In 1994 programmer Brian Corcoran was convicted and sentenced under Wisconsin’s computer crimes law for the willful destruction of computer data. His conviction was upheld on appeal by both the Wisconsin Court of Appeals and the United States Court of Appeals for the Seventh Circuit. Both courts made correct decisions, although their failure to grasp many of the technical details of the case somewhat weakened their judgments and could have opened the door to clever formalist arguments in defense of Corcoran. Corcoran, however, chose to represent himself and failed to make such arguments. This is fortunate, because he clearly broke the law, and the law which he broke was constitutional. A careful reconstruction of what occurred, including details glossed over by the lower courts, will make this evident.

Mueller Consulting Services (MCS) hired Corcoran in the spring of 1987, thus initiating what would prove to be a short and contentious relationship. The lower court opinions do little to illuminate the nature of this relationship. According to State v. Corcoran, Corcoran was hired “to write specialized application programs to manage data for MCS in time to prepare a report on May 15th.” There is no record of what sort of business MCS engaged in, what Corcoran’s programs were intended to do, what the contents of the planned report were, or if the report was ever created. But one can make some educated guesses about the purpose of Corcoran’s programs based on what little is known.

The programs were implemented as macros for Lotus 1-2-3, a very popular spreadsheet program at the time. A macro is an abbreviation for a longer set of program commands, which can be run when a data file is opened or at a specific time. Since the Lotus 1-2-3 program commands included things like moving the cursor, showing lists of options, and taking input from the user, they were often used to create interfaces for data entry. It appears that the macros which Corcoran created for MCS were used in this way, since there are several references to MCS inputting data into Corcoran’s programs. It is important to understand, however, that the purpose of such a macro is to automate the process of creating, in a uniform way, Lotus 1-2-3 spreadsheet files from data entered by users. The data are not “inside” the macro, any more than name, address, and credit card data one types into a Web form are “inside” that form after it is submitted. The form, like the macro, is simply an interface.

Corcoran’s macros may also have been used to process the MCS spreadsheet files into reports. Lotus 1-2-3 came with a program for creating graphs and charts, and was often used for creating reports from spreadsheet data. The fact that Corcoran was asked to finish his programs in time to prepare a report due May 15th would seem to support this. Again, however, it is important to distinguish Corcoran’s programs for processing spreadsheet files into reports from the spreadsheet files and reports themselves. The latter would have been the inputs and outputs of Corcoran’s separate programs.

Corcoran’s contract specified that he would not be paid for his work unless he produced fully functional programs. It seems that his programs were not fully functional, although the nature of the programs’ problems, like their functions, is unknown. Corcoran v. Sullivan says only that “his work was full of errors.” Rather than risk not being paid, he decided to resort to extortion. Sometime between August 1 and August 10, 1987, he modified six of his macros so that they would execute the necessary commands to delete themselves at 12AM on August 11, 1987. He also created another macro that when run would delete two 1-2-3 spreadsheet files, PONQTR2.WK1 and PAYROLL1.WK1, containing restaurant reviews and restaurant reviewer payroll data respectively. This macro was inserted in another 1-2-3 file, PONQTR1.WK1. It is not clear whether Corcoran made these modifications before or after he demanded his full payment plus an additional $1500 from MCS, but in any event the modifications were intended to enforce his threat to destroy the programs and their associated data in the event that MCS did not pay. MCS refused to pay, and so Corcoran delivered on his threat. The macros deleted themselves as scheduled, and the data-deleting macro achieved its purpose when it was run by Mary Mueller while following Corcoran’s written instructions. Although the exact course of ensuing events has not been recorded, it seems that after realizing what had happened MCS called the police, who arrested Corcoran.

The lower court opinions demonstrate that information technology in general, and spreadsheet programming in particular, lay outside the judges’ areas of expertise. The opinion of the first appeals court calls Corcoran’s macros “specialized application programs.” But Corcoran’s programs were not really standalone applications: they were interfaces for the Lotus 1-2-3 application, created to automate repetitive tasks. His logic bombs were incorrectly characterized by the judges and counsel as “Trojan horses.” More worryingly, the court is distracted by the details of how the “delete” command is implemented in DOS. One wishes that they had paid as much attention to the details of Corcoran’s programs. Their inability to distinguish among the various layers involved in software programming leads them to take at face value Corcoran’s claims that his programs “reduced the ‘raw data’ into electronic signals” and “positioned the data in memory.” These tasks are handled at the physical layer and OS layer of a computer—not by spreadsheet macros. The opinion of the federal court avoids such obvious blunders, but still shows a lack of clear thinking about how computer programs operate by claiming that Corcoran “embedded” MCS data in his programs. The federal court opinion also conflates the two separate logic bombs Corcoran created, and generally seems uninterested in the details of the relevant events.

While these sorts of mistakes may be understandable, they could have had serious consequences. For instance, a judge lacking fundamental knowledge of how an operating system works might be fooled into thinking that Corcoran purposefully engineered his logic bombs so that they would only “hide” data files, by removing their names from the file allocation table and declaring that the disk space they occupied to be free. This judge might then conclude that Corcoran didn’t actually intend to destroy the files, and that the destruction was the really the result of subsequent data entry by MCS employees. Such an interpretation of the events is laughable to someone who knows that this is the standard way that operating systems delete data. Corcoran’s logic bombs worked this way not because he skillfully engineered them to do so, but because he most likely didn’t have any other way to do it: he was limited to the macro commands offered by Lotus, and Lotus was limited to the DOS APIs exposed by Microsoft.

Fortunately Corcoran was unable to exploit the lower courts’ lack of information technology expertise to get himself off the hook. He presented a grab bag of arguments intended to show that the Wisconsin computer crimes statute was unsound and unconstitutional, and that his conviction was therefore illegal. Most of these arguments, such as his claims that the Wisconsin statute is vague and that it violates constitutional equal protection provisions, are entirely specious. Some of his arguments, however, deserve closer examination. Corcoran claimed copyright in both his spreadsheet macros and the data input to and output from those macros. He further claimed that the rights thus granted to him under the federal Copyright Act preempted enforcement of the Wisconsin computer crimes statute, and that the statute deprived him of his right to repossess his property.

Corcoran’s claims of copyright in his programs were sound. He was not an employee of MCS, and MCS did not specify in his contract that his macros would be considered “work for hire.” Although the details of Corcoran’s contract with MCS are unknown, the fact that the State of Wisconsin was willing to concede that Corcoran held the copyright for the programs seems to indicate that this is the case. Thus, as in Aymes v. Bonelli, the programmer retains copyright in his programs. But Corcoran’s rights to his programs go beyond copyright. Corcoran is also the rightful owner of his programs. MCS declined to purchase the programs from Corcoran, as they were not fully functional. Contrast this situation with Aymes v. Bonelli, in which Judge Altimari determined that although Aymes held the copyright to the program which he wrote for Bonelli, Bonelli was the rightful owner of the program because he bought it from Aymes. Corcoran, on the other hand, failed to sell his programs to MCS and thus retained rightful ownership.

Judge Posner, in the federal court opinion, ignores this fact completely with his analogy of the author who claims the right to tear up copies of his book, even if they have been purchased by a reader. A more suitable analogy would be an author who is allowed to use a reader’s office to write a book claiming the right to tear up his manuscript if the reader declines to purchase the book when it is finished. The reader could not claim ownership of the manuscript solely on the basis of the fact that his typewriter was used to produce it. Likewise, MCS cannot claim ownership of Corcoran’s programs just because their computer was used to create them.

But Corcoran still may have strayed outside his rights when he modified his programs to destroy themselves. The right of repossession, while generally accepted for material goods like automobiles, is still quite controversial when it comes to software products. Even the Uniform Computer Information Transactions Act (UCITA), a uniform law strongly biased in favor of software creators, permits the sort of “electronic self-help” attempted by Corcoran only if both parties explicitly agree to permit it (see § 816(c)). Again, the details of Corcoran’s contract with MCS are not known, but it seems unlikely that MCS would have agreed to such a provision.

Corcoran made a more serious error by trying to claim copyright in the data which he destroyed. Two types of data were destroyed: restaurant reviews and payroll records. The latter were facts and thus uncopyrightable, as the Supreme Court made quite clear in Feist v. Rural. Corcoran may have been able to claim copyright in the arrangement and compilation of the payroll data, but this seems unlikely. A listing of employees and how much they were paid is too common and obvious to deserve copyright protection. Like Rural’s white pages, it lacks originality, the key element required to trigger copyright.

The restaurant reviews, on the other hand, were original content and thus their copyright is held by either the individual reviewers or by MCS, if the reviewers were employees of MCS. The precise nature of the restaurant reviews is unknown, but even if they were just numbered ratings, they still deserve copyright protection as original products of professional judgment and expertise, regardless of the fact that they were expressed as numbers (see the discussion of Red Book valuations in CCC v. Maclean). So Corcoran cannot claim copyright in either of the files he destroyed, because in the first case there is no copyright to be had and in the second case the copyright belongs to someone else. The fact that Corcoran’s programs processed the files is irrelevant; as the GPL FAQ tells programmers, “copyright law does not give you any say in the use of the output people make from their data using your program.”

Corcoran may have been partially correct that the Copyright Act preempts the Wisconsin computer crimes statute. In NBA v. Motorola, the court found that New York’s misappropriation laws were preempted by federal copyright law because the state laws applied to works that fell under the subject matter of copyright and granted rights equivalent to those granted by copyright protection. The Wisconsin statute applies to computer programs and computer data. Computer programs are clearly within the subject matter of copyright. As Judge Easterbrook points out in ProCD v. Zeidenberg, this is true of uncopyrightable data as well: “’[S]ubject matter of copyright’ includes all works of a type covered by [the Copyright Act], even if federal law does not afford protection to them.”

So the question is whether the Wisconsin statute creates rights equivalent to those granted by the Copyright Act. Some parts of of the statute, notably § 943.70(2)(a)5, which forbids the copying of “data, computer programs or supporting documentation,” certainly appear to do so. When arguing that copyright law does not preempt contract law in the ProCD case, Judge Easterbrook contends that the party-specific rights created by contracts are not equivalent to the “rights against the world” created by the Copyright Act. The Wisconsin statute, by forbidding anyone “without authorization” to duplicate computer data or programs, creates an exclusive right, and thus meets Judge Easterbrook’s test of general scope.

But other parts of the statute, and in particular the part under which Corcoran was found guilty, are outside of the scope of copyright. § 943.70(2)(a)2, which forbids the unauthorized destruction of data, is concerned not with granting exclusive rights to the expression of ideas, but with ordinary property rights in material possessions. These computer crimes are considered to be specific kinds of crimes against property. Corcoran broke the law not because he violated any exclusive intellectual property rights granted to MCS, but because he destroyed material objects (magnetic patterns on a disk) which he did not own. This fact makes the issue of who had copyright in the destroyed data files irrelevant, because as 17 U.S.C. § 202 makes clear, “[o]wnership of a copyright, or of any of the exclusive rights under a copyright, is distinct from ownership of any material object in which the work is embodied.”

The only possible rejoinder to this argument is that somehow Corcoran owned the data files which were deleted. It has already been established that he could not have owned the copyright in the files; could he somehow claim material ownership of them? Clearly, the answer must be “no.” The files were created by MCS employees, on MCS computers, from data they collected. Corcoran’s programs were nothing more than tools used to create the files. The fact that he authored and owned those tools does not imply that he authored or owned the files, any more than the fact that Lotus Software authored Lotus 1-2-3 implies that Lotus owns his programs. To claim otherwise would lead to compiler programmers having absolute control over the free flow of information, an absurd conclusion with devastating socioeconomic consequences.

So by destroying files which he did not own, Corcoran violated a section of Wisconsin law which survives preemption by federal copyright law. The trial court was correct to convict him, the Wisconsin court of appeals was correct to uphold his conviction, and the Seventh Circuit was correct to deny his request for habeas corpus.

It is unfortunate that Corcoran waited until he faced criminal charges to educate himself about legal issues. Had he stopped at the deletion of the macros which he created, he likely could have escaped conviction by demonstrating his copyright and property rights in his programs. If he had had the foresight to negotiate a contract in which the right to “electronic self-help” was granted in the event that MCS refused to pay, he probably could have avoided the courts entirely. But his lack of knowledge about commercial law and intellectual property law led him to believe in fictions like the right to retaliate against database “trespassers,” and ultimately led to his conviction. The fantasy of revenge against unfair employers via hidden logic bombs is popular among hackers. The legal realities that Corcoran encountered show that this sort of revenge should remain a fantasy.