3 ms·

In this specific case (installing a root certificate) I would say it's not actually a CFAA violation because they're not "obtaining information", "defrauding",

In this specific case (installing a root certificate) I would say it's not actually a CFAA violation because they're not "obtaining information", "defrauding", or "intentionally causing damage". You might be able to argue that installing the driver on a "government computer" produces a violation of 18 USC 1030 (a) (3), but the rules for a mere "protected computer" which covers most internet-connected personal computers are actually not strict enough to cover this. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

nkw 9y ago
"Whoever [...] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [...] shall be punished as provided in subsection (c) of this section." "[T]he term 'protected computer' means a computer [...] which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States" "[T]he term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information"
- justinjlynn 9y ago
  Law is a different language. While it may read like computer code; it isn't. Well, it is but it's as if "goto" and ";" had different meanings depending not only on the last keyword used, but also on the mood of the computer. I wish a straightforward reading was possible but it's often not.
  - nkw 9y ago
    Some parts of the law are easier to appreciate if one considers vagueness and ambiguity can be features instead of bugs.
    - rocqua 9y ago
      Those exact ambiguous laws are the ones that are abused most easily. There is a hard balance between being general enough to cover bad things, without being so general as to allow authorities to prosecute anyone on some charge.
- somebodynew 9y ago
  That charge would depend entirely on whether or not installing a root certificate can be considered "intentional" "impairment to integrity". I can't find any case law that would provide the interpretation for this, but I think it's safe to say you probably won't be able to overcome the burden of proving that they caused the damage intentionally if it even qualifies as damage (which I find unlikely).

nkw 9y ago

"Whoever [...] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [...] shall be punished as provided in subsection (c) of this section." "[T]he term 'protected computer' means a computer [...] which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States" "[T]he term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information"

justinjlynn 9y ago
Law is a different language. While it may read like computer code; it isn't. Well, it is but it's as if "goto" and ";" had different meanings depending not only on the last keyword used, but also on the mood of the computer. I wish a straightforward reading was possible but it's often not.
- nkw 9y ago
  Some parts of the law are easier to appreciate if one considers vagueness and ambiguity can be features instead of bugs.
  - rocqua 9y ago
    Those exact ambiguous laws are the ones that are abused most easily. There is a hard balance between being general enough to cover bad things, without being so general as to allow authorities to prosecute anyone on some charge.
somebodynew 9y ago
That charge would depend entirely on whether or not installing a root certificate can be considered "intentional" "impairment to integrity". I can't find any case law that would provide the interpretation for this, but I think it's safe to say you probably won't be able to overcome the burden of proving that they caused the damage intentionally if it even qualifies as damage (which I find unlikely).