The Latest Developments in Computer Crime Law
-
Upload
source-conference -
Category
Technology
-
view
2.176 -
download
0
description
Transcript of The Latest Developments in Computer Crime Law
![Page 1: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/1.jpg)
The Latest Developments in
Computer Crime Law
SOURCE Seattle
June 15, 2011
Marcia Hofmann, EFF
![Page 2: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/2.jpg)
what we’ll talk about today
✪ The federal hacking law and why it’s problematic.
✪ A couple trends that have emerged from recent
cases in which courts have interpreted the scope of
this law.
✪ What these trends suggest about the future.
![Page 3: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/3.jpg)
Background
The Computer Fraud and Abuse Act
18 U.S.C. § 1030
![Page 4: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/4.jpg)
seven basic prohibitions1) espionage
2) improperly accessing financial records, governmentinformation, or information on a “protected computer”
3) trespass to government computers
4) improperly accessing someone else’s computer with intentto defraud
5) causing damage to someone else’s computer
6) password trafficking with intent to defraud
7) extortion
![Page 5: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/5.jpg)
improper access
The CFAA prohibits, among other things,
“intentionally access[ing] a computer withoutauthorization or in excess of authorization, andthereby obtain[ing] . . . information from anyprotected computer.”
18 U.S.C. § 1030(a)(2)(C).
![Page 6: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/6.jpg)
improper access
Courts have interpreted “obtaining information”
broadly.
Basically any computer connected to the internet is a
“protected computer.”
So the major limiting principle is “authorized.”
![Page 7: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/7.jpg)
development 1
expansive theories of unauthorized
access/exceeding authorized access
![Page 8: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/8.jpg)
Some people have argued that authorization endswhen an employee violates a duty of loyalty to
an employer...
International Airport Centers v. Citrin
LVRC Holdings v. Brekka
![Page 9: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/9.jpg)
Others have gone so far as to argue thatauthorization ends when a person violates a
web site’s terms of use.
United States v. Drew
Facebook v. Power Ventures
United States v. Lowson
![Page 10: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/10.jpg)
The case law in this area recently took a turn for
the worse when an appeals court found that
violating an employer’s computer use policies
“exceeds authorized access.”
United States v. Nosal
![Page 11: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/11.jpg)
The future?
Lee v. PMSI, Inc.
Sony v. Hotz
![Page 12: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/12.jpg)
development 2
attempts to double-count penalties for
unauthorized access
![Page 13: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/13.jpg)
A first-time violation of the “unauthorized
access” provision is generally a misdemeanor.
However, it can be elevated to a felony in certain
circumstances, like when the offense is
committed in furtherance of another crime or
tortious act.
![Page 14: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/14.jpg)
United States v. Drew
Government: felony unauthorized access to a
computer in furtherance of intentionally
inflicting emotional distress.
Jury: no, misdemeanor unauthorized access.
Judge: no, violating terms of service is not
unauthorized access.
![Page 15: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/15.jpg)
United States v. Kernell
Government: felony unauthorized access to a
computer in furtherance of unauthorized access
to email and unauthorized access to a computer.
![Page 16: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/16.jpg)
United States v. Kernell
Government: felony unauthorized access to a
computer in furtherance of unauthorized access
to email and unauthorized access to a computer.
Do over!
![Page 17: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/17.jpg)
United States v. Kernell
Government: felony unauthorized access to acomputer in furtherance of invasion of privacy
and aiding and abetting other unauthorizedaccesses to a computer.
Jury: no, misdemeanor unauthorized access.
![Page 18: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/18.jpg)
United States v. Cioni
Government: felony unauthorized access to a
computer in furtherance of unauthorized access
to email.
Jury: yup, two felonies.
(This is a problem.)
![Page 19: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/19.jpg)
The CFAA prohibits unauthorized access to and
obtaining information from a computer.
(Here, email.)
The Stored Communications Act prohibits
unauthorized access to an electronic communication
service and obtaining stored communications.
(Here, email.)
It’s the same thing.
![Page 20: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/20.jpg)
United States v. Cioni
Government: felony unauthorized access to a
computer in furtherance of unauthorized access
to email.
Jury: yup, two felonies.
Appeals court: no, these are misdemeanors.
![Page 21: The Latest Developments in Computer Crime Law](https://reader034.fdocuments.us/reader034/viewer/2022042713/549bf7b8ac7959bf2a8b4617/html5/thumbnails/21.jpg)
The future?
legislative changes
(enhanced penalties?)