United States v. Morris

United States Court of Appeals, Second Circuit
928 F.2d 504 (1991)

ELI5:

Rule of Law:

A conviction under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(A), requires proof of intentional access to a computer without authorization, but does not require proof that the defendant intended to cause the resulting damage or loss.

Facts:

In the fall of 1988, Robert Tappan Morris, a graduate student at Cornell University, created a computer program known as a 'worm'.
Morris's goal was to demonstrate security flaws in computer networks, and he designed the worm to spread without interfering with normal computer use.
To spread, the worm exploited security holes in common email (SEND MAIL) and user information (finger demon) programs, and also guessed passwords.
Morris included a feature to prevent the worm from copying itself onto an already-infected computer, but due to a design flaw, this safeguard failed and caused the worm to replicate at an uncontrollably fast rate.
On November 2, 1988, Morris released the worm from a computer at MIT to hide its origin.
The worm's rapid replication caused thousands of computers on the INTERNET network, including those at universities, military sites, and medical facilities, to crash or become unusable.
The cost to clean up the worm at each affected institution ranged from $200 to over $53,000, far exceeding the statute's $1,000 threshold.
Upon realizing the damage, Morris and a friend sent an anonymous message with instructions on how to stop the worm, but network congestion caused by the worm itself delayed the message until it was too late.

Procedural Posture:

Robert Tappan Morris was indicted in the U.S. District Court for the Northern District of New York for violating 18 U.S.C. § 1030(a)(5)(A).
Following a jury trial, the jury returned a verdict of guilty.
The District Court sentenced Morris to three years of probation, 400 hours of community service, and a fine of $10,050.
Morris, as the appellant, appealed his conviction to the United States Court of Appeals for the Second Circuit.

Premium Content

Subscribe to Lexplug to view the complete brief

You're viewing a preview with Rule of Law, Facts, and Procedural Posture

Issue:

Does a conviction under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030(a)(5)(A), require the government to prove that the defendant intended to cause damage or prevent authorized use of a computer?

Opinions:

Majority - Newman, J.

No. A conviction under 18 U.S.C. § 1030(a)(5)(A) requires proof of intentional access to a federal interest computer without authorization, but does not require proof that the defendant intended to cause the resulting damage or loss. The court's reasoning is based on statutory construction. The word 'intentionally' is placed directly before 'accesses' and is separated by a comma from the clause describing the resulting damage, suggesting it only modifies the act of access. Furthermore, the legislative history shows that when Congress amended the statute in 1986, it removed the dual 'knowingly' requirement that had previously applied to both the access and the damage, and replaced it with a single 'intentionally' standard for the access alone. This deliberate change indicates Congress's intent to punish the act of intentional unauthorized access that results in damage, regardless of the defendant's intent concerning the damage itself.

Analysis:

This decision established that the damage provision of the Computer Fraud and Abuse Act is a general intent crime, significantly lowering the prosecution's burden of proof. By holding that the government only needs to prove intent to access a computer without authorization, and not intent to cause damage, the ruling makes it much easier to convict individuals for reckless or negligent actions following an intentional unauthorized access. This interpretation has had a lasting impact on cybersecurity law, broadening the scope of the CFAA to cover hackers and programmers whose actions have unintended but foreseeable destructive consequences.

Gunnerbot

AI-powered case assistant

Loaded: United States v. Morris (1991)

Try: "What was the holding?" or "Explain the dissent"