3 ms·

This is illegal. Under the CFAA, any unauthorized access of any "protected" system anywhere (that causes at least $5,000 in damages, but hell, anything over a 1

This is illegal. Under the CFAA, any unauthorized access of any "protected" system anywhere (that causes at least $5,000 in damages, but hell, anything over a 1-2 man business can have $5,000 in damages, in legal terms, in a few seconds) is a felony. Protected system: "including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States" I think taking down NK internet would be considered affecting foreign commerce/communication.

unclebucknasty 12y ago
But, I wonder, if a case could be made for such an attack being a defensive maneuver on the part of the USG? That is, due to the claimed recent activity by NK and future threats articulated by NK to engage in cyber warfare, might taking their access offline be construed as a defensive measure? If so, would there be anything under the U.S. Code or otherwise that would supersede the CFAA; or are there exclusions in the CFAA itself?
- dragonwriter 12y ago
  Acts of the executive branch (or of anyone the executive branch agrees with) can escape criminal prosecution (whether or not they are technically crimes) simply because (1) the executive branch controls prosecutions, and (2) the executive branch has the power of the pardon. Criminal law, except from a political standpoint, does not constrain the policy of the executive branch.
  - unclebucknasty 12y ago
    So, you're saying that the GP's point is moot, in that the USG would disregard any perceived constraints imposed by the CFAA in limiting an attack like this? If so, we're effectively saying the same thing, with the exception that I do believe individuals are, and know themselves to be, technically liable for criminal conduct. As such, I believe that individuals and groups working within the USG (Executive or otherwise) do seek legal cover for their actions.
    - crazypyro 12y ago
      My point isn't moot because I'm not assuming the USG is behind this attack. It's still illegal, even if the USG wouldn't enforce it against itself. If it was a third party, then they would definitely be prosecuted if the USG had proof/extradition. That was my point.
      - unclebucknasty 12y ago
        Well, I wasn't saying it was moot, even if you were assigning responsibility to the USG! I was just pointing out that it was the implication of dragonwriter's comment with regard to potential USG involvement. So, rather than haggling with dragownwriter over that bit, I went on to point out that I don't believe the USG would be constrained by it for different reasons than the outright impunity he suggested; that is, that they would find legal justification for it. But, I do see that I may have misconstrued your comment by over-focus on the USG involvement bit. My bad.
        dragonwriter 12y ago
        > I went on to point out that I don't believe the USG would be constrained by it for different reasons than the outright impunity he suggested; that is, that they would find legal justification for it. I don't think that's really different; finding the legal justification to cite for it is responding to the political constraint (it also is a means of invoking the impunity, because reliance on such a legal justification provided by superiors within the executive branch itself creates a colorable legal defense against future prosecution without requiring an explicit pardon, even if the justification itself is flawed. This has been identified by many experts as one of the problems with actually prosecuting the people directly involved in torture in the US criminal justice system.)
downandout 12y ago
Yes, but the larger question is whether computers in NK "affect interstate or foreign commerce or communication of the United States". Since we don't conduct business with NK, I think it wouldn't meet the definition.
- crazypyro 12y ago
  Do we not have official communications with NK (really not sure about this, it might be diplomatically and legally we do not, but someone more informed could correct me)? The CFAA is so vague. It almost always is interpreted in a manner supportive of the USG's prosecution, go figure.
- rgbrenner 12y ago
  The FBI disagrees with your interpretation: http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf (I was going to quote some parts of this, but there are too many... giant wall of text.) Edit: This is also useful: http://www.fas.org/sgp/crs/misc/97-1025.pdf http://www.fas.org/sgp/crs/misc/97-1025.pdf And I'll quote this part (which is from a case cited in the footnotes): A computer that accesses the Internet is a computer used in interstate or foreign commerce. So there's your answer

unclebucknasty 12y ago

But, I wonder, if a case could be made for such an attack being a defensive maneuver on the part of the USG? That is, due to the claimed recent activity by NK and future threats articulated by NK to engage in cyber warfare, might taking their access offline be construed as a defensive measure? If so, would there be anything under the U.S. Code or otherwise that would supersede the CFAA; or are there exclusions in the CFAA itself?

dragonwriter 12y ago
Acts of the executive branch (or of anyone the executive branch agrees with) can escape criminal prosecution (whether or not they are technically crimes) simply because (1) the executive branch controls prosecutions, and (2) the executive branch has the power of the pardon. Criminal law, except from a political standpoint, does not constrain the policy of the executive branch.
- unclebucknasty 12y ago
  So, you're saying that the GP's point is moot, in that the USG would disregard any perceived constraints imposed by the CFAA in limiting an attack like this? If so, we're effectively saying the same thing, with the exception that I do believe individuals are, and know themselves to be, technically liable for criminal conduct. As such, I believe that individuals and groups working within the USG (Executive or otherwise) do seek legal cover for their actions.
  - crazypyro 12y ago
    My point isn't moot because I'm not assuming the USG is behind this attack. It's still illegal, even if the USG wouldn't enforce it against itself. If it was a third party, then they would definitely be prosecuted if the USG had proof/extradition. That was my point.
    - unclebucknasty 12y ago
      Well, I wasn't saying it was moot, even if you were assigning responsibility to the USG! I was just pointing out that it was the implication of dragonwriter's comment with regard to potential USG involvement. So, rather than haggling with dragownwriter over that bit, I went on to point out that I don't believe the USG would be constrained by it for different reasons than the outright impunity he suggested; that is, that they would find legal justification for it. But, I do see that I may have misconstrued your comment by over-focus on the USG involvement bit. My bad.
      - dragonwriter 12y ago
        > I went on to point out that I don't believe the USG would be constrained by it for different reasons than the outright impunity he suggested; that is, that they would find legal justification for it. I don't think that's really different; finding the legal justification to cite for it is responding to the political constraint (it also is a means of invoking the impunity, because reliance on such a legal justification provided by superiors within the executive branch itself creates a colorable legal defense against future prosecution without requiring an explicit pardon, even if the justification itself is flawed. This has been identified by many experts as one of the problems with actually prosecuting the people directly involved in torture in the US criminal justice system.)

downandout 12y ago

Yes, but the larger question is whether computers in NK "affect interstate or foreign commerce or communication of the United States". Since we don't conduct business with NK, I think it wouldn't meet the definition.

crazypyro 12y ago
Do we not have official communications with NK (really not sure about this, it might be diplomatically and legally we do not, but someone more informed could correct me)? The CFAA is so vague. It almost always is interpreted in a manner supportive of the USG's prosecution, go figure.
rgbrenner 12y ago
The FBI disagrees with your interpretation: http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf (I was going to quote some parts of this, but there are too many... giant wall of text.) Edit: This is also useful: http://www.fas.org/sgp/crs/misc/97-1025.pdf http://www.fas.org/sgp/crs/misc/97-1025.pdf And I'll quote this part (which is from a case cited in the footnotes): A computer that accesses the Internet is a computer used in interstate or foreign commerce. So there's your answer