united-states privacy hacking
Privacy on stolen laptop
<p>On slashdot.org the following case was discussed: <em>A</em> owns a laptop, and has software installed that allows to log into the laptop remotely. <em>B</em> steals the laptop, and uses it to log into their Facebook account. <em>A</em> logs remotely into his stolen laptop, notices the Facebook account, and finds the name, address, and phone number of the thief using the Facebook account. </p>

<p>There is the question what the owner of the laptop is allowed to do:</p>

<ol>
<li>Is the owner of a laptop authorized to access information put there by a thief – i.e., a person who definitely knew they had no right to use the laptop at all?</li>
<li>Is the owner of a laptop authorized to access a Facebook account of a laptop thief?  I.e., does the thief authorize the laptop owner by logging in to his account on the stolen laptop?</li>
<li>Would the identity of a laptop thief be protected from the legitimate owner because of privacy laws?</li>
</ol>

<p><strong>Summary:</strong> Accessing data is almost certainly OK as the laptop owner controls access and the thief has no expectation of privacy, but actively logging into someone else's Facebook account is questionable at best.</p>

<p>This answer does not consider any state laws that may affect the situation. </p>

<h1>Applicable legislation</h1>

<p>From a Fourth Amendment perspective, a thief has <a href="http://volokh.com/2011/08/31/do-you-have-fourth-amendment-rights-in-your-laptop-if-it-turns-out-it-was-stolen/" rel="nofollow noreferrer">no expectation of privacy</a> on a stolen laptop (cases cited in the link seem to extend this to all stolen property). While the Fourth Amendment is a protection against government intrusion and doesn't speak directly to individuals invading other individuals' privacy, I think it's a good baseline. </p>

<p>There turns out to be little federal legislation on this topic, as most is either industry specific (eg. parts of <a href="https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act" rel="nofollow noreferrer">HIPAA</a>), or is legislation on what the federal government itself can or can't do with private information (eg. <a href="https://en.wikipedia.org/wiki/Privacy_Act_of_1974" rel="nofollow noreferrer">Privacy Act of 1974</a>). The most relevant legislation I could find on the issue is the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">Computer Fraud and Abuse Act</a>, which is codified in <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">18 U.S. Code § 1030</a>.</p>

<p>Especially applicable to your question is subsection (a)(2)(C), which makes it an offence for whomever:</p>

<blockquote>
  <p>(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—(A) [...] (B) [...] or (C) information from any protected computer;</p>
</blockquote>

<p>The definition of "protected computer" is located in (e)(2) and has been interpreted to include essentially any internet-connected computer (which is the case here, given the remote login).</p>

<h1>Accessing the information</h1>

<p>Your 1st and 3rd questions boil down to whether accessing/obtaining the information "exceeds authorized access." Somewhat related is the Seventh Circuit Court of Appeals case <em>International Airport Centers, L.L.C. v. Citrin</em> [<a href="https://en.wikipedia.org/wiki/International_Airport_Centers,_L.L.C._v._Citrin" rel="nofollow noreferrer">wiki</a>, <a href="https://caselaw.findlaw.com/us-7th-circuit/1392048.html" rel="nofollow noreferrer">full text</a>]. In it, an employee on a company computer deleted information after leaving the company. It was found that he was not authorized to do so. </p>

<p>However, I don't personally think this case actually applies to the scenario. The laptop owner can make a strong argument that as the owner, he can ultimately authorize access to the computer and its contents. Also, with the knowledge that a thief has no expectation of privacy on a stolen computer, it can also be argued that the thief implicitly authorized access by placing the data there or making it available for remote login users to view it.</p>

<p>Additionally, there's a circuit split on what "authorized" means. The Ninth Circuit Court of Appeals has held in <em><a href="https://en.wikipedia.org/wiki/LVRC_Holdings_LLC_v._Brekka" rel="nofollow noreferrer">LVRC Holdings LLC v. Brekka</a></em> and <em><a href="https://en.wikipedia.org/wiki/United_States_v._Nosal" rel="nofollow noreferrer">United States v. Nosal</a></em> that restrictions of access (eg. not deleting company files) is not relevant to authorization, it is simply whether use of the computer itself is authorized. Following Ninth Circuit precedent, there's almost zero doubt that the laptop owner can legally access the thief's data as the owner controls authorization to access the computer.</p>

<h1>Logging into the thief's account</h1>

<p>As I explained above, I believe passively viewing what the thief is doing on their Facebook page is legal. However, obtaining credentials or session tokens and <em>actively</em> logging into the account to find information is different (it's not clear to me whether this is what you meant in your question, but I thought it would be useful to at least bring up this point). Accessing/obtaining data may itself be legal, but the method by which it is accessed/obtained and what is done with that information might not be legal.</p>

<p>In my brief research on this aspect, it is unclear if there would be any civil remedies available if there is no effective damage done (beyond violation of Facebook's terms of service). However, possible criminal offences include unauthorized access to a computer (Facebook's server, via the potentially illegal login) and circumventing technological barriers (by using someone else's credentials). See <a href="https://www.eff.org/deeplinks/2010/07/court-violating-terms-service-not-crime-bypassing" rel="nofollow noreferrer">this EFF article</a> for a little more info.</p>
