Appeals Court Says That Sharing Passwords Can Violate Criminal Anti-Hacking Laws

from the wait-just-a-second... dept

Remember David Nosal? He was the former Korn/Ferry executive looking to set up his own competing firm, but one that mainly relied on Korn/Ferry’s big database of people. As part of that process, after he left the company to head out on his own, he had some former colleagues who were planning to join him log into their Korn/Ferry accounts to access information. Then after those employees left, they got another former colleague to share her password so they could continue to log in. He was charged with violating the criminal portion of the CFAA, under the theory that convincing his former colleagues to gather info for him was a terms of service violation — and that meant he had “exceeded authorized access” under the statute. This became a key case in determining whether merely violating a terms of service could be considered criminal hacking under the CFAA. Thankfully, back in 2012, the 9th Circuit rejected such a broad ruling of the CFAA, pointing out that such an interpretation would “unintentionally turn ordinary citizens into criminals” and that couldn’t be the intent from Congress. This was a huge win that helped limit some of the worst abuses of the CFAA.

However, the US government was not yet done with Nosal. It then filed new CFAA charges against him, not over the original information sharing, but rather for getting that last colleague to share her password with Nosal. The feds argued that this fell under the other prong of the CFAA, that it was a version of accessing a computer system “without authorization” (as opposed to exceeding authorization). Unfortunately, the 9th circuit appeals court has ruled that merely sharing a password can be a CFAA violation.

The underlying question was how can this be unauthorized access since an employee of Korn/Ferry chose to hand over her login info, and thus a fairly strong argument can be made that the access was now authorized — i.e., it was authorized by an employee of Korn/Ferry. You could argue that that employee (who is referred to in the ruling as “FH”) violated the terms of her work agreement, for which perhaps she should have been fired. But it’s ridiculous to argue that merely receiving someone’s password is a criminal act. And yet, that’s what the court decided.

It tries to wave away the concerns about the everyday occurrence of password sharing by basically saying “but that’s different.” It also argues that if an employee handing over a password removes the CFAA, then the CFAA is never applicable to any situations where there’s “an insider” helping to get scammers into a computer system:

FH had no authority from Korn/Ferry to provide her password to former employees whose computer access had been revoked. Also, in collapsing the distinction between FH?s authorization and that of Christian and Jacobson, the dissent would render meaningless the concept of authorization. And, pertinent here, it would remove from the scope of the CFAA any hacking conspiracy with an inside person. That surely was not Congress?s intent.

The court’s majority ruling insists that this won’t harm everyday password sharing… mainly because Nosal and his other colleagues had lost access to the database directly. The reasoning seems to be “well, they once had access, and now they don’t, so now they know what they did was wrong.”

Implicit in the definition of authorization is the notion that someone, including an entity, can grant or revoke that permission. Here, that entity was Korn/Ferry and FH had no mantle or authority to give permission to former employees whose access had been categorically revoked by the company. There is no question that Korn/Ferry owned and controlled access to its computers, including the Searcher database, and that it retained exclusive discretion to issue or revoke access to the database. After Nosal?s login credentials were revoked on December 8, 2004, he became an ?outsider? and was no longer authorized to access Korn/Ferry computers, including Searcher. Christian and Jacobson?s credentials were also revoked after they left, at which point none of the three former employees were ?insiders? accessing company information. Rather, they were ?outsiders? with no authorization to access Korn/Ferry?s computer system.

The court later repeats that it’s the combination of this password sharing with the fact that Nosal’s own, earlier access, had been revoked that makes this a clear “without authorization” situation:

the circumstance here?former employees whose computer access was categorically revoked and who surreptitiously accessed data owned by their former employer?bears little resemblance to asking a spouse to log in to an email account to print a boarding pass. The charges at issue in this appeal do not stem from the ambiguous language of Nosal I ??exceeds authorized access??but instead relate to a common, unambiguous term. The reality is that facts and context matter in applying the term ?without authorization.?

That feels a bit like handwaving. It’s the court basically saying, “Well, we’d never go after just everyday password sharing, but this is serious!”

There’s a separate issue of why Nosal is the one facing criminal charges. After all, he’s not the one who shared the password! He was just the recipient. The government argues that Nosal “knowingly and intentionally aided” this “crime” of sharing the password. But the court is not too concerned about that, saying that he was in charge and demanded that his other employees “get what I need” in the form of access to Korn/Ferry’s database.

To me, the dissent argument makes much more sense. This is expanding areas for which law enforcement can throw the CFAA book at people for doing fairly common things such as password sharing:

This case is about password sharing. People frequently share their passwords, notwithstanding the fact that websites and employers have policies prohibiting it. In my view, the Computer Fraud and Abuse Act (?CFAA?) does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals. Whatever other liability, criminal or civil, Nosal may have incurred in his improper attempt to compete with his former employer, he has not violated the CFAA.

The dissent similarly argues that once an employee handed over the username and password, access was “authorized.” It also makes a key point I’ve tried to raise in the past: if the CFAA is supposed to be about stopping “hacking,” why is it always used for situations like this where there was no real “hacking”?

This narrower reading is more consistent with the purpose of the CFAA. The CFAA is essentially an anti-hacking statute, and Congress intended it as such. Nosal I, 676 F.3d at 858. Under the preferable construction, the statute would cover only those whom we would colloquially think of as hackers: individuals who steal or guess passwords or otherwise force their way into computers without the consent of an authorized user, not persons who are given the right of access by those who themselves possess that right. There is no doubt that a typical hacker accesses an account ?without authorization?: the hacker gains access without permission ? either from the system owner or a legitimate account holder. As the 1984 House Report on the CFAA explained, ?it is noteworthy that Section 1030 deals with an unauthorized access concept of computer fraud rather than the mere use of a computer. Thus, the conduct prohibited is analogous to that of ?breaking and entering.?? …We would not convict a man for breaking and entering if he had been invited in by a houseguest, even if the homeowner objected. Neither should we convict a man under the CFAA for accessing a computer account with a shared password with the consent of the password holder.

The dissent further notes that this ruling appears to conflict with the ruling in the first Nosal case:

Worse, however, the majority?s construction would base criminal liability on system owners? access policies. That is exactly what we rejected in Nosal I…. Precisely because it is unacceptable in our legal system to impose criminal liability on actions that are not proscribed ?plainly and unmistakably,? … it is also unacceptable to base ?criminal liability on violations of private computer use policies.?

It also calls out the hand waving by the majority:

It is impossible to discern from the majority opinion what principle distinguishes authorization in Nosal?s case from one in which a bank has clearly told customers that no one but the customer may access the customer?s account, but a husband nevertheless shares his password with his wife to allow her to pay a bill. So long as the wife knows that the bank does not give her permission to access its servers in any manner, she is in the same position as Nosal and his associates.12 It is not ?advisory? to ask why the majority?s opinion does not criminalize this under § 1030(a)(2)(C); yet, the majority suggests no answer to why it does not.

The dissent is littered with examples of perfectly reasonable password sharing that may now be criminal acts. Orin Kerr, who has been involved in a number of high profile CFAA cases and has been quite vocal on the law, doesn’t like the majority’s reasoning, though he agrees with the result. I’m not convinced. It still seems to me the issue should be between the company and the employee who handed over the access, not Nosal for receiving such info, from an employee, and then using it.

That said, Kerr notes that much more attention should be focused on another case on a related topic — Facebook’s crazy lawsuit against Power.com, an online social network aggregator that used people’s logins to collect and aggregate social media posts from a variety of platforms (including, obviously, Facebook). Kerr notes that the court can use this ruling to justify ruling either way in the Power case.

First, imagine the panel is inclined to rule for Facebook. It could incorporate Nosal II by saying that Facebook is like Korn/Ferry, Power is like Christian and Jacobson, and Facebook?s users are like FH. By that reasoning, Facebook revoked access rights by telling them to go away and by imposing an IP address block on Power. Power could not ?sidestep the statute? by relying on permission of Facebook?s users who wanted them to access Facebook on their behalf.

On the other hand, if the panel is inclined to rule for Power, it could easily distinguish Nosal II. It could first say that telling Power to go away and blocking IP addresses is insufficient to revoke access rights because it does not actually cancel any authenticated accounts. If Facebook wants to revoke access, it has to revoke the accounts that have authenticated access ? which it hasn?t done ? just like Korn/Ferry revoked the accounts of its employees when they left. At that point, Nosal II then offers no guidance because it is expressly limited to revocation. Accessing an account as the legitimate user?s agent is then authorized, just as it would be in a physical trespass case.

Either way, after this ruling, there’s at least a lot more legal uncertainty and liability in sharing passwords. And that’s unfortunate.

Filed Under: authorized access, cfaa, cfaa reform, david nosal, password sharing, passwords
Companies: korn/ferry

Matthew Keys Gets 2 Years In Jail For 40 Minute Web Defacement He Didn't Even Commit

from the punishment-fitting-the-crime? dept

The latest in the Matthe Keys case is that Keys has been sentenced to two years in federal prison for his involvement in a minor incomprehensible web defacement of an LA Times story that lasted for all of about 40 minutes. The prosecution was asking for 5 years, while Keys’ lawyers asked for nothing more than probation. As we noted, the whole thing seems fairly crazy. It is entirely possible that Keys acted like an immature jackass regarding his former employer, but the actual case revolved around a single action: the claimed sharing of login credentials for the content management system of the Tribune Company, which another person (who is apparently known to law enforcement, but has never been charged with anything) used to do a minor defacement of a single story to have the headline read: Pressure builds in House to elect CHIPPY 1337.

This minor defacement was up for about 40 minutes before being taken down. When the government tried to add up the damages, the Tribune Company at first admitted that there were basically none.

After being pushed, they “found” more damages and somehow it turned into nearly a million dollars, by making emails that “cost” $225 and talking about something totally unrelated to this hack — some alleged harassment Key did by emailing people in a database from his former employer. If he actually did this (he denies it), it was a really shitty thing to do, but it also was not what he was on trial for.

Either way, the government needed the number to be at least $5000 so it could use the CFAA (Computer Fraud and Abuse Act) against Keys. From the sound of things at the sentencing hearing (mainly via reporter Sarah Jeong’s excellent tweets), the judge initially did sound fairly skeptical about the government’s arguments, but eventually went with 24 months in prison. Somewhat incredibly, someone from the LA Times even presented that this minor bit of digital vandalism was “an attack” on the entire journalism field, and since there’s already difficulty in figuring out what news is real, this was a true threat to credibility for journalism as a whole. Really, now?

The prosecution also apparently whined to the judge that Keys has been talking publicly about his case, which, last I checked, is protected free speech:

Prosecutor does not like that Keys has been tweeting and giving interviews as follows pic.twitter.com/jdG5eUHkC2

— sarah jeong (@sarahjeong) April 13, 2016

While the judge at least indicated she didn’t care about all that — she still sentenced him to two years in prison.

And, really, that’s the crux of the issue here. For everything that Matthew Keys was accused of doing — and some of it was undoubtedly obnoxious — the single thing he was charged with was violating the CFAA by distributing a username and password. And he’s now been sentenced to two whole years in jail for that. How in the world does the punishment here fit the crime? As David Graham noted, this is basically the same sentence (actually slightly longer) that the “affluenza teen” received on the same day for killing four people while driving drunk. Or, as Adam Steinbaugh notes, Keys will end up spending about 18 days in prison for every minute that the LA Times defacement (which, again, he didn’t actually do) remained online.

Matthew Keys will spend ~18 days in prison for every sixty seconds that the LA Times said Chippy 1337 might pass in the House.

— Adam Steinbaugh (@adamsteinbaugh) April 13, 2016

And while Keys still maintains his overall innocence, even if he did exactly what he’s accused of doing this sentence is absolutely insane and highlights just how ridiculous the CFAA is as a law — and why it’s so beloved by prosecutors who can use it to go after lots of people for doing really small things.

Filed Under: cfaa, cfaa reform, defacement, doj, jail, matthew keys, vandalism
Companies: tribune company

Feds Ask For 5 Years In Jail For Matthew Keys Giving Up Tribune Account Password; Still Don't Care About Actual Hacker

from the something-seems-off-here dept

We’ve written a few times now about the somewhat bizarre Matthew Keys case. While he still denies having done anything, he has been found guilty under the CFAA for sharing the login information to the Tribune Company’s computer systems, which apparently resulted in someone hacking a story on the LA Times website. The hack was nonsensical and lasted for all of about 40 minutes. There’s no indication that this bit of vandalism did any actual harm — or even that very many people saw it. And yet… the Feds had to work overtime to figure out how to turn this minor bit of vandalism (which everyone agrees Keys did not actually do directly) into nearly $1 million in damages (thanks to emails that the Tribune Company says were worth $200+ each, and random claims about “ratings declines” due to a separate incident involving Keys and the Tribune-owned TV station Keys used to work for).

When he was found guilty, the prosecutors told the press that they would likely ask for “less than five years” at sentencing, but apparently that’s been turned into asking for exactly five years. You can read the full filing here:

The United States recommends that the Court impose a sentence of sixty months imprisonment. The Probation Department?s recommendation of eighty-seven months is reasonable and the best way to promote sentencing uniformity. But this prosecutor has been with this case since its inception in 2010 and submits that a five-year sentence as sufficient, but not greater than necessary, to comply with the purposes of sentencing. A sentence of five years imprisonment reflects Keys?s culpability and places his case appropriately among those of other white collar criminals who do not accept responsibility for their crimes.

Even assuming that the DOJ’s claims about what Keys did are entirely accurate, Keys comes off as an immature jackass, rather than some sort of criminal hacking mastermind. It’s difficult to see how that is worth five years in jail. Much of the DOJ’s reasoning is because Keys has continued to assert his innocence. And while the DOJ does seem to have a fair amount of evidence that Keys did some fairly stupid and immature stuff, insisting he is innocent shouldn’t be a reason to lock him up longer. The DOJ keeps going back to some stupid stuff Keys was accused of doing with a database of information he apparently had access to from the TV station — including emailing people in the TV station’s database with misleading messages — but even the DOJ admits that this wasn’t what the trial was about, and much of the evidence related to it was “redacted before it went to the jury” because it “created a substantial risk that the jury might read it and return a verdict based on something other than the elements of the offense.”

So the DOJ recognizes that… but still argues he should be sentenced for those very same things that are not elements of the offense he’s been charged with.

?Worried? would be an understatement for the emotions of at least one Fox 40 viewer. The Court will recall that Mercer told ?Cancer Man? that Mercer had just talked down a tearful elderly woman who had been having a ?panic attack? over the emails while her husband was in kidney failure. The Court ordered this and Keys?s reaction redacted before it went to the jury. The Rule 403 exclusion meant that the Court thought the unredacted email would have created a substantial risk that the jury might read it and return a verdict based on something other than the elements of the offense. The Government respects the Court?s ruling. The way Keys reacted shows he is a different and worse kind of person. Keys ridiculed the station for ?reporting to the old folks home? and casually passed judgment on the poor woman for having her priorities ?in the wrong place there.? … Keys?s haughty, cold reaction to that woman?s suffering was the other reason that Mercer said he came to take a personal interest in the outcome of this case…. The Court should sentence to reflect the characteristics of the Defendant…. Keys?s characteristics include narcissism and an arrogant indifference to the suffering of innocent and vulnerable people.

Again, from all of this, Keys clearly comes off as an immature jackass — but that’s not necessarily a reason to lock someone up.

Meanwhile, Keys’ lawyer has filed a much longer sentencing memorandum arguing for no jail time at all for Keys, still arguing that Keys’ actions were all part of an investigative reporting effort. Considering that the court has pretty much already rejected this line of thinking, I’m not sure it’s going to be very effective here either. There’s a huge section in the memorandum about Keys’ history working in journalism (going back to school), most of which I’m guessing the court will ignore as well — though the detailed explanations of his more recent investigative reporting does act as something of a counterbalance to the DOJ presenting him as nothing more than a petty internet vandal, annoyed at his former employer.

Despite his indictment, Matthew continued to report on matters of crucial public interest, bringing to light important facts on critical matters that, without his reporting, may never have seen the light of day. Taken as a whole, his commitment to journalism also demonstrates a commitment to public service. At a time when other journalists concern themselves with which burrito restaurant a presidential candidate patrons or the numerous antics of a real estate mogul-turned-politician, it someone who has dedicated serious personal and professional effort, sometimes at his own considerable expense, to research and publish impactful stories on topics that matter to the public, should not be incarcerated. If he were to be sentenced to any prison term, people in positions of authority who will go unchecked and stories of public importance that will go untold.

Frankly, I find this stuff to be about as relevant as the stuff about Keys being kind of a jerk to his former employer. Neither thing is at issue in this case. So it shouldn’t be reflected in the sentencing either.

What seems much more relevant is discussions about people who actually were breaking into computers and doing forms of computer vandalism… and who weren’t penalized nearly as much as the DOJ is seeking for Keys, who is charged with just handing over a login and encouraging people to hack stuff (which only resulted in very minor vandalism).

But the biggest issue of all is the fact that, despite all of this, no one has ever gone after the actual hacker who did the vandalism, who goes by the name “sharpie.” UK officials apparently know who sharpie is and told the FBI (it’s someone in Scotland), and yet, still, no one has done anything about it If what Keys did is deserving of five years in jail, why does no one even think about going after the person who actually made the edits to the Tribune website?

George David ?Sharpie?. Sharpie was the individual who actually accessed the Tribune Companies CMS and caused the damage Matthew was convicted for. Sharpe was never charged on either side of the Atlantic. He was visited once at his home in Scotland by the FBI and Scotland Yard. He spoke to them and that was the last of his contact with this case.

Either way, this case, yet again, demonstrates the ridiculousness of the Computer Fraud and Abuse Act (CFAA). Even if we accept that Keys did some immature things, this case is about a minor vandalism of a website. Hell, many years back, someone hacked into Techdirt and did much more serious vandalism (deleting the most recent 10 stories and all the comments), and if whoever did that was ever found, I wouldn’t even want them sent to jail at all. That seems like a pretty extreme punishment for what honestly amounts to little more than internet graffiti.

If I had to guess, I’d predict that the judge will side with the DOJ, because that’s what judges quite frequently do. The DOJ has done a good job distracting from the actual issues involved in this case and focusing it on other, unrelated issues, while painting Keys as something of a jerk. But on the actual issue of the CFAA, the whole thing seems like a massive stretch. Unfortunately, I think Keys’ lawyers own filing is somewhat weak. It should have focused much more clearly on a few issues, rather than overloading it with what feels like a rambling attempt to throw every possible idea at the wall to reduce the jail term. His lawyer correctly notes that if the DOJ’s focus is on “deterrence” that has already happened. Keys was fired from his job at Reuters, and no major news organization will hire him these days. That seems like plenty of deterrence for his activities. What, exactly, is five years in jail going to do at this point?

Filed Under: cfaa, cfaa reform, doj, hacking, matthew keys
Companies: tribune company

Did Marco Rubio's Campaign Violate The CFAA? Will He Commit To Reforming It?

from the broken-law dept

We’ve talked a lot in the past few years about the desperate need to reform the CFAA — an absolutely horrible “anti-hacking” law that has been stretched and broadened and twisted by people over the years, such that it’s frequently used to “pile on” charges when nothing else will stick. If you want to go into a lot more detail, you can listen to the podcast we recently did about the CFAA, or listen to this wonderful podcast that Reply All did about the CFAA (where I also make a brief appearance). But one of the biggest problems with it is that it considers you to be a dangerous hacker if you access a computer/network “without authorization” or if you merely have “exceeded authorized access.” It’s that latter phrase that often causes trouble. What does it even mean? Historically, cases have been brought against employees who use their employer’s computers for non-work related things, against someone for supposedly failing to abide by MySpace’s terms of service and for downloading too many academic journals that were freely available for downloading on MIT’s campus network.

Keep that in mind as you read this Associated Press story about how Presidential candidate and current Florida Senator Marco Rubio’s “low-budget” Presidential campaign office got free internet access for a bit:

At one of the campaign’s Nevada offices, staffers tried to do their part to live up to the less is more mantra. After noticing a pizza place next to a campaign office had free wireless internet that required a password, a staffer walked over and bought two pieces of pizza and asked for the internet access code.

But the cost-cutting measure was short-lived. After about three weeks, the pizza place caught on and asked the Rubio team to stop.

It’s not at all difficult to see how that could be “exceeding authorized access” under the statute. After all, it’s pretty clear that the intent of the access is for customers while they’re in the restaurant. That seems to be confirmed by the fact that the pizza place asked the Rubio campaign to knock it off once it discovered what was going on. Now, for it to be a felony, there needs to be $5,000 worth of damage — but considering that in another recent case, the DOJ turned a single news article defacement (that lasted just 40 minutes) into a supposed $929,977 in damages, I’m sure some creative math can make the use of the WiFi into something greater than $5,000. You just need to argue that the congestion on the WiFi likely turned off customers who may not ever come back, and the value of those losses exceeds $5,000.

Now, Rubio hasn’t really been involved at all in the debate over the CFAA and reforming it. The only official “policy” line he has even closely related to it on his campaign issues page suggests he’d favor making the CFAA punishments even worse: “Use American power to respond harshly to international cyber attacks on American citizens, businesses, and governments.” Of course, that’s focused on foreign attacks, so may not apply directly.

Either way, this seems like something an enterprising political reporter might want to ask the Rubio campaign, seeing as they themselves may have potentially committed a felony under the current CFAA.

Filed Under: access, cfaa, cfaa reform, internet access, marco rubio

How The Tribune Company And The DOJ Turned A 40 Minute Web Defacement Into $1 Million In 'Damages'

from the fudging-the-numbers dept

Last week we wrote about Matthew Keys being found guilty of three CFAA charges which will likely lead to some amount of jailtime for him (the prosecution has suggested it will ask for less than 5 years). While Keys still denies he did anything he’s accused of, the prosecution argues that he took a login to the Tribune Company’s content management system, handed it off to some hackers in an internet forum and told them to mess stuff up. And… so they made some minor vandalism changes to an LA Times article. It took the LA Times all of 40 minutes to fix it. Even if we assume that Keys did do this, we still have trouble seeing how it was any more than a bit of vandalism that deserves, at best, a slap on the wrist. Its ridiculous to say that it’s a form of felony hacking that requires a prison sentence. As we noted in our original article, the Tribune Company and the feds argued that the damage cost the company $929,977 in damage, well above the $5,000 threshold for the CFAA to apply. We still have trouble seeing how the $5,000 could make sense, let alone nearly a million dollars. And it’s important to note that the sentencing guidelines match up with the dollar amount of the “damages” so this actually matters quite a bit for Keys.

Sarah Jeong, who’s been doing an awesome job covering this for Motherboard, has a deep dive article looking at the case, which is totally worth reading. I wanted to dig in, though, just on the craziness of the $929,977 number and how that came about. First off, it appears that the feds pushed the Tribune Company to inflate the numbers. The original estimate from the Tribune Company turned out to be well below the $5,000 threshold, let alone the $900k+ number:

That’s obviously not going to cut it, so they had to ratchet things up a bit. For what it’s worth, Brandon apparently said on the stand that he was just joking, and he realizes that’s not the best thing to joke about, but who are we to say anything about jokes who miss their mark? What we can say, however, is that the final numbers look absolutely ludicrous:

Let’s dig in a bit here, because suddenly I feel underpaid. Those emails are pricey! In case you’re wondering the X Files references have to do with another thing that Keys apparently did: sending some nasty emails to people at the TV station after he left that job. From the look of it they were pretty obnoxious/childish behavior on the part of Keys (who eventually admitted to sending them), but they had absolutely nothing to do with the supposed CFAA violation. They were just nuisance emails, not any kind of hacking. However, to make the dollar value go up, the DOJ decided to lump this and some other incidents all together and asked the Tribune Company to add up all the time it was dealing with that issue, and so they did. Even to the point that they blamed ratings drops at the Fox channel that Keys used to work for on him as well, and put a dollar value on that.

Again, assuming Keys actually did all these things, it would make him something of an immature jerk. But it still seems like a huge stretch to turn that into nearly a million dollars in damages, directly due to a CFAA violation. Either way, it’s yet another reminder that when the DOJ decides it wants to take you down, it can find almost anything to use against you.

Filed Under: cfaa, cfaa reform, damages, doj, matthew keys
Companies: tribune company

Senators Introduce Anti-Aaron's Law To Increase Jail Terms For 'Unauthorized Access' To Computers

from the someone-buy-these-senators-a-clue dept

Yesterday, we wrote about an important new bill, Aaron’s Law, from Senators Ron Wyden and Rand Paul and Rep. Zoe Lofgren. It’s a fix to many of the problematic aspects of the Computer Fraud and Abuse Act (CFAA). If you’re unaware, the CFAA is supposed to be a law to be used against people doing malicious hacking, but the wording is so broad and problematic, it has been used against people for merely violating the terms of service on a website, or someone using a work computer for non-work-related items — which could lead to excessively long jail terms. The reason Aaron’s Law is named that is because of Aaron Swartz, the guy that Federal Prosecutors publicly announced was facing 30 years in jail under the CFAA because he downloaded too many academic journal articles from JSTOR — despite the fact that he did so on the MIT campus where the campus had a site license that allowed anyone on their network to download all the JSTOR papers.

As we noted in our post, there are still some who are pushing in the other direction — and they didn’t waste much time. The very same day that Aaron’s Law was introduced, Senators Mark Kirk and Kirsten Gillibrand introduced a competing law that appears to be a “We Should Have Threatened Aaron With More Years In Jail” Act. Okay, technically it’s called the Data Breach Notification and Punishing Cyber Criminals Act — and as I type this, no one seems willing to release the text. Both Senators have press releases out about the bill, but neither link to it, and Congress’s website has a placeholder saying that it hasn’t received the actual text yet either. Hopefully that will change soon.*

It’s bizarre that they’re lumping together data breach notifications and CFAA expansion in a single bill. These are two separate issues. And yet, from the press release quotes and the few small articles about these bills, it appears that everyone’s focusing on the data breach notification stuff (which has its own problems) and thus we should be worried that the CFAA expansion could get included as something of a “throw in.” The quotes, however, on this part of the bill are ridiculous. Here’s Senator Kirk‘s press release:

This bipartisan legislation increases the maximum allowable fines and imprisonment for many of the most common cyber-crimes, including identity theft and theft of personal information. Current law does not sufficiently punish cyber criminals, and incidences like these recent devastating breaches of confidential information must be punished more aggressively. By modernizing these punishments, as many prosecutors have requested, we will better align punishments to the degree of harm that these crimes may inflict on victims.

And Senator Gillibrand’s:

The bill raises the maximum allowable fines and imprisonment for many of the statutes which cyber criminals are charged: identity theft, conspiracy to commit access device fraud, obtaining information from a protected computer without authorization and computer hacking with intent to defraud.

It’s the whole “obtaining information from a protected computer without authorization” that is a serious concern here, as that’s part of what’s been widely abused. Both Kirk and Gillibrand use a lot of populist rhetoric about protecting people from all these scary data breaches out there, but it demonstrates a serious ignorance of how widely the CFAA (with insanely large existing punishments) has been used repeatedly for activities no one legitimately thinks of as malicious hacking. Furthermore, it suggests a pretty serious cluelessness about the incentives and motivations of those who commit many of those breaches. Increasing the number of years they could spend in time from crazily high to insanely high isn’t going to change a damn thing. And if these two Senators can’t understand that, they shouldn’t be touching the CFAA at all.

* As an aside, it’s plainly ridiculous for anyone to announce a new bill without releasing the actual text. Even more ridiculous: in searching for the text of the actual bill on both Senators websites, I note that the very first item highlighted on Senator Gillibrand’s website is “Transparency” where it says “Senator Gillibrand believes that more openness and transparency in government leads to more accountability and better results.” Well, you know what might helps with that transparency? If you actually release the text of the bills you’re introducing when you introduce them so that people can take a look at them.

Filed Under: aaron swartz, cfaa, cfaa reform, hacking, kirsten gillibrand, mark kirk

Aaron's Law Reintroduced To Try To Reform Dangerous, Broken Anti-Hacking Law

from the can-we-get-this-one-done-already? dept

We’ve written in the past how Rep. Zoe Lofgren and Senator Ron Wyden had introduced “Aaron’s Law” (named after Aaron Swartz) as a way to fix the very broken CFAA law, which was used to throw the book at Swartz for downloading too many JSTOR journal articles on MIT’s campus (where anyone on the network is allowed to download whatever they want from JSTOR). Swartz later committed suicide, which many blame on the aggressive prosecution against him (I hesitate to join those who do so, as you never know all the factors that went into the decision). Still, the CFAA has long needed a massive overhaul, as the law is frequently abused by law enforcement to threaten massive penalties for rather routine activities on a computer network.

Lofgren and Wyden have now reintroduced Aaron’s Law, and this time they’ve added Senator Rand Paul as a sponsor, which is interesting to see (especially as he courts the tech industry). They also have a nice group of co-sponsors, including Reps. Jim Sensenbrenner, Mike Doyle, Dan Lipinski, Jared Polis and Beto O’Rourke. Here are the three key things the new bill does, according to Lofgren:

• Establishing that breaches of terms of service, employment agreements, or contracts are not automatic violations of the CFAA. By using legislative language based closely on 9th and 4th Circuit Court opinions, the bill would instead define ‘access without authorization’ under the CFAA as gaining unauthorized access to information by circumventing technological or physical controls ? such as password requirements, encryption or locked office doors. Hack attacks such as phishing, injection of malware or keystroke loggers, denial-of-service attacks, and viruses would continue to be fully prosecutable under the strong CFAA provisions this bill does not modify.
• Bringing balance back to the CFAA by eliminating a redundant provision that enables an individual to be punished multiple times through duplicate charges for the same violation. Eliminating the redundant provision streamlines the law, but would not create a gap in protection against hackers.
• Bringing greater proportionality to CFAA penalties. Currently, the CFAA’s penalties are tiered, and prosecutors have wide discretion to ratchet up the severity of the penalties in several circumstances, leaving little room for non-felony charges under CFAA (i.e., charges with penalties carrying less than a year in prison). The bill ensures prosecutors cannot seek to inflate sentences by stacking multiple charges under the CFAA, including state law equivalents or non-criminal violations of the law.

Frankly, I’d like to see CFAA reform go even further, but this is a good (and necessary) start. If you agree, you should let your own elected officials know that this is a bill worth supporting. Unfortunately, the White House is pushing a terribly bad update to the CFAA that won’t actually fix the problems with it and could make the bill even worse. The DOJ, for example, remains a big fan of the CFAA and would like to see it expanded so it can be used more widely. At the same time, some large tech companies, like Oracle, have worked hard to prevent any significant CFAA reform, because they want to be able to use the law themselves. In other words, meaningful CFAA reform, no matter how strongly needed, is nowhere near a sure thing.

Filed Under: aaron swartz, aaron's law, cfaa, cfaa reform, rand paul, ron wyden, zoe lofgren

Aaron's Law Finally Introduced: Reform The CFAA

from the it's-about-time dept

Today, Zoe Lofgren and Jim Sensenbrenner in the House and Ron Wyden in the Senate introduced “Aaron’s Law,” an attempt to reform the widely abused CFAA, so that it no longer sweeps up innocent activity.

Vagueness is the core flaw of the CFAA. As written, the CFAA makes it a federal crime to access a computer without authorization or in a way that exceeds authorization. Confused by that? You’re not alone. Congress never clearly described what this really means. As a result, prosecutors can take the view that a person who violates a website’s terms of service or employer agreement should face jail time.

So lying about one’s age on Facebook, or checking personal email on a work computer, could violate this felony statute. This flaw in the CFAA allows the government to imprison Americans for a violation of a non-negotiable, private agreement that is dictated by a corporation. Millions of Americans — whether they are of a digitally native or dial-up generation — routinely submit to legal terms and agreements every day when they use the Internet. Few have the time or the ability to read and completely understand lengthy legal agreements.

The proposal tries to focus the law back to where it was intended when initially put in place:

It establishes a clear line that’s needed for the law to distinguish the difference between common online activities and harmful attacks.

Among those specific lines, it notes that a “mere breach of terms of service, employment agreements, or contracts are not automatic violations of the CFAA.” It also makes the penalties more reasonable, so people aren’t facing many years in jail for doing something minor. It’s well past due that the CFAA get fixed. Hopefully this is a start down that path.

Filed Under: aaron swartz, aaron's law, cfaa, cfaa reform, jim sensenbrenner, ron wyden, zoe lofgren

Did Stephen Colbert And President Bill Clinton Violate The CFAA?

from the another-day,-another-example dept

Last night, former President Bill Clinton joined Stephen Colbert on his TV show, The Colbert Report. As many people have noted, at the very end of the program, Colbert told Clinton that he had taken the liberty of signing him up for a Twitter account, since Clinton does not currently use Twitter (he joked that he was afraid no one would reply to his tweets). The Twitter account is @PrezBillyJeff, and Colbert sent Clinton’s first tweet live while on the air. If you’re in the US or the one or two other places that Hulu actually works, you can see the exchange below (if you’re elsewhere, blame Viacom for being stupid):

Of course, as we’ve been discussing this week, the CFAA is an awful bill concerning hacking, and needs to be reformed. A big part of the problem is that it appears to criminalize what seems like every day behavior, and the DOJ has interpreted the CFAA broadly. While not all courts agree, the DOJ has argued that merely disobeying a website’s terms of service means that you’ve violated the CFAA by accessing content either without authorization or by exceeding authorization.

Let’s jump over to Twitter’s terms of service. There, they clearly forbid impersonation:

Impersonation: You may not impersonate others through the Twitter service in a manner that does or is intended to mislead, confuse, or deceive others

Now, you could argue that Colbert registering an account for Clinton without his permission does not reach that level, but are you confident that someone else doing the same thing less publicly wouldn’t run into problems if their tweets pissed someone off? An account that many people believe actually belongs to Bill Clinton would be highly valuable. Indeed, just overnight the account has racked up tens of thousands of followers. In the meantime, it’s not even entirely clear who actually controls the account. Colbert registered it and tweeted from it. Are any future tweets coming from Colbert or Clinton or someone else? It’s not difficult to make an argument that the account is intended to confuse others. Furthermore, if Colbert is transferring the account over to Clinton, it means that Clinton never actually agreed to the terms of service in the first place. Would that mean he is then abusing the use of the service?

While they appear to now have been deleted, according to the Washington Post, after the inaugural post done live on the air, there were a series of other tweets in which it was not clear if it was Clinton or Colbert tweeting. One had “Clinton” refer to “Colbert” as his new “BFF” and the tweets used the hashtag “#notColbertpretendingtobeme.” At the very least, there is clear confusion, and a regular person might assume that this is Bill Clinton tweeting. If it’s actually Colbert, it could be seen as a CFAA violation.

Yes, this is a stretch — no doubt about it. But that’s part of the problem with the CFAA. It is so broadly worded that simple activities like these can be twisted into a violation should someone in power wish to do so.

Filed Under: bill clinton, cfaa, cfaa reform, impersonation, stephen colbert, terms of service
Companies: twitter

Law Professor Eric Goldman: The CFAA Is A Failed Experiment; It's Time To Gut It

from the take-a-stand dept

We’ve been talking a lot about CFAA reform lately, but law professor Eric Goldman is taking it a step further. He’s written a fantastic piece for Forbes that explains why the whole concept underlying the CFAA is a failure and should be almost entirely done away with. The key part is the theory underlying the CFAA is an attempt to apply the age-old concept of “trespass to chattels” online, in the theory that the online world can be considered not unlike the offline world. Except… it’s not so simple. Not at all.

Stretching the ancient doctrine of trespass to chattels to apply to Internet activities has been an experiment in law-making. Unfortunately, I think the experiment has failed completely. The CFAA and state computer crime laws initially were designed to restrict hackers from breaching computer security—a sensible objective that, as I discuss below, should be preserved. The expansion of these laws to cover all sending or receiving of data from an Internet-connected server hasn’t worked…

He goes on to point out that there have been massive unintended consequences of trying to apply an offline concept to a very different online world, and to also note that other existing laws can already handle many, if not potentially all, of the scenarios that people normally fear concerning malicious computer hacking.

Indeed, because legal doctrines already overlap so extensively, we almost never see an online trespass to chattels claim asserted on a standalone basis. Instead, an online trespass to chattels claim is usually just one of numerous legal violations asserted against the defendant. These doctrinal overlaps mean we usually don’t need online trespass to chattels either to supplement the more squarely applicable claims or to act as a “gap-filler” to plug the rare and narrow holes left by the other legal doctrines.

And thus, his recommendation is basically to gut the CFAA almost entirely:

1) Repeal most provisions of the CFAA (that don’t relate to government-run computers) and preempt all analogous state laws, including state computer crime laws and common law trespass to chattels as applied online. Note: without dealing with analogous state laws, reforming the CFAA is an incomplete solution.

2) Retain only the (A) restrictions on criminal hacking, which I would define as the defeat of electronic security measures for the goal of fraud or data destruction (and some of these efforts are already covered by other laws like the Electronic Communications Privacy Act), and (B) restrictions on denial-of-service attacks, which I would define as the sending of data or requests to a server with the intent of overloading its capacity.

3) Eliminate all civil claims for this conduct, so that only the federal government can enforce violations.

4) Specify that any textual attempts to restrict server usage fail unless the terms are presented in a properly formed contract (usually, a mandatory click-through agreement).

It’s difficult to argue with these suggestions, which is probably why most of Congress will likely instead ignore them.

Filed Under: cfaa, cfaa reform, chattles, doj, eric goldman, hacking, internet, laws, trespass, trespass on chattels