U.S. Industrial Fasteners, Inc. (1984) 36 Cal.3d 171, 177-180 [203 Cal.Rptr. 626, 681 P.2d 893].) All parties were informed this court was considering issuing a peremptory writ in the first instance. The matter having been fully briefed, issuance of an alternative writ would add nothing to the exposition of the issues.
Let a peremptory writ of prohibition issue, directing respondent to vacate its order of February 18, 1987, denying petitioner's motion to set aside the information, and to enter a new and different order granting the motion.
A petition for a rehearing was denied May 22, 1987, and the opinion was modified to read as printed above. The petition of real party in interest for review by the Supreme Court was denied July 23, 1987.