10.2 VIRGINIA COMPUTER CRIMES
10.201 Computer Fraud. The first cause of action set forth in the Act is computer fraud. Under the Act, "[a]ny person who uses a computer or computer network[ ] without authority and: (i) obtains property or services by false pretenses; (ii) embezzles or commits larceny; or (iii) converts the property of another is guilty of the crime of computer fraud." 8
[Page 523]
To show a violation of the VCCA, a plaintiff must demonstrate that the defendant: (i) used a computer or computer network without authority; (ii) with the intent to (a) obtain property or services by false pretenses, (b) embezzle or commit larceny, or (c) convert the property of another. 9 Under the VCCA, a person acts without authority when "he knows or reasonably should know that he has no right, agreement, or permission or acts in a manner knowingly exceeding such right, agreement, or permission." 10
In America Online, Inc. v. LCGM, Inc., 11 America Online (AOL) complained that the defendants sent large numbers of unauthorized and unsolicited bulk email advertising pornographic web sites to its members. The defendants admitted to causing "aol.com" to appear on the electronic header information of email messages that they sent to AOL members. AOL alleged that the defendants intended to obtain services by false pretenses and to convert AOL's property. The plaintiff also alleged that the defendants illegally obtained the use of AOL's email delivery service and obtained free advertising from AOL because AOL bore the cost of sending the messages. The court granted AOL's motion for summary judgment, finding there were no genuine issues for trial.
In Physicians Interactive v. Lathian Systems, 12 the plaintiff successfully brought a private right of action for computer fraud under the Act. The plaintiff, a website host, argued that a competitor and its employee obtained its property by false pretenses. The plaintiff alleged that the competitor and its employee hacked into the plaintiff's computer storing customer lists and other trade secrets but could not prove what the defendant did after that. The court found that it was highly likely that the defendants converted the plaintiff's proprietary information for their own use.
In McGladrey & Pullen, L.L.P. v. Shrader, 13 computer fraud was again at issue. There, a defendant employee filed a demurrer claiming he had
[Page 524]
authority to use his employer's computer and to download certain data. The circuit court overruled the demurrer, finding the defendant had no authority to use his employer's computers for purposes not authorized by the employer and inimical to his employer's best interest. 14
A complaint for computer fraud must allege that the defendant obtained, embezzled, or converted the plaintiff's property. A defendant merely reading an electronic communication does not constitute conversion. 15
10.202 Transmission of Unsolicited Bulk Electronic Mail.
A. Criminal Activity. The second crime set forth in section 18.2-152.3:1 of the Act is the transmission of unsolicited bulk electronic mail (UBE), 16 commonly referred to as "spam." The previous version of this "anti-spam" statute was declared unconstitutional by the Virginia Supreme Court in Jaynes v. Commonwealth. 17
The statute provides in part that:
A. Any person who:
1. Uses a computer or computer network with the intent to falsify or forge electronic mail transmission information or other routing information in any manner in connection with the transmission of spam through or into the computer network of an electronic mail service provider or its subscribers; or
2. Knowingly sells, gives, or otherwise distributes or possesses with the intent to sell, give, or distribute software that (i) . . . facilitat[es] or enabl[es] the falsification of the transmission information or other routing information of spam; (ii) has only limited commercially significant purpose or use . . . ; or (iii) is marketed . . . for use in facilitating or enabling the falsification of the
[Page 525]
transmission information or other routing information of spam is guilty of a Class 1 misdemeanor. 18
Violation of section 18.2-152.3:1 is a Class 6 felony if (i) spam is transmitted to over 10,000 attempted recipients in 24 hours, 100,000 attempted recipients in 30 days, or one million attempted recipients in one year or (ii) the revenue generated from a specific spam transmission exceeds $1,000 or the total revenue generated from all spam to any electronic mail service provider exceeds $50,000. 19
The defendant in Jaynes had been charged with felony violations of section 18.2-152.3:1 for transmitting spam to America Online and its subscribers. The defendant challenged the statute on constitutional grounds. The Supreme Court agreed with Jaynes, holding that the statute "is unconstitutionally overbroad on its face because it prohibits the anonymous transmission of all unsolicited bulk e-mails including those containing political, religious or other speech protected by the First Amendment to the United States Constitution." 20
Section 18.2-152.3:1 was amended after Jaynes, primarily changing the phrase "unsolicited bulk electronic mail" to simply the word "spam." Spam is defined by the Act as unsolicited commercial electronic mail, "not includ[ing] commercial electronic mail transmitted to a recipient with whom the sender has an existing business or personal relationship." 21 This section has not been relitigated since the amendment in published opinions, so it is unclear whether it is still unconstitutionally overbroad.
B. Tortious Activity. Several courts, including the United States District Court for the Eastern District of Virginia, have held that under certain circumstances, the transmission of spam through a computer system constitutes the tort of trespass to chattel, 22 independent from the VCCA.
[Page 526]
In Verizon Online Services, Inc. v. Ralsky, 23 the plaintiff, Verizon, a Virginia resident, sued the defendants, who were Michigan residents, based on their alleged transmission of spam to Verizon's subscribers through Verizon's online proprietary network of seven email servers located in Virginia. Verizon alleged three counts under the VCCA and other statutory and common law counts. The defendants moved for dismissal for lack of personal jurisdiction under Rule 12(b)(2) of the Federal Rules of Civil Procedure and improper venue or sought to have the matter transferred to the Eastern District of Michigan. The court denied the motions, finding that the defendants' transmission of spam to and through the plaintiff's servers in Virginia constituted sufficient minimum contacts to satisfy the demands of the Due Process Clause of the Fourteenth Amendment to the Constitution. 24
The United States District Court for the Eastern District of Virginia has decided several cases involving America Online as the plaintiff and has consistently held that the practice of sending spam and using techniques to evade AOL's blocking mechanisms violates the Act. 25 In America Online, Inc. v. Smith, 26 the defendant transmitted spam to the plaintiff's subscribers daily for 213 days, using numerous fraudulent and deceptive methods to evade the plaintiff's email filters and disrupt its business operations. The court granted the plaintiff's summary judgment motion and awarded $25,000 per day for each of the 213 days that a violation took place plus attorney fees and costs. 27
The Act also provides that the electronic mail service provider may recover attorney fees and costs from the spammer and, in lieu of actual damages, $1 for each transmission of spam or $25,000 per day. 28 These provisions do not apply to the transmission of email by an organization to its members.
[Page 527]
In addition to protecting the electronic mail service provider, the Act also provides a civil remedy for the recipients of spam who are injured by spam sent by another. Such an injured party may recover attorney fees and costs and receive as damages the lesser of $10 for each spam message transmitted or $25,000 per day in lieu of actual damages. 29
10.203 Computer Trespass. The crime of "computer trespass," makes it illegal to engage in eight distinct acts with malicious intent. 30 Each of the eight illegal acts are codified at section 18.2-152.4(A) of the Virginia Code:
| 1. | Temporarily or permanently remove, halt, or otherwise disable any computer data, program, or computer soft-ware; 31 | ||
| 2. | Cause a computer to malfunction; | ||
| 3. | Alter, disable, or erase any computer data, program, or software; | ||
| 4. | Create or alter a financial instrument or electronic transfer of funds; | ||
| 5. | Use a computer to cause physical injury to the property of another; | ||
| 6. | Use a computer to make an unauthorized copy of any computer data, program, or software residing in, communicated by, or produced by a computer or computer network; | ||
| 7. | Install or use software that records keystrokes made on another's computer without the owner's authorization; or | ||
| 8. | Install software on another's computer to take control of that computer or damage the ability of that computer to communicate with other computers or equipment. 32 |
[Page 528]
There are two exceptions to the criminal characterization of the prohibited activities. First, a Virginia-based Internet service provider can enter into contracts or licenses or implement technical measures that might otherwise violate the statute in order to prevent spam. 33 Second, this section does not prohibit a parent or guardian from monitoring a minor's computer use. 34
The first activity mentioned in section 18.2-152.4(A)—to temporarily or permanently remove, halt, or otherwise disable any computer data, program, or computer software—is substantially similar to the crime described in the Act as computer fraud. Both concern the taking of computer property; however, there are some important...
