Taylor Amil Wallace v. Commonwealth of Virginia

COURT OF APPEALS OF VIRGINIA

Present: Chief Judge Decker, Judges Humphreys,* Beales, Huff, O’Brien, AtLee, Malveaux,
PUBLISHED

Athey, Fulton, Ortiz, Causey, Friedman, Chaney, Raphael, Lorish, Callins and White
Argued at Richmond, Virginia

TAYLOR AMIL WALLACE
OPINION BY
v. Record No. 1040-21-1 JUDGE DANIEL E. ORTIZ
JANUARY 23, 2024
COMMONWEALTH OF VIRGINIA

UPON A REHEARING EN BANC

FROM THE CIRCUIT COURT OF THE CITY OF CHESAPEAKE
John W. Brown, Judge

Samantha Offutt Thames, Senior Appellate Attorney (Virginia
Indigent Defense Commission, on briefs), for appellant.

Stephen J. Sovinsky, Assistant Attorney General (Jason S. Miyares,
Attorney General, on brief), for appellee.

A person who uses a computer for a fraudulent purpose does not automatically use it

“without authority” under the computer fraud statute. Under the plain text of Code §§ 18.2-152.2

and -152.3, a defendant commits computer fraud only if they “use[]” a computer without permission

or “in a manner knowingly exceeding such right, agreement, or permission,” not every time they

use a computer to commit an enumerated crime. Following a bench trial, Taylor Amil Wallace was

convicted of computer fraud, obtaining money by false pretenses, uttering forged checks, and failing

to appear in court, after she deposited forged checks in an ATM. On appeal, Wallace challenged the

sufficiency of the evidence for each conviction. A three-judge panel found the evidence sufficient

to affirm her convictions on all charges except for four counts of computer fraud. In that regard, the

*
Judge Humphreys participated in the hearing and decision of this case prior to the
effective date of his retirement on December 31, 2023.
panel found the evidence insufficient to prove that Wallace used the ATM “without authority,” with

one judge dissenting. Upon the Commonwealth’s petition for a rehearing en banc as to the

computer fraud charges, this Court finds en banc that the evidence presented at trial failed to prove

that Wallace was “without authority” when she accessed her own bank account via an ATM and

deposited the checks.

BACKGROUND

On four different days in December 2018, Wallace used a drive-through ATM at BB&T

to deposit four checks into her BB&T bank accounts.1 The checks were made out from Gregory

Starling’s Southern Bank account to “Taylor A. Wallace.” All four checks were endorsed by

“Taylor Wallace.” Security camera footage shows Wallace driving to the ATM, sometimes with

an unidentified male in the front passenger seat, and depositing the checks. Two of the checks

were returned to BB&T as forged. The other two were returned because the Southern Bank

account was closed. After recouping its losses from Wallace’s bank accounts, BB&T suffered a

loss of $937.82. In an interview with police officers in January 2019, Wallace admitted that she

was the person depositing the checks and that she did not know Gregory Starling, but she refused

to say where she got the checks.

At a bench trial, Wallace testified that she did not steal the checks but received them from

her stepfather, Miguel Sumner, who had no bank account and told Wallace that the checks were

his paychecks for his demolition and cleaning work. She testified that Sumner was the

unidentified male in the passenger seat and that he did not give her the checks until they were at

the ATM. She denied having endorsed the checks, claiming that she never looked at the checks

because she trusted Sumner. Wallace’s mother corroborated Wallace’s story, testifying that she

1
The four checks were for $440, $324, $450, and $300.
-2-
dated Sumner during the time Wallace deposited the checks and that Sumner worked in

construction.

Starling testified that he did not write the four checks and that they were probably taken

from his work truck around December 7, 2018. He stated that, at the time, he worked at a job

site and had hired a man, James Watson, and an all-male team for demolition and cleaning work.

At the trial, BB&T investigator, Kevin Wolfe, testified that the ATM was a “very

sophisticated machine” and had “a number of different functions,” including depositing checks,

withdrawing cash, and making balance inquiries. Wolfe stated that an ATM “would be

considered a computer.”

Wallace was convicted of four counts of uttering a forged check, four counts of obtaining

money by false pretenses, four counts of computer fraud, and one count of felony failure to

appear, in violation of Code §§ 18.2-152.3, 18.2-172, 18.2-178, and 19.2-128(B). The trial court

found Wallace not guilty of forgery or identity fraud. See Code §§ 18.2-172, -186.3(A)(2). The

trial court sentenced Wallace to 17 years and 96 months of incarceration, with 13 years and 128

months suspended.

On appeal, Wallace challenged the sufficiency of the evidence for her convictions for

computer fraud, uttering, obtaining money by false pretenses, and failure to appear. As to the

computer fraud charges, a three-judge panel held that the evidence was insufficient to show that

Wallace acted “without authority,” with a single judge in dissent. The panel unanimously upheld

her convictions for the other charges. The Commonwealth requested, and this Court granted, a

rehearing en banc to reconsider the panel’s holding solely related to the computer fraud

convictions. Once again, we hold that the trial court erred in determining that Wallace was

“without authority” when she used the ATM in question to process the four checks.

-3-
Accordingly, we reverse the judgment of the trial court as to Wallace’s convictions for computer

fraud.

ANALYSIS

A. Standards of Review

In reviewing the sufficiency of the evidence, we consider the evidence “in the light most

favorable to the Commonwealth, the prevailing party below.” Vay v. Commonwealth, 67

Va. App. 236, 242 (2017) (quoting Smallwood v. Commonwealth, 278 Va. 625, 629 (2009)). In

doing so, we “discard the evidence of the accused in conflict with that of the Commonwealth,

and regard as true all the credible evidence favorable to the Commonwealth and all fair

inferences to be drawn therefrom.” Bowman v. Commonwealth, 290 Va. 492, 494 (2015)

(quoting Kelley v. Commonwealth, 289 Va. 463, 467-68 (2015)).

We defer “to the trial court’s findings of fact unless they are plainly wrong or without

evidence to support them.” Brewer v. Commonwealth, 71 Va. App. 585, 591 (2020). “The fact

finder, who has the opportunity to see and hear the witnesses, has the sole responsibility to

determine their credibility, the weight to be given their testimony, and the inferences to be drawn

from proven facts.” Commonwealth v. Taylor, 256 Va. 514, 518 (1998). Furthermore, “[t]he

judgment of a trial court sitting without a jury is entitled to the same weight as a jury verdict”

when reviewed on appeal. Martin v. Commonwealth, 4 Va. App. 438, 443 (1987). Still, “to the

extent that the issue on appeal requires the Court to determine the meaning of a statute and its

terms, it reviews that issue de novo.” Brewer, 71 Va. App. at 591.

B. Statutory Interpretation

Wallace challenges her computer fraud convictions under Code § 18.2-152.3. She argues

that, first, she did not use the ATM “without authority,” and second, the ATM she used was not a

-4-
“computer” under the statute. Assuming, without deciding, that the ATM was a computer,2 we

find that the trial court misinterpreted Code § 18.2-152.3 in finding that Wallace used the ATM

“without authority.”

“When construing a statute, our primary objective is ‘to ascertain and give effect to

legislative intent,’ as expressed by the language used in the statute.” Cuccinelli v. Rector,

Visitors of the Univ. of Va., 283 Va. 420, 425 (2012) (quoting Commonwealth v. Amerson, 281

Va. 414, 418 (2011)). “When the language of a statute is unambiguous, we are bound by the

plain meaning of that language.” Id. (quoting Kozmina v. Commonwealth, 281 Va. 347, 349

(2011)). We “presume that the legislature chose, with care, the words it used when it enacted the

relevant statute.” Zinone v. Lee’s Crossing Homeowners Ass’n, 282 Va. 330, 337 (2011)

(quoting Addison v. Jurgelsky, 281 Va. 205, 208 (2011)). In addition, “when the General

Assembly has used specific language in one instance, but omits that language or uses different

language when addressing a similar subject elsewhere in the Code, we must presume that the

difference in the choice of language was intentional.” Id. Such omission shows “that the

General Assembly ‘knows how’ to include such language in a statute to achieve an intended

objective” and unambiguously expressed “a contrary intention.” Morgan v. Commonwealth, 301

Va. 476, 482 (2022) (quoting Brown v. Commonwealth, 284 Va. 538, 545 (2012)). Finally,

when a statute is ambiguous, “the rule of lenity [directs] us to adopt a narrow construction, thus

2
The Commonwealth also argues that Wallace used a computer network as an alternative
ground for affirmance. See Code § 18.2-152.3 (defining computer fraud as using “a computer or
computer network, without authority and” committing a specified theft or fraud crime). Because
we find that the Commonwealth failed to prove that Wallace was “without authority,” we need
not decide whether a computer network was used here. See Commonwealth v. White, 293 Va.
411, 419 (2017) (noting that we must “decide cases ‘on the best and narrowest grounds
available’” under the doctrine of judicial restraint (quoting Commonwealth v. Swann, 290 Va.
194, 196 (2015))).
-5-
reducing exposure to criminal liability.” Fitzgerald v. Loudoun Cnty. Sheriff’s Off., 289 Va. 499,

508 (2015).

1. The plain language of Code §§ 18.2-152.2 and -152.3 means that a defendant must
“use[]” a computer “without authority.”

Under the Virginia Computer Crimes Act (“VCCA”), “[a]ny person who uses a computer

or computer network, without authority” and “[o]btains property or services by false pretenses,”

“[e]mbezzles or commits larceny,” or “[c]onverts the property of another” is guilty of computer

fraud. Code § 18.2-152.3. Under the VCCA, “[a] person is ‘without authority’ when he knows

or reasonably should know that he has no right, agreement, or permission or acts in a manner

knowingly exceeding such right, agreement, or permission.” Code § 18.2-152.2.

Preventing unauthorized access to computers is a primary purpose of computer crime

laws. The federal government and all fifty states have “enacted computer crime laws that

prohibit ‘unauthorized access’ to computers.” Orin S. Kerr, Cybercrime’s Scope: Interpreting

“Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U. L. Rev. 1596, 1596

(2003); see also Susan W. Brenner, State Cybercrime Legislation in the United States of

America: A Survey, 7 Rich. J.L. & Tech. 28, at 15 n.37 (2001) (listing state computer crime

statutes). In Virginia, the plain language of the VCCA expressly defines “without authority” and

includes it as an element of several offenses, including computer fraud. Code §§ 18.2-152.2

to -152.3. The language makes it clear that the computer fraud statute applies only to the

unauthorized use of computers and computer networks.3

3
The dissent suggests that we are unduly reliant upon “factors such as the purpose,
reason, and spirit of the law, including any legislative history” in analyzing the statute’s
meaning. See Eley v. Commonwealth, 70 Va. App. 158, 164 (2019). To the contrary, the
statute’s plain language on its own compels our interpretation of “without authority,” while the
legislative purpose provides helpful context.
-6-
 Here, both parties agree that, as a bank customer, Wallace had some “right, agreement, or

permission” to use the ATM. See Code § 18.2-152.2. At issue is simply whether Wallace

“act[ed] in a manner knowingly exceeding such right, agreement, or permission.” See id.

Wallace argues that as a BB&T customer, she had the authority to use the ATM for the functions

she performed—depositing checks and withdrawing cash. The Commonwealth responds that

while Wallace had authority to use the ATM for lawful purposes, Wallace exceeded her

authority by depositing forged checks. The question here is whether a person authorized to use a

computer necessarily exceeds that authority when they use the computer to obtain money by

false pretenses.

In Code § 18.2-152.3, the words “without authority” clearly modify “use[] [of] a

computer or computer network,” rather than the criminal purposes of such use, enumerated as

obtaining property or services by false pretenses, embezzlement, larceny, or conversion. Thus,

combining Code §§ 18.2-152.2 and -152.3, a computer fraud conviction requires that a defendant

either “has no right, agreement, or permission” to use the computer or computer network or uses

it “in a manner knowingly exceeding such right, agreement, or permission.” To prove that a

defendant knowingly exceeded their authorization, the Commonwealth must first establish the

scope of the defendant’s right, agreement, or permission. The plain text of the statute, which

states that a person must act “in a manner knowingly exceeding” their authorization, indicates

that the manner of use, rather than the purpose of the use, must be unauthorized. Code

§ 18.2-152.2 (emphasis added). This is distinct from lacking authority to achieve an enumerated

purpose of obtaining property by false pretenses, embezzlement, larceny, or conversion. The

structure of the statute, pairing “without authority” with “use,” rather than the enumerated fraud

or theft offenses, tells us that simply committing a listed crime—which is never “authorized,” in

-7-
the broad legal or moral sense—is not enough to be “without authority.” Rather, a person must

be “without authority” to use the computer in a certain way.

2. Reading the computer fraud statute in the context of the criminal code clarifies that a
person’s use, not their purpose, must be “without authority.”

A comparison of Code § 18.2-152.3 to Code § 18.2-152.5 also shows that “without

authority” relates to an individual’s “use.” Under Code § 18.2-152.5, “[a] person is guilty of the

crime of computer invasion of privacy when he uses a computer or computer network and

intentionally examines without authority any employment, salary, credit or any other financial or

identifying information . . . relating to any other person.” (Emphasis added). Unlike in the

computer fraud statute, here the words “without authority” modify the examination of

information, rather than the use of a computer or computer network. For example, in Ramsey v.

Commonwealth, 65 Va. App. 694 (2015), a state trooper ran inquiries using the Virginia

Criminal Information Network (“VCIN”) for personal purposes, knowing that she was only

authorized to do so for criminal justice purposes. Id. at 695-96. Although she had authority to

use the VCIN, this Court upheld her conviction under Code § 18.2-152.5 because she “was

without authority to examine the information on VCIN for non-criminal justice purposes.” Id. at

701. The words “without authority” modify different actions in the computer fraud and

computer invasion of privacy statutes. Because both sections of the VCCA address the “similar

subject” of computer crimes, “we must presume that the difference in the choice of language was

-8-
intentional.” Zinone, 282 Va. at 337. Thus, we must focus on whether a specific “use” of the

computer was authorized or not, irrespective of whether the ultimate purpose was lawful.4

We reject the Commonwealth’s argument that if a defendant uses a computer to deposit

forged checks—or for unlawful purposes more generally—their use is per se without authority

under the computer fraud statute. This interpretation would render the words “without authority”

in Code § 18.2-152.3 surplusage. See Hubbard v. Henrico Ltd. P’ship, 255 Va. 335, 340 (1998)

(“[E]very part of a statute is presumed to have some effect and no part will be considered

meaningless unless absolutely necessary.”). In fact, the General Assembly specifically rejected

proposals to remove the words from the statute. See, e.g., Va. St. Crime Comm’n, Computer

Crimes Act, Rep. Doc. No. 77, at 10 (2005) (recommending eliminating “without authority” from

Code § 18.2-152.3 because when “a criminal uses a computer to . . . commit a fraud on

another . . . it should not be a possible defense that he had the permission of the owner of the

computer to engage in illegal activities”); S.B. 1163 (as introduced, Jan. 12, 2005) (amending

“[a]ny person who uses a computer or computer network without authority and with intent to” to

4
A similar comparison is possible with Code § 18.2-186.3, criminalizing identity theft,
which this Court interpreted recently in Belcher v. Commonwealth, 75 Va. App. 505 (2022).
Among other things, that section makes it

unlawful for any person, without the authorization or permission of
the person or persons who are the subjects of the identifying
information, with the intent to defraud, for his own use or the use
of a third person, to: . . . [o]btain money, credit, loans, goods, or
services through the use of identifying information of such other
person.

Code § 18.2-186.3(A)(2). In the identity theft statute, the “without the authorization” clause
modifies the action of obtaining of money or other things of value, not the use of the identifying
information. Thus, even if an individual is authorized to use a credit card to buy groceries for
their employer, for example, they are not authorized to use that credit card for the purpose of
obtaining personal gain by buying groceries for themselves. See Belcher, 75 Va. App. at 519-21.
The computer fraud statute is structured differently, with the “without authority” clause
modifying “use[],” not the ultimate criminal purpose.
-9-
“[a]ny person who, through the use of a computer”). Moreover, unlike computer fraud, other

computer crimes under the VCCA do not include the “without authority” element. See, e.g.,

Code § 18.2-152.7:1 (harassment by computer); Code § 18.2-152.5:1 (using a computer to gather

identifying information). We again take the legislature at its word and read “without authority”

to require more than commission of an enumerated criminal act.

In support of its broad reading, the Commonwealth relies on several prior cases

upholding convictions for computer fraud and related crimes, none of which explore the meaning

of “without authority.” See Brewer, 71 Va. App. at 591-97; DiMaio v. Commonwealth, 272 Va.

504, 506-08 (2006); Barnes v. Commonwealth, No. 2693-98-1, slip op. at 1-5, 2000 WL 291436,

at *1-2 (Va. Ct. App. Mar. 21, 2000). In Brewer, we focused on whether a smartphone

constituted a “computer.” 71 Va. App. at 591. In DiMaio, the appellant challenged only the

sufficiency of the evidence regarding the value of data that he removed from a computer. 272

Va. at 506. Finally, Barnes is an unpublished case that does not interpret “without authority.”

Barnes, slip op. at 1-5, 2000 WL 291436, at *1-2 (briefly discussing a sufficiency of the

evidence claim under Code § 18.2-152.3). As such, these cases are of little value in determining

the meaning of “without authority.” See Jones v. Commonwealth, 293 Va. 29, 50 (2017)

(“[S]tare decisis does not ‘foreclose inquiry’ into an issue not previously ‘raised, discussed, or

decided.’” (quoting Chesapeake Hosp. Auth. v. Commonwealth, 262 Va. 551, 560 (2001))).

3. The VCCA definition of “use[]” further clarifies and contextualizes the meaning of
“without authority.”

Having established that “without authority” modifies the use of the computer, we must

also analyze the meaning of “use[]” under the VCCA—another defined term. The VCCA states

that “[a] person ‘uses’ a computer . . . when he attempts to cause or causes a computer . . . to

perform or to stop performing computer operations.” Code § 18.2-152.2. This definition is

mechanical, focused on the user’s direct interactions with the computer and the effect of those
- 10 -
interactions on “computer operations,” separately defined as “arithmetic, logical, monitoring,

storage or retrieval functions and any combination thereof, [which] includes, but is not limited

to, communication with, storage of data to, or retrieval of data from any device.” Id. The statute

also clarifies that computer operations include “any function for which that computer was

generally designed.” Id. Thus, to commit computer fraud, a person must “attempt[] to cause” or

actually “cause[] a computer” to perform operations—including, but not limited to “arithmetic,

logical, monitoring, storage or retrieval functions”—beyond the scope of the functions they are

allowed to perform. Id. The word “use[]” does not encompass the end goal or purpose of the

user, but their specific actions in operating the computer. Those discrete actions must be

undertaken “without authority.”

4. This Court’s reading of the VCCA is supported by persuasive authority from other
state courts and the United States Supreme Court, interpreting similar statutes.

While not binding on this Court, well-reasoned opinions from other jurisdictions

interpreting similar statutes support our conclusion that “without authority” modifies the manner

of use of computers and computer networks, rather than the purpose of the use. For example, in

Commonwealth v. Shirley, 653 S.W.3d 571 (Ky. 2022), the Supreme Court of Kentucky reversed

a conviction for unlawful access to a computer when the defendant fraudulently placed barcodes

from cheap items onto expensive items and then scanned those barcodes at a Walmart

self-checkout register. Id. at 572, 577-79. The court reasoned that the Kentucky statute “[did]

not refer to whether the individual is accessing a computer to commit fraud but [did] refer to

whether the individual [was] accessing a computer in the way consented to by the owner.” Id. at

579. Similarly, in People v. Golb, 15 N.E.3d 805 (N.Y. 2014), the Court of Appeals of New

York vacated a conviction for unauthorized use of a computer when the defendant used a

university computer to send emails criminally impersonating others. Id. at 810, 814. The court

rejected the prosecution’s argument that “using the computer to commit a crime cannot be an
- 11 -
authorized use” and found that New York’s computer crime statute was “intended to reach a

person who accesses a computer system without permission (i.e., a hacker).” Id. at 814. Finally,

in State v. Nascimento, 379 P.3d 484 (Or. 2016), the Supreme Court of Oregon reversed the

defendant’s conviction for computer crimes when she used a lottery terminal to print lottery

tickets for herself without paying. Id. at 485-86. The court rejected the “extremely broad

definition” that “any time a person uses or accesses a computer for a purpose not permitted by

the computer’s owner, the person does so ‘without authorization’ and commits computer crime.”

Id. at 490. The court found that the defendant’s “use of the lottery terminal to print [lottery]

tickets—as she was trained and permitted by her employer to do—was ‘authorized’ use,” despite

its ultimately criminal purpose. Id. at 491. The purpose of computer crime laws in general, as

reflected in these cases, aligns with our analysis of the VCCA’s language.

Finally, in Van Buren v. United States, 141 S. Ct. 1648 (2021), the United States

Supreme Court, interpreting the Federal Computer Fraud and Abuse Act of 1986 (“CFAA”),

considered whether a police sergeant violated federal law when, in contravention of department

policy, he used a law enforcement license plate database to search for information on an

acquaintance’s romantic interest in exchange for $5,000. Id. at 1652-53. The CFAA penalizes

“anyone who ‘intentionally accesses a computer without authorization or exceeds authorized

access,’ and thereby obtains computer information.” Id. at 1652 (quoting 18 U.S.C.

§ 1030(a)(2)). Like the VCCA, the CFAA differentiates between those who “intentionally

access[] a computer without authorization” and those who “exceed[] authorized access.” See 18

U.S.C. § 1030(a)(2). The CFAA goes a step further, defining “exceeds authorized access” as “to

access a computer with authorization and . . . use such access to obtain or alter information in the

computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6).

Dissecting the plain text, with a focus on the word “so,” the Court held that to violate the law a

- 12 -
person must access information “that a person is not entitled to obtain by using a computer that

he is authorized to access.” Van Buren, 141 S. Ct. at 1655. The Court concluded that the federal

statute did “not cover those who, like Van Buren, have improper motives for obtaining

information that is otherwise available to them.” Id. at 1652. This mirrors our conclusion that,

under the VCCA, a defendant authorized to use a computer to perform specific tasks is not

“without authority,” regardless of any “improper motives.”5 See id.

In reaching its conclusion, the Van Buren Court rejected the Government’s position that

the CFAA reached any person who was not authorized to obtain information “in the particular

manner or circumstances in which he obtained it.” Id. at 1654 (emphasis omitted). This broader

approach would have incorporated access limitations from a laundry list of potential external

sources, including “the United States Code, a state statute, a private agreement, or anywhere

else,” rendering any use of a computer which violated any other legal, moral, or contractual

obligation simultaneously a violation of the CFAA. Id. at 1655. Similarly, the Commonwealth’s

approach in this case would mean that any action that simultaneously involved the use of a

computer and the commission of a listed fraud or theft crime would be per se “without

authority,” notwithstanding the General Assembly’s express inclusion of that element in Code

§ 18.2-152.3. Considering the text of the VCCA, we decline to adopt the Commonwealth’s

reading, which renders the phrase “without authority” superfluous. Rather, we interpret the

phrase “right, agreement, or permission” in the context of the term “use[],” defined as the

mechanical computer operations performed on the computer, not the user’s ultimate ends,

5
Contrary to the dissent’s suggestion, while we find Van Buren persuasive in its analysis
of a similar statutory scheme, the statutory text, and not federal caselaw, compels our holding.
- 13 -
whether legal or otherwise. See Code §§ 18.2-152.2 to -152.3. In sum, though a user’s purpose

may be illegal, their use may still be authorized.6

We note that the VCCA and the CFAA differ in important respects. For example, a

person is penalized for unauthorized “access” under the CFAA and “use[]” under the VCCA.

Compare 18 U.S.C. § 1030(a)(2), (e)(6), with Code § 18.2-152.3. “Access” implies the initial

approach or entrance to the computer, while “use[]” focuses on the functions or operations

performed with the computer. Compare Van Buren, 141 S. Ct. at 1657-58, with Code

§ 18.2-152.2. In either case, both statutes require that specific interactions with the computer

must be “without authority,” not simply the result. The VCCA also lacks the specific word “so”

relied upon by the majority in Van Buren. See 141 S. Ct. at 1655-56. Even so, the framing of

the computer fraud definition, in which “without authority” modifies “use[],” and “use[]” means

the specific computer operations performed, leads us to the same result as the United States

Supreme Court in Van Buren.7

6
The dissent finds this result strange, suggesting that our reading of the statute eliminates
the mens rea requirement in the “without authority” definition. Because we find that Wallace
here did not exceed her “right, agreement, or permission” to use the ATM, we may not reach the
issue of whether her actions were “knowing” under the statute. See Code § 18.2-152.2.
7
Wallace correctly notes that if Code § 18.2-152.3 were ambiguous, the rule of lenity
would compel us to adopt her narrower reading. See Fitzgerald, 289 Va. at 508. Nonetheless,
because the unambiguous language of Code § 18.2-152.3 demonstrates that “without authority”
modifies the use of the computer itself, rather than the purpose of the use, we need not rely on
the rule of lenity here. Our narrower interpretation of the statutory language is consistent with
the legislative intent of preventing people from using computers without authorization to
perpetrate fraud. See Morgan, 301 Va. at 483. If the General Assembly found our traditional
fraud statutes insufficient and intended to enhance the punishment for all defendants who use
computers or computer networks as a tool in committing false pretenses, embezzlement, larceny,
or conversion, it could have made that clear by eliminating the words “without authority” in the
computer fraud statute. Absent such an express legislative intent, we refuse to adopt this broad
interpretation.
The Court in Van Buren similarly viewed the rule of lenity as “‘extra icing on a cake
already frosted,’” supporting the conclusion that the statutory term “exceed[ing] authorized
access” did not encompass accessing information that the defendant had legitimate authority to

- 14 -
 C. Sufficiency of the Evidence

Under Code § 18.2-152.3, “without authority” is an element of the crime of computer

fraud, for which the Commonwealth has the burden of proof. In this case, the Commonwealth

presented no evidence to establish the scope of Wallace’s authority to use the ATM or her

knowledge that she exceeded such authority. As a bank customer, she had authority to perform

specific functions on the ATM. She was authorized to use the ATM to deposit checks and

withdraw cash—functions “for which th[e ATM] was generally designed.” See Code

§ 18.2-152.2. She was similarly authorized to cause the ATM to perform behind-the-scenes

storage and retrieval functions to access her account and other accounts. See id.

By depositing a forged check, she used the ATM for an unlawful purpose, but not in an

unauthorized manner. The specific computer operations performed—whether viewed as logical,

arithmetic, or related to storage and retrieval of data—were the same regardless of the

provenance of the checks, whether forged or genuine. Under the statute, then, her use was not

“without authority.” The Commonwealth’s evidence ultimately fails to show that Wallace used

the ATM without authority.8 Rather, the Commonwealth simply relies on the assumption that

any use of a computer or computer network for a fraudulent purpose must be “without

access, even though the defendant harbored an impermissible purpose. See Van Buren, 141
S. Ct. at 1661 (quoting Yates v. United States, 574 U.S. 528, 557 (2015) (Kagan, J., dissenting)).
8
The Commonwealth does point to Starling’s testimony that he did not give Wallace
permission to use his identifying information or to cash checks written in his name. Here again,
we clarify that “without authority” modifies “use[],” which, in turn, modifies the words
“computer or computer network.” See Code § 18.2-152.3. The natural reading of the statute is
that only the authorization of the computer owner, not the victim of any related theft or fraud, is
required.
- 15 -
authority.”9 Because this assumption conflicts with the plain language of Code § 18.2-152.3, we

reject it and find the evidence insufficient to uphold Wallace’s convictions.10

Our interpretation of Code § 18.2-152.3 does not prevent the Commonwealth from

obtaining felony uttering convictions in this and similar cases, though it clarifies and necessarily

narrows the application of the computer fraud statute. Nor does it prevent the Commonwealth

from prosecuting, under Code § 18.2-152.3, persons who use their own computers to hack into

other computers or computer networks and commit false pretenses, embezzlement, larceny, or

conversion. Rather, it simply conforms the scope of Code § 18.2-152.3 to its legislative intent by

giving meaning to the words “without authority.”11

9
The Commonwealth correctly notes that “BB&T certainly could not authorize Wallace
to violate the law.” The dissent also highlights the facts that “after the checks were flagged,
BB&T’s fraud management team investigated the incidents and later provided the checks and
security camera images of Wallace at the ATM as evidence at trial.” They also note that a
BB&T investigator testified at trial on the Commonwealth’s behalf and that BB&T received
restitution in the case. Naturally, BB&T did not specifically authorize Wallace to pass bad
checks and thereby steal money. BB&T could, however, authorize Wallace to deposit checks
and withdraw cash from the bank’s own ATM.
10
We note, as did the Court in Van Buren, that based on the record in this case, we need
not address whether a person’s scope of authority is defined based “only on technological (or
‘code-based’) limitations on access, or instead also looks to limits contained in contracts or
policies.” Van Buren, 141 S. Ct. at 1659 n.8. Here, no evidence was proffered of any bank
policy or customer agreement that specifically barred the use of an ATM to deposit a forged
check. As such, we decline to consider what impact, if any, that evidence would have on
Wallace’s convictions. See Taylor v. Commonwealth, 78 Va. App. 147, 157 (2023) (noting that
we must decide cases “on the best and narrowest grounds available” (quoting Swann, 290 Va. at
196)).
11
The dissent suggests that this opinion would limit computer fraud convictions to only
those cases in which a defendant uses a computer “without any kind of permission.” Such an
interpretation would be at odds with the plain language of the statute, which expressly provides
that a person may be “without authority” either when they have “no right, agreement or
permission,” or when they “knowingly exceed[] such right, agreement or permission.” Code
§ 18.2-152.2. An individual who has authorization to use a friend’s computer to complete
homework is likely exceeding their authority when they then use the computer to embezzle
funds, for example. The distinction lies in looking at whether the specific computer operations
performed were authorized. We find that here, Wallace’s operations were, in fact, authorized.
- 16 -
 CONCLUSION

The evidence is insufficient to establish that Wallace used the ATM “without authority”

under the computer fraud statute. Therefore, we reverse her convictions for computer fraud, and

remand the case for entry of a sentencing order consistent with the rulings of this Court.

Reversed and remanded.

- 17 -
Callins, J., concurring.

Under the doctrine of judicial restraint, we must decide cases “on the best and narrowest

grounds available.” Butcher v. Commonwealth, 298 Va. 392, 396 (2020) (internal citation

omitted). I would decide this case on a crucial threshold question—whether the ATM in

question qualifies as a “computer” under Code § 18.2-152.3. Because I would hold that this

ATM is not a computer, I concur with the majority’s decision to reverse and remand Wallace’s

computer fraud convictions. Resolving this case, however, by determining whether the ATM is

a computer would be the best and narrowest grounds available.

Code § 18.2-152.2 defines a “computer” as “a device that accepts information in digital

or similar form and manipulates it for a result based on a sequence of instructions.” Although

“[t]he Act defines the term ‘computer’ broadly,” the definition is not without exceptions. Brewer

v. Commonwealth, 71 Va. App. 585, 593 (2020). Explicitly excluded are “simple calculators,

automated typewriters, [and] facsimile machines.” Id. at 592 (quoting Code § 18.2-152.2). The

statute further excludes as a computer “any other specialized computing devices that are

preprogrammed to perform a narrow range of functions with minimal end-user or operator

intervention and are dedicated to a specific task.” Id. (quoting Code § 18.2-152.2).12

Nothing in the record indicates that the functionality of the subject ATM was more than

receiving inputted information and outputting a result, much like a calculator or a facsimile

machine. The evidence presented at trial established that, here, the outputted result was

12
The majority notes that the Commonwealth “argues that Wallace used a computer
network as an alternative ground for affirmance.” See Code § 18.2-152.3 (defining computer
fraud as using “a computer or computer network, without authority and” committing a specific
theft or fraud crime). It then continues that “we need not decide whether a computer network
was used here.” I agree. Because I would find that this ATM is not a computer, a computer
network is necessarily lacking. See Code § 18.2-152.2 (defining a “computer network” as “two
or more computers connected by a network” (emphasis added)). Thus, there is no need to
address whether Wallace used a “computer network” under Code § 18.2-152.3.
- 18 -
extremely limited in scope. Kevin Wolfe, a corporate investigator with BB&T Bank, described

the range of functions that the ATM provided: it received deposited checks, expelled cash

withdrawals, and displayed balance inquiries.13 Nothing more. These three functions represent a

“narrow range” which the ATM was preprogrammed to accommodate. The record does not

indicate how this ATM performed these functions, so we have no indication of whether or to

what extent information was manipulated as opposed to preprogrammed. Cf. Midkiff v.

Commonwealth, 54 Va. App. 323, 337 (2009) (describing that in the operation of computer data

compilation “how much information will be required about data input and processing to

authenticate the output will depend on the nature and completeness of the data, the complexity of

the manipulation, and the routineness of the operation” (quoting 2 McCormick on Evidence

§ 227 (Kenneth S. Broun et al. eds., 6th ed. 2006))). Such evidence would support an inference

that this ATM was subject to manipulation and thus was more complex than the devices Code

§ 18.2-152.2 explicitly excludes.

Accordingly, the ATM in question is comparable to a facsimile machine—a device

expressly excluded from Code § 18.2-152.2’s definition of a “computer.” A facsimile machine

receives information inputted by the user. It then transmits that information to another device

and confirms the completion of the transmission in the form of an outputted result. A facsimile

machine is designed to perform limited functions. This is consistent with the statutory definition

of a specialized computing device; it is preprogrammed and dedicated to this specific task.

13
In determining whether this ATM is a “computer,” we consider the evidence
introduced at trial. Wolfe testified that this ATM was “a very sophisticated machine that actually
has electronics that can actually do a number of different functions.” Yet, Wolfe only identified
three functions: check depositing, cash withdrawal, and balance inquiry. Notably, Wolfe was not
qualified as an expert in ATM machines or in computers. This lack of qualification may account
for the conclusory yet dilettante description of “sophisticated machine that actually has
electronics” Wolfe provided when asked “what an ATM is.” But because neither party
challenged Wolfe’s qualification to testify on this subject, the above analysis does not take this
into consideration.
- 19 -
Likewise, this ATM was preprogrammed and dedicated to its limited range of rudimentary tasks,

which Wolfe testified were “depositing checks[,]” “mak[ing] withdrawals[,]” and “balance

inquiries.”

In conclusion, I would decide this case solely on the issue of whether this ATM is a

“computer” under Code § 18.2-152.3. Like my dissenting colleagues, I would not hold that

every ATM is or is not a computer. Yet, as the evidence here presents nothing more than a

machine of limited and preprogrammed functionality, I would hold that the evidence failed to

show that this ATM qualified as a computer as defined under Code § 18.2-152.2. Thus, I would

reverse and remand Wallace’s computer fraud convictions.

- 20 -
Athey, J., with whom Humphreys and Beales, JJ. join, dissenting.

Since Wallace violated Code § 18.2-152.3 when she used the ATM owned by BB&T

“without authority” to utter fraudulent checks and thereby obtain money by false pretenses, I

would have affirmed Wallace’s convictions. Hence, I must respectfully dissent from the

majority’s decision reversing and remanding her convictions for computer fraud.

Because the majority assumes without deciding that the ATM is a computer, I must first

briefly explain why I would have decided that this ATM meets the definition of a computer

pursuant to Code § 18.2-152.2. In 2005, the General Assembly broadly redefined the original

definition of a “computer” in the Virginia Computer Crimes Act (“VCCA”) to include “device[s]

that accept[] information in digital or similar form and manipulate[] it for a result based on a

sequence of instructions.” Brewer v. Commonwealth, 71 Va. App. 585, 592 (2020) (quoting

Code § 18.2-152.2). The new definition excludes several very basic devices “dedicated to a

specific task” requiring “minimal end-user or operator intervention.” Code § 18.2-152.2 (2005).

These excepted devices include simple calculators, automated typewriters, and fax machines. Id.

Finally, since it’s earliest iteration, Code § 18.2-152.2 has defined a computer network as “a set

of related, remotely connected devices” that “include[es] more than one computer.” Code

§ 18.2-152.2 (1984).

Here, the ATM used by Wallace was owned by her local banking institution, BB&T.

Wallace was authorized to use the ATM to conduct inquiries as to the balance in her account and

to deposit nonfraudulent checks therein. In addition, BB&T account holders were authorized to

utilize this ATM to conduct other transactions such as withdrawals, transfers, and account

inquiries. The ATM was also hard-wired to communicate with BB&T’s computer network and

to transmit data to and from other banks.

- 21 -
 I would not have held that every ATM device should universally fall within the Code

§ 18.2-152.2 definition of a computer since some stand-alone ATMs that are solely equipped to

dispense cash funds may be more akin to a calculator or fax machine and therefore fall within the

statutory exceptions. I would, however, have decided that this ATM was clearly a “device that

accept[ed] information in digital or similar form and manipulate[d] it for a result based on a

sequence of instructions.” Code § 18.2-152.2. Since I would not have found that this ATM was

a “specialized computing device[]” only “preprogrammed to perform a narrow range of

functions” I would have rejected Wallace’s contention that the ATM was excepted from the

definition of computer under Code § 18.2-152.2.

In dissenting from the majority’s decision reversing and remanding Wallace’s

convictions for computer fraud, it is worth further explaining the role of the 2005 amendments in

modifying the VCCA. The General Assembly modified Code § 18.2-152.3 by removing the

requirement that to be found guilty of computer fraud, the Commonwealth must prove that when

using a computer without authority, one must do so “with the intent to [o]btain property or

services by false pretenses.” Code § 18.2-152.3 (1984). Thus, from then on, the Commonwealth

must only prove that the computer fraud was committed “without authority.” Hence, I agree

with the majority that to determine whether Wallace was guilty of computer fraud pursuant to

Code § 18.2-152.3, one must first look to the plain meaning of the definitional section of the

statute within Code § 18.2-152.2.14

In the original 1984 Act, “without authority” was defined as “when [s]he ha[d] no right or

permission of the owner to use a computer, or, [s]he use[d] a computer in a manner exceeding

14
The majority explains in footnote seven that the language in Code § 18.2-152.3 is
“unambiguous.” I agree, and for this reason would avoid looking to “factors such as the purpose,
reason, and spirit of the law, including any legislative history” in analyzing this statute’s plain
meaning. See Eley v. Commonwealth, 70 Va. App. 158, 164 (2019).
- 22 -
such right or permission.” Code § 18.2-152.2 (1984). The 2005 amendments further expanded

the plain meaning of the term “without authority” by imposing a mens rea element requiring the

defendant “know[]” or “reasonably should know” that she was exceeding her permission to use

the ATM.15

Here, Wallace, a bank customer, was permitted and therefore authorized to use the ATM

owned by BB&T. Since Wallace had permission to use the ATM, the only question left to

resolve is whether Wallace, by using the computer, acted “in a manner knowingly exceeding

such right, agreement or permission.” Thus, I would have first held that the ATM

unambiguously meets the definition of a computer as defined in the Act. Further, based on the

definitions of “use[]” and “without authority,” Wallace “use[d]” the “computer” “without

authority” because when she used the computer to obtain property by false pretenses, she

knowingly acted in a manner exceeding her right or permission to use the ATM owned by

BB&T.

The majority incorrectly identifies the issue to be resolved as “whether a person [who is]

authorized to use a[n] [ATM] necessarily exceeds that authority when they use the computer to

obtain money by false pretenses.” The issue is much narrower in that the inquiry is whether,

after establishing that the ATM is a computer, the evidence was sufficient to establish that

Wallace acted “without authority” because she knew or reasonably should have known “that

s[he] ha[d] no right, agreement, or permission” or “knowingly exceed[ed] such right, agreement,

or permission.”

15
“Without authority” in its current definition in Code § 18.2-152.2 retains the mens rea
component stating that one is without authority “when he knows or reasonably should know that
he has no right, agreement, or permission or acts in a manner knowingly exceeding such right,
agreement, or permission.”
- 23 -
 Beginning here, I agree with the majority that “without authority” modifies “use[].”

“Use[]” as defined in Code § 18.2-152.2 means “when [one] attempts to cause or causes a

computer or computer network to perform or to stop performing computer operations.” The

majority asserts that because “‘use[]’ does not encompass the end goal or purpose of the user,”

and instead involves actions taken to operate the computer, Wallace’s actions were thus not a

“use[]” committed “without authority,” and therefore not in violation of the statute.

I disagree with this interpretation and contend that it is clear that the phrase “computer

operation” in Code § 18.2-152.2 encompasses various computer “functions” that “include[], but

[are] not limited to,” the “communication with, storage of data to, or retrieval of data.” And

further, that a “computer operation” “may also be any function for which that computer was

generally designed.” Code § 18.2-152.2. The majority’s limited definition of computer

operations avoids looking at the “function” of the computer here, which was to respond to

Wallace’s inputs. While I acknowledge that the statutory definition of “use[]” does not speak to

the “purposes” or intent of the user, “use[]” does encompass the user’s “communication with”

the machine as well as the “function” that the ATM was designed to serve. For this reason,

“use[]” encompasses “computer operation[s]” including “communication[s]” and “function[s]”

the ATM was designed to perform like processing checks, and “communicati[ng]” with the

computer leading it to perform “any function for which that computer was generally designed.”

Code § 18.2-152.2.

Thus, based on the plain meaning of Code § 18.2-152.2, “any function for which that

computer was generally designed” could be a use pursuant to the statute. “[W]e ‘apply[] the

plain meaning of the words unless they are ambiguous or [doing so] would lead to an absurd

result.’” Eley v. Commonwealth, 70 Va. App. 158, 164 (2019) (second and third alterations in

original) (quoting Wright v. Commonwealth, 278 Va. 754, 759 (2009)). With this principle of

- 24 -
statutory interpretation in mind, I would find that the majority’s reliance on Van Buren v. United

States, 141 S. Ct. 1648 (2021), which interprets a separate federal statute, is misplaced. Van

Buren involved a police officer’s violation of department policy in searching a law enforcement

database. Id. at 1652-53. Van Buren was prosecuted under 18 U.S.C. § 1030(a)(2) which

distinguished between “access[ing] a computer without authorization” and “exceed[ing]

authorized access.” Id. at 1652. 18 U.S.C. § 1030(e)(6) also includes a definitional section

which defines “exceeds authorized access” as “access[ing] a computer with authorization and to

use such access to obtain or alter information in the computer that the accesser is not entitled so

to obtain or alter.” Id.

In Van Buren, the United States Supreme Court reversed Van Buren’s conviction for

computer fraud and found that in order to violate the Computer Fraud and Abuse Act (“CFAA”),

an individual must access information “that a person is not entitled to obtain by using a computer

that he is authorized to access.” Id. at 1655. The Court further noted that it would thus not be a

violation if a user had “improper motives for obtaining information that is otherwise available to

them.” Id. at 1652. Based on that holding, the majority concludes that Van Buren compels this

Court to reach the same conclusion here because “a defendant authorized to use a computer to

perform specific tasks is not ‘without authority.’”

Although the majority acknowledges that the federal statute employs the term “access,”

but the VCCA employs the term “use[],” the majority avoids acknowledging any meaningful

distinction between these disparate state and federal statutes. To illustrate this point, the VCCA

defines “use[]” as when a user “attempts to cause or causes a computer or computer network to

perform or to stop performing computer operations,” Code § 18.2-152.2, while the CFAA fails to

define “access.” While I agree with the majority that “‘[a]ccess’ [as used in the CFAA] implies

the initial approach or entrance to the computer” and that “‘use[]’ [as used in the VCCA] focuses

- 25 -
on the functions or operations performed with the computer,” it is precisely this distinction that

makes the United States Supreme Court’s analysis in Van Buren irrelevant here.

Similarly, while I agree with the majority that the CFAA does not discuss motive or mens

rea for someone who is “access[ing] a computer,” I disagree that the VCCA does not contain a

reference to “motive.” As noted by the majority, the General Assembly chose to retain the term

“without authority” when they modified Code § 18.2-152.2 in 2005. However, the 2005

amendments to Code § 18.2-152.2 explicitly added a mens rea component to the definitional

section that remains in the current form of the statute in stating “[a] person is ‘without authority’

when he knows or reasonably should know that he has no right, agreement or permission.”

(Emphasis added).16 This mens rea requirement concerning the knowledge of the user is directly

tied to the user’s manner of use, and arguably, this language shows that “without authority”

directly contemplates the relevance of the user’s purpose. The majority would seem to posit that

interpreting “without authority” in a way that assesses the user’s intent “relies on the assumption

that any use of a computer or computer network for a fraudulent purpose must be ‘without

authority.’” However, the real issue here, as framed by the Commonwealth, is that Wallace’s

actions in using a computer “to request funds from the victim’s bank or to deposit fraudulent

checks” is a use that exceeds the rights and permissions of a bank customer. I thus reject the

majority’s characterization of the Commonwealth’s argument as “if a defendant uses a computer

to deposit forged checks . . . their use is per se without authority.” And while I would agree that

“‘use[]’ does not encompass the end goal or purpose of the user,” I would further conclude that

“without authority” does encompass the purposes of the user when she uses a computer.

16
The 2005 amendments to both Code §§ 18.2-152.2 and -152.3 effectively relocate the
“intent” language from the penalty section of Code § 18.2-152.3 to Code § 18.2-152.2 with the
addition of the phrase “knows or reasonably should know” to the definition of “without
authority.”
- 26 -
 The penalty section combined with the definition section provide a basis to determine

whether a use is “without authority” based on the rights and permissions of a given user in using

a computer. As such, it is evident that the circuit court was well within its discretion in finding

the evidence sufficient to establish that Wallace’s use of the computer in uttering fraudulent

checks and thereby obtaining property by false pretenses was committed “without authority,”

under the circumstances present in this case.17

In DiMaio v. Commonwealth, 46 Va. App. 755, 760 (2005), aff’d, 272 Va. 504 (2006),

both this Court and the Supreme Court affirmed an appellant’s computer fraud conviction under

Code § 18.2-152.3 when he transferred hundreds of files from his work computer to his personal

computer and then deleted the files on his work computer.18 Admittedly, there, the appellant

primarily challenged the sufficiency of the evidence regarding the value of the files he removed

from the computer owned by his employer. But nothing in either opinion suggests that because

the appellant had permission to use his work computer, the computer fraud conviction was

erroneous because the use was not unauthorized under Code § 18.2-152.3.19

17
Based on the same evidence, Wallace was found guilty of uttering under Code
§ 18.2-172, which contains the requirement that the person “know[s] [the writing] to be forged.”
18
I primarily cite DiMaio to help illustrate that, under the majority’s theory, situations in
which a defendant has permission to use a work computer, friend’s computer, etc., for legitimate
purposes (and then exceeds the given authority by engaging in illegal activity) would no longer
be subject to prosecution under Code § 18.2-152.3. Essentially, the majority seemingly limits
the statute’s application to situations in which a defendant steals a computer or uses one without
any kind of permission. Since one of the purposes of the VCCA is to enhance penalties for
crimes that are less risky to commit, I do not think Code § 18.2-152.3 was meant to be
interpreted so narrowly. See Va. St. Crime Comm’n, Computer Crimes Act, Rep. Doc. No. 11, at
18 (2005) (noting that “[i]n comparing the risk of computer crimes to that [of] robbery” fewer
people will risk committing robbery because “it has a high penalty and is socially unacceptable,”
compared to computer crimes where “there are low penalties and in many cases, it is socially
tolerable, if not acceptable”).
19
Frequently, when an appellant fails to raise an issue, the Supreme Court prefers not to
raise the issue sua sponte. The Court usually accepts the concession but makes clear that it is

- 27 -
 In Ramsey v. Commonwealth, 65 Va. App. 694 (2015), a panel of this Court analyzed a

different section of the VCCA specifically involving the “computer invasion of privacy” in

which a person is guilty of said offense “when [she] uses a . . . computer network and

intentionally examines without authority any . . . information . . . relating to any other person.”

Id. at 700. There, we noted that “to be convicted . . . the evidence must establish that the

offender viewed identifying information of another ‘when [s]he knows or reasonably should

know’ [s]he is without right, agreement, or permission to do so or ‘act[ing] in a manner

knowingly exceeding such right, agreement, or permission.’” Id. at 698 (third alteration in

original). This Court held that “the evidence is sufficient to find appellant was without authority

to examine the information on VCIN for non-criminal justice purposes.” Id. at 701. While the

majority distinguishes this result on the basis that “without authority” modified the verb

“examine” rather than “use[],” this distinction alone cannot do away with the mens rea

component of “without authority” contained in Code § 18.2-152.2 and its relevance to the

Court’s analysis in Ramsey. “Without authority” inherently has an intent element built in,

meaning that purpose is as relevant in assessing “use[]” as it was in assessing “examine.”

Simply put, unless Wallace had BB&T’s permission to use the ATM to cash forged

checks, keep half of the money, and deposit the other half into her checking account, she used

BB&T’s ATM “without authority” pursuant to Code § 18.2-152.3. Although I agree with the

majority that Wallace had permission to use the ATM, I disagree that the evidence was

insufficient to prove that Wallace “knowingly exceed[ed]” that authority by using the ATM in a

accepting the position because it was conceded, not necessarily because it was legally correct.
See, e.g., Daily Press, LLC v. Commonwealth, 301 Va. 384, 411 n.20 (2022) (stating that the
Supreme Court was not dispositively deciding the conceded issue and “offer[ed] no opinion on”
the legitimacy of the conceded standard); Butcher v. Commonwealth, 298 Va. 392, 398 (2020)
(flagging that although the Supreme Court accepted appellant’s concession that a statute was
conjunctive, it “[o]ffer[ed] no opinion on the competing conjunctive/disjunctive interpretations
of the statute”). In DiMaio, neither this Court nor the Supreme Court issued such a disclaimer.
- 28 -
manner that BB&T did not and would never authorize. Instead, I would have determined that the

evidence sufficiently established that Wallace knowingly exceeded her authority to use BB&T’s

ATM. The record reflects that after the checks were flagged, BB&T’s fraud management team

investigated the incidents and later provided the checks and security camera images of Wallace

at the ATM as evidence at trial. In addition, a representative from BB&T assisted the

Commonwealth in securing Wallace’s various convictions by testifying on the Commonwealth’s

behalf at trial. BB&T was also awarded $937.82 in restitution. By “regard[ing] as true all the

credible evidence favorable to the Commonwealth” and drawing all “fair inferences . . .

therefrom,” it seems clear BB&T did not authorize Wallace to use the ATM for fraud. Vay v.

Commonwealth, 67 Va. App. 236, 242 (2017) (quoting Parks v. Commonwealth, 221 Va. 492,

498 (1980)).

Finding that Wallace’s actions in cashing and depositing portions of fraudulent checks in

her checking account were done without authority does not make “without authority”

superfluous. Instead, this interpretation permits the clear legislative intent of the 2005 General

Assembly to be effectuated by allowing courts to determine on a case-by-case basis whether an

accused user “knows or reasonably should know” that the use of the computer was committed

with “no right, agreement, or permission” or “exceed[s] such . . . permission.” The interpretation

of the amended Act encouraged by the majority leads to a result that avoids giving any meaning

to the terms “knowingly” and “reasonably” inserted by the General Assembly when amending

the Act in 2005.20 For these reasons, I respectfully dissent.

20
By neutering the requirement that a user “knows” or “reasonably should know” her
actions were taken with “no right, agreement, or permission,” the strange result is that “though a
user’s purpose may be illegal, their use may still be authorized.”
- 29 -
 VIRGINIA:
In the Court of Appeals of Virginia on Tuesday the 28th day of March, 2023.
PUBLISHED

Taylor Amil Wallace, Appellant,

against Record No. 1040-21-1
Circuit Court Nos. CR19-1147-00 through CR19-1147-15 and
CR20-649-00

Commonwealth of Virginia, Appellee.

Upon a Petition for Rehearing En Banc

Before Chief Judge Decker, Judges Humphreys, Beales, Huff, O’Brien, AtLee, Malveaux, Athey, Fulton,
Ortiz, Causey, Friedman, Chaney, Raphael, Lorish, Callins and White

On March 14, 2023 came the appellee, by the Attorney General of Virginia, and filed a petition

requesting that the Court set aside the judgment rendered herein on February 28, 2023, and grant a rehearing

en banc on the issue(s) raised in the petition.

On consideration whereof and pursuant to Rule 5A:35 of the Rules of the Supreme Court of Virginia,

the petition for rehearing en banc is granted and the appeal of those issues is reinstated on the docket of this

Court. The mandate previously entered herein is stayed pending the decision of the Court en banc.

The parties shall file briefs in compliance with the schedule set forth in Rule 5A:35(b). The appellant

shall attach as an addendum to the opening brief upon rehearing en banc a copy of the opinion previously

rendered by the Court in this matter. An electronic version of each brief shall be filed with the Court and

served on opposing counsel. 1
A Copy,

Teste:

A. John Vollino, Clerk

original order signed by a deputy clerk of the
By: Court of Appeals of Virginia at the direction
of the Court

Deputy Clerk

1
The guidelines for filing electronic briefs and appendices can be found at
www.courts.state.va.us/online/vaces/resources/guidelines.pdf.
 COURT OF APPEALS OF VIRGINIA

Present: Judges Athey, Ortiz and Lorish
PUBLISHED

Argued at Norfolk, Virginia

TAYLOR AMIL WALLACE
OPINION BY
v. Record No. 1040-21-1 JUDGE DANIEL E. ORTIZ
FEBRUARY 28, 2023
COMMONWEALTH OF VIRGINIA

FROM THE CIRCUIT COURT OF THE CITY OF CHESAPEAKE
John W. Brown, Judge

Samantha Offutt Thames, Senior Assistant Public Defender (Virginia
Indigent Defense Commission, on briefs), for appellant.

Stephen J. Sovinsky, Assistant Attorney General (Jason S. Miyares,
Attorney General, on brief), for appellee.

A person who uses a computer for a fraudulent purpose does not automatically use it

“without authority” under the computer fraud statute. Following a bench trial, Taylor Amil Wallace

was convicted of computer fraud, obtaining money by false pretenses, uttering forged checks, and

failing to appear in court, after she deposited forged checks in an ATM. Wallace challenges the

sufficiency of the evidence for each conviction. She argues that the Commonwealth failed to prove

that: the ATM is a “computer,” she used the ATM “without authority,” she knew that the checks

were forged, and she “willfully” failed to appear in court. We find the evidence insufficient to

prove that Wallace used the ATM “without authority” but sufficient to prove the remaining

convictions. We affirm in part and reverse in part.

BACKGROUND

In December 2018, Wallace deposited four checks, in the amounts of $440, $324, $450,

and $300, into her bank accounts at BB&T, using a drive-through ATM. These checks were
deposited on four separate days and were made out from Gregory Starling’s Southern Bank

account to “Taylor A. Wallace.” The first two checks had the word “work” in their memo fields,

and the third and fourth checks had the words “cleaning” and “remaining balance,” respectively.

All four checks were endorsed by “Taylor Wallace.” Photos from security cameras show

Wallace driving to the ATM, sometimes with an unidentified male in the front passenger seat,

and depositing the checks. Two of the checks were returned to BB&T as forged. The other two

were returned because the Southern Bank account was closed. After using the funds in

Wallace’s accounts to make up for the loss, BB&T lost $937.82 in total.

On January 28, 2019, Wallace accepted an interview by Detective Ronald Ward at her

mother’s residence. Wallace admitted that she was the person depositing the checks and that she

did not know Gregory Starling, but she refused to tell Detective Ward where she got the checks.

After being arrested and granted bail, Wallace signed a continuance order requiring her to appear

before the trial court on January 30, 2020. However, she did not appear on January 30. Wallace

was charged with four counts of forging a check, four counts of uttering a forged check, four

counts of obtaining money by false pretenses, four counts of computer fraud, one count of using

false identification to obtain money, and one count of felony failure to appear, in violation of

Code §§ 18.2-152.3, 18.2-172, 18.2-178, 18.2-186.3(A)(2), and 19.2-128(B).

At the bench trial, Wallace testified that she did not steal the checks but received them

from her stepfather, Miguel Sumner, who had no bank account and told Wallace that the checks

were his paychecks for his demolition and cleaning work. She testified that the unidentified

male in the passenger seat was Sumner and that Sumner did not give her the checks until they

were at the ATM. She denied having endorsed the checks, claiming that she never actually

looked at the checks because she trusted Sumner. Wallace also stated that she had been

represented by several attorneys and that, although she signed the continuance order, the advice

-2-
from one of her attorneys caused her failure to appear. Wallace was not allowed to testify as to

what the attorney told her,1 and the attorney did not testify at trial. Finally, Wallace stated that

she was 18 years old in December 2018 and admitted that she had had one misdemeanor

conviction involving lying, cheating, or stealing, as well as three or four felony convictions as a

juvenile. Wallace’s mother corroborated Wallace’s story, testifying that she dated Sumner

during the time Wallace deposited the checks and that Sumner worked in construction.

Starling testified that he did not write the four checks and that they were probably taken

from his work truck around December 7, 2018. He stated that, at the time, he worked at a job

site and had hired a man, James Watson, and an all-male team for demolition and cleaning work.

BB&T investigator Kevin Wolfe testified that the ATM was a “very sophisticated

machine” and had “a number of different functions,” including depositing checks, withdrawing

cash, and making balance inquiries. Wolfe opined that an ATM “would be considered a

computer.”

After hearing all evidence, the trial court found Wallace guilty of uttering forged checks,

obtaining money by false pretenses, computer fraud, and failure to appear. It did not find

Wallace guilty of forgery or identity fraud. The trial court sentenced Wallace to 17 years and 96

months of incarceration, with 13 years and 128 months suspended. Wallace appeals, challenging

the sufficiency of the evidence for each conviction. First, Wallace argues that the evidence does

not support the computer fraud convictions because an ATM is not a computer and Wallace did

not use the ATM “without authority.” Second, Wallace argues that the evidence does not

establish that she possessed the requisite intent for uttering forged checks, obtaining money by

1
The trial court prohibited Wallace from testifying as to the attorney’s advice, finding
that such testimony would be inadmissible hearsay.
-3-
false pretenses, or computer fraud. Finally, Wallace argues that the evidence did not establish

that she “willfully” failed to appear in court.

ANALYSIS

A. Standards of Review

In reviewing the sufficiency of the evidence, we consider the evidence “in the light most

favorable to the Commonwealth, the prevailing party below.” Vay v. Commonwealth, 67

Va. App. 236, 242 (2017) (quoting Smallwood v. Commonwealth, 278 Va. 625, 629 (2009)). In

doing so, we “discard the evidence of the accused in conflict with that of the Commonwealth,

and regard as true all the credible evidence favorable to the Commonwealth and the inferences to

be drawn therefrom.” Bowman v. Commonwealth, 290 Va. 492, 494 (2015) (quoting Kelley v.

Commonwealth, 289 Va. 463, 467-68 (2015)).

We defer “to the trial court’s findings of fact unless they are plainly wrong or without

evidence to support them.” Brewer v. Commonwealth, 71 Va. App. 585, 591 (2020) (citing

Ramsey v. Commonwealth, 65 Va. App. 694, 697 (2015)). “The fact finder, who has the

opportunity to see and hear the witnesses, has the sole responsibility to determine their

credibility, the weight to be given their testimony, and the inferences to be drawn from proven

facts.” Commonwealth v. Taylor, 256 Va. 514, 518 (1998). Furthermore, “[t]he judgment of a

trial court sitting without a jury is entitled to the same weight as a jury verdict” when reviewed

on appeal. Martin v. Commonwealth, 4 Va. App. 438, 433 (1987) (citing Code § 8.01-680).

However, “to the extent that the issue on appeal requires the Court to determine the meaning of a

statute and its terms, it reviews that issue de novo.” Brewer, 71 Va. App. at 591.

B. The evidence is insufficient to establish that Wallace used the ATM “without authority.”

Wallace challenges her computer fraud convictions under Code § 18.2-152.3. She argues

that, first, the ATM she used was not a “computer” under the statute, and second, she did not use

-4-
the ATM “without authority.” Assuming, without deciding, that the ATM was a computer,2 we

find that the trial court misinterpreted Code § 18.2-152.3 in finding that Wallace used it “without

authority.”

Under the Virginia Computer Crimes Act (“VCCA”), “[a]ny person who uses a computer

or computer network, without authority” and “[o]btains property or services by false pretenses,”

“[e]mbezzles or commits larceny,” or “[c]onverts the property of another” is guilty of computer

fraud. Code § 18.2-152.3. Under the VCCA, “[a] person is ‘without authority’ when he knows

or reasonably should know that he has no right, agreement, or permission or acts in a manner

knowingly exceeding such right, agreement, or permission.” Code § 18.2-152.2. Wallace argues

that as a BB&T customer, she had the authority to use the ATM to deposit checks and withdraw

cash. The Commonwealth responds that Wallace exceeded her authority by depositing forged

checks. The question here is whether a person who uses a computer to obtain money by false

pretenses is per se “without authority.”

“When construing a statute, our primary objective is ‘to ascertain and give effect to

legislative intent,’ as expressed by the language used in the statute.” Cuccinelli v. Rector,

Visitors of the Univ. of Va., 283 Va. 420, 425 (2012) (quoting Commonwealth v. Amerson, 281

2
We agree with the dissent that the ATM was a “device that accept[ed] information in
digital or similar form and manipulate[d] it for a result based on a sequence of instructions.”
Code § 18.2-152.2. However, we decline to find that the ATM fell outside the exception of
“specialized computing devices that are preprogrammed to perform a narrow range of functions
with minimal end-user or operator intervention and are dedicated to a specific task.” Id. The
dissent finds that the ATM’s “level of sophistication” was high and that in using the ATM to
deposit checks, Wallace was not subject to the “same oversight” of a live-teller transaction.
Because Code § 18.2-152.2 does not base the distinction on a machine’s “level of
sophistication,” and because the record does not establish how ATM transactions and live-teller
transactions are subject to different oversight, we are not ready to reach the same conclusion.
Furthermore, we must “decide cases ‘on the best and narrowest grounds available’” under the
doctrine of judicial restraint. Commonwealth v. White, 293 Va. 411, 419 (2017) (quoting
Commonwealth v. Swann, 290 Va. 194, 196 (2015)); see also Spruill v. Garcia, 298 Va. 120, 127
(2019). Therefore, we decline to reach a finding regarding whether an ATM is a computer under
Code § 18.2-152.3.
-5-
Va. 414, 418 (2011)). We “presume that the legislature chose, with care, the words it used when

it enacted the relevant statute.” Zinone v. Lee’s Crossing Homeowners Ass’n, 282 Va. 330, 337

(2011). In addition, “when the General Assembly has used specific language in one instance, but

omits that language or uses different language when addressing a similar subject elsewhere in the

Code, we must presume that the difference in the choice of language was intentional.” Id. Such

omission shows “that the General Assembly knows how to include such language in a statute to

achieve an intended objective” and unambiguously expressed “a contrary intention.” Morgan v.

Commonwealth, __ Va. __, __ (Dec. 29, 2022). Finally, when a statute is ambiguous, “the rule

of lenity [directs] us to adopt a narrow construction, thus reducing exposure to criminal liability.”

Fitzgerald v. Loudoun Cnty. Sheriff’s Off., 289 Va. 499, 508 (2015); see also Morgan, __ Va. at

__ (applying the rule of lenity when a narrow interpretation of a penal statute did not conflict

with legislative intent and was not overly restrictive).

Preventing unauthorized access to computers is a primary purpose of computer crime

laws. The federal government and all fifty states have “enacted computer crime laws that

prohibit ‘unauthorized access’ to computers.” Orin S. Kerr, Cybercrime’s Scope: Interpreting

“Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U.L. Rev. 1596, 1596

(2003); see also Susan W. Brenner, State Cybercrime Legislation in the United States of

America: A Survey, 7 Rich. J.L. & Tech. 28, p15 n.37 (2001) (listing state computer crime

statutes). In Virginia, the plain language of the VCCA manifests this legislative intent. The

VCCA expressly defines “without authority,” and it is an element of several offenses within the

VCCA, including computer fraud. Code §§ 18.2-152.2 and -152.3. The language makes it clear

that the computer fraud statute applies only to the unauthorized use of computers and computer

networks.

-6-
 Moreover, the words “without authority” clearly modify “use[] [of] a computer or

computer network” in Code § 18.2-152.3, rather than the purposes of such use—that is, obtaining

property or services by false pretenses, embezzlement, larceny, and conversion. Thus,

combining Code §§ 18.2-152.2 and -152.3, a computer fraud conviction requires that the

defendant either “has no right, agreement, or permission” to use the computer or computer

network or uses it “in a manner knowingly exceeding such right, agreement, or permission.” To

prove that a defendant knowingly exceeded their authorization, the Commonwealth must first

establish the scope of the right, agreement, or permission. The manner, rather than purpose, of

the use must be unauthorized. The dissent argues that our analysis distinguishing the manner and

purpose of computer use is “unnecessarily complicated,” but the plain text of the statutes

compels such a distinction. The definition of “without authority” explicitly includes “in a

manner knowingly exceeding” authorization. Code § 18.2-152.2 (emphasis added). At the same

time, the words “without authority” in the computer fraud statute do not modify the enumerated

purposes of obtaining property by false pretenses, embezzlement, larceny, and conversion.

A comparison of Code § 18.2-152.3 to Code § 18.2-152.5 further supports this

conclusion. Under Code § 18.2-152.5, “[a] person is guilty of the crime of computer invasion of

privacy when he uses a computer or computer network and intentionally examines without

authority any employment, salary, credit or any other financial or identifying information . . .

relating to any other person.” (Emphasis added). Unlike in the computer fraud statute, here the

words “without authority” modify the examination of information, rather than the use of a

computer or computer network. For example, in Ramsey v. Commonwealth, a state trooper ran

inquiries using the Virginia Criminal Information Network (VCIN) for personal purposes,

knowing that she was only authorized to do so for criminal justice purposes. 65 Va. App. at

695-96. Although she had authority to use the VCIN, this Court upheld her conviction under

-7-
Code § 18.2-152.5 because she “was without authority to examine the information on VCIN for

non-criminal justice purposes.” Id. at 701. The words “without authority” modify different

actions in the computer fraud and computer invasion of privacy statutes. Because both sections

of the VCCA address the “similar subject” of computer crimes, “we must presume that the

difference in the choice of language was intentional.” Zinone, 282 Va. at 337.

We reject the Commonwealth’s argument that if a defendant uses a computer to deposit

forged checks—or for unlawful purposes more generally—her use is per se without authority

under the computer fraud statute. This interpretation would render the words “without authority”

in Code § 18.2-152.3 surplusage. In fact, the General Assembly specifically rejected proposals

to remove the words from the statute. See, e.g., Va. St. Crime Comm’n, Computer Crimes Act,

Rep. Doc. No. 77, at 10 (2005) (recommending eliminating “without authority” from Code

§ 18.2-152.3 because when “a criminal uses a computer to . . . commit a fraud on another . . . it

should not be a possible defense that he had the permission of the owner of the computer to

engage in illegal activities”); Senate Bill No. 1163 (Jan. 12, 2005) (amending “[a]ny person who

uses a computer or computer network without authority and with intent to” to “[a]ny person who,

through the use of a computer”). Moreover, unlike computer fraud, other computer crimes under

the VCCA do not include the “without authority” element. See, e.g., Code § 18.2-152.7:1

(harassment by computer); Code § 18.2-152.5:1 (using a computer to gather identifying

information). We must presume that the difference in language was intentional.

The unambiguous language of Code § 18.2-152.3 demonstrates that “without authority”

modifies the use of the computer itself, rather than the purpose of the use. But even if the

language were ambiguous, the rule of lenity would nevertheless compel the same interpretation.

If the General Assembly found our traditional fraud statutes insufficient and intended to enhance

the punishment for all defendants who use computers or computer networks as a tool in

-8-
committing false pretenses, embezzlement, larceny, or conversion, it could have made it clear by

eliminating the words “without authority” in the computer fraud statute. Absent such an express

legislative intent, we refuse to adopt this broad interpretation.

The Commonwealth argues that a person authorized to use a computer can exceed their

authorization, citing Brewer, 71 Va. App. at 592, DiMaio v. Commonwealth, 272 Va. 504,

507-08 (2006), and Barnes v. Commonwealth, No. 2693-98-1, 2000 WL 291436 (Va. Ct. App.

Mar. 21, 2000). While the proposition is correct, none of these cases explore the meaning of

“without authority.” In Brewer, we focused on whether a smartphone constituted a “computer.”

71 Va. App. at 591. In DiMaio, the appellant only challenged the sufficiency of the evidence

regarding the value of data that he removed from a computer. 272 Va. at 506. Finally, Barnes is

an unpublished case that does not interpret “without authority.” As such, these cases are of little

value in determining the meaning of “without authority.” See Jones v. Commonwealth, 293 Va.

29, 50 (2017) (“[S]tare decisis does not ‘foreclose inquiry’ into an issue not previously ‘raised,

discussed, or decided.’” (quoting Chesapeake Hosp. Auth. v. Commonwealth, 262 Va. 551, 560

(2001))).

While not binding on this Court, well-reasoned opinions from other jurisdictions

interpreting similar statutes support our conclusion that “without authority” modifies the use of

computers and computer networks, rather than the purpose of the use. For example, in

Commonwealth v. Shirley, 653 S.W.3d 571 (Ky. 2022), the Supreme Court of Kentucky reversed

a conviction for unlawful access to a computer when the defendant fraudulently placed barcodes

from cheap items onto expensive items and then scanned those barcodes at a Walmart

self-checkout register. The court reasoned that the Kentucky statute “[did] not refer to whether

the individual is accessing a computer to commit fraud but [did] refer to whether the individual

[was] accessing a computer in the way consented to by the owner.” Id. at 579. Similarly, in

-9-
People v. Golb, 15 N.E.3d 805 (N.Y. 2014), the Court of Appeals of New York vacated a

conviction for unauthorized use of a computer when the defendant used a university computer to

send emails criminally impersonating others. The court rejected the prosecution’s argument that

“using the computer to commit a crime cannot be an authorized use” and found that New York’s

computer crime statute was “intended to reach a person who accesses a computer system without

permission (i.e., a hacker).” Id. at 814. Finally, in State v. Nascimento, 379 P.3d 484 (Or. 2016),

the Supreme Court of Oregon reversed a defendant’s conviction for computer crimes when she

used a lottery terminal to print lottery tickets for herself without paying. The court rejected the

“extremely broad definition” that “any time a person uses or accesses a computer for a purpose

not permitted by the computer’s owner, the person does so ‘without authorization’ and commits

computer crime.” Id. at 490. It found that her “use of the lottery terminal to print [lottery]

tickets—as she was trained and permitted by her employer to do—was ‘authorized’ use,” despite

its ultimately criminal purpose. Id. at 491. The purpose of computer crime laws in general, as

reflected in these cases, is consistent with our analysis of the VCCA’s language.

Under Code § 18.2-152.3, “without authority” is an element of the crime, for which the

Commonwealth has the burden of proof.3 In this case, the Commonwealth presented no

evidence to establish the scope of Wallace’s authority to use the ATM or her knowledge that she

exceeded such authority. As a bank customer, she had authority to use the ATM to deposit

checks and withdraw cash. By depositing a forged check, she used the ATM for an unlawful

purpose, but not in an unauthorized manner. The dissent cites as evidence the facts that BB&T

3
The dissent argues that “[f]or Wallace’s use of the ATM to have been authorized, the
evidence would have needed to show that Wallace had BB&T’s permission to use its ATM to
perpetrate the fraud that led to her multiple convictions and BB&T’s loss of funds.” This
proposition is inconsistent with the general principle that “[t]he Commonwealth has the burden
to prove every essential element of the charged crime beyond a reasonable doubt.” Hubbard v.
Commonwealth, 276 Va. 292, 295 (2008).
- 10 -
investigated the incident, had its representative testify at trial, and was awarded restitution.

However, none of these facts establish that Wallace used the ATM in a manner knowingly

exceeding her authority, and the restitution was based on her fraudulent behavior, not her use of

the ATM. Furthermore, the Commonwealth does not cite these facts to show that Wallace used

the ATM without authority. Rather, it simply relies on the assumption that any use of a

computer or computer network for a fraudulent purpose is per se “without authority.” Because

the assumption conflicts with the plain language of Code § 18.2-152.3, we reject it and find the

evidence insufficient to establish that Wallace used the ATM “without authority.”

Our interpretation of Code § 18.2-152.3 does not prevent the Commonwealth from

obtaining felony uttering convictions in this and similar cases, whereas computer fraud in this

case was a Class 1 misdemeanor. Neither does it prevent the Commonwealth from prosecuting,

under Code § 18.2-152.3, persons who use their own computers to hack into other computers or

computer networks and commit false pretenses, embezzlement, larceny, or conversion. Rather, it

simply conforms the scope of Code § 18.2-152.3 to its legislative intent by giving meaning to the

words “without authority.”

C. The evidence is sufficient to establish Wallace’s intent to defraud.

Wallace further argues that the evidence is insufficient to establish that she knew the

falsity of the checks and that the trial court erred in convicting her of uttering forged checks,

obtaining money by false pretenses, and committing computer fraud. To be convicted of uttering

forged checks, a defendant must “know it to be forged.” Code § 18.2-172. To be convicted of

obtaining money by false pretenses, a defendant must “inten[d] to defraud.” Code § 18.2-178.

Finally, a defendant is guilty of computer fraud only when she obtains “property or services by

false pretenses,” “[e]mbezzles or commits larceny,” or “[c]onverts the property of another.”

- 11 -
Code § 18.2-152.3. Thus, each conviction required Wallace to know that the checks were forged

when she deposited them.

Here, considering all evidence, the trial court was entitled to conclude that Wallace knew

the falsity of the checks. Despite Wallace’s argument that she was “not a sophisticated banker,”

the trial court found that Wallace “knew when she got the check that something was wrong.”

Wallace did not know the payer and was not entitled to be paid, the memo fields reflected work

that she did not do, and the checks were already endorsed by someone else in her name.

Furthermore, the trial court, as the fact finder, was entitled to find her testimony incredible.

Despite Wallace’s argument that it was “obvious” that Sumner stole the checks, the trial court

refused to “presume” that Sumner was “the thief or that he [was] putting her up to anything,

because there is no evidence of that.” The trial court concluded that Wallace had “the intent for

this scam to succeed” and “did her part.” Given the circumstances, the trial court’s factual

findings were not plainly wrong and should not be disturbed on appeal.

D. The evidence is sufficient to establish that Wallace “willfully” failed to appear in court.

Wallace argues that the evidence is insufficient to establish that she “willfully” failed to

appear in court under Code § 19.2-128(B). “Any failure to appear after notice of the appearance

date [is] prima facie evidence that such failure to appear [was] willful.” Hunter v.

Commonwealth, 15 Va. App. 717, 721 (1993). “When the government proves that an accused

received timely notice of when and where to appear for trial and thereafter does not appear on

the date or place specified, the fact finder may infer that the failure to appear was willful.” Id. at

721.

Here, uncontested evidence shows that Wallace signed the continuance order requiring

her to appear in court on January 30, 2020, but that she failed to appear on that day. Thus, there

is prima facie evidence that her failure to appear was willful. While Wallace testified that an

- 12 -
attorney’s advice affected her failure to appear, she could not establish what the attorney told

her, and the trial court was entitled to determine her credibility as a witness. The trial court

“recognize[d] [the] flip-flop in attorneys” but noted that Wallace already had a pending charge of

failure to appear and thus “would be on more alert.” As such, the trial court’s finding that the

changes in trial counsel did not overcome the prima facie evidence of willful failure to appear

was not plainly wrong.

CONCLUSION

The evidence is insufficient to establish that Wallace used the ATM “without authority”

under the computer fraud statute, but sufficient to support the remaining charges. Therefore, we

reverse her convictions of computer fraud, affirm her convictions of uttering forged checks,

obtaining money by false pretenses, and failure to appear in court, and remand the case for entry of

a sentencing order consistent with the rulings of this Court.

Affirmed in part, reversed in part, and remanded.

- 13 -
Athey, J., concurring in part and dissenting in part.

I agree with the majority that the evidence was sufficient to support Wallace’s

convictions for obtaining money by false pretenses, uttering forged checks, and failing to appear in

court. However, I disagree that the evidence was insufficient to establish that Wallace used the

ATM without authority. I therefore respectfully dissent from the majority’s decision to reverse

Wallace’s convictions for computer fraud. Since, in my judgment, the evidence sufficiently

established that BB&T did not authorize Wallace to use its ATM to obtain money by false pretenses

or to utter a forged check, I would have also affirmed Wallace’s convictions for computer fraud in

violation of Code § 18.2-152.3.

First, the majority “assumes without deciding” that the ATM is a computer. I must

therefore briefly explain why I would have decided that this particular ATM meets the definition

of a computer pursuant to Code § 18.2-152.2. Initially, Code § 18.2-152.2 broadly defines a

“computer” as including “all ‘device[s]’ not specifically excluded ‘that accept[ ] information in

digital or similar form and manipulate[ ] it for a result based on a sequence of instructions.’”

Brewer v. Commonwealth, 71 Va. App. 585, 593 (2020) (quoting Code § 18.2-152.2). The

computer fraud statute specifically excludes several very basic devices “dedicated to a specific

task” requiring “minimal end-user or operator intervention.” Code § 18.2-152.2. The limited

exceptions include simple calculators, automated typewriters, and fax machines. Id. Finally, a

“‘[c]omputer network’ means two or more computers connected by a network.” Id.

Here, the ATM used by Wallace was owned and operated by her local banking

institution, BB&T. Wallace was authorized to use the ATM to conduct inquiries as to the

balance of her account and to deposit nonfraudulent checks therein. In addition, BB&T account

holders, like Wallace, and even clients from other banks were authorized to utilize this ATM to

conduct other transactions such as withdrawals. The ATM was also hard-wired to communicate

- 14 -
data transmissions to and from other banks. Moreover, Wallace’s authorization to use this

“computer” enabled her to utter forged checks more easily since she did not have the same

oversight she would have had during a transaction with a live teller.4

I would not hold that every ATM should be included within the Code § 18.2-152.2

definition of a computer. For example, some stand-alone ATMs that are solely equipped to

dispense cash funds may be more akin to a calculator or fax machine and therefore fall within the

statutory exception. However, I would have decided that this particular ATM was clearly a

“device that accept[ed] information in digital or similar form and manipulate[d] it for a result

based on a sequence of instructions.” Code § 18.2-152.2. Since the level of sophistication of

this ATM was closer to a computer, I would have rejected Wallace’s contention that the ATM

was not a computer under Code §§ 18.2-152.2 and 18.2-152.3.

Second, I agree with the majority that “any person who uses a computer or computer

network, without authority and . . . [o]btains property or services by false pretenses . . . is guilty

of the crime of computer fraud.” Code § 18.2-152.3. The majority also correctly states that

Code § 18.2-152.3 applies only to the unauthorized use of computers or computer networks. I

also agree that “unauthorized” modifies the “use[] [of] a computer or computer network” and

that “unauthorized use” means the Commonwealth must prove Wallace either “ha[d] no right,

agreement, or permission” to use the computer or computer network or used it “in a manner

knowingly exceeding such right, agreement, or permission.” However, I simply disagree with

the majority’s conclusion that since Wallace was authorized to use the ATM for some purpose,

4
The majority assumes without deciding that this ATM is a computer but, in a footnote,
seemingly disagrees with the dissent’s conclusion that this ATM meets the definition of a
computer pursuant to Code § 18.2-152.2. If the majority contends that this ATM in fact falls
within the exception of “specialized computing devices” that are not computers, it should decide
the case accordingly since that is a fact-specific inquiry and would indeed be the “narrowest
grounds available” on which to decide this case.
- 15 -
she could not exceed that authorization by knowingly using the ATM for an illegal purpose—

namely, to utter fraudulent checks and thereby obtain money by false pretenses.

By its own definition, the majority contends that “use” becomes unauthorized when

someone knowingly exceeds their authority or permission. The majority then engages in an

unnecessarily complicated analysis distinguishing the “manner” and “purpose” of such use. In

my judgment, the inquiry here is quite simple: Did the Commonwealth prove that Wallace used

the ATM in a manner not authorized by BB&T? If the answer is “yes,” the use was

unauthorized. If “no,” the use was authorized.

Accordingly, I agree with the Commonwealth’s contention that the computer fraud

statute focuses on a defendant’s use of a computer when the owner does not allow for that kind of

use. In DiMaio v. Commonwealth, 46 Va. App. 755, 760 (2005), aff’d, 272 Va. 504 (2006),5

both this Court and the Supreme Court affirmed an appellant’s computer fraud conviction under

Code § 18.2-152.3 when he transferred hundreds of files from his work computer to his personal

computer and then deleted the files on his work computer. Admittedly, there, the appellant

primarily challenged the sufficiency of the evidence regarding the value of the files he removed

from the computer owned by his employer. But nothing in either opinion suggests that because

5
I primarily cite DiMaio to help illustrate that, under the majority’s theory, situations in
which a defendant has permission to use a work computer, friend’s computer, etc. for legitimate
purposes (and then exceeds the given authority by engaging in illegal activity) would no longer
be subject to prosecution under Code § 18.2-152.3. Essentially, the majority seemingly limits
the statute’s application to situations in which a defendant steals a computer or uses one without
any kind of permission. Since one of the purposes of The Virginia Computer Crimes Act is to
enhance penalties for crimes that are less risky to commit, I do not think Code § 18.2-152.3 was
meant to be interpreted so narrowly. See Va. St. Crime Comm’n, Computer Crimes Act, Rep.
Doc. No. 11, at 18 (2005) (noting that “[i]n comparing the risk of computer crimes to that [of]
robbery” fewer people will risk committing robbery because “it has a high penalty and is socially
unacceptable,” compared to computer crimes where “there are low penalties and in many cases,
it is socially tolerable, if not acceptable”).
- 16 -
the appellant had permission to use his work computer, the computer fraud conviction was

erroneous because it was not “unauthorized use” under Code § 18.2-152.3. 6

Simply put, unless Wallace had BB&T’s permission to use the ATM to cash a forged

check, keep half of the money, and deposit the other half into her checking account, she used

BB&T’s ATM “without authority” pursuant to Code § 18.2-152.3. And although I agree with

the majority that Wallace had permission to use the ATM, I disagree that the evidence was

insufficient to prove that Wallace “knowingly exceeded” that authority by using the ATM in a

manner that BB&T did not and would never authorize. Instead, I would have determined that the

evidence sufficiently established that Wallace knowingly exceeded her authority to use BB&T’s

ATM. In support thereof, the record reflects that after the checks were flagged, BB&T’s fraud

management team investigated the incident and later provided the checks and security camera

images of Wallace at the ATM as evidence at trial. In addition, a representative from BB&T

assisted the Commonwealth in securing Wallace’s various convictions by testifying on the

Commonwealth’s behalf at trial. BB&T was also awarded $937.82 in restitution. By

“regard[ing] as true all the credible evidence favorable to the Commonwealth” and drawing all

“fair inferences . . . therefrom,” it seems clear BB&T did not authorize Wallace to use the ATM

for fraud. Vay v. Commonwealth, 67 Va. App. 236, 242 (2017) (quoting Parks v.

Commonwealth, 221 Va. 492, 498 (1980)).

6
Frequently, when an appellant fails to argue an issue the Supreme Court prefers not to
address sua sponte, the Court accepts the concession, but makes clear it is accepting the position
because it was conceded, not necessarily because it was legally correct. See e.g., Daily Press,
LLC v. Commonwealth, ___ Va. ___, ___ (Oct. 20, 2022) (stating that the Supreme Court was
not dispositively deciding the conceded issue and “offer[ed] no opinion on” the legitimacy of the
conceded standard); Butcher v. Commonwealth, 298 Va. 392, 395 (2020) (flagging that although
the Supreme Court accepted appellant’s concession that a statute was conjunctive, it “offer[ed]
no opinion on the competing conjunctive/disjunctive interpretations of the statute”). In DiMaio,
neither this Court nor the Supreme Court issued such a disclaimer.
- 17 -
 For Wallace’s use of the ATM to have been authorized, the evidence would have needed

to show that Wallace had BB&T’s permission to use its ATM to perpetrate the fraud that led to

her multiple convictions and BB&T’s loss of funds. I agree with the majority that any fraudulent

act committed using another’s computer is not per se “without authority.” 7 But I disagree that,

based on the unique facts of this particular case, the Commonwealth failed to prove Wallace

acted “without authority.” Wallace used BB&T’s ATM to utter fraudulent checks, and in

response to Wallace’s use of the ATM, BB&T aided in the fraud investigation, testified at trial

with respect to her crimes, produced the fraudulent checks and security camera images used at

trial, and is now required to be paid restitution as a result of the fraud.

Since I would have affirmed Wallace’s convictions for computer fraud pursuant to Code

§ 18.2-152.3, I respectfully dissent.

7
The majority incorrectly frames the issue as, “whether a person who uses a computer to
obtain money by false pretenses is per se ‘without authority.’” The answer to that inquiry is
clearly “no.” Under that interpretation, Code § 18.2-152.3 would criminalize a defendant’s use
of a co-conspirator’s computer. Such a stance would indeed be a misinterpretation of Code
§ 18.2-152.3. Instead, the issue here is whether there was sufficient evidence to prove that
Wallace exceeded her authority to use the ATM when she used it to utter fraudulent checks for
payment by BB&T and deposited a portion of the funds from the fraudulent checks in her
personal checking account. Considering all the evidence in the light most favorable to the
Commonwealth, I simply think there was clearly sufficient evidence to support Wallace’s
convictions.
- 18 -