Investigators Used Terrible Computer Fraud Laws To Ensure People Were Punished For Leaking Air Crash Footage To CNN

Earlier this year, an Army helicopter collided with a passenger plane over the Potomac River in Washington, DC. All sixty-seven people aboard both vehicles were killed. While the FAA focused its investigation on the failures that led to this mid-air collision, local investigators in Virginia were somehow far more concerned about identifying who had leaked footage of the collision to CNN.

The subject matter of the leaked recordings was obviously of public interest. And while the government may have its own interest in controlling dissemination of recording of incidents that involve federal agencies and their oversight, it’s not the sort of government interest most courts consider to be worthy of violating the First Amendment.

Fortunately, the government has options. For a very long time, the option federal law enforcement deployed most frequently in cases involving pretty much any sort of technology was the Computer Fraud and Abuse Act (CFAA). This broadly written law not only allowed prosecutors to charge people with federal crimes for doing nothing more than interacting with services/servers/etc. in unexpected ways, but allowed companies to, essentially, shoot the messengers for reporting data breaches, unsecured servers, or sloppy user interfaces that could be exploited to display far more information than those running them intended.

The CFAA has since been neutered a bit, slowing its abusive role in federal prosecutions. Unfortunately, there are plenty of sloppily written state laws that can accomplish what the CFAA no longer can, as Nikita Mazurov and Shawn Musgrave report for The Intercept.

Here’s what Metropolitan Washington Airports Authority investigator Patrick Silsbee wrote in his report:

“The video shows camera angles and views that can only be found on the Metropolitan Washington Airport’s Authority CCTV video,” Silsbee wrote in a January 31 report, noting the location of landmarks in the videos, including a boathouse near the airfield.

The locations of the MWAA security cameras are redacted in the reports provided to The Intercept, ostensibly “to prevent the disclosure of law enforcement and security techniques and procedures not generally known outside the law enforcement community,” according to an accompanying letter from MWAA.

That doesn’t mean much by itself, but Silsbee apparently figured out (thanks in part to CNN’s initial failure to redact some CCTV text that described the location of the camera) this footage must have been obtained by an MWAA employee working at the police dispatch center.

CCTV footage from inside the dispatch center was obtained, which allegedly showed these actions being taken by the suspected leaker:

“Between the hours of 2256 and 0545, Mr. Mbengue can be seen on multiple occasions utilize [sic] his personal cell phone to record video and photograph these critical scenes,” Silsbee wrote.

That would be MWAA dispatch employee Mohamed Mbengue, who has since pleaded “no contest” to charges stemming from Virginia’s ultra-vague “computer trespass” law. But it really takes a person with an overriding desire to shoot messengers to call cell phone recordings of screen images a “trespass.”

The word is generally understood to describe unauthorized access to an area a person is not allowed to be in. Mbengue was at work and had full access to these recordings as a part of his job. That he recorded them and sent them to CNN doesn’t align with any rational definition of the word “trespass.” The dissemination of footage may be a violation of policy, but policy violations aren’t criminal charges — the sort of thing that can do permanent damage to a person’s life in ways that write-ups and even justified terminations simply can’t.

That’s why discretion is key. But when discretion matters most, law enforcement tends to deliberately “err” on the side of whatever does the most damage to anyone it happens to be investigating. And it appears MWAA investigators are more than happy to throw criminal charges at people for, at most, violating agency policies. A second dispatcher (Jonathan Savoy) was caught doing the same thing (albeit without sharing the recordings with CNN) and faced similar charges until someone actually exercised a bit of discretion and declined to move forward with the case.

On February 3, the MWAA announced both men’s arrests, writing in a press statement that Savoy had been arrested “following further police investigation.”

In May, however, local prosecutors quietly dropped the charges against Savoy, through a filing called a “nolle prosequi,” according to the court docket.

There’s absolutely nothing in the statute that actually covers the actions described here, which formed the basis for the bullshit criminal charges. It takes a ton of punitive imagination to turn “recording a CCTV monitor with a phone” into a criminal act. The only clause that could be even possibly be considered applicable requires investigators and prosecutors to engage in lot of extremely creative re-interpretations of the plain text of the law:

Use a computer or computer network to make or cause to be made an unauthorized copy, in any form, including, but not limited to, any printed or electronic form of computer data, computer programs or computer software residing in, communicated by, or produced by a computer or computer network

A smartphone is a computer. A recording could be considered an “unauthorized copy.” To call the CCTV cameras and screens “computers/computer network” means ignoring the generally understood utility of this tech. Even if a network connects the cameras and a computer provides access to recordings, recording playback via phone while accessing footage the suspects had every right to access, calling this a violation of the law demonstrates investigators were out for revenge, rather than serving the commonly understood definition of the word “justice.”