5 ms·

The problem here is that the CFAA - especially the way it is being interpreted as of late - is a relatively new and undefined body of law. Therefore, there is

The problem here is that the CFAA - especially the way it is being interpreted as of late - is a relatively new and undefined body of law. Therefore, there is not much case law on point. As a result you have prosecutors doing what they do best, throwing everything at the wall and seeing what sticks. The problem with throwing everything at the wall is that defendants are more inclined to accept a reasonable plea rather than face the unknown. For example, is it reasonable to charge someone with a count under CFAA for each instance they try to access a system without permission? You can try to adapt existing case law in unrelated crimes - such as attempted murder, should someone be charged for a new count of attempted murder for each bullet that was shot at a given victim or just a single count notwithstanding the number of shots fired, or how about if there are 2 potential victims the defendant wanted dead but only shot 1 bullet near both of them? Is it reasonable to charge a count under CFAA for running vulnerability software on a website? Is it reasonable to charge someone for breaking and entering if the defendant simply checks to see if doors or windows are unlocked, should we file an additional count for each door/window that was checked or a new count for each time a door knob was turned? These are all issues that are ripe for the courts to decide, but it will take a very long time before you have a defendant willing to take the risk. What is really troublesome is that in the meantime there are cases such as this where 44 felony counts can be reduced to a single misdemeanor in exchange for a change of plea. The fact that a prosecutor was willing to offer a deal like this means the original charges were improper even in the eyes of the prosecutor. Expect things to only get worse in terms of prosecutorial discretion vis-a-vis charges under CFAA in the foreseeable future.

tptacek 12y ago
The number of counts charged in CFAA doesn't appear to have much to do with sentencing. There is a huge problem with CFAA sentencing: the sentence accelerator for damages. The iterator count in someone's "for()" loop can make the difference between probation and 3 years in prison. Incidentally: you probably can be charged with breaking and entering for checking your neighbors window locks.
- rayiner 12y ago
  Your example makes me thing of something: what if we're all just less conscientious people online? Lots of people looked at the recent leaked celebrity pictures who wouldn't look into those peoples' windows. It's hard to argue that this is the result of the former being less wrong--the impact on the victim is identical. So it must be that people are just more willing to do "wrong" things on the internet. Should the law take this into account, especially when you're analogizing between the CFAA and breaking and entering, or cyberstalking and real stalking.
  - tptacek 12y ago
    We're not just less conscientious online (though we certainly are that). Technology also makes unethical, immoral, and criminal decisions much easier to make, often so easily that we don't realize that we've done it unless we go out of our way to reflect on it.
    - boracay 12y ago
      That isn't unique to the Internet though. That goes both for other technologies like cars, guns or publishing and "protected" activities like running a business, being a journalist or a lawyer. Maybe most importantly there has to be a reasonable balance between protection (liability) and enforcement (punishment).
  - will_brown 12y ago
    >Should the law take this into account... Definitely not. Doing so is to much of a slippery slope when extended to drugs/alcohol or anything else that has the effect of lowering inhibitions or increasing the likeliness of committing a crime where one might otherwise not. That said I agree with your point there is a blurring of the line. Whereas in your example, one would have to actively go to someones private property and peep through a window until they caught what they were looking for, versus the internet where a picture practically comes to you, your only act is clicking (tptacek touched on this...maybe could be termed "lowering the barrier to criminal behavior"). So while the victim impact is the same as you say (I might even argue online is worse because there is greater/continued victimization), the acts are different in nature. Blurring the line further is that culturally the internet pictures are normalized in the sense that they are practically marketed via traditional news, social media and late night comedians as things to see rather than condemned as acts of victimization.
chongli 12y ago
As a result you have prosecutors doing what they do best, throwing everything at the wall and seeing what sticks. The problem with throwing everything at the wall is that defendants are more inclined to accept a reasonable plea rather than face the unknown. This is a symptom of a much greater problem in our society: plea bargaining and the legislation built to take advantage of it. Plea bargaining is routinely used to extract guilty pleas from those too intimidated or otherwise unable to adequately defend themselves. It is profoundly unjust at its core. Its proponents tout it as a way to save money and reduce the burden on our courts. Since when has saving money been a fundamental pillar of justice? If you ask me, we should do away with pleas altogether. All defendants would automatically be tried as if not guilty. Prosecution would likewise be compulsory. We would then have to rewrite most of our laws to reduce the ridiculous number of prosecutions that would result from the above changes. This would empower judges to do what they have been trained to do: discover the factual record and independently assess the case against the defendant.

tptacek 12y ago

The number of counts charged in CFAA doesn't appear to have much to do with sentencing. There is a huge problem with CFAA sentencing: the sentence accelerator for damages. The iterator count in someone's "for()" loop can make the difference between probation and 3 years in prison. Incidentally: you probably can be charged with breaking and entering for checking your neighbors window locks.

rayiner 12y ago
Your example makes me thing of something: what if we're all just less conscientious people online? Lots of people looked at the recent leaked celebrity pictures who wouldn't look into those peoples' windows. It's hard to argue that this is the result of the former being less wrong--the impact on the victim is identical. So it must be that people are just more willing to do "wrong" things on the internet. Should the law take this into account, especially when you're analogizing between the CFAA and breaking and entering, or cyberstalking and real stalking.
- tptacek 12y ago
  We're not just less conscientious online (though we certainly are that). Technology also makes unethical, immoral, and criminal decisions much easier to make, often so easily that we don't realize that we've done it unless we go out of our way to reflect on it.
  - boracay 12y ago
    That isn't unique to the Internet though. That goes both for other technologies like cars, guns or publishing and "protected" activities like running a business, being a journalist or a lawyer. Maybe most importantly there has to be a reasonable balance between protection (liability) and enforcement (punishment).
- will_brown 12y ago
  >Should the law take this into account... Definitely not. Doing so is to much of a slippery slope when extended to drugs/alcohol or anything else that has the effect of lowering inhibitions or increasing the likeliness of committing a crime where one might otherwise not. That said I agree with your point there is a blurring of the line. Whereas in your example, one would have to actively go to someones private property and peep through a window until they caught what they were looking for, versus the internet where a picture practically comes to you, your only act is clicking (tptacek touched on this...maybe could be termed "lowering the barrier to criminal behavior"). So while the victim impact is the same as you say (I might even argue online is worse because there is greater/continued victimization), the acts are different in nature. Blurring the line further is that culturally the internet pictures are normalized in the sense that they are practically marketed via traditional news, social media and late night comedians as things to see rather than condemned as acts of victimization.

chongli 12y ago

As a result you have prosecutors doing what they do best, throwing everything at the wall and seeing what sticks. The problem with throwing everything at the wall is that defendants are more inclined to accept a reasonable plea rather than face the unknown. This is a symptom of a much greater problem in our society: plea bargaining and the legislation built to take advantage of it. Plea bargaining is routinely used to extract guilty pleas from those too intimidated or otherwise unable to adequately defend themselves. It is profoundly unjust at its core. Its proponents tout it as a way to save money and reduce the burden on our courts. Since when has saving money been a fundamental pillar of justice? If you ask me, we should do away with pleas altogether. All defendants would automatically be tried as if not guilty. Prosecution would likewise be compulsory. We would then have to rewrite most of our laws to reduce the ridiculous number of prosecutions that would result from the above changes. This would empower judges to do what they have been trained to do: discover the factual record and independently assess the case against the defendant.