COURT OF APPEALS OF OHIO, EIGHTH DISTRICT COUNTY OF CUYAHOGA NO. 59190 STATE OF OHIO : : Plaintiff-appellee : : JOURNAL ENTRY -vs- : AND : OPINION THOMAS R. JOHNSON : : Defendant-appellant : : DATE OF ANNOUNCEMENT : OF DECISION : FEBRUARY 13, 1992 CHARACTER OF PROCEEDING : Criminal appeal from Court of Common Pleas : Case No. CR-237557 JUDGMENT : AFFIRMED DATE OF JOURNALIZATION : APPEARANCES: For plaintiff-appellee: For defendant-appellant: STEPHANIE TUBBS-JONES JONATHAN GARVER, ESQ. CUYAHOGA COUNTY PROSECUTOR 1404 East Ninth Street MARY PAPCKE, ASST. Suite 300 Justice Center - 8th Floor Cleveland, Ohio 44114 1200 Ontario Street Cleveland, Ohio 44113 - 2 - J.F. CORRIGAN, J., Defendant Thomas Johnson appeals from his conviction for unauthorized access to a computer, computer system, or computer network in violation of R.C. 2913.04(B). We affirm. I. On May 12, 1989, following an investigation at the Southerly Treatment Plant of the Northeast Ohio Regional Sewer District (hereafter referred to as the "District"), defendant, a former maintenance manager at the Southerly Plant, was indicted for theft, theft in office, and unauthorized access to a computer, computer system, or network. Defendant entered pleas of not guilty and the matter proceeded to a jury trial on November 27, 1989. Maintenance clerk Rochelle Bricker established that on Friday February 17, 1989, defendant, Bricker's superior removed the "David and Goliath" computer from her office and said he was taking it home for the weekend to work on it with his daughter. Defendant then placed part of the computer in a box and carried it to his car, then returned a short time later for the remaining parts. Bricker established that she knew that District employees were not permitted to remove District property from the premises, but she did not report the incident because she feared retaliation. Will Baylis, Chief of Operations at the District's waste water treatment plants, Frank Cuffaro, Superintendent of the - 3 - Southerly plant, and John Ward, Assistant Superintendent in charge of maintenance at Southerly and defendant's immediate supervisor, likewise established that longstanding District policy prohibits employees from taking home District property, including computers. These witnesses further established that they had not given defendant permission to take the computer home for the weekend. Further, when it was returned on February 21, 1989, the program password and security password had been changed, thereby leaving the District's programs unprotected and, at least one program inaccessible to District employees. At a subsequent hearing held on February 23, 1989, defendant indicated that someone at the District's administrative offices named "John" had given him permission to take the computer home. In addition, defendant initially refused to disclose the new program and security passwords, claiming that the computer now contained his own personal programs which he wished to protect. Later however, defendant revealed the program password, but not the security password. Louis DeBevec, Assistant Chief of Operations, testified that the information which defendant had programmed into the computer was encrypted, and could not be read. He further indicated that from April 1987 to November 1988 defendant had, without authority to do so, requisitioned or initiated the requisition of numerous computer component parts which were both incompatible with the computers presently being used, and could not be located at the - 4 - plant. Finally, DeBevec opined that defendant had ordered these parts in order to assemble his own computer system, and that defendant took the "David and Goliath" computer home in order to render this computer functional. Defendant elected to put forth evidence and he testified that he had in fact requisitioned the purchase of many computer components without obtaining proper approval, but he claimed that he did so in order to update existing systems. Defendant further testified that he took the "David and Goliath" computer home in order to install a program which would make data more accessible to the District. Thomas Harkaway, Director of Marketing for Xycom, a manufacturer of industrial computer equipment, and an expert in the design of computer systems, testified that many of the components surreptitiously ordered by defendant are in fact compatible with existing District computers. Finally, the state put forth rebuttal evidence of statements defendant had made regarding a computer which he had at his home. Thereafter, the case was submitted to the jury and the jury found defendant not guilty of theft and theft in office, and guilty of unauthorized access to a computer. Defendant now appeals assigning three errors. For the sake of clarity, we shall address these errors out of their predesignated order. II. Defendant's second assignment of error states: "SECTION 2913.04(B), OHIO REVISED CODE IS UNCONSTITUTIONAL ON ITS FACE AND AS APPLIED - 5 - TO THIS CASE BECAUSE IT IS IMPERMISSIBLY VAGUE AND OVERBROAD. FOURTEENTH AMENDMENT TO THE CONSTITUTION OF THE UNITED STATES" Within this assignment of error, defendant asserts that R.C. 2913.04(B), is unconstitutionally vague and overbroad because some of this state's computer crime legislation has been criticized by a joint committee of the Ohio State Bar Association, and because there are proposed amendments to R.C. 2913.04(B) which add, as an additional element to this offense, the requirement that the defendant be given notice that he lacks consent. A. Vagueness "It is a basic principle of due process that an enactment is void for vagueness if its prohibitions are not clearly defined. Vague laws offend several important values. First, because we assume that man is free to steer between lawful and unlawful conduct, we insist that laws give the person of ordinary intelligence a reasonable opportunity to know what is prohibited, so that he may act accordingly. Vague laws may trap the innocent by not providing fair warning.[] Second, if arbitrary and discriminatory enforcement is to be prevented, laws must provide explicit standards for those who apply them.[] A vague law impermissibly delegates basic policy matters to policemen, judges, and juries for resolution on an ad hoc and subjective basis, with the attendant dangers of arbitrary and discriminatory application.[] Third, but related, where a vague statute 'abut[s] upon sensitive areas of basic First Amendment freedoms,'[] it 'operates to inhibit the exercise of [those] freedoms.'[] Uncertain meanings inevitably lead citizens to 'steer far wider of the unlawful zone' *** than if the boundaries of the forbidden areas were clearly marked.'"[] (Footnotes and citations omitted.) - 6 - Grayned v. Rockford (1972), 408 U.S. 104, 108-109. Thus, under the vagueness doctrine, statutes which do not fairly inform a person of what is prohibited will be found unconstitutional as a violative of due process. State v. Reeder (1985), 18 Ohio St. 3d 25, 26. In order to withstand a challenge that it is unconstitutionally vague, a statutory prohibition must be clearly defined and it must give a person of ordinary intelligence a reasonable opportunity to know what is prohibited. State v. Mollenkopf (1982), 8 Ohio App. 3d 210. The courts, however, will accord words their "common, ordinary and usually accepted meaning[s] in the connection[s] in which [they] are used." State v. Reeder, supra, at 26, citing to Mutual Bldg. & Invest. Co. v. Efros (1949), 152 Ohio St. 369, paragraph one of the syllabus. Moreover, one to whose conduct a statute clearly applies may not successfully challenge the statute for vagueness. Parker v. Levy (1974), 417 U.S. 733, 756; Singer v. Cincinnati (1990), 57 Ohio App. 3d 1, 4. R.C. 2913.04(B) provides as follows: "(B) No person shall knowingly gain access to, attempt to gain access to, or cause access to be gained to any computer, computer system, or computer network without the consent of, or beyond the scope of the express or implied consent of, the owner of the computer, computer system, or computer network or other person authorized to give consent by the owner." R.C. 2913.01(T) defines "gain access" as follows: - 7 - "(T) 'Gain access' means to approach, instruct, communicate with, store data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network." In addition, R.C. 2913.04 adopts by reference the following affirmative defenses to a charge of unauthorized use of a computer: "(C) The following are affirmative defenses to a charge under this section: "(1) At the time of the alleged offense, the actor, though mistaken, reasonably believed that he was authorized to use or operate the property. "(2) At the time of the alleged offense, the actor reasonably believed that the owner or person empowered to give consent would authorize the actor to use or operate the property." Considering all of the foregoing, we do not find R.C. 2913.04(B) to be unconstitutionally vague as this statute clearly and reasonably apprises persons of ordinary intelligence that it is unlawful to, inter alia, store data in, or use a computer, when one is without or beyond the express or implied consent of the owner, or without a reasonable, though mistaken belief that one has proper authorization. Defendant informs us, however, that the Criminal Justice Committee and the Computer Law Committee of the State Bar Association have concluded in a joint report that: (1) R.C. 2913.04 "is likely to be the type of statute that many people will unknowingly violate *** [and which] gave rise to the - 8 - litigation in State v. McGraw [Ind. App. 1984], 469 N.E. 2d 61"; (2) the term "approach" is problematical; and (3) "gain access" should be discarded in favor of "use *** without authorization." In addition, Proposed House Bill No. 524 offers an amendment to R.C. 2913.04(B) which has in fact deleted the term "gain access" and has adopted the term "use *** without authorization." We find this insufficient to render R.C. 2913.04 unconstitutionally vague. First, the joint committee's chief complaints do not concern the issue of fair notice, but rather focus upon the penalties imposed. In addition, McGraw, supra, concerned fair notice entailed in use of the term "property," and this term does not appear in R.C. 2913.04(B). Further, we fail to see how the deletion of "gain access" with its specific enumeration of the kinds of activities which are prohibited would render this statute more clear. Cf. State v. Young (1980), 62 Ohio St. 2d 370, 376. (R.C. 2923.04(A) was found facially unconstitutionally vague where, inter alia, it failed to specify with reasonable clarity the kinds of activity it prohibits). Also, because as presently written no violation of R.C. 2913.04(B) will be established when there is consent, and an affirmative defense will be established where one reasonably believes he has proper authorization, we fail to see how the "use *** without authorization" offers any additional illumination of the meaning of R.C. 2913.04. - 9 - Finally, in this case, the evidence established that defendant, without consent or a reasonable belief of authorization, physically deprived the District of a computer for three days, surreptiously stored data in the computer, and altered the passwords of the computer rendering at least one program unaccessible. As this conduct clearly and unambiguously falls within the prohibitions of R.C. 2913.04, it is doubtful that defendant possesses proper standing to raise a vagueness challenge. B. Overbreadth A statutory enactment may be overbroad if in its reach it prohibits constitutionally protected conduct. Grayned v. Rockford, supra, at 114. In this case, defendant has not demonstrated what privileged, protected activity R.C. 2913.04 precludes. Nor can we independently discern an overbreadth infringement as defendant has no privileged, protected right to unlimited use and access of the computer property of another. Defendant's second assignment of error is overruled. III. Defendant's third assignment of error states: "THE TRIAL COURT ERRED IN FAILING TO INSTRUCT THE JURY ON THE ISSUE OF IMPLIED CONSENT AS REQUESTED BY APPELLANT" If a requested instruction contains a correct and pertinent statement of the law, and is appropriate to the facts, it must be - 10 - included, at least in substance. State v. Brooks (1984), 21 Ohio App. 3d 47, 51. Where an incomplete instruction is given, and the accused's substantial rights are adversely affected, reversible error has occurred. Id. In this case, we find that the requested instruction was included within the substance of the court's general charge and we therefore fail to find reversible error. That is, defendant requested the following instruction as to the definition of implied consent: "Implied consent is determined by the circumstances which surround those involved, including their words, acts, inaction, silence, course of conduct, or the relationship between the parties from which the jury may infer that consent has been given to the defendant.[] Implied consent exists where a person by his line of conduct has shown a disposition to permit another person to do a certain thing without raising objection thereto.[] Implied consent exists where a person, though mistaken, reasonably believes, based on the circumstances, words, acts, inaction, silence and relationships involved that consent has been given." In its charge, however, the court explained: "You will determine from these facts and circumstances whether there existed at the time in question, in the mind of the defendant, an awareness of the probability that his access to the maintenance department computer was beyond the scope of the express or implied consent of the Sewer District. "Evidence of mistake of fact, lack of information, or other honest purpose negates the existence of knowledge. "If the defendant has an honest belief, arrived at in good faith, that he had consent - 11 - to use the computer, and acted in accordance with that belief, he is not guilty of the crime of unauthorized access to a computer since defendant's knowledge that his use of the computer was beyond the scope of the express or implied consent of the Sewer District is an essential element of the crime." (Tr. 547-548) Defendant's third assignment of error is overruled. IV. Defendant's first assignment of error states: "THE JUDGMENT OF CONVICTION AND SENTENCE IS AGAINST THE MANIFEST WEIGHT OF THE EVIDENCE" On the trial of a case, either civil or criminal, the weight to be given the evidence, and the credibility of the witnesses are primarily for the trier of the facts. State v. DeHass (1967), 10 Ohio St. 2d 230, paragraph one of the syllabus. In considering whether a conviction is against the manifest weight of the evidence, these guidelines may be considered, pursuant to State v. Mattison (1985), 23 Ohio App. 3d 10, 14: "'"1. Knowledge that even a reviewing Court of Appeals is not required to accept as true the incredible. *** "'"2. Whether evidence is uncontradicted, *** "'"3. Whether a witness was impeached, *** "'"4. Consideration of what was not proved, *** "'"5. The certainty of the evidence, *** "'"6. The reliability of the evidence, *** - 12 - "'"7. The extent to which any of the witnesses may have an interest to advance or protect by their testimony, *** "'"8. The extent to which the evidence is vague, uncertain, conflicting, fragmentary, or not fitting together in a [logical] pattern, ***."'" [Citations omitted.] In this case, the state presented evidence which consistently, credibly, and certainly demonstrated that defendant made use of the computer at his home without the consent of district personnel, that defendant stored an encrypted personal program into the computer, and that defendant changed the program and security passwords of the program, rendering at least one District program unaccessible to District employees. Further, while defendant admitted that he took the computer home, programmed it and changed the program password, he claims that there is only circumstantial evidence that he did so improperly. Defendant further claims that he acted with District consent or at least a reasonable basis for believing that his acts were authorized, and this constitutes a reasonable theory of innocence which precludes conviction. We note, however, that pursuant to State v. Jenks (1991), 61 Ohio St. 3d 259, paragraph one of the syllabus, there is no need for circumstantial evidence to be irreconcilable with any reasonable theory of innocence in order to sustain a conviction. Moreover, defendant's claims were wholly unsupported and self-serving, and were contradicted by defendant's previous statements, the surreptitious manner of removing the computer, the encrypted nature of the program he - 13 - installed, and failure to explain his conduct until it was discovered by his supervisors. Defendant's first assignment of error is overruled. Judgment affirmed. - 14 - It is ordered that appellee recover of appellant its costs herein taxed. The Court finds there were reasonable grounds for this appeal. It is ordered that a special mandate issue out of this Court directing the Court of Common Pleas to carry this judgment into execution. The defendant's conviction having been affirmed, any bail pending appeal is terminated. Case remanded to the trial court for execution of sentence. A certified copy of this entry shall constitute the mandate pursuant to Rule 27 of the Rules of Appellate Procedure. DAVID T. MATIA, P.J., CONCURS. HARPER, J., DISSENTS. (SEE ATTACHED DISSENTING OPINION) JUDGE JOHN F. CORRIGAN N.B. This entry is made pursuant to the third sentence of Rule 22(D), Ohio Rules of Appellate Procedure. This is an announce- ment of decision (see Rule 26). Ten (10) days from the date hereof, this document will be stamped to indicate journaliza- tion, at which time it will become the judgment and order of the court and time period for review will begin to run. COURT OF APPEALS OF OHIO EIGHTH DISTRICT COUNTY OF CUYAHOGA NO. 59190 : STATE OF OHIO : : : Plaintiff-Appellee : : DISSENTING -vs- : : OPINION THOMAS R. JOHNSON : : : Defendant-Appellant : : : DATE OF ANNOUNCEMENT OF DECISION: FEBRUARY 13, 1992 HARPER, J. DISSENTING: I must respectfully dissent from the majority opinion. The majority affirmed appellant's conviction on the evidence which, in my opinion, was against the manifest weight of the evidence and was insufficient as a matter of law to give a permanent criminal record to an otherwise law abiding citizen, who might have been a little misguided in his approach to carrying out his job assignments. The majority, in upholding appellant's conviction, stated: "In this case, the state presented evidence which consistently, credibly, and certainly demonstrated that defendant made use of the computer at his home without the consent of district personnel, that defendant stored an encrypted personal program into the computer, and that defendant changed the program and security - 2 - passwords of the program, rendering at least one District program inaccessible to District employees." Since the core of appellant's contention and the majority opinion is on the application of R.C. 2913.04(B), I shall address R.C. 2913.04(B) as applied to appellant. R.C. 2913.04(B) states as follows: "(B) No person shall knowingly gain access to, attempt to gain access to, or cause access to be gained to any computer, computer system, or computer network without the consent of, or beyond the scope of the express or implied consent of, the owner of the computer, computer system, or computer network or other person authorized to give consent by the owner." Appellant, in his first assignment of error, challenges the jury verdict as being against the manifest weight of the evidence. Appellant specifically argued that the application of R.C. 2913.04(B) to the within case was confusing to the jury since it cannot be ascertained from the verdict whether his conviction was based on lack of consent to remove the computer from the premises or lack of consent to access the computer. I agree. While the weight to be given evidence and the credibility to be attached to a witness' testimony are primarily left to the trier of facts, State v. DeHass (1967), 10 Ohio St. 2d 230, this court, however, has the power to weigh evidence, and if the case is a proper one and the question has been properly brought upon the record, it has a duty to do so. Hoover v. State (1914), 91 Ohio St. 41; Bridgeport Bunk Co. v. Shadyside Co. (1930), 121 Ohio St. 544; see also State, ex rel. Squire v. City of Cleveland (1948), 150 Ohio St. 303, 345. - 3 - An interpretation of a statute must accomplish the purpose for which it was intended, otherwise, the statute loses its effectiveness and meaningful purpose. I have seen the suggestion made that the law can be used to accomplish anything those in power desire. But it cannot be used to confound the conscience of justice. If the policy on which our law is founded is to be too broadly applied, as in the within case, then the law is no longer intended to protect, but to oppress. In the within case, appellant was convicted of gaining access to a computer in violation of R.C. 2913.04(B). The record is uncontroverted that appellant has a password and an unrestricted access to the computer he removed to his home. The implication that appellant's conduct of doing at home what he could have done at the office makes the otherwise lawful conduct unlawful is what makes this case rather intriguing. Appellant should not be convicted for unauthorized access or for exceeding the scope of his employer's consent of the very computer he is authorized to access, by the simple fact that he did the accessing at home. Implicit in the majority opinion is the fact that one of the reasons for affirmance was that the state "demonstrated that defendant made use of the computer at home without consent of district personnel," but removing a computer without authorization is not an issue addressed by R.C. 2913.04(B). The Ohio Penal Code is replete with provisions intending to punish such conduct, but R.C. 2913.04(B) is not one of those provisions. Assuming arguendo that appellant's - 4 - removal of the computer was punishable, the facts of this case still preclude conviction because the state has failed to show that appellant in any way intended to deprive the District of its use of its computer. The computer was removed during a holiday, when nobody was scheduled to use it. It was brought back in time for normal business operation. The so-called personal program the majority so relied on was put in the computer to help appellant in a more efficient running of his department and not for his home shopping or any other purpose not relating to his employment. There is no evidence that the so-called "encryption" was put in the computer by appellant. Appellant's supervisor, Mr. Ward, testified that to the best of his knowledge appellant took the computer home "for work on District business". The majority relied further on the state's argument that appellant's programming rendered "at least one District program unaccessible to District employees". However, Rochelle Bricker testified that she used the computer the very day appellant brought it back to the plant and it worked well. I find it ludicrous on one hand and extremely distressing on the other that a law abiding citizen is being given a criminal record because one employee could not access a program when it is not inconceivable that the employee, like many who use computers, could have misunderstood what it takes to access the computer at the time in question. After all is said and done, the role of this court is to review the facts of this case and apply it to the intent of the - 5 - statute and determine whether reasonable minds can reach different conclusions as to whether each material element of R.C. 2913.04(B) has been proved beyond a reasonable doubt. State v. Bridgeman (1978), 55 Ohio St. 2d 261, syllabus, to which I answer in the negative. The record also shows that the District did not have a clear policy on removal of District property from the premises or what programs can be entered in the computer. Appellant, therefore, was suspended, by his supervisor, not for accessing the computer, but for removing it from the premises. Appellant's conviction is a travesty of justice and should be overturned. The law is a two-edged sword. It is intended to bring a criminal to justice, but at the same time, forbids its use by government as an intimidation factor or as a tool to put people in check who would disagree with those in authority for personal and ideological reasons, none of which is criminal. I cannot, for the life of me, see the legal lesson this conviction accomplishes other than satisfying appellant's superior's intent to use the law and the government to intimidate their subordinates. This court cannot, by implication, sanction a process which can lead an overzealous prosecutor to use the penal code to create criminal records on law abiding citizens just because it is convenient and can be done. A careful review of this case leads me to hold that "the jury clearly lost its way and created such a manifest miscarriage - 6 - of justice that the conviction must be reversed." State v. Martin (1983), 20 Ohio App. 3d 172. Appellant's conduct did not rise to the level of a criminal violation as contemplated by the legislature in enacting R.C. 2913.04(B). Accordingly, I would vote to overturn appellant's conviction. .