Hacking, Facebook Fakers, and Felonies…What you don’t know can hurt you August 20, 2015Posted by Chris Mark in Uncategorized.
Tags: access, block, computers, control, cybercrime, facebook, hacking, information security, security, unauthorized, utah
Consider this situation. You want to see what your ex husband/wife is up to in 2015 and try to access his/her Facebook account only to realize that you have been ‘blocked’! Oh the Humanity! in response you decide to set up a ‘fake’ account and go to his/her public page to download some content. No harm no foul, right? Not so fast brainiac from Smartron 5! Let’s take a closer look at this situation. You could be committing a crime…and a felony no less!
Many states, including Utah, have statutes (laws) against. ‘Hacking’ which is generally acknowledged as ‘unauthorized’ access to computer systems (this is a blog post so some more detailed info is not included). Since I live in Utah, I will use the Utah law Utah Computer Crimes Act (76-6-702) as an example. First…let’s lay some ground work.
Facebook is explicit in their Terms and Conditions that “1) You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission. AND 2) You will not create more than one personal account.”.
So you set up a fake profile in violation of FB terms and conditions to check on your ex-husband/wife. Seems pretty benign. While troubling, is this a crime? In short, no. It does create a major problem, however.
Facebook allows users to ‘block’ those who are ‘bothering’ them. This point is important for two reasons. First, FB requires that a user use their real name and secondly, Facebook provides a mechanism to control access to your page. This “access control” is the key to the crime. In short, if your ex believes you should not see his/her stuff, and they ‘block’ you they are saying that you are “…not authorized to access my page and I have taken steps to control your access through technical mechanisms.” By setting up a ‘fake account’ you are deliberately circumventing the access control mechanisms to gain unauthorized access to your ex’s account. Remember from above…unauthorized access is…hacking.
Before we go to far down this read we need some working definitions from the Utah Computer Crime Act. Please check your own state for the various laws. (bold added for emphasis)
Authorization- “”Authorization” means having the express or implied consent or permission of the owner, or of the person authorized by the owner to give consent or permission to access a computer, computer system, or computer network in a manner not exceeding the consent or permission.”
Security System – “”Security system” means a computer, computer system, network, or computer property that has some form of access control technology implemented, such as encryption, password protection, other forced authentication, or access control designed to keep out unauthorized person“
The two definitions are critical to the larger discussion. It could be argued that by NOT applying ‘blocking’ or other ‘access control’ technologies (Facebook privacy settings) you are providing implicit consent for people to access your Facebook page. By applying the blocking feature a Facebook user is explicitly telling a user that they are NOT authorized to access the page. Remember, under Facebook’s terms and conditions, it is a violation to set up a ‘fake profile’ or more than one profile. By applying the ‘blocking’ feature on Facebook, a user is employing “..some form of access control…” designed to “…keep out unauthorized person(s).” By using a fake profile to access a page from which you are blocked you are (in my mind) committing a crime.
Utah 76-6-703 Computer Crimes and Penalties states that (bold added for emphasis): “A person who without authorization gains or attempts to gain access to and alters, damages, destroys, discloses, or modifies any computer, computer network, computer property, computer system, computer program, computer data or software, and thereby causes damage to another, or obtains money, property, information, or a benefit for any person without legal right, is guilty of”
(while there are different clauses, this one sticks out for this example)
“(e) a third degree felony when:
(i) the property or benefit obtained or sought to be obtained is a license or entitlement;
(ii) the damage is to the license or entitlement of another person; or
(iii) the information obtained is confidential; or
(iv) in gaining access the person breaches or breaks through a security system.”
Understanding the above, it would certainly seem as if a person who sets up a fake Facebook profile with the objective of ‘breaking through’ a security system (ie. the blocking mechanism on Facebook) appears to be committing a 3rd Degree Felony in Utah!..WOW! A seemingly simple action could land someone in major trouble…
The point of this post is to caution people about such actions. They may appear benign but could be a violation of numerous laws. At a minimum they are a violation of Facebook’s terms of service and make you look like a stalking idiot…