The 'Cloud Computing Act Of 2012'… Or How Internet Regulation Can Go Awry

from the paved-with-good-intentions dept

Sen. Amy Klobuchar has introduced a new bill, the “Cloud Computing Act of 2012” (S.3569), that purports to “improve the enforcement of criminal and civil law with respect to cloud computing.” Given its introduction so close to the election, it’s doubtful this bill will go anywhere. Still, it provides an excellent case study of how even well-meaning legislators can botch Internet regulation.

What the Bill Does

From its 1980s origins as a law restricting hacking into government computers, the Computer Fraud and Abuse Act (CFAA) has morphed into a general-purpose federal law against trespassing on anyone else’s computers. With that breadth, the CFAA extends to a wide variety of activities, ranging from data scraping (see, e.g., EF Cultural Travel v. Explorica) to fake profiles (see, e.g., the Lori Drew prosecution related to Megan Meier’s death) to ex-employees walking out the door with competitively sensitive information (see, e.g., US v. Nosal and WEC v. Miller).

The proposed bill’s main substantive provisions attempt to give “cloud computing services” extra protections under the CFAA. First, the bill says that each unauthorized access of a cloud computing account counts as a separate CFAA offense. Second, the bill specifies a formula for computing losses in CFAA violations involving cloud computing services, setting a minimum floor of $500 loss per affected cloud computing account.

Problems with the Bill 

The CFAA is Already a Mess.  Good luck trying to read the CFAA’s text. Constant amendments over the years have created spaghetti code. This bill adds only slightly to the CFAA’s overall lack-of-tidiness, but every incremental amendment makes the CFAA more unwieldy.

The Definition of “Cloud Computing Service” is Incoherent. The bill seeks to protect cloud computing services, but what are those? Check out the bill’s definition:

the term “cloud computing service” means a service that enables convenient, on-demand network access to a shared pool of configurable computing resources (including networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or interaction by the provider of the service.

What??? This sounds more like a vendor’s sales pitch than a basis for criminal prosecution. We can reinforce the definition’s weakness by trying to determine what isn’t a cloud computing service. Every user-generated content website seems to qualify; but so should every online bank. In fact, this definition of cloud computing service probably becomes co-extensive with the Internet generally.

To be fair, the failed definition isn’t totally the drafter’s fault. I don’t think it’s possible to define “cloud computing service” precisely. Tip to legislators: if you can’t clearly define your subject matter of your legislation, you’re probably doing something wrong.

What’s the Problem That Needs to Be Solved? I can’t figure out how the proposed amendments address any problem we’re seeing in the field. It’s possible I’ve missed some relevant case, but I can’t think of a single case I’ve seen where the CFAA underprotected a cloud computing service or this legislation would have changed the outcome. Seeking some clarity, I submitted a press inquiry to Sen. Klobuchar’s office last week and got no response. So I have no idea what problem this bill purports to solve.


This bill exemplifies several ongoing problems with efforts to legislate the Internet:

1) Legislative grandstanding. It’s flashy for legislators to tell their constituents that they are fighting hard to protect emerging technologies like “cloud computing.” But legislators rarely understand cutting-edge technologies, and usually rapidly evolving technologies are poor candidates for legislative intervention. So legislators’ efforts to push buzzword-laden legislation are often more for show than substance.

2) Regulatory exceptionalism. As I explain here, legislators keep creating new “exceptionalist” rules for subsets of the Internet ecosystem–online dating sites, social networks, cloud computing services, etc. We saw how well that worked in California’s effort to ban employers from asking employees for social media login credentials. California so utterly failed at defining “social media” that it simply covered the entire Internet…and all non-networked electronic data too! Yet, legislators seemingly haven’t learned from their colleagues’ repeated failed efforts to precisely define the contours of some Internet subcommunity. The proposed CFAA amendment, and its gibberish definition of “cloud computing service,” exemplifies this.

3) Code proliferation. For every problem, real or perceived, legislators think they can fix the problem with more regulatory code. But the manufacturing of new legal code exacts a toll of its own. This bill increases the CFAA’s complexity with minimal or zero commensurate benefit. If Sen. Klobuchar or anyone else really wants to “fix” the CFAA, a good start would be to reduce the law’s length, organize it better, and reduce its implications for users’ ordinary Internet activity.

Filed Under: , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “The 'Cloud Computing Act Of 2012'… Or How Internet Regulation Can Go Awry”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Re:

Or bribery. Is somebody bribing Klobuchar to do this? If we could figure out who is bribing her and why, then her actions might at least appear slightly more sane. They might be a lot less moral, too, but at least things could be more understandable.

Maybe some member of the cloud computing industry is trying to get themselves some sort of government-protected status?

Eric says:

I have the solution

As part of the difficulty with this law is identifying what cloud computing services actually are, the govt should set up an agency that all service providers will be required to register with. At this time they will clearly identify what services they offer (Social Networking, Cloud Computing, evil file sharing, etc…).

The service providers will then be granted a license to participate in this industry. If during their license period they choose to get involved in an additional service type, they will need to apply for these additional licenses.

These groups will have to re-register each year and of course pay a fee to help fund this new agency. If they cover multiple service areas a fee will be paid to each. Each service area will consist of government appointed experts to assist in any confusion a service provider has when trying to categorize itself.

If a fee is not paid in a timely manner the RIAA has the right to shut down your service. End of story.

I can’t see anything wrong with my idea 🙂

jupiterkansas (profile) says:

So basically these laws are like the constant patches that Microsoft applies to Windows, causing the program to become less and less reliable over time so that the only real fix is to wipe it all away and start fresh; with new code based on the same old code.

And republicans want the states to have more say, which is essentially creating multiple operating systems that all must somehow be compatible with each other.

Good thing you can’t patent laws.

weneedhelp (profile) says:


“And republicans want the states to have more say, which is essentially creating multiple operating systems that all must somehow be compatible with each other.”

Not to seem like I am endorsing a party, but the other end is to have a country wide or world wide governance and if you think its tough to protest/change laws now, imagine when we are under a world government. The little guy then will really be a spec of sand in the desert.

I can learn multiple OS’s and choose which is best for me.

gorehound (profile) says:

I am staying away from any Clouds.I do not need a Storm in my life and that is what Cloud Computing is to me.
Like I really need to store my Data and Apps on some Server only to see it all taken down like what happened to all the legal users of MegaUpload.
I like my Desktop and my new VPN ! And I also like those various Forefox Plugins I use like better privacy,adblock,do not track,ghostery………….ETC.

Daniel Lucraft (profile) says:

Cloud computing definition

It actually seems quite reasonable to me. Whenever I get annoyed at the wide misuse of the term cloud computing, what I am thinking it should be restricted to is pretty much the definition given there. There is a difference between AWS and Gmail, and that definition pretty much captures that difference.

Why do you think that a UGC website qualifies under that, or a bank? I can’t provision computing resources from YouTube, or my banks websites. (WordPress qualities, because I can rapidly roll out new copies of the “application” which is a type listed.)

If I try really hard, I can sort of imagine that as a user, a bank has to “provision” access to a computer (which is by definition configurable…) in order to service my request. But that’s a long way from the plain reading which says I can provision configurable computing resources for myself to use.

Maybe it could be tightened up, to avoid maliciously wide interpretations, but for someone who isn’t a lawyer (and is a developer), that definition is absolutely fine, and quite narrow compared to most uses of the term, which nowadays people seem to use for any website at all…

Ninja (profile) says:

Narrow laws

I think that most of the problems with new legislation could be solved by narrowing down what is supposed to be regulated in any form and establishing review deadlines. By the time we have a set of laws that address a similar action (ie: murder) we can gather them together to reduce the number of scattered laws while maintaining the review deadlines.

It’s like major international treaties. Why can’t we have smaller, narrow and focused provisions to be signed and then gather then in a major treaty once it gets well tested and verified?

Surely my method have flaws but wouldn’t it be better to narrow down the targets?

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...