Court Opinion

ID: 4017852
Source: CourtListenerOpinion
Date Created: 2016-07-21 15:11:16.541501+00
Date Added: 2024-06-11T14:34:22.855892
License: Public Domain

28	                             July 21, 2016	                           No. 48

              IN THE SUPREME COURT OF THE
                    STATE OF OREGON

                   STATE OF OREGON,
                   Respondent on Review,
                              v.
               CARYN ALINE NASCIMENTO,
                    Petitioner on Review.
           (CC 09FE0092, CA A147290, SC S063197)

    On review from the Court of Appeals.*
    Argued and submitted November 12, 2015.
   Daniel C. Bennett, Deputy Public Defender, Salem,
argued the cause and submitted the brief for the petitioner.
With him on the brief was Ernest G. Lannet, Chief Defender,
Office of Public Defense Services.
   Patrick M. Ebbett, Assistant Attorney General, Salem,
argued the cause and filed the brief for the respondent. With
him on the brief was Ellen F. Rosenblum, Attorney General,
and Anna Joyce, Solicitor General.
   J. Ashlee Albies, Creighton & Rose PC, Portland, filed
the brief for amicus curiae Electronic Frontier Foundation.
With her on the brief was Jamie L. Williams, Electronic
Frontier Foundation, San Francisco, California.
  Before Balmer, C.    J., and Kistler, Walters, Landau,
Baldwin, Brewer, JJ.**
    BALMER, C.  J.
   The decision of the Court of Appeals is reversed. The judg-
ment of the circuit court is affirmed in part and reversed in
part, and the case is remanded to the circuit court for fur-
ther proceedings.
______________
	**  Appeal from Jefferson County Circuit Court, George W. Neilson, Judge.
268 Or App 718, 343 P3d 654 (2015).
	   **  Linder, J., retired December 31, 2015, and did not participate in the deci-
sion. Nakamoto, J., did not participate in the consideration or decision of this
case.
Cite as 360 Or 28 (2016)	29

     Case Summary: Defendant, who was convicted of aggravated first-degree
theft and computer crime, sought review of a decision of the Court of Appeals
upholding her conviction for computer crime. Defendant, who worked as a deli
clerk at a convenience store, used the store’s lottery terminal to dispense lottery
tickets for herself, and did not pay for those tickets. Defendant was convicted of
theft based on her activities and did not challenge that conviction. Defendant also
was charged with computer crime under ORS 164.377(4), on the theory that she
accessed the lottery terminal “without authorization.” Defendant argued that her
use of the lottery terminal, although in violation of her employer’s policies and for
an unlawful purpose, was not “without authorization” as that term is used in ORS
164.377(4), because she was authorized to use the lottery terminal to dispense
lottery tickets in the course of her employment. Held: Defendant was prosecuted
for computer crime under ORS 164.377(4), which criminalizes computer use
without authorization, rather than under ORS 164.377(2), which criminalizes
computer use for purposes of committing theft of fraud. Under ORS 164.377(4),
an employee’s use of a computer to perform a task she was authorized to perform
does not become “without authorization” because the use violates the employer’s
personnel or computer use policies. The focus of the statute is not on the purpose
for which a person uses a computer, but on whether the use is “authorized.” The
legislative history of the statutes demonstrates that this subsection was directed
at criminalizing remote hacking of computers by unauthorized third parties, and
was not directed at persons trained and authorized to use a computer who do so
for purposes that an employer does not permit.
    The decision of the Court of Appeals is reversed. The judgment of the circuit
court is affirmed in part and reversed in part, and the case is remanded to the
circuit court for further proceedings.
30	                                                    State v. Nascimento

	           BALMER, C. J.
	        The narrow but potentially far-reaching issue in
this case is the scope of ORS 164.377(4), which makes it
a crime to use, access, or attempt to access a computer
or computer network “without authorization.” The state
argues that, although defendant’s employer authorized
her to use the computer terminal at issue here, defen-
dant did so for a purpose not permitted by her employer
and thus was guilty of computer crime. Defendant con-
tends that, because her access to and use of the computer
terminal was authorized by her employer, she cannot be
guilty of violating ORS 164.377(4), even if she used the
computer for an impermissible purpose. She concedes,
however, that her use may have violated her employer’s
policies or other provisions of ORS 164.377. For the rea-
sons explained below, we agree that defendant’s conduct
did not violate subsection (4) of the statute, and, accord-
ingly, that the trial court erred in denying her motion for
judgment of acquittal. We therefore reverse defendant’s
computer crime conviction.
	        Defendant was convicted of theft and computer
crime for using a computer terminal at work, which was
linked to the Oregon State Lottery, to print and steal lot-
tery tickets. She appealed the conviction for computer crime,
arguing that the trial court erred in denying her motion for
judgment of acquittal on that count because, she argued,
she was “authorized” to use the computer terminal and
therefore had not violated ORS 164.377(4).1 In reviewing the
denial of a motion for judgment of acquittal, we describe the
facts and all reasonable inferences that may be drawn from
those facts in the light most favorable to the state. State v.
Walker, 356 Or 4, 6, 333 P3d 316 (2014).
	        Defendant was employed as a deli clerk at Tiger
Mart, a convenience store in Madras, beginning in 2007.
In February 2009, Masood, the vice-president of the store’s
parent company, investigated issues relating to the sale of
lottery tickets at the Tiger Mart. He found that, between
November 2008 and February 2009, there were unexplained
	1
        Defendant did not challenge the theft conviction on appeal.
Cite as 360 Or 28 (2016)	31

cash shortages well beyond the amount expected in the oper-
ation of such a store, sometimes exceeding $1,000 a day. He
soon determined that the store also showed a surprisingly
large number of sales of Keno lottery tickets, including sales
of an unusual number of high-priced tickets. The total short-
ages between November 2008 and February 2009 exceeded
$16,000. After examining cash register receipts and lottery
reports, he concluded that the shortages related to the sale
of Keno tickets and that they occurred on days when defen-
dant was working. Masood also reviewed video recordings
and observed occasions when defendant would move from
the deli area to the cash register area and print out and
pocket Keno tickets from the lottery terminal. Masood sus-
pected that defendant was printing and taking—but not
paying for—those Keno tickets. Although Masood did not
work in the store himself and did not train defendant, he
testified at one point that defendant was not authorized
to use the lottery terminal to dispense Keno tickets, and
at another point, in response to a question about whether
defendant was supposed to be operating the lottery ter-
minal, stated “Not as far as I know.” He further indicated
that, to the best of his knowledge, defendant had not been
trained to operate the lottery terminal that dispensed Keno
tickets.
	        Donelly, the manager of the Tiger Mart and defen-
dant’s direct supervisor, testified that she had trained defen-
dant and other deli employees to use the cash register and
the lottery terminal, and that they routinely were required to
use them when other employees were busy or taking breaks.
She testified that she had authorized defendant to use the
lottery terminal and the cash register. She indicated that
that practice had been in place before the current owners
took over the convenience store and that she did not recall
there being any policy prohibiting deli clerks from operat-
ing the cash register or the lottery terminal. Another deli
employee confirmed Donelly’s testimony about deli workers’
regular use of the cash register and lottery terminal. Both
Masood and Donelly, as well as the other employee, testified
that the store had a policy that employees were not to pur-
chase or redeem lottery tickets on their own behalf while on
duty.
32	                                       State v. Nascimento

	        The state presented evidence about the lottery ter-
minal itself and how defendant was trained to use it. The
lottery terminal is a touchscreen machine that is networked
to the Oregon State Lottery. The terminal has only three
functions: It can print lottery tickets, it can scan lottery
tickets to validate whether they are winning tickets, and
it can produce reports. It is not networked with the store’s
cash register. A manager needed to sign in once a day to
activate the terminal, but the terminal did not otherwise
require any sort of password to operate. Tiger Mart employ-
ees received training that, when they sold lottery tickets,
they were to collect payment from customers and put the
payment in the cash register before using the touchscreen
on the lottery terminal to dispense the ticket or tickets.
	        The state also presented video evidence that, when
no one else was around, defendant used the lottery termi-
nal at the Tiger Mart to print Keno tickets, which she then
pocketed. There also was evidence that defendant failed
to pay for those Keno tickets. Other evidence showed that
defendant had redeemed at least one winning ticket through
the mail and had redeemed other tickets at a local store.
Further evidence was presented correlating some of those
tickets to video evidence of defendant using the lottery
terminal at the Tiger Mart. Thus, evidence supported the
state’s theory that defendant used the lottery terminal to
print lottery tickets that she took without paying for and
that she later redeemed those tickets.
	        Defendant was charged with one count of aggra-
vated first-degree theft, as well as computer crime. The com-
puter crime statute, ORS 164.377, provides, in part:
   	 “(2)  Any person commits computer crime who know-
   ingly accesses, attempts to access or uses, or attempts to
   use, any computer, computer system, computer network or
   any part thereof for the purpose of:
   	 “(a)  Devising or executing any scheme or artifice to
   defraud;
   	 “(b)  Obtaining money, property or services by means
   of false or fraudulent pretenses, representations or prom-
   ises; or
Cite as 360 Or 28 (2016)	33

   	 “(c)  Committing theft, including, but not limited to,
   theft of proprietary information or theft of an intimate
   image.
   	   “* * * * *
   	 “(4)  Any person who knowingly and without authori-
   zation uses, accesses or attempts to access any computer,
   computer system, computer network, or any computer soft-
   ware, program, documentation or data contained in such
   computer, computer system or computer network, commits
   computer crime.”

	       It is of particular significance in this case how
the computer crime count was charged. The caption of the
indictment cited ORS 164.377(2), but the body of the indict-
ment charged conduct that instead tracked ORS 164.377(4),
including the “without authorization” wording that does not
appear in subsection (2):
   	 “The defendant, on or between November 11, 2008 and
   February 6, 2009, in Jefferson County, Oregon, did know-
   ingly and without authorization use and access a computer
   system operated by Tiger Mart Convenience Store, an
   entity, under contract to and at the direction of the Oregon
   State Lottery Commission; contrary to statute and against
   the peace and dignity of the State of Oregon.”

(Emphasis added.)
	       After the state’s evidence was presented, defen-
dant moved for a judgment of acquittal, arguing that the
state had not presented sufficient evidence to create a jury
question as to whether defendant used the lottery terminal
“without authorization,” noting the evidence that deli clerks
were, in fact, authorized to use the lottery terminal. The
prosecutor did not dispute that point, but argued instead
that
   “the access alone is not what makes this criminal. It’s that
   the access is for the purpose of under three different cate-
   gories, devising or executing a scheme or artifice to defraud
   obtaining money, property, or services through fraudulent
   pretenses or committing theft—
   “* * * * *
34	                                        State v. Nascimento

   “That’s under—from the statute itself, ORS 164.377, and
   under State v. Schwartz, 173 Or App 301 [21 P3d 1128
   (2001) (discussing subsections (2) and (3) of the statute)].
   “* * * * *
   	 “So therefore, Your Honor, the fact that she did have
   some apparent authority to operate the machine to sell
   tickets and to conduct business of Tiger Mart [does not
   affect] the fact that she then also used the terminal to
   print out tickets for which she did not pay. That is the
   unauthorized—the knowing unauthorized use of the ter-
   minal. Such that she committed theft while she was doing
   that and therefore the State has met its elements on that
   crime.”
	        The trial court denied defendant’s motion for judg-
ment of acquittal without explanation. In her closing argu-
ment, the prosecutor described the case as involving “a
simple issue of did someone steal lottery tickets from the
Tiger Mart—Tiger Mart here in town and the Oregon State
Lottery.” When discussing the computer crime count, the
prosecutor stated:
   “[Defendant] went onto the computer, the computer was
   part of the Oregon State Lottery System, she printed out
   those tickets, and she did so with the purpose of steal-
   ing those tickets. So the theft of the tickets counts as the
   purpose that is that she is authorized [sic], that she was
   accessing a computer. We’re not talking about the time
   when she was acting as an employee and actually selling
   tickets to customers who were paying for them. That’s not
   the kind of behavior we’re talking about. We’re talking
   about her printing those tickets out for herself so that she
   could [indiscernible].”
	       In instructing the jury on computer crime, the trial
court followed the wording in the indictment. That is, it
instructed that the jury needed to find that defendant used
or accessed a computer “without authorization.”
	        As noted, the jury found defendant guilty of com-
puter crime, as well as aggravated first-degree theft, and
defendant appealed the computer crime conviction, arguing
that the trial court erred in denying her motion for judgment
of acquittal. In particular, she argued that ORS 164.377(4)
Cite as 360 Or 28 (2016)	35

does not criminalize theft by means of a computer—rather,
subsection (2) of the statute criminalizes that conduct.
Defendant contended that subsection (4) relates only to
using or accessing a computer without authorization, and
the evidence in this case, while it could have supported a
conviction under subsection (2), did not support a conviction
under subsection (4). The Court of Appeals rejected that
argument, concluding that “[t]here was evidence from which
the jury could conclude that [defendant] was authorized to
access the physical device itself—the lottery terminal—only
to serve paying customers.” Nascimento, 268 Or App at 722.
It therefore concluded that the record was sufficient for the
jury to have found that defendant used the computer “with-
out authorization.” Id.
	        In this court, defendant maintains that she did not
use the lottery terminal “without authorization.” She again
acknowledges that the evidence could have been sufficient
to establish a violation of subsection (2) of ORS 164.377—
which prohibits, among other things, using or accessing a
computer for the purpose of “obtaining money * * * by means
of false or fraudulent pretenses” and “committing theft”—
but reiterates that she was not charged under that subsec-
tion. See, e.g., State v. Briggen, 112 Or 681, 683, 231 P. 125
(1924) (court looks to the body of the indictment, not the
caption, to determine what crime is charged). Defendant
does not dispute that there was evidence that she accessed
the lottery terminal to print tickets without having received
payment—or having made payment herself—for the tickets.
However, she argues that that act does not constitute access-
ing or using a computer “without authorization.” Defendant
also suggests that the Court of Appeals’ interpretation of
subsection (4) is so broad as to raise constitutional vague-
ness concerns.
	        The state makes two arguments in response. First,
it asserts that defendant used the lottery terminal for a pur-
pose not permitted by her employer. Specifically, the state
introduced evidence that Tiger Mart’s policy was that deli
clerks like defendant were authorized to use the terminal
only when a customer wanted to buy or validate a ticket and
the cashier was unavailable, and that defendant’s use of the
terminal to print tickets for herself therefore was “without
36	                                       State v. Nascimento

authorization,” as that term is used in ORS 164.377(4).
The state contends that the statute is not unconstitution-
ally vague because it unambiguously prohibits a person
from doing anything with a computer without permission.
Second, apparently as an alternative basis for affirmance,
the state argues that, even under defendant’s definition of
“authorization” as related to physical access or use of the
computer, rather than access or use only in compliance with
an employer’s policies, evidence in the record supported the
guilty verdict. Specifically, the state points to Masood’s tes-
timony that defendant was not authorized to use the termi-
nal at all. As noted, at trial the prosecutor conceded, for pur-
poses of defendant’s motion for judgment of acquittal, that
defendant did have authorization from her supervisor to use
the lottery terminal. The state, however, now asserts that
it may disavow that concession and argues that, although
Masood’s testimony on authorization was contradicted by all
of the other evidence on that point, it nonetheless was suf-
ficient to defeat defendant’s motion. See generally Outdoor
Media Dimensions Inc. v. State of Oregon, 331 Or 634,
659-60, 20 P3d 180 (2001) (reviewing court has discretion
to affirm ruling of lower court on an alternative basis if
facts support alternative basis, alternative view of evidence
is consistent with trial court’s ruling, and record would not
have developed in materially different way had prevailing
party raised alternative basis below).
	       We first address—and reject—the state’s proffered
alternative basis for affirmance. As the narrative above
demonstrates, the prosecutor apparently was confused
about how the computer crime offense had been charged
in the indictment. That is, her argument in opposition to
defendant’s motion for judgment of acquittal focused on
whether the state had provided adequate evidence to sat-
isfy the requirements of ORS 164.377(2)(a), (b), or (c),
rather than ORS 164.377(4). To the extent that the prose-
cutor addressed the concept of “authorization,” she agreed
that defendant had been given “authority [to] operate the
machine to sell tickets and conduct the business of Tiger
Mart,” but argued that what made defendant’s use of the lot-
tery terminal “unauthorized” was that she used the lottery
terminal for the purpose of committing theft, a use that is
Cite as 360 Or 28 (2016)	37

expressly prohibited by ORS 164.377(2)(c). In making those
arguments, the prosecutor conceded that defendant was, in
fact, authorized by her supervisor as part of her employment
to use the lottery terminal to print lottery tickets.
	        We agree with the state’s general proposition that,
at least in the abstract, a prosecutor in that circumstance
could have argued that Masood’s equivocal evidence about
whether or not defendant was authorized to use the lottery
terminal at all was sufficient to defeat a motion for judgment
of acquittal on that point, given that the court was required
to view all of the evidence in the light most favorable to the
state, and not to weigh the evidence. But the prosecutor did
not make that argument, and in fact conceded the point.2
As noted, one of the criteria for our discretionary review of
alternative bases for affirmance is whether, had an argu-
ment been made in the trial court, the record could have
developed in a materially different way. Outdoor Media, 331
Or at 659-60. In this case, we have no doubt that, had the
prosecutor made the argument that the state now makes,
the record might well have developed differently.
	        The evidence on which the state now relies for affir-
mance on that ground was equivocal and weak, at best. Had
the state relied on it in opposition to a motion for judgment
of acquittal rather than disavowing it as the basis for its
legal argument, defendant easily could have countered that
evidence in her own case-in-chief, as there appears to have
been no shortage of witnesses who would have confirmed
that defendant was, in fact, trained by her supervisor to use
the lottery terminal to print lottery tickets and was expected
to do so as part of her job. See, e.g., State v. Dickerson, 356 Or
822, 826-27, 345 P3d 477 (2015) (rejecting state’s alterna-
tive basis for affirmance of denial of motion for judgment of
acquittal on different factual theory than pursued by state

	2
       We do not fault the prosecutor for failing to pursue that theory of the case.
As noted, Masood’s own testimony indicated that he did not have personal knowl-
edge of whether defendant was authorized to use the lottery terminal, and the
state presented extensive evidence that defendant had, in fact, been authorized
by her supervisor to use the lottery terminal and had been trained to do so. Thus,
while that theory of the case might have been viable as a technical matter, as
a practical matter it is not surprising that the prosecutor would not ultimately
want to rely on it in trying to secure a conviction.
38	                                                 State v. Nascimento

at trial, in part because record might have developed differ-
ently had state raised theory below). As we observed in State
v. Burgess, 352 Or 499, 504, 287 P3d 1093 (2012), based on
the circumstances of that case, “it would be fundamentally
unfair to defendant to sustain defendant’s conviction on a
separate factual and legal theory that has been proffered by
the state for the first time on appeal.” That is even more so
in a circumstance such as this, where the state conceded in
the trial court the factual and legal theory that it advances
for the first time on appeal.
	        We thus return to the issue that was litigated in
the lower courts: Whether defendant’s use of the lottery
terminal to print Keno tickets for herself—tickets that she
did not pay for—constituted “computer crime” under ORS
164.377(4), because she printed those tickets “without
authorization.” Our goal is to determine the intent of the
legislature in enacting that statutory provision, which we
do by examining the text, context, and legislative history of
the statute. State v. Gaines, 346 Or 160, 171, 206 P3d 1042
(2009). We again set out subsection (4):
   	 “Any person who knowingly and without authorization
   uses, accesses or attempts to access any computer, computer
   system, computer network, or any computer software, pro-
   gram, documentation or data contained in such computer,
   computer system or computer network, commits computer
   crime.”3
	        Although ORS 164.377(1) provides definitions
of numerous terms used in the computer crime statute,
it does not define “authorization” or “without authoriza-
tion.” It does define “computer” and “computer system,”
and the latter term specifically includes lottery termi-
nals. ORS 164.377(1)(b), (f). Subsection (1) also defines
the verb “access,” as “to instruct, communicate with, store
data in, retrieve data from or otherwise make use of any

	3
      A violation of ORS 164.377(4) generally is a misdemeanor. In this case, it
was treated as a class C felony, because ORS 164.377(5)(b) provides:
   	    “Any violation of this section relating to a computer, computer network,
   computer program, computer software, computer system or data owned
   or operated by the Oregon State Lottery or rented, owned or operated by
   another person or entity under contract to or at the direction of the Oregon
   State Lottery Commission shall be a Class C felony.”
Cite as 360 Or 28 (2016)	39

resource on a computer, computer system or printer.” ORS
164.377(1)(a). It is undisputed that, when defendant used
the lottery terminal to dispense Keno tickets, she “used”
and “accessed” a “computer system,” as those terms are
used in ORS 164.377.
	        As to the meaning of “without authorization,” the
state proposes an extremely broad definition, arguing that
any time a person uses or accesses a computer for a purpose
not permitted by the computer’s owner, the person does so
“without authorization” and commits computer crime. For
that reason, the state contends, even though defendant was
authorized to physically use the terminal to print Keno tick-
ets, because she violated her employer’s policy by using it to
print Keno tickets for her own use (and also by not paying
for them), her use was “without authorization,” in violation
of ORS 164.377(4). In short, the state’s argument is that an
employee’s otherwise authorized use of an employer’s com-
puter is “without authorization”—and therefore a computer
crime under ORS 164.377(4)—whenever the employee’s
access or use violates the employer’s personnel or computer
use policies.
	        Defendant, on the other hand, notes that the 1985
Legislative Assembly that enacted subsection (4) was con-
cerned with remote “hacking” of computers by persons with
no right to access those computers. Defendant suggests that
the statute therefore was not meant to reach conduct such
as hers, which she characterizes as “authorized use for an
impermissible purpose.” Rather, she argues, when a person
is permitted to use an employer’s computer system, and
when the person uses the computer as permitted—here, to
print lottery tickets—the person’s use is “authorized,” even
if the use is for an impermissible purpose. She asserts that
ORS 164.377(4) addresses authorization to use or access a
computer, not the particular purpose for or circumstances of
that use.
	        Amicus curiae Electronic Frontier Foundation
contends that the Court of Appeals and the state’s reading
of the statute—which arguably criminalizes any computer
use in violation of an employer’s personnel or computer use
policies—is unworkably broad because it gives private
40	                                       State v. Nascimento

entities the power to decide what conduct in the workplace
is criminal and what is not. Amicus argues that “with-
out authorization” should be construed narrowly, as fed-
eral courts have construed somewhat similar provisions
in the Computer Fraud and Abuse Act, 18 USC § 1030, as
accessing a computer by circumventing security measures,
rather than simply violating an employer’s use restriction
policies.
	        As noted, the parties agree that defendant “accessed”
and “used” a “computer network.” The question is whether
she did so “without authorization.” The meanings of “autho-
rization” and “authorize” are not obscure. “Authorization” is
simply “the state of being authorized.” Webster’s Third New
Int’l Dictionary 146 (unabridged ed 2002). “Authorize,” in
turn, means “to endorse, empower, justify, or permit by or
as if by some recognized or proper authority.” Id. We agree
with defendant that her employer “empowered” and “permit-
ted” her to use the lottery terminal. The actual use that she
made of the lottery terminal—to print lottery tickets—was
a use “authorized” by her employer.
	         The state does not disagree that defendant was
authorized to use the lottery terminal to print lottery tick-
ets, but contends that her use of the terminal became “unau-
thorized” when she used it to print tickets for herself with-
out paying for them. That use was “unauthorized” within
the meaning of ORS 164.377(4), the state contends, because
it was for a purpose that was prohibited by her employer’s
policies. For her part, defendant concedes that she may have
violated her employer’s computer use or personnel policies by
printing lottery tickets for herself and failing to pay for them.
She also concedes that she may have violated provisions of
the computer crime statute other than ORS 164.377(4), in
addition to the theft statute under which she also was con-
victed. However, she maintains that ORS 164.377(4) does
not criminalize her conduct here. She points out that she was
trained and authorized to use the computer to print lottery
tickets and, moreover, that she did not bypass any security
measures or access any protected data. For those reasons,
she asserts, her use of the computer to print lottery tickets
was authorized, and it did not become “unauthorized,” even
though her purpose in printing tickets for her own use (and
Cite as 360 Or 28 (2016)	41

not paying for them) violated her employer’s personnel or
computer use policies.
	        It is difficult to square the state’s position with the
text of ORS 164.377(4). The text establishes a binary divi-
sion between those who are “authorized” to access or use a
computer and those who are not. The text does not distin-
guish between use that is authorized for certain purposes
(such as those permitted by employer policies) and use that
otherwise would be authorized but that is inconsistent with
those policies. Indeed, subsection (4) of the statute does not
focus on the purpose or manner of use at all, but only on
whether the access or use is “authorized.”
	        As noted, “access” is defined in the computer
crime statute as “retriev[ing] data” or “mak[ing] use of any
resource on a computer.” ORS 164.377(1)(a). If a person is
“empowered” or “permitted”—the dictionary synonyms of
“authorized”—by the appropriate authority to “retrieve
data” or “make use” of the computer, then that use is “autho-
rized.” Applying those words in their ordinary senses, it is
a stretch to suggest that an employee who uses her work
computer to send a private email during the work day—
or check Facebook or buy a movie ticket—contrary to her
employer’s policy against personal use, has “accessed” or
“used” the computer “without authorization,” although she
may have violated her employer’s policy. Nothing in the text
of the statute suggests that the legislature intended such a
result. As defendant argues, the state’s interpretation would
criminalize not only “unauthorized” use of a computer, but
also “authorized use for an impermissible purpose.” Such an
interpretation would require adding words to the text of the
statute that the legislature did not use. See ORS 174.010
(court may not add words to statute).
	        Viewed in that light, the text supports defendant’s
assertion that her use of the lottery terminal to print Keno
tickets—as she was trained and permitted by her employer
to do—was “authorized” use. The fact that she printed the
tickets for her own use and did not pay for them may have
violated company policies and other parts of the computer
crime statute (in addition to the theft statute), but her use
was not “without authorization” as that term is used in ORS
42	                                                   State v. Nascimento

164.377(4).4 That conclusion is supported by the evidence
that, once a store manager had signed into the terminal
and activated it at the beginning of the work day, employ-
ees such as defendant could use the terminal to print Keno
tickets without additional authentication or permission.
When defendant physically accessed and used the terminal
to print Keno tickets, that access and use was authorized by
her employer. Moreover, there was, for example, no evidence
that defendant circumvented any computer security mea-
sures, misused another employee’s password, or accessed
any protected data. The sole basis for the state’s claim that
defendant’s printing of Keno tickets was “unauthorized” was
the employer’s policy that employees were not supposed to
print tickets for their own use and were supposed to obtain
payment for tickets before printing them.
	        The legislative history of ORS 167.377(4) sup-
ports defendant’s argument that the statute was intended
to criminalize access or use of a computer by someone who
had no authority to do so, the kind of intrusion or access
to a computer by unauthorized third parties commonly
referred to as “hacking.” HB 2795, as introduced during
the 1985 legislative session, was concerned with the theft
of cable television services. See Bill File, HB 2795 (1985).
Representatives of General Telephone Company urged the
adoption of an amendment to that bill that would deal with
a related problem, “computer crime, or computer hackers
if you will.” Tape Recording, House Judiciary Committee,
Subcommittee 1, May 6, 1985, Tape 576 (testimony of Dave
Overstreet, General Telephone Company). The head of
General Telephone’s security department noted that many
businesses now used computers, stating that, “what we’re
trying to get into the statute is a part of the law that will
prevent people from calling into someone’s computer.” Id.

	4
       We do not rely on federal court interpretations of the Computer Fraud and
Abuse Act, 18 USC § 1030, because the text of the federal and state statutes have
some differences and because ORS 164.377 was passed a decade before the fed-
eral law. However, we note that the federal courts have interpreted that statute,
which prohibits computer access “without authorization”—and also, arguably
broader than the Oregon statute, use that “exceeds authorized access”—not to
prohibit use that is otherwise authorized but that violates employer use restric-
tions. See, e.g., United States v. Nosal, 676 F3d 854 (9th Cir 2012) (en banc) (so
holding).
Cite as 360 Or 28 (2016)	43

He gave, as examples, people who had obtained access to
business computers that lacked security systems and had
altered business documents, as well as individuals who had
made their way remotely into telephone company comput-
ers and obtained and then publicly posted confidential tele-
phone billing codes. Id.
	        In response to a legislator’s concern that the amend-
ment might restrict computer hobbyists who used telephone
modems to connect with other computers, Marion County
District Attorney Dale Penn emphasized that the law would
apply to only third parties who had no authority to access
the remote computer:
   	 “There we get into the definition of ‘access.’ I think * * *
   if you call up to a computer system and you’re not autho-
   rized you’re probably not even going to be able to get the
   menu up. If you’re calling to a bulletin board you’re going
   to see the menu. And that’s not what we’re addressing here.
   We’re addressing a computer system in which you’re not
   authorized to dial. You won’t know the codes.”
Id. (Emphasis added.) Testimony before the Senate Judiciary
Committee was to the same effect. General Telephone’s rep-
resentative, Overstreet, again testified in support of the com-
puter crime provisions, which he described as addressing
“computer hackers—persons who use computers to defraud.”
Tape Recording, Senate Judiciary Committee, June 7, 1985,
Tape 180, Side A; Minutes, Senate Judiciary Committee,
HB 2795, June 7, 1985, 18.
	        The legislative history thus shows that the com-
puter crime provisions were intended to address the unau-
thorized access of a computer by “hackers” or by others who
had no authority whatsoever to use the computer—who, in
the context of the technology of the time, were “not autho-
rized to dial.” There is no indication at all that the bill would
reach the conduct of a person, such as defendant here, who
was authorized by a computer owner to use the computer,
but did so in violation of the owner’s policy or for a purpose
not permitted by the owner.
	       The state acknowledges that legislative history
and the concerns that animated the legislature’s enactment
of ORS 164.377. It argues, however, that the text that the
44	                                       State v. Nascimento

legislature adopted “is not so limited,” and that it prohib-
its all “access” that is “without authorization.” As both par-
ties recognize, “[t]he legislature may and often does choose
broader language that applies to a wider range of circum-
stances than the precise problem that triggered legislative
attention.” South Beach Marina, Inc. v. Dept. of Rev., 301 Or
524, 531, 724 P2d 788 (1986). But that important teaching
does not mean that we necessarily interpret statutes in the
broadest possible sense that the text might permit. Indeed,
as we recently noted in Walker, 356 Or at 17, “[i]f, in fact, the
legislative history reveals that the legislature had a nar-
rower understanding of the term in mind, and if that nar-
rower meaning is consistent with the text, even if not com-
pelled by it, the legislative history would be a basis on which
we appropriately may construe the text more narrowly.”
	        Here, the legislative history supports defendant’s
view that the legislature intended ORS 164.377(4) to pro-
hibit computer access or use by a person who accessed or
used a computer without permission or authorization from
the owner. Nothing in the legislative history suggests that
the statute was intended to reach a person who was trained
and authorized to use a particular computer, but did so for
an unpermitted purpose. As discussed above, the text and
context of the statute provide a sufficient basis for deciding
this case: ORS 164.377(4) does not distinguish between a
person’s “authorization” to access or use a computer for some
purposes and not for others; the access or use is authorized,
or it is not. The legislative history simply reinforces that
interpretation.
	        In summary, we conclude that the phrase “without
authorization” applies to the “use” or “access” of the com-
puter. A person’s “authorization” to access or use a com-
puter may be restricted by a password or other authentica-
tion or security procedures—but defendant’s employer here
did not so restrict her use. Nor was defendant’s use of the
computer—to print lottery tickets—inconsistent with the
scope of her authorized use. We disagree with the state’s posi-
tion that an employee’s authorized use of an employer’s com-
puter becomes “without authorization” for purposes of ORS
164.377(4) simply because the employee used the computer
for a purpose not permitted by the employer’s personnel or
Cite as 360 Or 28 (2016)	45

computer use policies.5 Such impermissible use, of course,
may lead to personnel actions or other private discipline or
to possible proceedings under other statutes, but it does not
violate ORS 164.377(4).
	       Applying that interpretation of ORS 164.377(4) to
the facts here, we conclude that no reasonable juror could
find that defendant accessed or used the lottery terminal
“without authorization” when she printed Keno tickets for
herself without paying for them. She was authorized to use
the computer to print Keno tickets, and the fact that her
conduct violated her employer’s policy did not make her com-
puter use “unauthorized.” The trial court erred in denying
defendant’s motion for judgment of acquittal on the com-
puter crime count.
	        The decision of the Court of Appeals is reversed.
The judgment of the circuit court is affirmed in part and
reversed in part, and the case is remanded to the circuit
court for further proceedings.

	5
      In interpreting the term “authorization” for purposes of this case, we do
not mean to suggest that an employer or other computer owner may not devise
means to restrict the scope of access that it authorizes for particular users. This
case involves a computer terminal that printed Keno tickets and an employee
who was trained and permitted to use the computer to perform that function.
As discussed above, after a store manager “signed in” to the computer at the
beginning of the day, trained employees, including defendant, were authorized to
use the computer to print Keno tickets without further authentication, password
use, or other identity verification. 360 Or at 32. A different analysis of “authoriza-
tion” would be called for if an employer, through use of security codes, password-
protected data, or encryption, blocks an employee from access to certain com-
puter functions or data. In a similar vein, Orin Kerr suggests that the policy
issues involving “unauthorized” use should be resolved by using authentication
requirements—as many websites and computer networks already do—and con-
sidering access to be “unauthorized” when “a user bypasses an authentication
requirement, either by using stolen credentials or bypassing security flaws to cir-
cumvent authentication.” Orin Kerr, Norms of Computer Trespass, 116 Columbia
L Rev 1143, 1171 (2016).