4 ms·

Despite the assertions of tptacek, there is no requirement for any fraud to occur for a crime to have occurred. This is a pretty important thing for computer pe

by rprasad 14y ago

Despite the assertions of tptacek, there is no requirement for any fraud to occur for a crime to have occurred. This is a pretty important thing for computer people to understand, and it's really unfortunate that one knucklehead vehemently asserting false facts has ruined this whole thread. I agree, you should stop embarrassing yourself. Multiple lawyers, including practitioners in this field, are discussing in depth why you are completely wrong. Fraud, it should be noted, is only one of the possible violations--there are others. But tptacek's point was that the intent to commit one of these violations is necessary (and that specific intent determines which charges apply. As you can clearly see from the statute, intent is an element for every one of these charges http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030. You can shouldersurf someone's password, log in as them, type "ls", log out and never use that password again - you've violated that law. That's not fraud. That's accessing a protected system, which is a separate charge. It's a problem if you don't have permission, express or implicit, for that access.

chacham15 14y ago
> You wonder what the next article is, so you go to the URL and change it “articleId=31338” and hit return. Does that constitute intent?
- jellicle 14y ago
  The "intent" is "intent to access a computer". It's not "intent to commit a crime". If I am unconscious, and someone lifts my hand up and uses my fingers to type in a password, I didn't have intent to access a computer - I am not guilty of a crime. But if I intentionally struck keys on my keyboard, knowing that I was striking keys on my keyboard - that's intent. I do NOT have to know that it's a crime or intend to commit a crime. Some crimes do have specific intent elements, where the person must be proved to have intended some specific result. This isn't one of them.
jellicle 14y ago
> tptacek's point was that the intent to commit one of these violations is necessary No, to be clear, tptacek is saying that fraud is necessary for any conviction under 1030(a). That's false. You're saying that intent to commit a crime is necessary for any conviction under 1030(a). That's false too. It's you and tptacek vs. the DOJ's cybercrimes manual. Good luck!
- DannyBee 14y ago
  You do realize of course, that the manual is about what the DOJ is going to take a position as, and has little to no bearing on how a court will actually interpret the law? Yes, it makes legal citations, but so do the US PTO guidelines. It's like reading one of the briefs for a supreme court case and declaring that's what the law is. Like any legal brief, it's just a glorified policy position with legal citations instead of study citations. If you want to know what you may get arrested for, sure, it's great. If you want to know what you may get convicted of, it's near worthless. The first one would be very hard to solve anyway. Most laws don't specifically prevent arrest for minor violations, and at least right now, you can almost never prevent the police from arresting you for something (in most cases, they don't actually have to tell you why they are arresting you, only that you are being arrested. They can charge you with something different than they tell you anyway).
- tptacek 14y ago
  That's specifically not what I said. You can look at the timestamp on this comment and the timestamp on the comment where I listed the 1030(a) crimes to see that. This argument is invalid on its face; it's a straw man. The core of your argument is that Rob is right that there's a chargeable offense happening when you read his blog, because the 1030(a) statute is so vague. That's just not true. There's specific precedent for why it's not true. If you want to refine your argument to say that 1030(a)(2) (plain unauthorized access) and 1030(e)(2)(b) ("protected computer") are unconscionably vague and leave too many people exposed to frivolous prosecution, we agree, modulo that I think we diverge on the fact that nobody's going to be convicted in those prosecutions without an allegation of fraud to accompany it.

by rprasad 14y ago

chacham15 14y ago

> You wonder what the next article is, so you go to the URL and change it “articleId=31338” and hit return. Does that constitute intent?

jellicle 14y ago
The "intent" is "intent to access a computer". It's not "intent to commit a crime". If I am unconscious, and someone lifts my hand up and uses my fingers to type in a password, I didn't have intent to access a computer - I am not guilty of a crime. But if I intentionally struck keys on my keyboard, knowing that I was striking keys on my keyboard - that's intent. I do NOT have to know that it's a crime or intend to commit a crime. Some crimes do have specific intent elements, where the person must be proved to have intended some specific result. This isn't one of them.

jellicle 14y ago

> tptacek's point was that the intent to commit one of these violations is necessary No, to be clear, tptacek is saying that fraud is necessary for any conviction under 1030(a). That's false. You're saying that intent to commit a crime is necessary for any conviction under 1030(a). That's false too. It's you and tptacek vs. the DOJ's cybercrimes manual. Good luck!

DannyBee 14y ago
You do realize of course, that the manual is about what the DOJ is going to take a position as, and has little to no bearing on how a court will actually interpret the law? Yes, it makes legal citations, but so do the US PTO guidelines. It's like reading one of the briefs for a supreme court case and declaring that's what the law is. Like any legal brief, it's just a glorified policy position with legal citations instead of study citations. If you want to know what you may get arrested for, sure, it's great. If you want to know what you may get convicted of, it's near worthless. The first one would be very hard to solve anyway. Most laws don't specifically prevent arrest for minor violations, and at least right now, you can almost never prevent the police from arresting you for something (in most cases, they don't actually have to tell you why they are arresting you, only that you are being arrested. They can charge you with something different than they tell you anyway).
tptacek 14y ago
That's specifically not what I said. You can look at the timestamp on this comment and the timestamp on the comment where I listed the 1030(a) crimes to see that. This argument is invalid on its face; it's a straw man. The core of your argument is that Rob is right that there's a chargeable offense happening when you read his blog, because the 1030(a) statute is so vague. That's just not true. There's specific precedent for why it's not true. If you want to refine your argument to say that 1030(a)(2) (plain unauthorized access) and 1030(e)(2)(b) ("protected computer") are unconscionably vague and leave too many people exposed to frivolous prosecution, we agree, modulo that I think we diverge on the fact that nobody's going to be convicted in those prosecutions without an allegation of fraud to accompany it.