6 ms·

If I fire someone, and they come back into the office afterwards at night to do whatever, is that still "a civil dispute between two private parties"?

btilly 14y ago
You make a good point. There is clearly theft of proprietary information. (Though the guy who got convicted didn't do the stealing.) But I reiterate. The fact that the information was stored on a computer shouldn't trigger massively bigger penalties. Everything is stored on computers these days!
- anigbrowl 14y ago
  OK, so would you be OK with it if unauthorized access to a computer system (eg an ex-employers or some other case where the lack of authorization is clear and criminal intent is present) resulted in a charge of burglary?
  - etvmueller 14y ago
    The problem is that there is already a well developed set of laws to govern human interactions with each other and with the environment. This is like the broken patent system: it's something that has been done for 40 years, except on a computer! We do not need a patent for that, and we do not need a new law for stealing information on a computer. We already have laws for theft.
    - tptacek 14y ago
      The problem the authors of CFAA faced when the law was written is that this is actually not the case. Existing laws regarding e.g. burglary did not cleanly apply to computer crimes. I think there are probably cases that do a better job showcasing the need for computer-specific crime laws, and crimes that do a worse job at that. Basic wire fraud cases don't really need CFAA from what I can tell, and CFAA serves primarily as a sentence accelerant in them. But in other cases, particularly where people cause damage but don't reap profits, the need for specific laws is clearer.
      - etvmueller 14y ago
        Was it really the case that someone could steal information from a computer and not be charged with a crime, or indicted by a grand jury and then successfully prosecuted under existing law, and that until recently, when information was stolen from a computer, that was not a crime?
        tptacek 14y ago
        You think I'm arguing something I'm not arguing. I'm not saying there aren't crimes that are chargeable under CFAA that could be better charged under a pre-existing law. I'm just saying there are crimes that can't be charged that way, thus the need for computer-specific crime laws. CFAA is not a good computer-specific crime law. Two gigantic problems with it: sentences that scale linearly with damages despite the fact that criminal intent and diligence does not scale the same way, and the CFAA's "sentencing accelerant" property, where it bonds covalently with other criminal charges to increase penalties.
        etvmueller 14y ago
        I understand and I share your point of view to a degree, but I remain skeptical that until CFAA, there were no successful prosecutions for crimes that we are told are only now covered by CFAA. Computers and criminals have been around for a while now. I am also opposed to the idea that we need specific crime laws for things like this. What about vehicular manslaughter while listening to an iPod, and why would that not be covered as distraction equivalent to listening to radio, which I assume and also hope that it would be. There should be some respect for the intent of existing law in addition to the letter, because we do have laws for theft and I am certain that the intent of those laws covers these cases.
        tptacek 14y ago
        Before CFAA, computer crimes were charged under wire fraud statutes. But to prove wire fraud you have to establish the elements of a fraud, which include deliberate intent to secure some kind of gain from your deception.
    - anigbrowl 14y ago
      I'm asking a specific yes/no question, not one about theft.
      - etvmueller 14y ago
        Would the charge be burglary for unauthorized access, or burglary if information was stolen after unauthorized access, and otherwise breaking and entering or just entering? To that, yes. If the information that was stolen was then used to commit other crimes, then other charges should follow as appropriate.
        anigbrowl 14y ago
        The former. burglary (in some places criminal trespass) is entry to premises with the intent of committing a crime [1]. Anyway we're on the same page, insofar as you're OK with extending existing law to cover virtual intrusions. See my other comment upthread, though. 1. The exact definition varies by state - in some places only residences can be burgled (but you can have criminal trespass on commercial premises) and now that I think of it burglary is usually defined as taking place during the night, whereas in the daytime the same crime would be breaking & entering, and so on.
betterunix 14y ago
The problem here is that the CFAA was invoked only because a [separate] crime was committed. We might as well have a law that requires everyone to follow all laws, so that prosecutors have unlimited power to tack on charges.

btilly 14y ago

You make a good point. There is clearly theft of proprietary information. (Though the guy who got convicted didn't do the stealing.) But I reiterate. The fact that the information was stored on a computer shouldn't trigger massively bigger penalties. Everything is stored on computers these days!

anigbrowl 14y ago
OK, so would you be OK with it if unauthorized access to a computer system (eg an ex-employers or some other case where the lack of authorization is clear and criminal intent is present) resulted in a charge of burglary?
- etvmueller 14y ago
  The problem is that there is already a well developed set of laws to govern human interactions with each other and with the environment. This is like the broken patent system: it's something that has been done for 40 years, except on a computer! We do not need a patent for that, and we do not need a new law for stealing information on a computer. We already have laws for theft.
  - tptacek 14y ago
    The problem the authors of CFAA faced when the law was written is that this is actually not the case. Existing laws regarding e.g. burglary did not cleanly apply to computer crimes. I think there are probably cases that do a better job showcasing the need for computer-specific crime laws, and crimes that do a worse job at that. Basic wire fraud cases don't really need CFAA from what I can tell, and CFAA serves primarily as a sentence accelerant in them. But in other cases, particularly where people cause damage but don't reap profits, the need for specific laws is clearer.
    - etvmueller 14y ago
      Was it really the case that someone could steal information from a computer and not be charged with a crime, or indicted by a grand jury and then successfully prosecuted under existing law, and that until recently, when information was stolen from a computer, that was not a crime?
      - tptacek 14y ago
        You think I'm arguing something I'm not arguing. I'm not saying there aren't crimes that are chargeable under CFAA that could be better charged under a pre-existing law. I'm just saying there are crimes that can't be charged that way, thus the need for computer-specific crime laws. CFAA is not a good computer-specific crime law. Two gigantic problems with it: sentences that scale linearly with damages despite the fact that criminal intent and diligence does not scale the same way, and the CFAA's "sentencing accelerant" property, where it bonds covalently with other criminal charges to increase penalties.
        etvmueller 14y ago
        I understand and I share your point of view to a degree, but I remain skeptical that until CFAA, there were no successful prosecutions for crimes that we are told are only now covered by CFAA. Computers and criminals have been around for a while now. I am also opposed to the idea that we need specific crime laws for things like this. What about vehicular manslaughter while listening to an iPod, and why would that not be covered as distraction equivalent to listening to radio, which I assume and also hope that it would be. There should be some respect for the intent of existing law in addition to the letter, because we do have laws for theft and I am certain that the intent of those laws covers these cases.
        tptacek 14y ago
        Before CFAA, computer crimes were charged under wire fraud statutes. But to prove wire fraud you have to establish the elements of a fraud, which include deliberate intent to secure some kind of gain from your deception.
  - anigbrowl 14y ago
    I'm asking a specific yes/no question, not one about theft.
    - etvmueller 14y ago
      Would the charge be burglary for unauthorized access, or burglary if information was stolen after unauthorized access, and otherwise breaking and entering or just entering? To that, yes. If the information that was stolen was then used to commit other crimes, then other charges should follow as appropriate.
      - anigbrowl 14y ago
        The former. burglary (in some places criminal trespass) is entry to premises with the intent of committing a crime [1]. Anyway we're on the same page, insofar as you're OK with extending existing law to cover virtual intrusions. See my other comment upthread, though. 1. The exact definition varies by state - in some places only residences can be burgled (but you can have criminal trespass on commercial premises) and now that I think of it burglary is usually defined as taking place during the night, whereas in the daytime the same crime would be breaking & entering, and so on.

betterunix 14y ago

The problem here is that the CFAA was invoked only because a [separate] crime was committed. We might as well have a law that requires everyone to follow all laws, so that prosecutors have unlimited power to tack on charges.