5 ms·

I've never heard of death by copying. :)

tptacek 14y ago
Copying shouldn't be a felony under the CFAA. To the extent that prosecutors find ways to bring civil torts to federal court as CFAA felony charges, that needs to change. But in fact, that's the opposite of what Robert is recommending in this post: he thinks that we remove the computer abuse element of the crime and focus on the property crime issue.
- vy8vWJlco 14y ago
  What property crime would that be again?
  - tptacek 14y ago
    "Stolen" credit card numbers, "stolen" bank account information, "stolen" browser histories, "stolen" copyrighted files. Swartz wasn't charged with criminal copyright violation.
    - vy8vWJlco 14y ago
      "Copied" credit card numbers, etc... (FTFY) Fraudulently charging a card is prohibited and addressed in other laws. Copying isn't injury on its own.
      - tptacek 14y ago
        Copyright infringement is already illegal without the CFAA.
        vy8vWJlco 14y ago
        So there's no need for it.
        tptacek 14y ago
        Non sequitur.
        vy8vWJlco 14y ago
        To clarify, by your own assertion, the CFAA isn't necessary to address specific claims of damage (you have suggested copyright). Removing it would place the justification of damage (for example, copyright) back at the center of the debate, where I think it should be.
- mindslight 14y ago
  Isn't the major property of the entire CFAA is that it makes civil torts into federal felonies? It's not about focusing on just the property crimes, but any other crime done by exploiting a computer. Crack a hospital and shut off a ventilator? That's murder 1, 2, or 3. As for pure computer tampering, what should the appropriate criminal penalty be for say breaking into HN and putting a banner at the top of everyone's page? Sounds an awful like misdemeanor territory to me.
  - tptacek 14y ago
    Imagine a very angry 22 year old is fired from his IT job at a hospital, has his credentials revoked, and uses his knowledge of vulnerabilities at his old work site to log in and rm a bunch of servers. Imagine that as a result, the hospital is unable to enroll patients or to get MRI results back or things like that. Without CFAA, what crime has been committed? The appropriate penalty for defacing a website should probably be very low. Defacing sites should be criminal, and probably a felony, but the bulk of the remedy should be civil.
    - mindslight 14y ago
      Well the non-virtual analog would be "malicious destruction of property", no? And if he were to say physically go over to the hospital and smash the MRI machine, would he be charged with additional crimes due to the hospital's inability to take MRIs ? So maybe this is what you mean by 'property crimes' - a specific analog for 'malicious destruction of data' or the like. I'm not quite sure I agree that defacing a site should automatically be a felony. But that's even presently based on the dollar value of the damage caused being over $5k, right? (which seems pretty low and maybe that combined with overblown copyright maximalist valuations is the real problem). I need to brush up on what the current laws actually say; I remember them as basically do anything to a machine out of what "normal people" expect (like even just nmap) and you could technically get screwed.
      - tptacek 14y ago
        I strongly agree with you that the sentencing for CFAA crimes makes no sense. You can do $300 or $5000 or $1000000 worth of damage based solely on the number you type into a for() loop. That doesn't make any sense. I have a hobbyhorse about how the Internet has made criminal mischief so easy to accomplish that people do it without thinking; that the Internet & technology are short-circuiting our judgement. I don't think that the criminality of an act should depend solely on how difficult it was to accomplish. But I also don't think sentences should scale with assessed damages. We already have a remedy that scales with damages: tort claims. I think a more sensible regime would accelerate the severity of computer abuse based on: * Commercial intent * Harm to the public * Knowing involvement of critical infrastructure * Malicious intent * Repeat offenses * Attempts to obstruct investigation

Copying shouldn't be a felony under the CFAA. To the extent that prosecutors find ways to bring civil torts to federal court as CFAA felony charges, that needs to change. But in fact, that's the opposite of what Robert is recommending in this post: he thinks that we remove the computer abuse element of the crime and focus on the property crime issue.

vy8vWJlco 14y ago
What property crime would that be again?
- tptacek 14y ago
  "Stolen" credit card numbers, "stolen" bank account information, "stolen" browser histories, "stolen" copyrighted files. Swartz wasn't charged with criminal copyright violation.
  - vy8vWJlco 14y ago
    "Copied" credit card numbers, etc... (FTFY) Fraudulently charging a card is prohibited and addressed in other laws. Copying isn't injury on its own.
    - tptacek 14y ago
      Copyright infringement is already illegal without the CFAA.
      - vy8vWJlco 14y ago
        So there's no need for it.
        tptacek 14y ago
        Non sequitur.
        vy8vWJlco 14y ago
        To clarify, by your own assertion, the CFAA isn't necessary to address specific claims of damage (you have suggested copyright). Removing it would place the justification of damage (for example, copyright) back at the center of the debate, where I think it should be.
mindslight 14y ago
Isn't the major property of the entire CFAA is that it makes civil torts into federal felonies? It's not about focusing on just the property crimes, but any other crime done by exploiting a computer. Crack a hospital and shut off a ventilator? That's murder 1, 2, or 3. As for pure computer tampering, what should the appropriate criminal penalty be for say breaking into HN and putting a banner at the top of everyone's page? Sounds an awful like misdemeanor territory to me.
- tptacek 14y ago
  Imagine a very angry 22 year old is fired from his IT job at a hospital, has his credentials revoked, and uses his knowledge of vulnerabilities at his old work site to log in and rm a bunch of servers. Imagine that as a result, the hospital is unable to enroll patients or to get MRI results back or things like that. Without CFAA, what crime has been committed? The appropriate penalty for defacing a website should probably be very low. Defacing sites should be criminal, and probably a felony, but the bulk of the remedy should be civil.
  - mindslight 14y ago
    Well the non-virtual analog would be "malicious destruction of property", no? And if he were to say physically go over to the hospital and smash the MRI machine, would he be charged with additional crimes due to the hospital's inability to take MRIs ? So maybe this is what you mean by 'property crimes' - a specific analog for 'malicious destruction of data' or the like. I'm not quite sure I agree that defacing a site should automatically be a felony. But that's even presently based on the dollar value of the damage caused being over $5k, right? (which seems pretty low and maybe that combined with overblown copyright maximalist valuations is the real problem). I need to brush up on what the current laws actually say; I remember them as basically do anything to a machine out of what "normal people" expect (like even just nmap) and you could technically get screwed.
    - tptacek 14y ago
      I strongly agree with you that the sentencing for CFAA crimes makes no sense. You can do $300 or $5000 or $1000000 worth of damage based solely on the number you type into a for() loop. That doesn't make any sense. I have a hobbyhorse about how the Internet has made criminal mischief so easy to accomplish that people do it without thinking; that the Internet & technology are short-circuiting our judgement. I don't think that the criminality of an act should depend solely on how difficult it was to accomplish. But I also don't think sentences should scale with assessed damages. We already have a remedy that scales with damages: tort claims. I think a more sensible regime would accelerate the severity of computer abuse based on: * Commercial intent * Harm to the public * Knowing involvement of critical infrastructure * Malicious intent * Repeat offenses * Attempts to obstruct investigation