Umhoefer v. State

SILBERMAN, Judge. Joel Alan Umhoefer appeals his judgment and sentence for unauthorized access of a computer network or electronic device, a third-degree felony. The charge arose as a result of his online relationship with a teenage girl, M.B. We affirm his judgment and sentence and write to address the denial of his .motion for judgment of acquittal. Umhoefer contends that the trial court should have granted his motion for judgment of acquittal because the State failed to prove that he accessed a computer network and that the access was unauthorized. Appellate review of the denial of a motion for judgment of acquittal is by the de novo standard. State v. Shearod, 992 So.2d 900, 903 (Fla. 2d DOA 2008). Section 815.06(2)(a), Florida Statutes (2014), provides as follows: (2) A. person commits an offense against users • of computers, computer systems,- computer networks, or electronic devices if he or she willfully, knowingly, and without authorization: (a) Accesses or causes to be accessed any computer, computer system, computer network, or electronic device with knowledge that such access is unauthorized!)] The applicable version of section 815.03, effective October ■ 1, 2014, defines a computer network as ' a system that provides á medium for communication between one or more computer systems or electronic devices, including communication with an input or output device such as a display terminal, printer, or other electronic equipment that is connected to the computer systems or electronic devices by physical or wireless telecommunication facilities. § 815.03(4). “‘Access’ means to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network.” § 815.03(1). Umhoefer developed an online relationship with M.B. beginning in .November 2012 when she was fourteen. M.B. made videos for Umhoefer, and he sent her gifts, including a laptop and stuffed animals.1 After she began a relationship with E.C., a boy her age, Umhoefer became jealous. An injunction for protection against dating violence was issued against Umhoefer in August 2014. The State filed the charge at issue after Umhoefer sent an email to M.B.’s mother on November 23, 2014, that attached Face-book messages between M.B. and E.C. that were sexually explicit'. Umhoefer claimed that he had been monitoring M.B. and was trying to help her.. He asserted that she had given him .her password a long time ago but that she had just changed it that day to hide further conversations with E.C. . M.B. testified that Umhoefer and she had exchanged passwords but that by June of 2014 she had changed her password and that she did not give Umhoefer the new password. She specifically testified that she did not give him the password to go into a new Facebook account she had set up. Detective McHenry, an expert in computer forensics, testified that accessing Fa-cebook involves using the internet to communicate from a computer with another network and stated that accessing Face-book is accessing a network. He stated that Umhoefer hacked into Faeebook’s network and stated that the private conversations between E.C. and M.B, “are not stored locally” but on Facebook’s “server farm, which is a network of computers that provide service and content access. So you, by accessing that account, you’re actually accessing Facebook’s network which allows you to use their network as a user.” This access occurred in October, November, and December of 2014. Detective McHenry explained that Umhoefer got into both M.B.’s account and Facebook’s server. The detective indicated that the home and Fa-cebook networks were connected and stated that the home network is part of that. The internet is part of that. And then Face-book, because they house all the material, I can go into the more specifics of how their folders and logging work, but they also are a network. So all of these structures are considered^—maybe it’s easier to think of your home network and then a bridge using the internet to the secondary network which is Facebook. Detective McHenry also stated that when law enforcement wants to get information from Facebook it has to get a search warrant because of the privacy issues. Defense counsel argued to the trial court that Detective McHenry went beyond the wording of statute in saying that Facebook’s network was accessed and rather the situation “was accessing somebody’s individual, account, which is different.” In denying the motion, the trial court stated that it thought “the evidence presented by Detective McHenry shows that there was indeed a network that the defendant did access without authorization.” Umhoefer argues on appeal that the State failed, to prove that he accessed a computer network without authorization. He acknowledges that the State proved that he accessed M.B.’s Facebook account but contends that the State did not prove that he accessed any social media site’s server or network. He relies upon Crapps v. State, 180 So.3d 1125 (Fla. 1st DCA 2015), for the proposition that accessing a person’s specific account was insufficient to prove a violation of section 815.06. In Crapps, the First District determined that the State had failed to prove a violation of section 815,06(l)(a), Florida Statutes (2013),2 when the defendant accessed his ex-girlfriend’s Instagram account without permission and posted nude photos of her. 180. So.3d at 1126-27, The First District stated that the statute’s definitions in section 815.03 referred to tangible devices and-not the data located on the device. Id. at 1127. The court stated that to prove a violation the State was required to “establish that the defendant accessed one of the listed tangible devices without authorization, not that the defendant accessed a program or information stored on the device without authorization.” Id (citing Rodriguez v. State, 956 So.2d 1226, 1230 (Fla. 4th DCA 2007)). In determining that the State failed to prove .its case, the First District pointed out. that it had before it no evidence to “explain[] how accessing an Instagram account works from a technological perspective, leaving unanswered whether or how Appellant’s actions amounted to accessing a specific computer, computer system, or computer network,” Id. In fact, the court stated that it “d[id] not foreclose the possibility that the State could present sufficiént evidence to prove a violation of section 815.06 for unauthorized, sexually-explicit Internet postings such as those in this case.” 180 So.3d at 1127. And the case cited in Crapps, Rodriguez v. State, 956 So.2d 1226 (Fla. 4th DCA 2007), is distinguishable from the present case. There, an employee was charged with a violation of section 815.06 for accessing his employer’s computer system and adjusting the inventory. M. at 1230. The Third District determined that although the employee “was not authorized to access the computer function he accessed in order to make inventory adjustments!,]” the employee “was authorized to access the system by using his password” and “was authorized to access the network.” Id. The court also noted that the statute provides an exception for an employee accessing his employer’s computer system when acting in the scope of lawful employment. Id. at 1230-31. The court thus concluded that the evidence was insufficient to show the employee “accessed the computer, computer system, or computer network without authorization.” Id. Here, the State presented an expert in computer forensics who testified that Umhoefer accessed both M.B.’s account and Facebook’s network, specifically Facebook’s servers where the private messages were stored. In contrast, in Crapps, the only evidence “explaining what Instar gram is was the ex-girlfriend’s testimony that it is a form of social media and ‘a place where you post pictures [and] yóur friends get to see it.’ ” 180 So.3d at 1127 (alteration in original). Based on the trial testimony in the present case, we- find no error in the trial court’s conclusion that Umhoefer accessed a computer network in violation of the applicable statutes. The State also presented sufficient evidence to prove that Umhoefer’s access was unauthorized. There was no dispute that Umhoefer accessed M.B.’s Facebook account and sent data, consisting of private messages between M.B. and E.C., to M.B.’s mother. Although Umhoefer claimed that he had M.B.’s password because she had given it to him, M.B. testified that by June of 2014 she had changed her password and that she did not give him the password to go into her account. In addition, Detective McHenry testified that Umhoefer used the Passfinder application, a method of bypassing password protections, to get into the account. If Umhoefer still had the password to M.B.’s Facebook account, he would not have needed Passfinder to access it. Thus, we conclude that the State presented sufficient evidence and that the trial court properly denied his motion for judgment of acquittal. Therefore, we affirm his judgment and sentence. Affirmed. NORTHCUTT and MORRIS, JJ., Concur. Footnotes [1] The case went to trial on the additional counts of lewd or lascivious conduct and solicitation of a child over the internet. Those counts arose from what was described as fetish videos that Umhoefer asked M.B. to make and involved M.B. flatulating on a sock while she was clothed in a t-shirt and underwear. The defense argued that the State did not prove that his fetish was of a sexual nature or that the videos were lewd or lascivious; although the trial court found the conduct troubling and inappropriate, the trial court agreed with the defense and granted the motion on those two counts. [2] The prior version of section 815.03 that was applicable in Crapps defined a computer network as "any system that provides communications between one or more computer systems and its input or output devices, im eluding, but not limited to, display terminals and printers that are connected by telecommunication facilities,” § 815.03(4), Fla. Stat, (2013).