The Oregon Supreme Court has ruled that while a convenience store clerk was guilty of stealing lottery tickets through the store’s computer system, she did not violate the state’s anti-hacking law while doing so.

In the case, known as State v. Nascimento, Oregon’s highest court ruled late last month that a hacking conviction against the defendant should be overturned, and the court sent the case back down to the lower court for reconsideration. The Electronic Frontier Foundation, which appeared on Caryn Nascimento’s behalf during the case as an amicus curae (friend of the court), announced the narrow victory on Tuesday.

According to the Supreme Court’s decision, the case dates back to 2007, when Nascimento began working at Tiger Mart, a small convenience store in Madras, Oregon, about 120 miles southeast of Portland. In late 2008 and early 2009, a company vice president began investigating what appeared to be cash shortages at that store, sometimes about $1,000 per day. After reviewing video recordings that correlated with Nascimento’s work schedule, this executive began to suspect that she was buying lottery tickets but not paying for them.

Eventually, Nascimento was charged not only with aggravated first-degree theft but also of violating the state’s computer crime law, which includes language that "any person who knowingly and without authorization uses, accesses or attempts to access any computer, computer system, computer network, or any computer software, program, documentation or data contained in such computer, computer system or computer network, commits computer crime."

She was convicted on both charges at trial. On appeal before the Oregon Supreme Court, Nascimento’s lawyers argued that while their client may have violated a company policy to not print lottery tickets that she did not receive payment for, she was, in fact, authorized to access the lottery printing computer.

The EFF agreed with this position.

"We did not challenge the theft conviction but explained to the court that the state’s interpretation of Oregon's computer crime statute was unworkable because it turned employees into criminals for reading personal email or checking a baseball game's score while at work, in violation of company policy," wrote Jamie Williams, an EFF legal fellow.

In its opinion, the Oregon Supreme Court agreed with the EFF’s reasoning, saying:

It is difficult to square the state’s position with the text of ORS 164.377(4). The text establishes a binary division between those who are "authorized" to access or use a computer and those who are not. The text does not distinguish between use that is authorized for certain purposes (such as those permitted by employer policies) and use that otherwise would be authorized but that is inconsistent with those policies. Indeed, subsection (4) of the statute does not focus on the purpose or manner of use at all, but only on whether the access or use is "authorized." … Viewed in that light, the text supports defendant’s assertion that her use of the lottery terminal to print Keno tickets—as she was trained and permitted by her employer to do—was "authorized" use. The fact that she printed the tickets for her own use and did not pay for them may have violated company policies and other parts of the computer crime statute (in addition to the theft statute), but her use was not "without authorization" as that term is used in ORS 164.377(4).

While Oregon’s law is reminiscent of the Computer Fraud and Abuse Act, the Oregon Supreme Court noted that the state law predates that federal law by a decade.

"The prosecutor’s interpretation of the statute would have transformed innocent employees and Internet users into criminals on the basis of innocuous, everyday behavior," Williams added. "We’re happy the Oregon Supreme Court took to heart our warnings about the dangers of such an expansive interpretation of the law and adopted a clear rule that limits the discretion of overzealous prosecutors."