People v. Versaggi

OPINION OF THE COURT Simons, J. Rochester City Court has found defendant guilty of two counts of computer tampering in the second degree (Penal Law § 156.20), determining that he intentionally altered two computer programs designed to provide uninterrupted tele *125 phone service to the offices of the Eastman Kodak Corporation (see, 136 Misc 2d 361). 1 County Court affirmed, without opinion. Defendant contends that he is not guilty of altering the programs because he did not change them; he merely activated existing instructions which commanded the computers to shut down. The People maintain that defendant is guilty because he changed the instructions being received by the computers and thereby prevented the computers from performing their intended functions. We agree and therefore affirm the judgment of conviction. I. The telephone system at Kodak is operated by two SL-100 computers. One, located at Kodak’s State Street office in the City of Rochester, operates 7,000 lines and the other, at the Kodak Park Complex, operates 21,000 lines. On November 10, 1986, approximately 2,560 of the lines at the Kodak Park Complex were shut down and use of another 1,920 impaired for approximately an hour and a half before company employees were able to restore service. As a result, a substantial number of the employees working at this large industrial complex, with the potential for dangerous chemical spills and accidents, were unable to receive calls, to call outside the complex or to call 911 or similar emergency services. On November 19, 1986 a second interruption occurred. Essentially all service at the State Street office of Kodak was shut down for four minutes before the computer reactivated itself. As a result all outside telephone calls, from the company’s customers and offices worldwide, were disconnected. At the time of these incidents, defendant was employed by Kodak as a computer technician and was responsible for maintaining and repairing several telephone systems, though not the SL-100’s. His job often required him to work from his home and for that purpose Kodak provided him with home computer equipment and a company telephone line which allowed him to connect his computer with the Kodak systems. All calls from defendant’s home to Kodak appeared on the monthly New York Telephone Company bill as itemized long- *126 distance calls. Defendant also had been given an "accelerator” —a security device which allowed him to access the Kodak systems. Kodak maintained several computer systems and to reach a particular one from outside, a caller first accessed the Tellabs system and it then routed the call to the system desired. Security was maintained by requiring the use of an accelerator to access the systems and Tellabs also maintained a log of all calls in a script file. Once a caller had accessed another system by way of Tellabs, a monitor port recorded on a floppy disc everything that appeared on the user’s screen. The monitor port thus performed a security function similar to a hidden bank camera. By using the printouts from the Tellabs system and the telephone bills for defendant’s telephone line, company investigators determined that defendant had accessed the SL-100 systems on November 10 and November 19 and caused the phone lines to shut down. He was subsequently charged with two counts of computer tampering in the second degree. 2 II. At defendant’s trial, the People presented two witnesses who explained the mechanics of what defendant had done. David Nentarz, a Kodak employee who worked in the telecommunications department, testified that he had reviewed a printout of activity on the Tellabs system for November 10, 1986 and discovered that a user had accessed the SL-100 system and issued commands which caused the computer at Kodak Park to shut down. An hour and a half, and some 40 commands, later technicians were able to restore phone service. Nentarz testified further that the printout for November 19, 1986, showed that a user had first accessed defendant’s electronic mail — which required the use of a password chosen by defendant — and then accessed the SL-100 system at the State Street office. Once in the State Street SL-100 system, the user first issued commands which forced two parallel central processing units out of synchronization, i.e., disabled the back-up *127 devices for the SL-100, and then issued commands which caused the program to shut down completely. Joseph Doyle, supervisor of Kodak’s Telecommunications Department, testified that without defendant’s commands on November 10 and November 19, the telephone service would have run without interruption. In fact, he stated, it had done so for six years before the November incidents. Doyle testified that to direct the SL-100 to perform a function other than basic telephone service, duties such as providing dial tones and placing telephone calls, specific commands had to be entered which activated a series of instructions directing the SL-100 off its existing operation. For example, to discontinue service on November 10 defendant had to confront a list of approximately 14 questions asking him if he wished to continue with his destructive commands and to respond to each before proceeding, questions such as "Do you want to go ahead? Respond 'yes’ or 'no’ "Do you want to kill the program? Respond 'yes’ or 'no’ ”. In each case defendant answered "yes”. On November 19, before shutting down the State Street computer, defendant had to respond to similar questions advising him that he was discontinuing the parallel functions of the synchronized Central Processing Units and that at his command, the system would shut down completely. In each instance defendant answered "yes”, indicating that it was his intention to change the existing function of the programs. There was no evidence of physical damage to Kodak’s programs and expert testimony established that defendant did not delete or add to the programs which run the SL-100 systems. Rather, he selected and activated various options as they were presented by the programs. At the close of evidence defendant moved to dismiss, insisting that his conduct did not constitute alteration of a computer program under Penal Law § 156.20. City Court denied the motion and found defendant guilty of both charges. It held that by "issuing commands to the software which changed the instructions to the hardware, taking it off its normal course of action and shutting down the phone lines”, defendant had "altered” a computer program within the meaning of Penal Law § 156.20 (136 Misc 2d 361, 368, supra). III. In this Court, defendant renews his argument that he *128 cannot be guilty of tampering because he merely entered commands which allowed the disconnect instructions of each program to function. In his view, he did not "alter” the "programs”; he used them. His appeal presents us with our first opportunity to construe the statute. A. In 1986 the New York State Legislature made significant changes to the Penal Law in an effort to control what a Task Force of the American Bar Association had described as the "frightening spectre” of increased computer crime in our society (see generally, June 1984 Report on Computer Crime, ABA Task Force on Computer Crime, at iii; see also, Donnino, Practice Commentary, McKinney’s Cons Laws of NY, Book 39, Penal Law art 156, at 173). 3 A program bill submitted by the Attorney-General sought to provide a "comprehensive statutory scheme” to allow for effective law enforcement in the area (Mem of Atty Gen, Bill Jacket, L 1986, ch 514, at 32). The breadth of the changes manifests the Legislature’s intent to address the full range of computer abuses. The Legislature proceeded in two ways. First, it added statutory definitions to the Penal Law which described "computer data” and a "computer program” as "property”. Second, it added to the Penal Law new sections addressing specific computer crimes. The expansive definitions were intended to eliminate any doubt that computer data and programs are protected under Penal Law article 145 ("Criminal Mischief and Related Offenses”) and article 155 ("Larceny”). Additionally, to provide protection from electronic forgers, the Legislature included "computer data” and "computer program” within the definitions of written instruments and business records . (Penal Law art 170 — "Forgery and Related Offenses”; Penal Law art 175 — "Offenses Involving False Written Statements”). However, the Legislature went beyond expanding the definitions of "property” and "written instrument” as applied by *129 the more traditional criminal statutes; it also criminalized activity which constituted misuse of a computer but was difficult to categorize under the existing Penal Law. Specifically, the Legislature created the offenses of unauthorized use of a computer (Penal Law § 156.05); computer trespass (Penal Law § 156.10); computer tampering (Penal Law §§ 156.20, 156.25); unlawful duplication of computer related material (Penal Law § 156.30); and criminal possession of computer related material (Penal Law § 156.35). The crime of computer tampering involves the use of a computer or a computer service as the instrumentality of a crime (see, Donnino, Practice Commentary, op. cit., at 177). The defendant uses the computer to sabotage its intended operation in some way. The American Bar Association’s Task Force on Computer Crime found in its survey that such tampering was the most prevalent means of computer abuse (June 1984 Report on Computer Crime, op. cit., at 9). In contending that defendant was guilty of tampering in this case, the People sought to establish that he had altered two computer programs. The issue before the Court is whether defendant’s conduct is encompassed within the language of the tampering statute. B. Interpretation begins with the language of the statute. The Legislature did not define "alter”, however, and thus the Court must give the word its ordinary meaning (Matter of Manhattan Pizza Hut v New York State Human Rights Appeal Bd., 51 NY2d 506, 511). As commonly understood, "alter” means to change or modify. When something is altered it is made "different in some particular characteristic * * * without changing [it] into something else” (Webster’s Third New International Dictionary 63 [Unabridged]). For an alteration to occur, the identity of the thing need not be destroyed, nor need an entirely new thing be substituted. It is sufficient if some of the "elements or ingredients or details” are changed (Black’s Law Dictionary 103 [4th ed]). Significantly, the Legislature attached expansive language to the verb it used in section 156.20, stating that the crime consisted of altering a computer program "in any manner”. A program’s function is to control the computer’s activities. It does so by a series of instructions or statements prepared in order to achieve a certain result and input into a computer in *130 a form acceptable to it (see, 1 Bender, Computer Law § 2.06 [1], at 2-115). Notwithstanding this general definition, a program has been defined differently under various statutes as consisting of a single instruction (see, e.g., Montana Code Annot § 45-2-101 [10]) or a set of instructions (see, e.g., Mo Rev Stat § 569.093). The New York statute defines a program as "an ordered set of data representing coded instructions or statements that, when executed by computer, cause the computer to process data or direct the computer to perform one or more computer operations” (Penal Law § 156.00 [2]). 4 A computer may contain several "sets” of "coded instructions”, however, and, in that sense, a computer may contain more than one "program”. Indeed, computers commonly contain both "system programs” and "application programs” (1 Bender, Computer Law § 2.06 [2] , at 2-117). A system program is generally provided by the computer manufacturer and is intended to make the computer function. "It is the collection of system programs (called the 'operating system’) which converts the computer hardware * * * into a * * * functioning computer” (ibid.). The application program "is the program with which the ultimate user directs the computer to perform [a] particular task” (id., § 2.06 [3] , at 2-118.2). There is nothing in the statutory language which compels an interpretation that the Legislature intended its definition of a "computer program” to include all of the instructions contained in a computer. If it considered the question at all, and the legislative history sheds no light on the question, the Legislature did not address it in the law as finally enacted. Thus, to the extent that the definition contained in Penal Law § 156.00 (2) fails to specify whether a "computer program” includes all the input instructions, its language is ambiguous. Defendant would resolve this ambiguity by confining the statutory definition to the total set of instructions which directs all the functions of a computer. As he interprets the statute, so long as the computer contains an existing set of coded instructions which allows it to perform a function, a user may never be convicted of computer tampering no matter how malevolent the user’s purpose or how disastrous or unin *131 tended the result of activating those instructions may be to the owner. He fortifies his view by relying on the common-law rule that penal statutes must be strictly construed. There is no justification for defining the terms of the statute so narrowly. The Legislature has expressly declared that the provisions of the Penal Law be construed "according to the fair import of their terms to promote justice and effect the objects of the law” (Penal Law § 5.00; People v Ditta, 52 NY2d 657, 660). While section 5.00 of the Penal Law does not allow imposition of criminal sanctions for conduct "beyond the fair scope of the statutory mandate” (People v Wood, 8 NY2d 48, 51), "it does authorize a court to dispense with hypertechnical or strained interpretations of [a] statute” (Ditto, supra, at 660; see also, People v Sansanese, 17 NY2d 302, 306; People v Abeel, 182 NY 415, 420-421). Conduct that falls within the plain, natural meaning of the language of a Penal Law provision may be punished as criminal (Ditta, supra, at 660). Indeed, given that the enactment of a criminal statute often "follow[s] in [the] wake” of the activity it attempts to penalize, courts should not legislate or nullify statutes by overstrict construction (People v Abeel, supra, at 421-422). Applying these rules of construction, and giving the language of the statute its ordinary meaning, we conclude that the interpretation applied by City Court comports with the legislative intention. C. The purpose of Kodak’s computers was to provide telephone service and, absent instructions to the contrary, that is exactly what they did. By implementing the application programs, a set of coded instructions were executed by the computers which directed them to perform a computer operation. Those directions clearly came within the statutory definition of an "ordered set of * * * instructions” which, when executed, directed the computer "to perform one or more computer operations”. Thus those instructions constituted a "computer program”. Defendant encountered the application programs when he entered the SL-100 systems. By disconnecting them and commanding the computers to shut down, he altered the programs in some manner. Whether defendant used existing instructions to direct the phone system off-line or input new instructions accomplishing the same thing is legally irrelevant. He made the system "different in some particular char *132 acteristic * * * without changing [it] to something else” (see, Webster’s Third New International Dictionary, op. cit.). His conduct differed only in degree from shutting down the system by executing a command to add or delete program material. In either event, the result would be the same. The intended purpose of the computer program is sabotaged. Defendant’s conduct constituted tampering within the intendment of the statute because it altered the computer programs at Kodak’s State Street office and Kodak Park Complex by interrupting the telephone service to those two facilities. Accordingly, the order of County Court should be affirmed. Chief Judge Kaye and Judges Bellacosa, Smith, Levine and Ciparick concur; Judge Titone taking no part. Order affirmed. Footnotes [1] Penal Law § 156.20 provides that: "A person is guilty of computer tampering in the second degree when he uses or causes to be used a computer or computer service and having no right to do so he intentionally alters in any manner or destroys computer data or a computer program of another person.” [2] Penal Law § 156.20 was amended in 1993 to change the offense from computer tampering in the second degree to computer tampering in the fourth degree (see, L 1993, ch 89, § 1). The offense is still classified as a class A misdemeanor. [3] In doing so, the State joined a growing number of jurisdictions attempting to address the problem: Alabama, Alaska, Arizona, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maryland, Michigan, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, Washington, Wisconsin and Wyoming. [4] The definition has been criticized as technical jargon which "obfuscates and intimidates” (see, Note, Computer Crime in Virginia, 27 William & Mary L Rev 783, 802 [criticizing identical language found in Virginia Code § 18.2-152.21).