Lesson 21 - Privacy 9:

ECPA: Material You Might Have Stored on Your Computer

We all have heard about hackers - computer experts who have used their power to gain access to systems that they were not authorized to access. Most hackers are quite harmless. But harmlessness aside, hacking is a crime. ECPA, as well as other federal statutes (the Computer Fraud and Abuse Act in particular) make it a crime. Our focus here is ECPA: Under chapter 121 of ECPA, it is a crime to gain "unauthorized access" to a stored communications on a computer system.

What that means is this: It is a crime either

to gain access without permission to a system that is used to provide electronic communication, or
to exceed the authorization you have under any permission you have been granted.

You may, for example, have permission to send and receive email on an on-line service; that does not mean you have permission to hack into the email of someone else. In either case, the hacking must be intentional. You must mean to cross a border for your crossing to be a crime.

That does not mean you have to intend to cause harm before your crossing is a crime. Under the Computer Fraud and Abuse Act (CFAA), if you intentionally exceed your authorization on a computer system and cause harm, then you are guilty under the statute whether or not you intended to cause any harm.

This was decided in the famous Robert Morris case, where Morris released a "worm" onto the internet, designed to show the world a hole in the security of the net. Morris intended his worm to gain unauthorized access to machines around the world, but he did not intend the worm to do harm. The worm, it turns out, had a different intent, and very quickly it did a large amount of harm. Morris was guilty under the CFAA, even though his intent was good. It was the worm's effect, not Morris' intent, that mattered.

Finally, ECPA also protects against unauthorized disclosure of the contents of private communications. This just follows from the protection against unauthorized access. If you don't have access, then you can't disclose what you have learned.

ECPA is just one statute that is designed to supplement constitutional protections for privacy. There are others that we have not discussed. For example, though we said in an earlier post that the constitution does not make it illegal for the government to install pen registers, Congress has regulated the use of pen registers by statute. We have tried to identify the most significant statutory protections, but our coverage is not exhaustive.

Next time: Steps you can take to protect your privacy.

authors:

Larry Lessig David Post Eugene Volokh

Back to Lesson Index