4 ms·

Care to explain what the law really means then? Because I just read what the law _says_, but to me it still sounds pretty vague, and its unclear exactly what co

by elpool2 14y ago

Care to explain what the law really means then? Because I just read what the law _says_, but to me it still sounds pretty vague, and its unclear exactly what constitutes "authorization".

monochromatic 14y ago
Which section of this law criminalizes merely accessing something without authorization?
- elpool2 14y ago
  "Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer. A protected computer is any computer which is used in or affecting interstate or foreign commerce or communication." His blog seems to be used in foreign communication, it can be accessed from foreign countries. Does that make it a "protected computer"? I accessed his computer and received information. And I was never "authorized" to do so, except through the implied openness of the web, which the law doesn't seem to mention at all.
  - danielweber 14y ago
    Orin Kerr has an excellent paper on the state of the law in this area that I'm too lazy too Google right now. But while the courts have occasionally ruled that "access" is "any access," other courts have realized how stupid this is and have moved away from that strict meaning. "Protected computer" is explicitly defined.
tptacek 14y ago
The defendant is charged in [Count _______ of] the indictment with computer fraud in violation of Section 1030(a)(4) of Title 18 of the United States Code. In order for the defendant to be found guilty of that charge, *the government must prove each of the following elements* beyond a reasonable doubt: First, the defendant knowingly [accessed without authorization] [exceeded authorized access to] a computer [that was exclusively for the use of a financial institution or the United States government] [that was not exclusively for the use of a financial institution or the United States government, but the defendant’s access affected the computer’s use by or for the financial institution or the United States government] [used in or affecting interstate or foreign commerce or communication] [located outside the United States but using it in a manner that affected interstate or foreign commerce or communication of the United States]; Second, the defendant did so with the intent to defraud; Third, by [accessing the computer without authorization] [exceeding authorized access to the computer], the defendant furthered the intended fraud; [and] Fourth, the defendant by [accessing the computer without authorization] [exceeding authorized access to the computer] obtained anything of value[.] [; and] [Fifth, the total value of the defendant’s computer use exceeded $5,000 during [specify applicable period.] The last clause applies when the object of the fraud is access to the computer itself; for instance, if your fraud was "gain free wireless access".
- jellicle 14y ago
  In this case, the defendant is charged with 1030(a)(4), which is fraud, and the government therefore has to prove fraud. The defendant could also have been charged - in some other case - with 1030(a)(2), which is obtaining information from any protected computer without access. In that case, the government would not have to prove fraud.
  - tptacek 14y ago
    A blog is not a protected computer, which is a term with a definition in the law --- it's one that used by financial institutions, by the US government, or that affects interstate commerce. Again: not a blog. Furthermore, regardless of whether the prosecution charges a crime that requires intent to commit fraud --- for instance, in the unlikely event that they tried to spin a yarn about a blog affecting interstate commerce --- CFAA crimes aren't strict liability. They must prove intent to exceed authorization.
    - trhtrsh 14y ago
      "affects interstate commerce" is anything, as has been shown time and time again by the Federal government. http://en.wikipedia.org/wiki/Wickard_v._Filburn http://en.wikipedia.org/wiki/Wickard_v._Filburn and subsequent cases: producing a product on your own, and thereby not engaging in commerce, is considered commerce.
      - danielweber 14y ago
        As someone who thinks Wickard was a gross expansion of power, that doesn't mean that it applies in CFAA cases. (Also, this year's PPACA ruling detoothed the commerce clause's power. How much it did that is to be determined.)
    - jahewson 14y ago
      If you have AdWords on your blog, you're doing interstate commerce.

by elpool2 14y ago

Care to explain what the law really means then? Because I just read what the law _says_, but to me it still sounds pretty vague, and its unclear exactly what constitutes "authorization".

monochromatic 14y ago

Which section of this law criminalizes merely accessing something without authorization?

elpool2 14y ago
"Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer. A protected computer is any computer which is used in or affecting interstate or foreign commerce or communication." His blog seems to be used in foreign communication, it can be accessed from foreign countries. Does that make it a "protected computer"? I accessed his computer and received information. And I was never "authorized" to do so, except through the implied openness of the web, which the law doesn't seem to mention at all.
- danielweber 14y ago
  Orin Kerr has an excellent paper on the state of the law in this area that I'm too lazy too Google right now. But while the courts have occasionally ruled that "access" is "any access," other courts have realized how stupid this is and have moved away from that strict meaning. "Protected computer" is explicitly defined.

tptacek 14y ago

The defendant is charged in [Count _______ of] the indictment with computer fraud in violation of Section 1030(a)(4) of Title 18 of the United States Code. In order for the defendant to be found guilty of that charge, *the government must prove each of the following elements* beyond a reasonable doubt: First, the defendant knowingly [accessed without authorization] [exceeded authorized access to] a computer [that was exclusively for the use of a financial institution or the United States government] [that was not exclusively for the use of a financial institution or the United States government, but the defendant’s access affected the computer’s use by or for the financial institution or the United States government] [used in or affecting interstate or foreign commerce or communication] [located outside the United States but using it in a manner that affected interstate or foreign commerce or communication of the United States]; Second, the defendant did so with the intent to defraud; Third, by [accessing the computer without authorization] [exceeding authorized access to the computer], the defendant furthered the intended fraud; [and] Fourth, the defendant by [accessing the computer without authorization] [exceeding authorized access to the computer] obtained anything of value[.] [; and] [Fifth, the total value of the defendant’s computer use exceeded $5,000 during [specify applicable period.] The last clause applies when the object of the fraud is access to the computer itself; for instance, if your fraud was "gain free wireless access".

jellicle 14y ago
In this case, the defendant is charged with 1030(a)(4), which is fraud, and the government therefore has to prove fraud. The defendant could also have been charged - in some other case - with 1030(a)(2), which is obtaining information from any protected computer without access. In that case, the government would not have to prove fraud.
- tptacek 14y ago
  A blog is not a protected computer, which is a term with a definition in the law --- it's one that used by financial institutions, by the US government, or that affects interstate commerce. Again: not a blog. Furthermore, regardless of whether the prosecution charges a crime that requires intent to commit fraud --- for instance, in the unlikely event that they tried to spin a yarn about a blog affecting interstate commerce --- CFAA crimes aren't strict liability. They must prove intent to exceed authorization.
  - trhtrsh 14y ago
    "affects interstate commerce" is anything, as has been shown time and time again by the Federal government. http://en.wikipedia.org/wiki/Wickard_v._Filburn http://en.wikipedia.org/wiki/Wickard_v._Filburn and subsequent cases: producing a product on your own, and thereby not engaging in commerce, is considered commerce.
    - danielweber 14y ago
      As someone who thinks Wickard was a gross expansion of power, that doesn't mean that it applies in CFAA cases. (Also, this year's PPACA ruling detoothed the commerce clause's power. How much it did that is to be determined.)
  - jahewson 14y ago
    If you have AdWords on your blog, you're doing interstate commerce.