Man Convicted of Hacking Despite Not Hacking(wired.com)
wired.com
Man Convicted of Hacking Despite Not Hacking
http://www.wired.com/threatlevel/2013/04/man-convicted-of-hacking-despite-no-hacking/?buffer_share=7c9de&utm_source=buffer&utm_medium=linkedin&utm_campaign=Buffer%253A%252BYaniv%2520Capeluto%2520%2528Kapluto%2529%252Bon%252Blinkedin
7 comments
There have been rules and lawsuits around former employees stealing their employer's list of clients for ages.
The fact that said lists are now stored in a computer rather than in a rolodex or filing system should not suddenly increase the potential penalties manyfold.
I also don't see why the federal government is prosecuting what I see as a civil dispute between two private parties.
The fact that said lists are now stored in a computer rather than in a rolodex or filing system should not suddenly increase the potential penalties manyfold.
I also don't see why the federal government is prosecuting what I see as a civil dispute between two private parties.
If I fire someone, and they come back into the office afterwards at night to do whatever, is that still "a civil dispute between two private parties"?
The problem here is that the CFAA was invoked only because a [separate] crime was committed. We might as well have a law that requires everyone to follow all laws, so that prosecutors have unlimited power to tack on charges.
You make a good point. There is clearly theft of proprietary information. (Though the guy who got convicted didn't do the stealing.)
But I reiterate. The fact that the information was stored on a computer shouldn't trigger massively bigger penalties. Everything is stored on computers these days!
But I reiterate. The fact that the information was stored on a computer shouldn't trigger massively bigger penalties. Everything is stored on computers these days!
OK, so would you be OK with it if unauthorized access to a computer system (eg an ex-employers or some other case where the lack of authorization is clear and criminal intent is present) resulted in a charge of burglary?
The problem is that there is already a well developed set of laws to govern human interactions with each other and with the environment. This is like the broken patent system: it's something that has been done for 40 years, except on a computer! We do not need a patent for that, and we do not need a new law for stealing information on a computer. We already have laws for theft.
The problem the authors of CFAA faced when the law was written is that this is actually not the case. Existing laws regarding e.g. burglary did not cleanly apply to computer crimes.
I think there are probably cases that do a better job showcasing the need for computer-specific crime laws, and crimes that do a worse job at that. Basic wire fraud cases don't really need CFAA from what I can tell, and CFAA serves primarily as a sentence accelerant in them. But in other cases, particularly where people cause damage but don't reap profits, the need for specific laws is clearer.
I think there are probably cases that do a better job showcasing the need for computer-specific crime laws, and crimes that do a worse job at that. Basic wire fraud cases don't really need CFAA from what I can tell, and CFAA serves primarily as a sentence accelerant in them. But in other cases, particularly where people cause damage but don't reap profits, the need for specific laws is clearer.
Was it really the case that someone could steal information from a computer and not be charged with a crime, or indicted by a grand jury and then successfully prosecuted under existing law, and that until recently, when information was stolen from a computer, that was not a crime?
It would be an awful lot easier to argue that. I'd need to go back and look up a bunch of cases which I don't feel like doing at present because it would be a large research project, but absent any specific computer-crime laws I'd argue that because a computer is a digital system and a digital system is just a complex agglomeration of switches, there's no qualitative difference between accessing a computer system and turning a light switch on and off. You'd never convict someone of a crime for turning a light switch on and off; if they entered your office at night to do so that would just be trespass rather than burglary. So how is operating a computer all that different? You're just opening and closing a few million different circuits. Sure, you could say my client illegally obtained information by doing so, but where is this information? Can you produce it in evidence? If you can't do so without printing it out, and you can't show that my client printed it out, where is the crime? Etc. etc. Likewise I could argue that no fraud has taken place because fraud involves a deception, a deception involves a deceiver and a deceived, and computers are not sapient, therefore they're not capable of being deceived. Defeating a login system isn't a case of deception because administrator of said system was not consulted for permission; arguably he automated away his duty of granting or withholding access and the defendant should not be blamed for the inadequacy of that automated process.
Sure, these are bullshit arguments, but the point is that our legal system works on a rough mix of common sense and code. If I can find an exploitable ambiguity in statute or precedent and apply it to a defendant's case, then it's like an exploit in which throwing an exception is equivalent to a trial resulting in an acquittal. we have laws defining what a computer system is and what constitutes access to one etc. precisely because the virtualized nature of digital information makes it tricky to apply laws that were drafted to deal with theft of physical property.
Sure, these are bullshit arguments, but the point is that our legal system works on a rough mix of common sense and code. If I can find an exploitable ambiguity in statute or precedent and apply it to a defendant's case, then it's like an exploit in which throwing an exception is equivalent to a trial resulting in an acquittal. we have laws defining what a computer system is and what constitutes access to one etc. precisely because the virtualized nature of digital information makes it tricky to apply laws that were drafted to deal with theft of physical property.
Is the intent of existing law considered as part of the concept of common law? Would the average member of the jury really not understand this? Why couldn't a prosecutor receive an indictment and then argue this before a court and jury and thereby develop the methodology to approach this problem. This process may require several cases but wouldn't that be preferable to have jurists extend common law rather than have legislators parachute in new laws that obviously have problems?
Those are very good questions: the fact is that there is a huge amount of tension between the judicial and legislative branches, and within the judicial branch itself, about there the boundary between jduges' interpretation and reaasonable interpolation of teh law, and the text of statute as written. Conservative jurists like Justice Antonin Scalia think you should always go by the text of the law, and that it's dead wrong to consider legislative intent, no matter how obvious or well-documented it is/was; this approach (known as textualism) holds that if a law is no good, the correct remedy is for Congress to rewrite it. Judges should only dismiss a law as unconstitutional or go around it in cases where there is a clear and unambigious conflict between the Constitution and the statute. Other jurists, such as Justice Stephen Breyer, look at the Constitution as more of a framework document and think that you absolutely need to examine laws within the context in which they were passed and in the light of which problem they're intended to solve.
This is a very gnarly question, with good arguments on both sides - but in addition, there's a lot of unstated political baggage tied to both sides of the argument, so that what is on the surface a question of legal philosophy is on closer examination rooted in quite different philosophies of governance.
Now myself, I like the common-law approach and I would prefer a general class of crimes and that the details of individual cases be taken up by wise jurists. On the other hand, it's not a foregone conclusion that all judges are wise or selfless, and of course there might be judges who are both but who would come to quite different conclusions from me because they operate on a different moral calculus. So for the sake of consistency and predictability, there's a strong argument to have laws debated and promulgated by legislators rather than judges, so that anyone can do and look them up for guidance about what is and is not legal. Of course that involves some idealistic assumptions about legislators...
If you like high-density reading material, I strongly recommend How Judges Think by Judge Richard Posner.
This is a very gnarly question, with good arguments on both sides - but in addition, there's a lot of unstated political baggage tied to both sides of the argument, so that what is on the surface a question of legal philosophy is on closer examination rooted in quite different philosophies of governance.
Now myself, I like the common-law approach and I would prefer a general class of crimes and that the details of individual cases be taken up by wise jurists. On the other hand, it's not a foregone conclusion that all judges are wise or selfless, and of course there might be judges who are both but who would come to quite different conclusions from me because they operate on a different moral calculus. So for the sake of consistency and predictability, there's a strong argument to have laws debated and promulgated by legislators rather than judges, so that anyone can do and look them up for guidance about what is and is not legal. Of course that involves some idealistic assumptions about legislators...
If you like high-density reading material, I strongly recommend How Judges Think by Judge Richard Posner.
You think I'm arguing something I'm not arguing. I'm not saying there aren't crimes that are chargeable under CFAA that could be better charged under a pre-existing law. I'm just saying there are crimes that can't be charged that way, thus the need for computer-specific crime laws.
CFAA is not a good computer-specific crime law. Two gigantic problems with it: sentences that scale linearly with damages despite the fact that criminal intent and diligence does not scale the same way, and the CFAA's "sentencing accelerant" property, where it bonds covalently with other criminal charges to increase penalties.
CFAA is not a good computer-specific crime law. Two gigantic problems with it: sentences that scale linearly with damages despite the fact that criminal intent and diligence does not scale the same way, and the CFAA's "sentencing accelerant" property, where it bonds covalently with other criminal charges to increase penalties.
I understand and I share your point of view to a degree, but I remain skeptical that until CFAA, there were no successful prosecutions for crimes that we are told are only now covered by CFAA. Computers and criminals have been around for a while now.
I am also opposed to the idea that we need specific crime laws for things like this. What about vehicular manslaughter while listening to an iPod, and why would that not be covered as distraction equivalent to listening to radio, which I assume and also hope that it would be. There should be some respect for the intent of existing law in addition to the letter, because we do have laws for theft and I am certain that the intent of those laws covers these cases.
I am also opposed to the idea that we need specific crime laws for things like this. What about vehicular manslaughter while listening to an iPod, and why would that not be covered as distraction equivalent to listening to radio, which I assume and also hope that it would be. There should be some respect for the intent of existing law in addition to the letter, because we do have laws for theft and I am certain that the intent of those laws covers these cases.
Before CFAA, computer crimes were charged under wire fraud statutes. But to prove wire fraud you have to establish the elements of a fraud, which include deliberate intent to secure some kind of gain from your deception.
I'm asking a specific yes/no question, not one about theft.
Would the charge be burglary for unauthorized access, or burglary if information was stolen after unauthorized access, and otherwise breaking and entering or just entering? To that, yes. If the information that was stolen was then used to commit other crimes, then other charges should follow as appropriate.
The former. burglary (in some places criminal trespass) is entry to premises with the intent of committing a crime [1]. Anyway we're on the same page, insofar as you're OK with extending existing law to cover virtual intrusions. See my other comment upthread, though.
1. The exact definition varies by state - in some places only residences can be burgled (but you can have criminal trespass on commercial premises) and now that I think of it burglary is usually defined as taking place during the night, whereas in the daytime the same crime would be breaking & entering, and so on.
1. The exact definition varies by state - in some places only residences can be burgled (but you can have criminal trespass on commercial premises) and now that I think of it burglary is usually defined as taking place during the night, whereas in the daytime the same crime would be breaking & entering, and so on.
A more fact-based article: http://7thspace.com/headlines/436581/executive_recruiter_dav....
What's your point? Had he walked away with a paper copy of the data in question, more than half those charges would not exist. The issue here is that "involving a computer" has become an excuse for harsher sentencing and greater power for police and prosecutors. Driving that is a law that is so broad that nearly anyone with computer access could be accused of violating it (in other words, the majority of Americans).
The point is that Wired's egregiously shitty journalism isn't doing anybody any favors when it comes to mustering up legitimate opposition to the CFAA. If I opposed the CFAA in its present incarnation (which I do), I'd be embarassed to be associated with Wired's coverage. If I were a friend of Aaron Swartz, I'd be offended at Wired's repeated attempts to compare guys with malicious intent like this guy and the Watts guy in an article earlier this week to Aaron.
First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime.
Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In all three cases, the CFAA charges were used for no reason other than to pressure the defendant.
You are doing a disservice to those who are trying to fix the problems with the CFAA by suggesting that there is any legitimacy to the application of that law in this case.
Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In all three cases, the CFAA charges were used for no reason other than to pressure the defendant.
You are doing a disservice to those who are trying to fix the problems with the CFAA by suggesting that there is any legitimacy to the application of that law in this case.
> First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime.
The jury concluded based on the evidence that he knew that his friend intended to use it to commit a crime. Knowledge and concious disregard for the fact that your work is being used to commit a crime is indeed malicious intent.
> Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate.
In two of the cases, the men were directly involved in the commission of a computer-related crime and acted maliciously. If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices.
The jury concluded based on the evidence that he knew that his friend intended to use it to commit a crime. Knowledge and concious disregard for the fact that your work is being used to commit a crime is indeed malicious intent.
> Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate.
In two of the cases, the men were directly involved in the commission of a computer-related crime and acted maliciously. If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices.
"Knowledge and concious disregard for the fact that your work is being used to commit a crime is indeed malicious intent."
Cryptographers beware...
"computer-related crime"
Except that "computer-related crime" has come to mean "any crime in which a computer is used." As more and more things become computerized, more and more crimes will be "computer-related." Eventually everyone who is accused of a crime will also be accused of a CFAA violation, which will weaken everyone's defense.
"If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices"
Henry Louis Mencken addressed this more eloquently than I can:
"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all."
Cryptographers beware...
"computer-related crime"
Except that "computer-related crime" has come to mean "any crime in which a computer is used." As more and more things become computerized, more and more crimes will be "computer-related." Eventually everyone who is accused of a crime will also be accused of a CFAA violation, which will weaken everyone's defense.
"If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices"
Henry Louis Mencken addressed this more eloquently than I can:
"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all."
Just as there is a difference between making guns in general, and making a specific gun for a friend who has indicated that he will use it for a specific crime, there is a difference between making programs which can be used in crimes in general and making specific programs to aid and abet specific future crimes.
Your point about computer crimes becoming more prevalent is certainly justification to alter legislation dealing with computer crimes so that minor infractions have minor penalties, but I never saw rayiner arguing to the contrary.
Your point about computer crimes becoming more prevalent is certainly justification to alter legislation dealing with computer crimes so that minor infractions have minor penalties, but I never saw rayiner arguing to the contrary.
IANAL, but I think "knowledge ... a crime" means a particular crime, not a general category. So if you reasonably suspect that your work might be useful to criminals, that's not conspiracy, but as soon as one particular criminal tells you he intends to use your software for a particular crime, you're a conspirator unless you report him to the authorities. So honest cryptographers have nothing to fear, unless a criminal tells them about his crypto-assisted crimes and they don't report it.
>If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices.
So what do you do if you're trying to show that the law has excessive and disproportionate penalties?
So what do you do if you're trying to show that the law has excessive and disproportionate penalties?
I'd find a better case, for starters.
The trade secret charge has the harshest penalty, and is independent of computer use.
The conspiracy charge has the same maximum as the unauthorized network access charge.
Someone who is an expert at the Federal Sentencing Guidelines will have to chime in with what that means for an eventual sentence, but I suspect that even if the computer violation were considered extremely minor that it would have nearly the same marginal effect on the eventual sentence, once the trade secret and conspiracy sentences are thrown into the mix.
Even if the prosecutors had never mentioned the term "computer" this guy would be in some deep shit...
The trade secret charge has the harshest penalty, and is independent of computer use.
The conspiracy charge has the same maximum as the unauthorized network access charge.
Someone who is an expert at the Federal Sentencing Guidelines will have to chime in with what that means for an eventual sentence, but I suspect that even if the computer violation were considered extremely minor that it would have nearly the same marginal effect on the eventual sentence, once the trade secret and conspiracy sentences are thrown into the mix.
Even if the prosecutors had never mentioned the term "computer" this guy would be in some deep shit...
>I'd find a better case, for starters.
I was responding to the general point.
But as for finding a better case, the problem is that you don't get to pick which cases get prosecuted. If the parties have decided to appeal then a precedent is going to be set here one way or the other. So let him go to jail for what he actually did -- there is no reason to allow the CFAA charge to be piled on top of that and set a terrible precedent for next time when the defendant is sympathetic but the question has already been settled.
I was responding to the general point.
But as for finding a better case, the problem is that you don't get to pick which cases get prosecuted. If the parties have decided to appeal then a precedent is going to be set here one way or the other. So let him go to jail for what he actually did -- there is no reason to allow the CFAA charge to be piled on top of that and set a terrible precedent for next time when the defendant is sympathetic but the question has already been settled.
Why is it OK to have a law against something as general as mail fraud, given that pretty much everyone has used the post at some time or another, but have no law at all regarding computer crimes?
I would understand arguing that CFAA in particular is overbroad but it's hard to claim it's being used in this case in a way that's inconsistent with the rest of the U.S. Code. In fact even the CFAA is more narrowly-focused than the aforementioned mail fraud law.
And that's what I mean by "finding a better case". This is simply not a suitable demonstration of stupendous overreach. Prosecutors pile charges on, that's what they do. They only get one trial to sort everything out and entire swaths of their case can be thrown out in one fell swoop so yes, they'll stick everything they feel they can prove on there.
Even with some theoretical replacement for CFAA that is more fair I would think that at least the authorized access using a co-conspirator's credentials would end up being a chargeable offense, so the difference here is with the remaining accesses that were made. And even those are hard to claim would be "authorized" access with a straight face, as why would any company authorize access to their networks for the purpose of industrial espionage?
I would understand arguing that CFAA in particular is overbroad but it's hard to claim it's being used in this case in a way that's inconsistent with the rest of the U.S. Code. In fact even the CFAA is more narrowly-focused than the aforementioned mail fraud law.
And that's what I mean by "finding a better case". This is simply not a suitable demonstration of stupendous overreach. Prosecutors pile charges on, that's what they do. They only get one trial to sort everything out and entire swaths of their case can be thrown out in one fell swoop so yes, they'll stick everything they feel they can prove on there.
Even with some theoretical replacement for CFAA that is more fair I would think that at least the authorized access using a co-conspirator's credentials would end up being a chargeable offense, so the difference here is with the remaining accesses that were made. And even those are hard to claim would be "authorized" access with a straight face, as why would any company authorize access to their networks for the purpose of industrial espionage?
>Why is it OK to have a law against something as general as mail fraud, given that pretty much everyone has used the post at some time or another, but have no law at all regarding computer crimes?
I don't understand what your question has to do with what we were discussing. Who said we should "have no law at all regarding computer crimes"? There may be a need for specific regulation regarding some unique aspect of what computers do, or for carving out specific provisions in existing laws when some distinctive feature of computers changes the analysis, but that isn't what the CFAA is. We have laws against theft of trade secrets, what cause is there for them to work differently or have different penalties just because a computer is involved? And if there is such a cause, why must it be addressed with a law having such breadth and penalties as the CFAA rather than something more narrowly targeted at the actual evil?
>In fact even the CFAA is more narrowly-focused than the aforementioned mail fraud law.
The mail fraud law may be similarly problematic, though it at least is mitigated by the fact that it requires you to use the mail, which is becoming less and less common and even in its heyday was never involved in so much of the everyday activities of normal citizens as the internet is today.
>Prosecutors pile charges on, that's what they do. They only get one trial to sort everything out and entire swaths of their case can be thrown out in one fell swoop so yes, they'll stick everything they feel they can prove on there.
Which is kind of the point: They're willing to abuse whatever you give them, so we shouldn't be giving them anything so easy to abuse.
>Even with some theoretical replacement for CFAA that is more fair I would think that at least the authorized access using a co-conspirator's credentials would end up being a chargeable offense, so the difference here is with the remaining accesses that were made.
I think there is a case to be made that authenticating with someone else's credentials (and nothing more) does not need to be a federal offense. Imagine the same scenario (you log on to a friend's work computer using their credentials) but you do so for some totally innocuous purpose like reading The New Yorker online while your friend is finishing up some work. How do you suppose that behavior justifies a federal prosecution? That's the thing the law prohibits, not the actually malicious thing that may or may not follow it.
And all of this is ignoring the original point, which is that even if unauthorized access without any distinct malicious act is to be illegal, the existing penalties remain unjustifiable.
>And even those are hard to claim would be "authorized" access with a straight face, as why would any company authorize access to their networks for the purpose of industrial espionage?
I think you're just proving the point that "unauthorized access to a computer" is a preposterous basis for legislation. If the way you know that access is unauthorized is that breaking some other law implies unauthorized access, what good is the law against unauthorized access? Just attach the penalties you would have attached to unauthorized access to the actually malicious thing the doing of which implies that access was unauthorized and be done with it.
I don't understand what your question has to do with what we were discussing. Who said we should "have no law at all regarding computer crimes"? There may be a need for specific regulation regarding some unique aspect of what computers do, or for carving out specific provisions in existing laws when some distinctive feature of computers changes the analysis, but that isn't what the CFAA is. We have laws against theft of trade secrets, what cause is there for them to work differently or have different penalties just because a computer is involved? And if there is such a cause, why must it be addressed with a law having such breadth and penalties as the CFAA rather than something more narrowly targeted at the actual evil?
>In fact even the CFAA is more narrowly-focused than the aforementioned mail fraud law.
The mail fraud law may be similarly problematic, though it at least is mitigated by the fact that it requires you to use the mail, which is becoming less and less common and even in its heyday was never involved in so much of the everyday activities of normal citizens as the internet is today.
>Prosecutors pile charges on, that's what they do. They only get one trial to sort everything out and entire swaths of their case can be thrown out in one fell swoop so yes, they'll stick everything they feel they can prove on there.
Which is kind of the point: They're willing to abuse whatever you give them, so we shouldn't be giving them anything so easy to abuse.
>Even with some theoretical replacement for CFAA that is more fair I would think that at least the authorized access using a co-conspirator's credentials would end up being a chargeable offense, so the difference here is with the remaining accesses that were made.
I think there is a case to be made that authenticating with someone else's credentials (and nothing more) does not need to be a federal offense. Imagine the same scenario (you log on to a friend's work computer using their credentials) but you do so for some totally innocuous purpose like reading The New Yorker online while your friend is finishing up some work. How do you suppose that behavior justifies a federal prosecution? That's the thing the law prohibits, not the actually malicious thing that may or may not follow it.
And all of this is ignoring the original point, which is that even if unauthorized access without any distinct malicious act is to be illegal, the existing penalties remain unjustifiable.
>And even those are hard to claim would be "authorized" access with a straight face, as why would any company authorize access to their networks for the purpose of industrial espionage?
I think you're just proving the point that "unauthorized access to a computer" is a preposterous basis for legislation. If the way you know that access is unauthorized is that breaking some other law implies unauthorized access, what good is the law against unauthorized access? Just attach the penalties you would have attached to unauthorized access to the actually malicious thing the doing of which implies that access was unauthorized and be done with it.
I'm no expert in the Watt prosecution and know nothing about him, but from the reading I did: he wasn't accused of writing an innocuous tool and sharing it with a friend, or even writing a particularly useful network security testing tool. He's accused of writing a sniffer specifically designed to capture and record credit card transactions. Then he shared that tool with the ringleader of the largest credit card theft ring in the history of credit cards, who was a personal friend of his, with whom he partied during the ongoing criminal activities. At least one other longtime associate of Watt's was an active, remunerated contributor to the theft ring.
On the other hand, had he used a conspirator within the old company use the postal service to mail over a paper-based list he could easily have been charged with mail fraud, which occurs whenever the postal system is used in furtherance of a criminal act... any criminal act. Theft of trade secrets, even for purely corporate-interest reasons, has been a crime in the U.S. since 1996.
Yes, and a bunch of other charges would exist. Since you're so convinced of your rightness on this, be specific, tell u which charges he would have faced in the two different situations, and calculate the different penalties he'd be eligible for.
The "bunch of other charges" is actually two charges: conspiracy, and unauthorized receipt and possession of stolen trade secrets. That would have been plenty to charge this guy with, and would have meant a lengthy maximum sentence of fifteen years in prison.
The CFAA charges have a maximum penalty of five years in prison per charge. So with all six charges, the maximum penalty was thirty five years.
All charges carried a maximum $250000 fine. Again, the CFAA charges more than doubled the maximum penalty.
Really though, what is your point in asking? This is laid out in rayiner's link, anyone can read it. Yes, the judge has leeway in deciding the penalty, but that is not really the issue; the issue is that a defendant facing 35 years faces a much harder choice than a defendant facing 15 years. The CFAA violations are an example of a typical prosecutor strategy of pressuring defendants into making a guilty plea, and of trying to reduce the likelihood of an acquittal.
The CFAA charges have a maximum penalty of five years in prison per charge. So with all six charges, the maximum penalty was thirty five years.
All charges carried a maximum $250000 fine. Again, the CFAA charges more than doubled the maximum penalty.
Really though, what is your point in asking? This is laid out in rayiner's link, anyone can read it. Yes, the judge has leeway in deciding the penalty, but that is not really the issue; the issue is that a defendant facing 35 years faces a much harder choice than a defendant facing 15 years. The CFAA violations are an example of a typical prosecutor strategy of pressuring defendants into making a guilty plea, and of trying to reduce the likelihood of an acquittal.
What about accessory charges? You don't get to have clean hands just because some else does the dirty work for you.
Really though, what is your point in asking?
Because you keep making these assertions about how awful the CFAA but handwaving away critiques of your argument and any charges you don't like. So, you say that conspiracy and trade secrets charges are plenty, but from the point of view of interest of the public, why should we abstain from charging the guy with everything we can pin on him? Because he's a white-collar criminal as opposed to some kid with a bunch of drugs or a gun? Or because the deterrent 'yield' on marginal charges diminishes?
I get that you hate the CFAA, but you always spluttera bout how unfair it is and how much it's used for leverage against defendants. You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet, and you need to show why the breach of trust involved in compromising a private computer system doesn't or shouldn't matter. As it is, all your arguments seem to revolve around 'it's just a computer, it's not that bad.'
I had the same problem with the Aaron Swatz case with people saying it was no big deal that he plugged his laptop into the wiring closet. Just because an act is trivially easy to commit doesn't mean that you have a right to do it. My neighbor tends to leave his window open, but I don't think it entitles me to enter his apartment even though I could do so very easily.
Really though, what is your point in asking?
Because you keep making these assertions about how awful the CFAA but handwaving away critiques of your argument and any charges you don't like. So, you say that conspiracy and trade secrets charges are plenty, but from the point of view of interest of the public, why should we abstain from charging the guy with everything we can pin on him? Because he's a white-collar criminal as opposed to some kid with a bunch of drugs or a gun? Or because the deterrent 'yield' on marginal charges diminishes?
I get that you hate the CFAA, but you always spluttera bout how unfair it is and how much it's used for leverage against defendants. You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet, and you need to show why the breach of trust involved in compromising a private computer system doesn't or shouldn't matter. As it is, all your arguments seem to revolve around 'it's just a computer, it's not that bad.'
I had the same problem with the Aaron Swatz case with people saying it was no big deal that he plugged his laptop into the wiring closet. Just because an act is trivially easy to commit doesn't mean that you have a right to do it. My neighbor tends to leave his window open, but I don't think it entitles me to enter his apartment even though I could do so very easily.
"What about accessory charges? You don't get to have clean hands just because some else does the dirty work for you."
What about them? My issue is not with whether or not the guy is a criminal, but with whether or not it makes sense for "involves a computer" to mean "doubles the penalty."
"why should we abstain from charging the guy with everything we can pin on him?"
What if we had a law that criminalized crime itself, so that nobody could ever claim to have broken only one law? How would you feel about prosecutors using such a law to double the number of charges against every defendant?
I do not want to live in a society where anyone who is accused of a crime faces decades in prison, especially not when we already have the largest prison population on the planet. Computers are already ubiquitous, and will be even more ubiquitous in the future. If any crime that involves a computer is really two, three, or more crimes, then as time goes on the penalties for crimes will become increasingly severe regardless of whether or not the harm to society increases.
"you always splutter about how unfair it is and how much it's used for leverage against defendants"
Most defendants never have a jury trial, because they are pressured into taking a plea bargain. That is a problem, especially when defendants already have to wait years before they get a trial. Anything that gives prosecutors more power over defendants exacerbates this situation and clears the way for even more people to be imprisoned.
"You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet"
That is not equivalent. The equivalent crime would be having a friend in the office hold a door open so that you can enter and make a copy of some documents. There are two crimes there: conspiracy, and theft of trade secrets.
"you need to show why the breach of trust involved in compromising a private computer system doesn't or shouldn't matter"
It does matter, but what matters is that there was a breach of trust. The fact that a computer is involved is irrelevant.
What about them? My issue is not with whether or not the guy is a criminal, but with whether or not it makes sense for "involves a computer" to mean "doubles the penalty."
"why should we abstain from charging the guy with everything we can pin on him?"
What if we had a law that criminalized crime itself, so that nobody could ever claim to have broken only one law? How would you feel about prosecutors using such a law to double the number of charges against every defendant?
I do not want to live in a society where anyone who is accused of a crime faces decades in prison, especially not when we already have the largest prison population on the planet. Computers are already ubiquitous, and will be even more ubiquitous in the future. If any crime that involves a computer is really two, three, or more crimes, then as time goes on the penalties for crimes will become increasingly severe regardless of whether or not the harm to society increases.
"you always splutter about how unfair it is and how much it's used for leverage against defendants"
Most defendants never have a jury trial, because they are pressured into taking a plea bargain. That is a problem, especially when defendants already have to wait years before they get a trial. Anything that gives prosecutors more power over defendants exacerbates this situation and clears the way for even more people to be imprisoned.
"You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet"
That is not equivalent. The equivalent crime would be having a friend in the office hold a door open so that you can enter and make a copy of some documents. There are two crimes there: conspiracy, and theft of trade secrets.
"you need to show why the breach of trust involved in compromising a private computer system doesn't or shouldn't matter"
It does matter, but what matters is that there was a breach of trust. The fact that a computer is involved is irrelevant.
What if we had a law that criminalized crime itself
This is an empty argument. You haven't shown that merely doing things with a computer makes it worse.
"You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet" That is not equivalent. The equivalent crime would be having a friend in the office hold a door open so that you can enter and make a copy of some documents. There are two crimes there: conspiracy, and theft of trade secrets.
You're committing criminal trespass in that example, why don't you include that? And why do you equate accessing the system to simply holding a door open, as if there were no login security? I mentioned the example of documents being held in a safe as a proxy for the fact that you need to log into a system before copying documents from it, it's not like you just SSH in and get automatic access to the shell prompt for the asking. The reason that we have a crime of unauthorized access to a computer system is precisely because it's easier to get into a computer without damaging it than it is to get through a window without breaking it.
You're rewriting the facts to make your argument stand up. that's what's wrong with it. You do not get to just walk into someone else' place of business and start using the copier, and then only be charged for the copies you made, for the same reason that if you break into my house at night and take some money you're guilty of burglary as well as theft. Just because the unauthorized access/ criminal trespass/ burglary is a necessary prerequisite to the theft of trade secrets/ cash does not mean it's incorporaated into it.
This is an empty argument. You haven't shown that merely doing things with a computer makes it worse.
"You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet" That is not equivalent. The equivalent crime would be having a friend in the office hold a door open so that you can enter and make a copy of some documents. There are two crimes there: conspiracy, and theft of trade secrets.
You're committing criminal trespass in that example, why don't you include that? And why do you equate accessing the system to simply holding a door open, as if there were no login security? I mentioned the example of documents being held in a safe as a proxy for the fact that you need to log into a system before copying documents from it, it's not like you just SSH in and get automatic access to the shell prompt for the asking. The reason that we have a crime of unauthorized access to a computer system is precisely because it's easier to get into a computer without damaging it than it is to get through a window without breaking it.
You're rewriting the facts to make your argument stand up. that's what's wrong with it. You do not get to just walk into someone else' place of business and start using the copier, and then only be charged for the copies you made, for the same reason that if you break into my house at night and take some money you're guilty of burglary as well as theft. Just because the unauthorized access/ criminal trespass/ burglary is a necessary prerequisite to the theft of trade secrets/ cash does not mean it's incorporaated into it.
"why do you equate accessing the system to simply holding a door open, as if there were no login security?"
They were using a valid login; one of the coconspirators had given his credentials to them.
"the example of documents being held in a safe as a proxy for the fact that you need to log into"
No, that is what the door in my example is. The door was held open by a coconspirator.
To put it another way, nothing had to be broken; they accessed the computer in the normal fashion and downloaded the files in the normal fashion. They did not sneak in, they were allowed in by someone with legitimate, authorized access.
They were using a valid login; one of the coconspirators had given his credentials to them.
"the example of documents being held in a safe as a proxy for the fact that you need to log into"
No, that is what the door in my example is. The door was held open by a coconspirator.
To put it another way, nothing had to be broken; they accessed the computer in the normal fashion and downloaded the files in the normal fashion. They did not sneak in, they were allowed in by someone with legitimate, authorized access.
If you've conspired with someone to let you in, then your claim of authorized access is a sham. The question is whether the employer would have authorized such access, not whether you could successfully suborn a member of the employer's staff.
I don't know why, but there is this persistent misconception that just because you can do something easily it shouldn't be illegal.
It matters with what intent deeds are performed. If you come into my office at my invitation for a social chat, and while I'm visiting the restroom you notice a trade secret lying on my desk and copy it, you've stolen the trade secret but you were entitled to be there. But if you know I have a trade secret and you go into my office without permission, or trick me into admitting you under false pretenses, then you're guilty of criminal trespass as well.
The defendant knew that Korn/Ferry wouldn't want him copying client lists. Just because he used someone else as his man on the inside does not sanitize the unauthorized access. You're essentially applying the principles of money laundering to information and saying it's cool. This is total bullshit. I think you know better and that you would howl like a lonely coyote if anyone pulled the same trick on you.
I don't know why, but there is this persistent misconception that just because you can do something easily it shouldn't be illegal.
It matters with what intent deeds are performed. If you come into my office at my invitation for a social chat, and while I'm visiting the restroom you notice a trade secret lying on my desk and copy it, you've stolen the trade secret but you were entitled to be there. But if you know I have a trade secret and you go into my office without permission, or trick me into admitting you under false pretenses, then you're guilty of criminal trespass as well.
The defendant knew that Korn/Ferry wouldn't want him copying client lists. Just because he used someone else as his man on the inside does not sanitize the unauthorized access. You're essentially applying the principles of money laundering to information and saying it's cool. This is total bullshit. I think you know better and that you would howl like a lonely coyote if anyone pulled the same trick on you.
This is a common pattern for objects that are force multipliers. For example, the use of firearms and/or automobiles in the commission of a crime leads to harsher sentencing. Anything that gives the everyman an outsize advantage, like a computer, is treated harshly if that advantage is used against society.
I don't see what the big deal is. If you pay somebody to commit a crime (e.g., murder), you may be prosecuted for the crime itself.
Four of the six charges were related to accessing a computer. In this case, that amounted to logging in and downloading files.
And yet the trade secret charge had the harshest penalty, and the conspiracy charge was tied for second-harshest. Maybe the Federal Sentencing Guidelines count the number of charges convicted on but it's hard to claim that the CFAA is the only or predominant reason Nosal will be facing jail time in this particular case.
This sort of Brings back to light Aaron. Can someone please update me on what if any progress has been made to make sure this doesn't happen again?
Has his cause and actions just sort of belly flopped and gone no where or have we seen something meaningful come from the tragic loss?
Has his cause and actions just sort of belly flopped and gone no where or have we seen something meaningful come from the tragic loss?
Ok, exactly what did he do that is illegal: He paid another company's employees to get information from said company's database, and that these employees accessed the data by using some other employee's login credentials without permission?
Well, "industrial espionage" actually is a crime since 1996, no matter what tools you use to do it (and notably, has the harshest sentence of the 3 major types of crimes Nosal was charged with).
Unauthorized access to a computer network was made to help complete the crime, which is itself criminal, just like there is a charge "mail fraud" that makes use of the postal system to further any criminal act illegal.
Conspiracy is always illegal itself as well.
Unauthorized access to a computer network was made to help complete the crime, which is itself criminal, just like there is a charge "mail fraud" that makes use of the postal system to further any criminal act illegal.
Conspiracy is always illegal itself as well.
thank you. i couldn't recall the exact words, but yeah this is classic industrial espionage
The problem is that "hacking" is crime with disproportionate penalties. The consequence is that prosecutors would rather charge and convict someone (who didn't touch a computer) for hacking than for fraud.
Like the old saying goes, Don't do the crime if you can't do the time....
From the source 'rayiner provided:
The CFAA is a hugely problematic law. But I'm not a fan of manipulative news stories either.