Stolen email - Can it be used as evidence in court?

[tbeard0902]

My ex-wife broken into my email account and printed emails prior to our divorce. She did not have the password. She used the "forgot password" feature to reset my password and then opened my email account. She is now using those emails in a lawsuit against my current wife of 1.5 years. My questions are: Is this considered stolen evidence since she did not have the password and her name was not on the account? And is it legal to use use evidence in court?

 

[Michael Wechsler]

Was this an account which had joint access? How did she use the forgot password feature to recover a password?

 

[mightymoose]

Nope. Nothing illegal about it.

You probably could make an argument to keep it out of court though, since it can't be authenticated.

 

[mightymoose]

How did she use the forgot password feature to recover a password?

Oh it's soooooooooo easy!

Guessing someone's security questions is not "hacking", and even if it was the victim would be the email provider, not the user. Obtaining the emails is not illegal, but how the information obtained is used COULD be.

Since she was able to access the account it could be assumed that she was able to send/receive/edit any messages on the account. The authenticity of the emails as having been written by a particular person and unedited can't be proven. The emails are a good information source for her, but should not stand as valid evidence for anything... assuming the appropriate argument is made to reject them.

 

[Michael Wechsler]

Oh it's soooooooooo easy!

Guessing someone's security questions is not "hacking", and even if it was the victim would be the email provider, not the user. Obtaining the emails is not illegal, but how the information obtained is used COULD be.

Since she was able to access the account it could be assumed that she was able to send/receive/edit any messages on the account. The authenticity of the emails as having been written by a particular person and unedited can't be proven. The emails are a good information source for her, but should not stand as valid evidence for anything... assuming the appropriate argument is made to reject them.

I disagree moose. It's hacking and unlawfully accessing the private property of another person. There are computer laws that deal with this matter such as wiretap statutes. See New Jersey for state laws that allow for prosecution for such an act:

Wrongful Access to a Computer N.J.S.A. 2C:20-32, N.J.S.A. 2C: 20-25 (Computer-Related Theft), N.J.S.A. 2C:20-30 (Damage or Wrongful Access to a Computer System), N.J.S.A. 2C:20-31 (Disclosure of Data for Wrongful Access), and/or N.J.S.A. 2C:20-32 (Wrongful Access to a Computer).

Let's just discuss what happened - guessing someone's password is no different than guessing how a key opens a lock on someone's front door and entering a home which was the right of exclusive access only by the owner/renter. In this instance, the wife may have done the same.

What's my question concerning? Whether this could have been a joint mailbox and also whether the wife was able to recover the password because she had shared access to the alternate email address to which a new password may have been sent.

An interesting leading case is this one: White v. White, 344 N.J. Super 211 (Ch. Div. 2001) which discusses the issue of whether a spouse had a right and ability to access files belonging to the other spouse.

 

[mightymoose]

Still.. the hack... if it is to be considered a hack... is an offense with the ISP or email provider as the victim since it is their computer system where the email resides. It sounds as if the wife never actually used the husband's computer- though she may have. The "hacked" computer is many miles away, and the ISP/email provider would be the victim. The husband would not have much of a claim to make, and would have to prove that the wife is the one that actually did it to even make a civil claim for invasion of privacy. Her possession of the info is not illegal. A crime doesn't occur until the information obtained is used for some illegal purpose, or if some sort of programming or script is used to alter the computer that was accessed. Simply logging into an email account and printing emails comes nowhere close to a crime... at least not in this scenario.
if it was a private company with secure servers within the business then we have something. However this is a computer in public domain that was accessed using the features provided by the website. Very very different.

 

[tbeard0902]

This was not a joint account, nor did she have an alternate account with which to receive the password. This was my private email. She was never given the password, nor permission to use the account. She simply used the forgot password feature while I was in the hopital, got my security question, called a relative to help figure out the answer and then reset my password. She now attempting to use the emails to sue my current wife for alienation of affection, among other things. I once read that breaking into ones email was considered the same as opening ones mail, and is thus covered under some privacy laws. Thus my question concerning the legality of the use of stolen emails.

 

[mightymoose]

White v. White, 344 N.J. Super 211 (Ch. Div. 2001)

It appears that nothing is really certain regarding this, though clearly the law is trying to catch up with the times. It appears New Jersey has a specific statute in place to address such issues, but certainly all states do not. The OP here will have to check specific state law in Mississippi.

I, for one, don't think there is anything to worry about here as far as a crime. The husband should not have had such a simple password if he was concerned about privacy.

 

[mightymoose]

She now attempting to use the emails to sue my current wife for alienation of affection, among other things.

She can not prove the emails have not been altered. She could have edited them to say anything she wants. Simply argue that the emails can not be authenticated and make them go away. If she wasn't bright enough to get the headers then she has even less to work with.

In the future, don't store sensitive information in public domain. Save them locally on your computer and use more secure passwords. The password reminder features are problematic for the very reason you found out- the answers are easily guessed. Come up with an easy to remember way to code your answers.

If the password hint is the name of your high school, and you went to Happy Town High School.... then try using the last letter of each word and alternate caps, and maybe substitute the corresponding number for the last letter. In such case, YnH12 would be your answer for Happy Town High School. Always use the same system and you will always know your passwords.

 

[tbeard0902]

The password was not that easy. As i stated, she had to call a relative to figure out the answer. We were married for 20 years, yet she didn't know the answer. However, I suspect that the password has little to do the the legality of this issue. The fact is she opened an account that was not her's. She pretended to be me and accessed the account. If I follow your thought process, what your saying seems to be that anyone can access anyone elses email account without fear of recourse. What's the use of private email if that's the case? Is there no protection for an invasion of privacy of this kind?

 

[tbeard0902]

Thanks for the ideas on how to fight the admission of the emails. They could prove very helpful.

 

[Michael Wechsler]

In the future, don't store sensitive information in public domain. Save them locally on your computer and use more secure passwords. The password reminder features are problematic for the very reason you found out- the answers are easily guessed. Come up with an easy to remember way to code your answers.

This is not true - the email was not stored in the "public domain." It was stored through a private mail account. The ex went through some trouble to hack into his email account. I could cite numerous different reasons why what she did was illegal and a crime. From what I am aware, all states have some statutes that make this a crime.

Let's make this easier - what if the ex hacked into his back account and took money? Using your example, the account is in the "public domain" and it's all dependent upon whether the password is strong enough. If the password isn't strong enough does that mean that the bank account is less private property? If it was hacked, does taking money (or any other information or item) any less of an invasion that could easily constitute trespass? Mississippi state law might not work well since it appears almost all the statutes deal with "land" as opposed to property... but let's move on. There are plenty of other statutes that could and are probably used.

Doing a quick search on Mississippi law, this could fit within computer fraud statutes calling her attempts to hack and login to another computer as a "false action" (couldn't find a definition of false but one definition under Black's Law Dictionary was "not genuine" which this access certainly falls under."

MISSISSIPPI
§ 97-45-1 Definitions
§ 97-45-3 Computer fraud; penalties.
§ 97-45-5 Offense against computer users; penalties
§ 97-45-7 Offense against computer equipment; penalties
§ 97-45-9 Offense against intellectual property; penalties
§ 97-45-11 Venue
§ 97-45-13 Effect on other offenses

SEC. 97-45-3. Computer fraud; penalties.

(1) Computer fraud is the accessing or causing to be accessed of any computer, computer system, computer network or any part thereof with the intent to:

(a) Defraud; * * *

(b) Obtain money, property or services by means of false or fraudulent conduct, practices or representations; or through the false or fraudulent alteration, deletion or insertion of programs or data; or

(c) Insert or attach or knowingly create the opportunity for an unknowing and unwanted insertion or attachment of a set of instructions or a computer program into a computer program, computer, computer system, or computer network, that is intended to acquire, alter, damage, delete, disrupt, or destroy property or otherwise use the services of a computer program, computer, computer system or computer network.

(2) Whoever commits the offense of computer fraud shall be punished, upon conviction, by a fine of not more than One Thousand Dollars ($1,000.00), or by imprisonment for not more than six (6) months, or by both such fine and imprisonment. However, when the damage or loss or attempted damage or loss amounts to a value of Five Hundred Dollars ($500.00) or more, the offender may be punished, upon conviction, by a fine of not more than Ten Thousand Dollars ($10,000.00) or by imprisonment for not more than five (5) years, or by both such fine and imprisonment.

SOURCES: Laws, 1985, ch. 319, Sec. 2; Laws, 2003, ch. 562, § 5, SB 2756, eff from and after July 1, 2003.

SEC. 97-45-1. Definitions.

For the purposes of this chapter, the following words shall have the meanings ascribed herein unless the context clearly requires otherwise:

(u) "Property" means property as defined in Section 1-3-45, Mississippi Code of 1972, and shall specifically include, but not be limited to, financial instruments, electronically stored or produced data and computer programs, whether in machine readable or human readable form.

 

[tbeard0902]

Would the following apply in this case?

Quoting 18 USC Sec. 2701. - Unlawful access to stored communications
--------------------------------------------------------------------------------

(a) Offense.--Except as provided in subsection (c) of this section whoever--

(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or

(2) intentionally exceeds an authorization to access that facility;

and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.

(b) Punishment.--The punishment for an offense under subsection (a) of this section is--

(1) if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain, or in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State--

(A) a fine under this title or imprisonment for not more than 5 years, or both, in the case of a first offense under this subparagraph; and
(B) a fine under this title or imprisonment for not more than 10 years, or both, for any subsequent offense under this subparagraph; and

(2) in any other case--

(A) a fine under this title or imprisonment for not more than 1 year or both, in the case of a first offense under this paragraph; and

(B) a fine under this title or imprisonment for not more than 5 years, or both, in the case of an offense under this subparagraph that occurs after a conviction of another offense under this section.

(c) Exceptions.--Subsection (a) of this section does not apply with respect to conduct authorized--

(1) by the person or entity providing a wire or electronic communications service;

(2) by a user of that service with respect to a communication of or intended for that user; or

(3) in section 2703, 2704 or 2518 of this title.

 

[Michael Wechsler]

SEC. 97-17-43. Petit larceny defined; penalty.

(1) If any person shall feloniously take, steal and carry away any personal property of another under the value of Five Hundred Dollars ($500.00), he shall be guilty of petit larceny and, upon conviction, shall be punished by imprisonment in the county jail not exceeding six (6) months or by fine not exceeding One Thousand Dollars ($1,000.00), or both. The total value of property taken, stolen or carried away by the person from a single victim shall be aggregated in determining the gravity of the offense.

-------------------

No question this should qualify if you want to make a case. Email data is your personal property. I'm also wondering about federal law, and this one comes to mind as a stored communications:

US Code - Chapter 121: Stored wire and electronic communications and transactional records access

(a) Offense. - Except as provided in subsection (c) of this
section whoever -
(1) intentionally accesses without authorization a facility
through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that
facility;
and thereby obtains, alters, or prevents authorized access to a
wire or electronic communication while it is in electronic storage
in such system shall be punished as provided in subsection (b) of
this section.
(b) Punishment. - The punishment for an offense under subsection
(a) of this section is -
(1) if the offense is committed for purposes of commercial
advantage, malicious destruction or damage, or private commercial
gain, or in furtherance of any criminal or tortious act in
violation of the Constitution or laws of the United States or any
State -
(A) a fine under this title or imprisonment for not more than
5 years, or both, in the case of a first offense under this
subparagraph; and
(B) a fine under this title or imprisonment for not more than
10 years, or both, for any subsequent offense under this
subparagraph; and
(2) in any other case -
(A) a fine under this title or imprisonment for not more than
1 year or both, in the case of a first offense under this
paragraph; and
(B) a fine under this title or imprisonment for not more than
5 years, or both, in the case of an offense under this
subparagraph that occurs after a conviction of another offense
under this section.
(c) Exceptions. - Subsection (a) of this section does not apply
with respect to conduct authorized -
(1) by the person or entity providing a wire or electronic
communications service;
(2) by a user of that service with respect to a communication
of or intended for that user; or
(3) in section 2703, 2704 or 2518 of this title.

 

[Michael Wechsler]

You pasted the one that I just did at the same time, lol. This federal act was designed to prevent hacking into email facilities which I would say is hacking into a Yahoo, Hotmail or corporate email server. It's privately owned. It doesn't matter whether the hack is brilliant or relatively simple.

There is also the Electronic Communications Privacy Act of 1986 ("ECPA") which might be of use.

These are just off the top of my head and IMHO and opinions may differ! I certainly enjoy hearing the other side and would enjoy hearing what MightyMoose thinks on these subject.

 

[tbeard0902]

Thanks professor!! I'm going to look into this quickly and throughly; then give the results to my attorney. It's time to fight back in this case.