Proposal also expands hacking definition. That’s a “dangerous idea,” expert says.
The Obama administration, currently engaged in a war of words with North Korea over the recent hacking of Sony Pictures Entertainment, is calling on Congress to increase prison sentences for hackers and to expand the definition of hacking.
During next week’s State of the Union address, the president is set to publicly urge increased prison time and other changes to the Computer Fraud and Abuse Act—the statute that was used to prosecute Internet activist Aaron Swartz before he committed suicide in 2013.
At issue is the Computer Fraud and Abuse Act (CFAA), passed in 1984 to bolster the government’s ability to nab hackers who destroy or disrupt computer functionality or who steal information.
In general, the CFAA makes it illegal to “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period.”
Obama said Tuesday, “We want cybercriminals to feel the full force of American justice, because they are doing as much damage—if not more, these days—as folks who are involved in more conventional crime.”
Among other things, penalties under Obama’s plan would increase from a maximum five-year penalty to 10 years for pure hacking acts, like circumventing a technological barrier. What’s more, the law would expand the definition of what “exceeds authorized access” means. A hacker would exceed authorization when accessing information “for a purpose that the accesser knows is not authorized by the computer owner.”
That raised the eyebrows of researchers and scholars alike.
That language is “awkward,” according to Orin Kerr, a professor and CFAA expert who has defended Lori Drew and Andrew “weev” Auernheimer in CFAA criminal prosecutions. “For example, if your employer has a policy that ‘company computers can be accessed only for work-related purposes,’ and you access the computer for personal reasons, then you presumably would be accessing the computer for a purpose that you know the employer has not allowed,” Kerr said Wednesday.
With that said, I don’t know how this proposed language would apply to other written restrictions. Some written restrictions are phrased as conditions on purpose, but others are not. I’m not sure if the proposal would prohibit all violations of written conditions or only those phrased as or substantially resembling conditions on purpose. For example, imagine the employer has a policy that company computers can only be accessed by company employees. If a non-employee accesses the computer, the written restriction is breached, but there isn’t a breach of a purpose-based condition. It’s not clear if the Administration proposal is an awkwardly drafted way to have liability for breaching written-restrictions generally, or if it was intended to only impose liability for violating purpose-based written restrictions. (If the latter, why should purpose-based limitations be treated differently from other limitations, and what should the test be for distinguishing them?)
Kerr said his “biggest concern” surrounds accepted social computing practices, or as he calls it—”norms-based” liability. He said:
The key problem is the expanded definition of “exceeds authorized access,” which would make it an unauthorized access when a user accesses information “for a purpose that the accesser knows is not authorized by the computer owner.” This is at least somewhat clear in the case of a written restriction: A person might know that a purpose is not authorized because the written restriction says so. But think about how this language would apply when the prosecution is based on a norms violation. The problem is, when it comes to norms, how do you know what a computer owner has authorized? Is that just a matter of what the computer owner would say if you asked them? Something else?
More broadly, Kerr added, “The expansion of ‘exceeding authorized access’ would seem to allow lots of prosecutions under a ‘you knew the computer owner wouldn’t like that’ theory. And that strikes me as a dangerous idea, as it focuses on the subjective wishes of the computer owner instead of the individual’s actual conduct.”
Security expert Robert Graham said Wednesday that the proposal would affect “cybersecurity professionals that protect the Internet. If you cared about things such as ‘national security’ and ‘cyberterrorism,’ then this should be your biggest fear. Because of our knowledge, we do innocent things that look to outsiders like ‘hacking.’ Protecting computers often means attacking them. The more you crack down on hackers, the more of a chilling effect you create in our profession. This creates an open door for nation-state hackers and the real cybercriminals.”