4

On slashdot.org the following case was discussed: A owns a laptop, and has software installed that allows to log into the laptop remotely. B steals the laptop, and uses it to log into their Facebook account. A logs remotely into his stolen laptop, notices the Facebook account, and finds the name, address, and phone number of the thief using the Facebook account.

There is the question what the owner of the laptop is allowed to do:

  1. Is the owner of a laptop authorized to access information put there by a thief – i.e., a person who definitely knew they had no right to use the laptop at all?
  2. Is the owner of a laptop authorized to access a Facebook account of a laptop thief? I.e., does the thief authorize the laptop owner by logging in to his account on the stolen laptop?
  3. Would the identity of a laptop thief be protected from the legitimate owner because of privacy laws?
  • 1
    I think it would be a more complicated situation if there was conversion or trespass to chattels. Prima facie don't see any weight for thief's privacy rights. Owner's got to do some efforts if he wants his property back. – lawsome Jan 22 '17 at 15:23
2

Summary: Accessing data is almost certainly OK as the laptop owner controls access and the thief has no expectation of privacy, but actively logging into someone else's Facebook account is questionable at best.

This answer does not consider any state laws that may affect the situation.

Applicable legislation

From a Fourth Amendment perspective, a thief has no expectation of privacy on a stolen laptop (cases cited in the link seem to extend this to all stolen property). While the Fourth Amendment is a protection against government intrusion and doesn't speak directly to individuals invading other individuals' privacy, I think it's a good baseline.

There turns out to be little federal legislation on this topic, as most is either industry specific (eg. parts of HIPAA), or is legislation on what the federal government itself can or can't do with private information (eg. Privacy Act of 1974). The most relevant legislation I could find on the issue is the Computer Fraud and Abuse Act, which is codified in 18 U.S. Code § 1030.

Especially applicable to your question is subsection (a)(2)(C), which makes it an offence for whomever:

(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—(A) [...] (B) [...] or (C) information from any protected computer;

The definition of "protected computer" is located in (e)(2) and has been interpreted to include essentially any internet-connected computer (which is the case here, given the remote login).

Accessing the information

Your 1st and 3rd questions boil down to whether accessing/obtaining the information "exceeds authorized access." Somewhat related is the Seventh Circuit Court of Appeals case International Airport Centers, L.L.C. v. Citrin [wiki, full text]. In it, an employee on a company computer deleted information after leaving the company. It was found that he was not authorized to do so.

However, I don't personally think this case actually applies to the scenario. The laptop owner can make a strong argument that as the owner, he can ultimately authorize access to the computer and its contents. Also, with the knowledge that a thief has no expectation of privacy on a stolen computer, it can also be argued that the thief implicitly authorized access by placing the data there or making it available for remote login users to view it.

Additionally, there's a circuit split on what "authorized" means. The Ninth Circuit Court of Appeals has held in LVRC Holdings LLC v. Brekka and United States v. Nosal that restrictions of access (eg. not deleting company files) is not relevant to authorization, it is simply whether use of the computer itself is authorized. Following Ninth Circuit precedent, there's almost zero doubt that the laptop owner can legally access the thief's data as the owner controls authorization to access the computer.

Logging into the thief's account

As I explained above, I believe passively viewing what the thief is doing on their Facebook page is legal. However, obtaining credentials or session tokens and actively logging into the account to find information is different (it's not clear to me whether this is what you meant in your question, but I thought it would be useful to at least bring up this point). Accessing/obtaining data may itself be legal, but the method by which it is accessed/obtained and what is done with that information might not be legal.

In my brief research on this aspect, it is unclear if there would be any civil remedies available if there is no effective damage done (beyond violation of Facebook's terms of service). However, possible criminal offences include unauthorized access to a computer (Facebook's server, via the potentially illegal login) and circumventing technological barriers (by using someone else's credentials). See this EFF article for a little more info.

| improve this answer | |
  • I'm less familiar with American jurisprudence, but in Canada we had a Supreme Court case in February, R v. Jarvis, where as I suggest might be possible in this answer, the jurisprudence of Charter s. 8 (our equivalent to the 4th Amendment) was used to inform a decision on individuals invading another's privacy (though 3 of 9 justices dissented on this point). – DPenner1 Sep 29 '19 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.