Summary
In State v. Corcoran, 186 Wis.2d 616, 522 N.W.2d 226 (Ct.App.), review denied, ___ Wis.2d ___, 527 N.W.2d 335 (1994), the Wisconsin Court of Appeals upheld a conviction under the Wisconsin Computer Crimes Act of a computer software programmer who destroyed data stored on the computer of his former employer by inserting "booby traps" into programs he had written for the employer.
Summary of this case from ProCd, Inc. v. ZeidenbergOpinion
No. 93-2671-CR.
Submitted on briefs May 31, 1994. —
Decided August 3, 1994.
APPEAL from a judgment of the circuit court for Waukesha County: MARIANNE E. BECKER, Judge. Affirmed.
On behalf of the defendant-appellant, there were pro se briefs filed by Brian P. Corcoran of Milwaukee.
On behalf of the plaintiff-respondent, the cause was submitted on the brief of James E. Doyle, attorney general and Mary V. Bowman, assistant attorney general.
Before Anderson, P.J., Brown and Snyder, JJ.
Brian P. Corcoran appeals from a conviction for the felony destruction of computer data belonging to Mueller Consulting Services (MCS) in violation of § 943.70(2)(a)2 and (b)3, STATS. We affirm the judgment of conviction because we conclude that the Federal Copyright Law does not preempt enforcement of the Wisconsin computer crimes act and the statute is not constitutionally defective.
FACTS
In the spring of 1987, Corcoran was hired by MCS to write specialized computer software application programs. Corcoran had difficulties in refining the specialized application programs so that they would operate without generating numerous errors. During the summer he became concerned that he might not be paid for his work and surreptitiously inserted two "booby traps" or "Trojan horses" into separate programs that he had written for MCS.
The "booby traps" inserted by Corcoran were inaccurately called "Trojan horses" throughout the trial and in the briefs filed on appeal. A "Trojan horse" is "[a] desirable program which performs some useful function, such as logic, but which contains a parasite or viral infection within its login which is undetectable upon casual review." Anne W. Branscomb, Rogue Computer Programs and Computer Rogues: Tailoring the Punishment to Fit the Crime, 16 RUTGERS COMPUTER TECH. L.J. 1, 4 n. 15 (1990). There is no evidence that Corcoran's "Trojan horses" had any beneficial purpose; on the contrary, the only purpose of these programs was to destroy Corcoran's work product stored on MCS's computer.
Corcoran installed the first "Trojan horse" in six programs. This "Trojan horse" checked the computer's internal clock and when the time on the clock passed 12:00:00 a.m. on August 11, 1987, a command was automatically issued to delete each of the programs from the computer's memory. The files were not physically erased from the hard drive — permanent memory storage — of MCS's computer. The "delete" command had the disk operating system (DOS) perform two functions. First, DOS erased the names of the six files from the directory structure in the file allocation table (FAT). Second, DOS altered the FAT to indicate that the space on the hard drive containing the data of the six files was available for the storage of new data; the entry of new data into the computer could have overwritten the data in these files after the "delete" command was executed. Because no new data overwrote these six files, MCS was able to completely recover all of the files.
This "Trojan horse" is more properly called a "time bomb" or "logic bomb." This destructive program is "intended to launch its attack at a preset time," in this case, at 12:00:00 a.m., August 11, 1987. See Branscomb, supra note 1, at 5 n. 16.
A complete technical explanation of how an IBM compatible personal computer and its disk operating system manages application software and data can be found in JOHN SOCHA, ET AL., PC WORLD DOS 6 HANDBOOK 154, 257-61, 268-70 (2d ed. 1993) and RON WHITE, HOW COMPUTERS WORK 52-61, 67-69 (1993). The fundamentals of disk and file management are the same and are not dependent upon the hardware or the brand or version of the disk operating system installed on the personal computer.
Corcoran's second "Trojan horse" was inserted in a file called PONQTR1.WK1 and was far more destructive. Mary Mueller activated this "Trojan horse" when she followed Corcoran's written instructions on how to find a log of his project hours and in so doing inadvertently unleashed a "delete" command. The files deleted included PONQTR2.WK1, that contained 400 store reviews for one customer, and PAYROLL1.WK1. These files could not be recovered because sometime between the activation of Corcoran's "DestroyAll" program and MCS's attempt to recover the files, additional data was entered on the computer that overwrote the disk space previously assigned to PONQTR2.WK1 and PAYROLL1.WK1. With the assistance of temporary help, MCS was able to reenter all of the data from the 400 store reviews.
This destructive program does not have an identifying name such as "time bomb," "logic bomb" or "Trojan horse." Corcoran's naming the program "DestroyAll" is apropos.
Mueller testified that MCS incurred expenses of almost $4000 to recover from Corcoran's attempts to write useable programs and activation of the two "Trojan horses." In addition, MCS lost one major customer because it was not able to deliver timely reports and a second customer refused to expand MCS's contract.
PROCEDURAL HISTORY
In 1989, the State filed a criminal complaint alleging that Corcoran did willfully, knowingly and without authorization, destroy computer data and cause damage in an amount greater that $2500 in violation of § 943.70(2)(a)2 and (b)3, STATS. After a preliminary examination, Corcoran filed a motion to dismiss the information, setting forth seven challenges to Wisconsin's computer crimes statute, § 943.70, STATS. He alleged that (1) the federal Copyrights Act, 17 U.S.C. § 102, 103, 106 and 301 preempts the State's computer crimes statute; (2) the statute deprived him of his common law and constitutional right to use and dispose of his property, including the right of repossession; (3) the statute is vague; (4) the statute places a prohibitive penalty on his exercise of an exclusive right of distribution of his work product guaranteed by 17 U.S.C. § 106; (5) the statute impairs his right to contract; (6) the statute violates the constitutional prohibition against involuntary servitude; and (7) the statute violates the equal protection provisions of the United States Constitution.
The trial court denied Corcoran's motion to dismiss. The court held that preemption did not apply to this action, reasoning that the "defense of federal copyright protection is a dependent defense to the State's claim of unauthorized destruction of computer data." Also rejected was Corcoran's theory that the statute unconstitutionally interfered with his exclusive rights to the computer program he wrote. The trial court pointed out that Corcoran was charged with the destruction of data that was owned by MCS and not with destruction of the computer program he wrote. The other issues raised by Corcoran were summarily disposed of by holding that the statute was not vague; the statute did not interfere with any rights granted by the federal Copyrights Act; the statute did not require involuntary servitude; and because the statute applies to any person who destroys computer data not just computer programmers, it does not violate equal protection guarantees.
An amended information was filed in November of 1992 alleging two counts of criminal conduct. Count one alleges that on August 12, 1987, Corcoran did "willfully, knowingly and without authorization, destroy data, and did cause damage in an amount greater than $2500, contrary to § 943.70(2)(a)2 and (b)3, Wisconsin Statutes." Count two alleges that between August 1 and August 10, 1987, Corcoran did "willfully, knowingly and without authorization, modify computer program, and did cause damage in an amount greater than $2500, contrary to § 943.70(2)(a)1 and (b)3, Wisconsin Statutes." After a jury trial, Corcoran was found guilty of count one and not guilty of count two.
The State was required to file a second amended information to clarify the dates of the alleged criminal behavior in order to avoid Corcoran's argument that the amended information was multiplicitous.
Subdivisions (a)2 and (b)3 of § 943.70(2), STATS., provide in part: (2) OFFENSES AGAINST COMPUTER DATA AND PROGRAMS. (a) Whoever wilfully, knowingly and without authorization does any of the following may be penalized as provided in par. (b): . . . . 2. Destroys data, computer programs or supporting documentation. . . . . (b) Whoever violates this subsection is guilty of: . . . . 3. A Class D felony if the damage is greater than $2,500 or if it causes an interruption or impairment of governmental operations or public communication, of transportation or of a supply of water, gas or other public service.
Subdivisions (a)1 and (b)3 of § 943.70(2), STATS., provide in part: (2) OFFENSES AGAINST COMPUTER DATA AND PROGRAMS. (a) Whoever wilfully, knowingly and without authorization does any of the following may be penalized as provided in par. (b): 1. Modifies data, computer programs or supporting documentation. . . . . (b) Whoever violates this subsection is guilty of: . . . . 3. A Class D felony if the damage is greater than $2,500 or if it causes an interruption or impairment of governmental operations or public communication, of transportation or of a supply of water, gas or other public service.
DECISION
On appeal, Corcoran's issues can be grouped into two general topics. First, he argues that he is the author of the specialized programs and holds a copyright on both the programs and the data collected by MCS that is inserted into the programs; and therefore, the federal Copyrights Act, 17 U.S.C. preempts enforcement of the Wisconsin computer crimes act (WCCA). Second, he argues that the WCCA is unconstitutional because it impairs the obligation of contract, imposes involuntary servitude, suffers from vagueness, or suffers from overbreadth. We find that all of Corcoran's issues are without substantial merit and affirm his conviction.
It is important to point out what issues Corcoran does not raise in this pro se appeal. He does not challenge the sufficiency of the evidence proving intent, lack of authorization, destruction of computer data, causation, or the $2500 minimum for use of the felony penalty enhancer, § 943.70(2)(b)3, STATS.
I. COPYRIGHT ISSUES
Corcoran was found guilty of count one of the information, destroying computer data, and was acquitted of count two, modifying computer programs. The WCCA distinguishes computer programs and computer data. For these reasons we will restrict our discussion to whether or not the federal Copyrights Act preempts the prosecution of Corcoran for destroying computer data.
The WCCA defines both "computer program" and "computer data." "`Computer program' means an ordered set of instructions or statements that, when executed by a computer, causes the computer to process data." Section 943.70(1)(c), STATS. "Computer data" means: a representation of information, knowledge, facts, concepts or instructions that has been prepared or is being prepared in a formalized manner and has been processed, is being processed or is intended to be processed in a computer system or computer network. Data may be in any form including computer printouts, magnetic storage media, punched cards and as stored in the memory of the computer. Data are property. Section 943.70(1)(f).
Corcoran claims a copyright in the MCS data that was incorporated into and arranged by the specialized programs that he developed for MCS. He contends that he held a copyright to the data that was destroyed because the programs he wrote (1) reduced the "raw data" into electronic signals capable of being stored and retrieved in a machine readable format; (2) broke the data down into records and fields; (3) labeled the fields and records to facilitate the recovery and use of the data; and (4) positioned the data in memory relative to other files.
The State concedes that Corcoran holds a copyright for the specialized programs he wrote for MCS that made use of the macro command language of "Lotus 1-2-3."
The United States Supreme Court has held, "A factual compilation is eligible for copyright if it features an original selection or arrangement of facts, but the copyright is limited to the particular selection or arrangement. In no event may copyright extend to the facts themselves." Feist Publications, Inc. v. Rural Tel. Serv. Co. Inc., 499 U.S. 340, 350-51 (1991). The Supreme Court explained, "as [17 U.S.C.] § 103 makes clear, copyright is not a tool by which a compilation author may keep others from using the facts or data he or she has collected." Id. at 359. "[C]opyright protects only the elements that owe their origin to the compiler — the selection, coordination, and arrangement of facts." Id. Feist's explanation of the extent of copyright protection provided for the compilation of data leads us to conclude that any protection Corcoran had under the Federal Copyright Law did not include copyright protection of the data. Any copyright Corcoran might have had was limited to the unique framework he selected to present the data; he did not have a copyright to the data collected, selected and inserted into the framework by MCS.
If we were to accept Corcoran's argument, software developers who hold the copyright on popular application programs would also have a copyright on the data entered by every user of their programs. Corcoran's theory is preposterous, outrageous and repugnant to the basic principles of copyright law. It is preposterous because it would strip the author of the protection afforded originality. It is outrageous because it would repress original thought and ideas and discourage intellectual labor. It is repugnant to the principles of copyright law because the author's original thoughts would become the property of another, who did no more than write the source code that directed a software program to manipulate the user's data. See id. at 345-47. (Originality is the sine qua non of copyright, it is a constitutional requirement. It is a bedrock principle of constitutional copyright law that before a copyright can be granted, there be a dash of intellectual labor.)
We hold that Corcoran did not have a copyright to the data on 400 restaurant reviews collected by MCS and included in the file labelled PONQTR2.WK1. Likewise, he did not hold a copyright to the data on reimbursement of restaurant reviewers employed by MCS and included in the file labeled PAYROLL1.WK1. At the most, he held a copyright to the form of presentation of the data in both files. Therefore, we need not decide if the federal Copyrights Act preempts the enforcement of the WCCA; Corcoran was properly convicted of destroying facts that cannot be protected by copyright.
If we were to address the question of whether the federal Copyrights Act preempts enforcement of the WCCA when a computer programmer has allegedly destroyed a computer program, we would adopt the reasoning of those federal courts that have held that 17 U.S.C. § 301(a) only preempts those state law rights that "may be abridged by an act which, in and of itself, would infringe one of the exclusive rights" provided by federal copyright law. Rosciszewski v. Arete Assocs., Inc., 1 F.3d 225, 229 (4th Cir. 1993) (quoted source omitted); Computer Assocs. Int'l, Inc. v. Altai, Inc., 982 F.2d 693, 716 (2d Cir. 1992). The analysis applied by the federal courts requires a determination if the state-created cause of action contains an "extra element" in addition to the acts of reproduction or distribution. Computer Associates, 982 F.2d at 716.
II. CONSTITUTIONAL ISSUES
Corcoran's constitutional challenges to WCCA, § 943.70, STATS., present questions of law that this court answers independently of the trial court. See State v. Hanson, 182 Wis.2d 481, 485, 513 N.W.2d 700, 701 (Ct.App. 1994). Our independent consideration of constitutional challenges begins with the strong presumption that all statutes are constitutional and the burden is upon the challenger to prove unconstitutionality beyond a reasonable doubt. See id.
A. IMPAIRMENT OF CONTRACT
As best as Corcoran's argument can be deciphered, he begins with the proposition that he was hired by MCS to develop and write specialized software at a stated hourly rate. He then contends that as a result of this contract he held a copyright to both the programs he wrote and the MCS data inserted into the programs. Finally, he concludes that MCS's insertion of its data into the programs he wrote, along with MCS's failure to pay him the agreed upon fee, constituted "trespass" upon his property, and he had the common law right to destroy MCS's data.
It is from these propositions that Corcoran concludes that the WCCA impairs the obligations to contract because it is being used to punish him and "to protect the property of trespassers [MCS] who have lodged their data into a copyrighted computer database to which they have acquired no proprietary right." He also asserts that this situation is akin to an attempt by the State to force him to perform a contract for which consideration is lacking. Without citation to authority, he concludes that as WCCA is applied to the facts of this case, it is unconstitutional because it violates Article I, Section 12 of the Wisconsin Constitution.
Wisconsin Constitution, Article I, Section 12 provides: No bill of attainder, ex post facto law, nor any law impairing the obligation of contracts, shall ever be passed, and no conviction shall work corruption of blood or forfeiture of estate.
"The obligation of a contract is defined as the law or duty which binds the parties to perform their agreements." Burke v. E.L.C. Investors, Inc., 110 Wis.2d 406, 411, 329 N.W.2d 259, 262 (Ct.App. 1982). To hold that the WCCA impaired a contract, it must have altered a contract existing at the time the statute became effective in such a way as to have imposed a loss on Corcoran. See id.
We reject Corcoran's argument for several reasons. First, the sections of the WCCA that Corcoran was convicted of violating, § 943.70(2)(a)2 and (b)3, STATS., became effective on May 1, 1982, Laws of 1981, ch. 293 § 1; the contract between MCS and Corcoran was not formed until 1987. It is an elementary principle of law that the existing law of the land is a part of every contract. See Burke, 110 Wis.2d at 410, 329 N.W.2d at 261. Therefore, the WCCA's prohibition against destroying computer data was a part of the contract between MCS and Corcoran.
Second, the application of the WCCA to Corcoran does not result in his suffering any financial loss. He has not been paid for the work he performed, as the trial court found that the contract did not require payment until fully functional application programs were furnished to MCS.
Third, Corcoran's attempts in August of 1987 to compel MCS to pay the agreed-upon hourly fee plus a premium of $1500 or suffer the loss of use of the computer programs and data, along with his insertion and activation of "Trojan horses," are a form of self-help not recognized by a vast majority of the jurisdictions in this country. Regardless of whether the contract between Corcoran and MCS is characterized as a contract for goods or a contract for services, neither the Uniform Commercial Code nor the common law sanctions self-help that breaches the peace. See Stephen L. Poe Teresa L. Conover, Pulling the Plug: The Use and Legality of Technology-Based Remedies by Vendors in Software Contracts, 56 ALB. L. REV. 609 (1993).
B. INVOLUNTARY SERVITUDE
Corcoran asserts that in prosecuting him for violations of the WCCA, the State is coercing him into designing custom software without corresponding payment for his services and this amounts to involuntary servitude. We reject this argument on basic constitutional grounds.
Both the Thirteenth Amendment of the United States Constitution and Article I, Section 2 of the Wisconsin Constitution prohibit involuntary servitude. Involuntary servitude has been defined by the United States Supreme Court as "a condition of servitude in which the victim is forced to work . . . by the use or threat of physical restraint or physical injury, or by the use or threat of coercion through law or the legal process." United States v. Kozminski, 487 U.S. 931, 952 (1988). The Wisconsin Supreme Court has also applied a like definition. See City of Milwaukee v. Horvath, 31 Wis.2d 490, 495-96, 143 N.W.2d 446, 448-49, cert. denied, 385 U.S. 970 (1966).
Corcoran's prosecution is not for breach of contract; he is not being forced to fulfill the terms of the contract. His prosecution and sentence do not force him to labor for the benefit of MCS; he is not being compelled to write specialized computer programs for MCS, the State or anyone else. The "fruits" of Corcoran's labor were worthless, the specialized programs he wrote did not perform as required but he is not being prosecuted for his ineptitude. Corcoran's conviction is for destroying computer data that was the property of another. Corcoran's sentence does not impose labor for the benefit of another. See 45 Am. Jur. 2d Involuntary Servitude and Peonage § 7 (1969).
C. VAGUENESS
Corcoran's third attack on the constitutionality of the WCCA is a contention that the statute is vague. He makes two claims: first, that the failure of the WCCA to define "without authorization" leaves a person of ordinary intelligence without guidance as to what is forbidden conduct and second, that the provision that damages in excess of $2500, increasing the penalty from a misdemeanor, § 943.70(2)(b)1, STATS., to a felony, § 943.70(2)(b)3, permits the arbitrary inclusion of "civil" damages.
The general principles of procedural due process require fair notice and proper standards for adjudication of conduct; a criminal statute is unconstitutionally vague if it lacks either of these features. See State v. Barman, 183 Wis.2d 180, 197, 515 N.W.2d 493, 501 (Ct.App. 1994). Before a criminal statute may be invalidated for vagueness we must be convinced, beyond a reasonable doubt, that there is some ambiguity or uncertainty in the description of the duty imposed or conduct prohibited that either prevents a person of ordinary intelligence who wants to obey the statute from determining what is prohibited conduct or prevents the trier of fact from ascertaining guilt or innocence and forces the trier of fact to create and apply its own standards of conduct. See City of Milwaukee v. K.F., 145 Wis.2d 24, 32-33, 426 N.W.2d 329, 333 (1988).
Corcoran contends that the statute is vague because it does not define "without authorization." He argues that as the "author" of the specialized application programs, he was "authorized" to destroy the data inserted into those programs.
We will consider both features of the vagueness test. In arguing that a person of ordinary intelligence might conclude that the "author" of a computer program would be prohibited from destroying his or her own computer program, Corcoran is trying to rely upon hypotheticals. We will ignore his hypotheticals because his conduct in destroying the data in PONQTR2.WK1 and PAYROLL1.WK1 unquestionably falls in the zone of conduct prohibited by the WCCA. See State v. Pittman, 174 Wis.2d 255, 277, 496 N.W.2d 74, 83, cert. denied, 114 S. Ct. 137 (1993). The following undisputed evidence conclusively places Corcoran's conduct within the conduct prohibited by § 943.70(2)(a)2, STATS.:
In the spring of 1987, MCS hired Corcoran to write specialized application programs to manage data for MCS in time to prepare a report on May 15th.
MCS was solely responsible for collecting the data and inputting the data into the computer and the specialized application programs written by Corcoran.
Corcoran was given limited access to MCS's computer and data for the sole purpose of writing the necessary programs.
The data was the property of MCS.
MCS, its officers, agents and employees did not give Corcoran permission to destroy the data that was entered into the specialized application programs he wrote.
Corcoran did not have permission to insert "Trojan horses" into any of the programs.
Corcoran did not have permission to activate the "Trojan horses."
We are satisfied that a person of ordinary intelligence would realize that the insertion and activation of "Trojan horses" that would destroy data collected and used by MCS is within the sphere of conduct prohibited by the statute.
We next consider the second prong of the vagueness test, whether the trier of fact is without sufficient guidelines to apply when applying the statute to specific conduct. Although the phrase "without authorization" is not defined in the statutes, a person of ordinary intelligence is well apprised of its meaning and the conduct it prohibits. The jury was instructed that the phrase means the "defendant acted without the permission of the person responsible for the computer data or programs." WIS J I — CRIMINAL 1504. This definition of the phrase can also be found in THE RANDOM HOUSE DICTIONARY OF THE ENGLISH LANGUAGE 139 (2d ed. unabr. 1987), where one of the definitions for "authorization" is the "permission or power granted by an authority." And, an "authority" is not one who writes computer programs; rather an "authority" is the person in whom the right to control, command and determine is vested. Id. We conclude that the phrase is not so uncertain or ambiguous as to compel the trier of fact to devise its own standards when asked to settle whether Corcoran's conduct was prohibited by the WCCA.
We also reject Corcoran's vagueness challenge to the value of the data. The WCCA makes it a felony to destroy data "if the damage is greater than $2,500." Section 943.70(2)(b)3, STATS. This monetary provision is not an element of the crime; it only determines the range of possible punishment, it is a penalty enhancer. See State v. Thompson, 146 Wis.2d 554, 561-62, 431 N.W.2d 716, 719 (Ct.App. 1988). This monetary provision does not help the person of ordinary intelligence determine if his or her conduct is nearing the prohibited zone. "One disposed to violate the law need not know in advance exactly what the consequences will be." State v. Menard, Inc., 121 Wis.2d 199, 204, 358 N.W.2d 813, 816 (Ct.App. 1984).
D. OVERBREADTH
We need not expend much labor on Corcoran's complaint that the WCCA is overbroad. It is rudimentary constitutional law that the doctrine of overbreadth is to be applied to a statute only when its language is so sweeping that its sanctions could be applied to activities protected by the United States Constitution. See K.F., 145 Wis.2d at 39-40, 426 N.W.2d at 336.
Corcoran cannot have the benefit of an overbreadth attack on the WCCA because the destruction of computer data is not a protected constitutional activity. We have previously concluded that any potential copyright Corcoran might have on the programs he wrote is not relevant to this case; therefore, we do not have to consider if the constitutional status of a federal copyright falls under the umbrella of protected constitutional activities that have the benefit of an overbreadth attack. By the Court. — Judgment affirmed.