Alaska Crime of Unauthorized Email Access & Applicable Law

On September 17, 2008, an email account used by US vice presidential candidate Sarah Palin was breached by a hacker. The contents of her emails, including private photos, were then posted online by someone called "anonymous," stating the aim was to "derail her campaign." The son of a prominent Tennessee politician, twenty-year-old college student David Kernell, has now had his apartment and computer searched by the FBI and he remains the only named suspect in the case.

The illegal and interstate nature of the Palin data crime provides an opportunity to examine the law proscribing this act in Alaska. A primary issue covered in this essay is the question of who owns a free, web-based email account, such as the Yahoo service that Governor Palin uses, because this affects the rights of the victim.

Overall, the following questions will be answered to better understand these issues: Who Owns An Email Account & its Contents? Which Alaska Laws Apply to Email Hacking? What Other Alaska Laws Apply to a Criminal Email Hack? What Punishments Apply to Such a Hacking Conviction? Can Prosecutors Satisfy Alaska's State Jurisdiction for a Non-Resident Crimes? Further, since the hack also breaks Federal statutes, and so a follow-up article will be devoted to describing the laws associated with that aspect of the law, as well.

Who Owns An Email Account & its Contents?
For a free web-based message account, such as offered by Yahoo email service, the answer of who owns the account and contents has two aspects. First, Yahoo states in its Terms of Service for its email accounts, in section 9: "Yahoo! does not claim ownership of content you submit or make available for inclusion on the service."

So the content of messages in any Yahoo email account is owned by the email account's holder. This is in keeping with international standards for intellectual property creation and rights. And the email messages themselves are data property, owned by the composer. Yet, the rule is influenced by setting. For example, in a workplace environment, the employer normally owns all emails sent over company equipment and by corporate email servers. Generally, copyright protection adheres to any original composition as soon as it is composed in any medium. But specific rights of any free email subscriber are set out in the user terms of service.

Free Internet accounts are not supported by a paid contract, or by valuable, legally binding consideration, and so do not confer exclusive ownership rights. A Yahoo email account, for instance, is owned by Yahoo, Inc. and use of the account is an "at will" agreement, revocable at any time, for a number of reasons, and without notice.

Which Alaska Laws Apply to Email Hacking?
The applicable statute would be the Alaska law of Criminal Use of Computer, found in the Alaska Criminal Code in Ch. 46: Offenses Against Property; Art. 5, Business and Commercial Offenses.

Criminal Use of Computer (AS 11.46.740. )
This states, in part, "(a) A person commits the offense of criminal use of a computer if, having no right to do so...the person knowingly accesses...a computer, computer system, computer program, computer network, or any part of a computer system or network, and, as a result of or in the course of that access, (1) obtains information concerning a person..."

The hacker used a computer to criminally enter Palin's account, and so has clearly violated this statute in more ways than one.

What Other Alaska Laws Apply to a Criminal Email Hack?
The main additional law applying would be the Alaska law on Theft, (AS 11.46.100.). This is defined as acting..."with intent to deprive another of property or to appropriate property of another to oneself or a third person, the person obtains the property of another."

Palin's personal data was stolen and posted online, where any person could see it.

A component of a prosecution for such a crime would use the section on Theft by Deception, (AS 11.46.180). This states, "(a) A person commits theft by deception if, with intent to deprive another of property...the person obtains the property of another by deception."

Clearly, the hacker deceived Palin's email account to steal her data.

Additionally, the prosecution would probably add: "Deceiving a Machine" (AS Sec 11.46.985). This says, "In a prosecution...requiring "deception" as an element, it is not a defense that the defendant deceived...a machine."

Obviously, the hacker deceived Palin's email account, which is a machine-based program.

What Punishments Apply to Such a Hacking Conviction?
The act of Criminal Use of Computer is a class C felony. The Alaska Statutes cover this at AS 2.55.125, titled Sentences of Imprisonment For Felonies. This states that Class-C convictions may be sentenced up to five years in prison.

Alaska uses a Presumptive/Non-Presumptive felony sentencing method. For serious crimes and repeat offenders, there is a presumptive stipulation for a set sentence.

For less serious crimes, such as might include computer hacking, especially for a first-time offender, the sentence could be simple probation. But sentencing could be up to 5 years imprisonment. It would depend on how the court viewed the seriousness of the crime, the convicted person's prior record, normal sentencing for similar crimes and the likelihood for re-offense, among other sentencing factors.

The crime of data theft could be included in the charges, adding to the potential sentence, depending upon how seriously the court viewed the matter, and the value imputed to the stolen material.

Can Prosecutors Satisfy Alaska's State Jurisdiction for a Non-Resident Crime?
Generally, for a state to prosecute a person who has committed a crime within the territory, the wrongdoer must be in the state. If not, the problem of jurisdictional authority will often block the prosecution.

But there is an Alaska law that could be used for getting an accused person from one state to another for a criminal charge, such as hacking an email account: "Crime commenced outside state but consummated inside." (Sec. 12.05.010.)

This says, "When the commission of a crime commenced outside the state is consummated inside the state, the defendant is liable to punishment in this state even though out of the state at the time of the commission of the crime charged, if the defendant consummated the crime through ...means proceeding directly from the defendant."

The application for this type of law, which the Model Penal Code provides an example, can be done via the "detrimental effects" test from the United States Supreme Court decision in Strassheim v. Daily. In Strassheim, the Supreme Court stated that "Acts done outside a jurisdiction, but intended to produce and producing detrimental effects within it, justify a State in punishing the cause of the harm as if he had been present at the effect, if the state should succeed in getting him within its power."

Conclusion:
Email hacking is a growing problem on the Internet, especially regarding free accounts offered by Internet based companies, such as Yahoo and Google. In reaction to the Palin hack, Internet security analysts have stressed how much weaker the security checks are for such free accounts, as opposed to secured servers, or non-Internet-based email. The Palin hack had an even more nefarious element, being an announced attempt to undermine the US democratic process by influencing an election with stolen private data.

The law in this area is still being developed for states, and undoubtedly could use more direct treatment. Given the possibility for harm in loss of privacy, and the release of various kinds of sensitive information, severe laws sanctioning these types of acts are warranted. During a recent state prosecutor's symposium, the question of cross-jurisdictional national prosecutions was called one of the thorniest issues for the 21st century. This is because of the difficulty in gathering evidence, compelling defendants and witness appearance, and the overall lack of budget support for extra-territorial prosecutions. The easiest answer for prosecution in such cases is often Federal statutes which sanction cyber-crimes.

Please see the next article on this topic.