Chelsea Manning Appeals 35-Year Sentence For Leaking Files

from the seems-a-bit-extreme dept

It’s been almost three years since Chelsea Manning was sentenced to 35 years in jail for leaking a bunch of State Department cables to Wikileaks in what she claims was an act of whistleblowing (though, obviously, some disagree). As we noted in the past, even if you disagree with the whistleblowing claim, the leak did lead to some important discussions about what the US government was doing in certain areas and (contrary to some hyperbolic claims) did not lead to a single death. In addition, we’ve pointed out that people who were flat out selling secrets to the Russians, or simply full-on terrorists, have received lighter sentences. Something does not seem at all right with that.

And now, Manning has officially appealed the conviction and sentence. The full filing is a massive 209 pages and seems to challenge just about everything about the case against Manning, and makes Constitutional arguments around the First Amendment, Fifth Amendment, Sixth Amendment and Eighth Amendment. The basic argument, however, still relies on the “whisteblower, not a spy” defense:

For what PFC Manning did, the punishment is grossly unfair and unprecedented. No whistleblower in American history has been sentenced this harshly. Throughout trial the prosecution portrayed PFC Manning as a traitor and accused her of placing American lives in danger, but nothing could be further from the truth.

PFC Manning disclosed the materials because under the circumstances she thought it was the right thing to do. She believed the public had a right to know about the toll of the wars in Iraq and Afghanistan, the loss of life, and the extent to which the government sought to hide embarrassing information of its wrongdoing. At sentencing PFC Manning took responsibility for the disclosures and admitted she should have considered other lawful ways of expressing these concerns. But she was not disloyal and did not harm anyone, nor did she intend to.

There are a lot of details in the filings, obviously, but the appeal is focused on six “errors” it claims were made in the original case:

First, as set forth in Assignment of Error I, the government violated Article 13, Uniform Code of Military Justice (UCMJ), by subjecting PFC Manning to unlawful pretrial confinement for nearly a year. The military judge correctly found Article 13 error, but did not fully credit PFC Manning for the deplorable and inhumane conditions, which were tantamount to solitary confinement. For this alone the charges and specifications should be reversed or her punishment substantially reduced.

Second, as set forth in Assignments of Error II, III, and IV, the government overcharged the case to expose PFC Manning to excessive punishment. This appeal challenges the convictions related to 18 U.S.C. §§ 641, 1030(a)(1) and 793(e). Rather than charging PFC Manning for mishandling classified information, a charge she admitted to, the government charged her with stealing databases (Section 641), using unauthorized software on a classified computer system (Section 1030(a)(1)), and disclosing classified information with knowledge it might harm the national defense (Section 793(e)). As addressed below, the military judge misapprehended and misapplied the law with respect to these statutes, which unfairly inflated the penalty landscape.

Third, in Assignment of Error V, the defense challenges the military judge?s consideration of aggravation evidence that was not directly related to or resulting from the offenses. And finally, in Assignment of Error VI, the defense urges this Court to exercise its broad powers to reconsider the appropriateness of PFC Manning?s sentence to confinement. These last two Assignments of Error are at the core of PFC Manning?s appeal.

While the filing claims the last two errors are at the core, I’m probably most interested in errors II, III and IV, which are basically arguing that the government was abusing the CFAA to claim that what Manning did was much worse than what she actually did. Abusing the CFAA to lock people up for simple actions? Where have we heard that one before….

Meanwhile, the ACLU has filed an amicus brief as well, hitting hard on the ridiculousness of the Espionage Act and its use in this case:

It is a pervasive feature of our democracy that government and military officials at all levels regularly disclose what may broadly be considered ?information relating to the national defense.? They do so in pursuit of various agendas. Some disclose information to further the government?s preferred messages, some to pursue private agendas, and some to inform the public of information critical to democratic accountability. Until Private First Class (?PFC?) Manning was convicted before a general court-martial of six counts of violating the Espionage Act, 18 U.S.C. § 793(e), however, no person in the history of this nation had been sentenced to decades in prison for the crime of disclosing truthful information to the public and press.

The conviction and sentence of PFC Manning under the Espionage Act must be overturned for two reasons. First, the Espionage Act is unconstitutionally vague, because it provides the government a tool that the First Amendment forbids: a criminal statute that allows the government to subject speakers and messages it dislikes to discriminatory prosecution. Second, even if the Act were not unconstitutional in all its applications, the military judge?s application of the Act to PFC Manning violated the First Amendment because the military judge did not permit PFC Manning to assert any defense that would allow the court to evaluate the value to public discourse of any of the information she disclosed. The military judge therefore failed to weigh the public interest in the disclosures against the government interest in preventing them, as required by the First Amendment. For these reasons, PFC Manning?s conviction for violating the Espionage Act should be vacated.

I have no idea what, if any, chances there are that this appeal is successful. Without knowing that much about how military court works, I’m still guessing the chances of success are… slim.

Filed Under: appeal, cfaa, chelsea manning, espionage act

Rhode Island Attorney General Pushing For A State-Level CFAA That Will Turn Researchers, Whistleblowers Into Criminals

from the 'unauthorized-access'-isn't-always-a-bad-thing... dept

We recently wrote about the Rhode Island attorney general’s “cybercrime” bill — a legislative proposal that seeks to address cyberbullying, revenge porn, etc. with a bunch of broadly — and poorly — written clauses. Two negative comments written months apart could be viewed as “cyber-harassment” under the law, separating it from the sustained pattern of abuse that one normally considers “harassment.”

In addition, the proposed law would criminalize “non-consensual communications.” If the sender does not obtain the recipient’s permission to send a message, it’s a criminal act if the recipient finds the message to be distressing — which could mean anything from emailing explicit threats to posting a negative comment on someone’s Facebook page.

But that’s not Attorney General Peter F. Kilmartin’s only bad idea. It appears he’s behind another legislative proposal — one that would amend the state’s computer crime laws into something more closely resembling the catastrophic federal equivalent: the CFAA.

Here’s the worst part of the suggested amendments:

Whoever intentionally and without authorization or in excess of one’s authorization, directly or indirectly accesses a computer, computer program, computer system, or computer network with the intent to either view, obtain, copy, print or download any confidential information contained in or stored on such computer, computer program, computer system, or computer network, shall be guilty of a felony and shall be subject to the penalties set forth in §11-52-5.

This would make the following Google search illegal:

filetype:pdf site:*.gov “law enforcement use only”

Anything deemed “confidential information” — if accessed by people not “authorized” to do so — falls under the protection of this legislation, even if it can be accessed by any member of the public without actually “breaking into” a company/government/etc. server.

The definition of “confidential information” makes the legislation even more problematic.

“Confidential Information” means data that is protected from disclosure on a computer, computer program, computer system or computer network and that the computer, computer program, computer system or computer network does not transmit or disclose unless initiated by the owner of such computer, computer program, computer system or computer network.

Something accessible by a Google search is not “protected from disclosure” by any stretch of the imagination. But this phrase, “unless initiated by the owner of such computer…,” makes it illegal to obtain documents not otherwise protected. Uploading a sensitive document to a public-facing website crawled by Google is stupid and the person doing the uploading should take any “unauthorized access” as a learning experience. But under the law, it could successfully be argued that the uploading of a document to a publicly-accessible website is not the same thing as “initiating transmission.”

The proposal makes several exemptions for service providers, software manufacturers and (no kidding) advertisers, so that their trawling of confidential information in the course of their businesses won’t be viewed as criminal acts. But what it doesn’t do is carve out an exception for security researchers, who often access confidential information during the course of their work.

In this form, the legislation is dangerous. It will criminalize security research and punish citizens for the stupidity of others. On top of that, the law would pretty much turn every whistleblower into a criminal by treating the access of confidential information as a crime, no matter what the circumstances are. Running it through an editing process involving politicians surrounded by “cyberwar” hype is unlikely to improve it.

Filed Under: cfaa, computer crimes, peter kilmartin, research, rhode island

Matthew Keys Gets 2 Years In Jail For 40 Minute Web Defacement He Didn't Even Commit

from the punishment-fitting-the-crime? dept

The latest in the Matthe Keys case is that Keys has been sentenced to two years in federal prison for his involvement in a minor incomprehensible web defacement of an LA Times story that lasted for all of about 40 minutes. The prosecution was asking for 5 years, while Keys’ lawyers asked for nothing more than probation. As we noted, the whole thing seems fairly crazy. It is entirely possible that Keys acted like an immature jackass regarding his former employer, but the actual case revolved around a single action: the claimed sharing of login credentials for the content management system of the Tribune Company, which another person (who is apparently known to law enforcement, but has never been charged with anything) used to do a minor defacement of a single story to have the headline read: Pressure builds in House to elect CHIPPY 1337.

This minor defacement was up for about 40 minutes before being taken down. When the government tried to add up the damages, the Tribune Company at first admitted that there were basically none.

After being pushed, they “found” more damages and somehow it turned into nearly a million dollars, by making emails that “cost” $225 and talking about something totally unrelated to this hack — some alleged harassment Key did by emailing people in a database from his former employer. If he actually did this (he denies it), it was a really shitty thing to do, but it also was not what he was on trial for.

Either way, the government needed the number to be at least $5000 so it could use the CFAA (Computer Fraud and Abuse Act) against Keys. From the sound of things at the sentencing hearing (mainly via reporter Sarah Jeong’s excellent tweets), the judge initially did sound fairly skeptical about the government’s arguments, but eventually went with 24 months in prison. Somewhat incredibly, someone from the LA Times even presented that this minor bit of digital vandalism was “an attack” on the entire journalism field, and since there’s already difficulty in figuring out what news is real, this was a true threat to credibility for journalism as a whole. Really, now?

The prosecution also apparently whined to the judge that Keys has been talking publicly about his case, which, last I checked, is protected free speech:

Prosecutor does not like that Keys has been tweeting and giving interviews as follows pic.twitter.com/jdG5eUHkC2

— sarah jeong (@sarahjeong) April 13, 2016

While the judge at least indicated she didn’t care about all that — she still sentenced him to two years in prison.

And, really, that’s the crux of the issue here. For everything that Matthew Keys was accused of doing — and some of it was undoubtedly obnoxious — the single thing he was charged with was violating the CFAA by distributing a username and password. And he’s now been sentenced to two whole years in jail for that. How in the world does the punishment here fit the crime? As David Graham noted, this is basically the same sentence (actually slightly longer) that the “affluenza teen” received on the same day for killing four people while driving drunk. Or, as Adam Steinbaugh notes, Keys will end up spending about 18 days in prison for every minute that the LA Times defacement (which, again, he didn’t actually do) remained online.

Matthew Keys will spend ~18 days in prison for every sixty seconds that the LA Times said Chippy 1337 might pass in the House.

— Adam Steinbaugh (@adamsteinbaugh) April 13, 2016

And while Keys still maintains his overall innocence, even if he did exactly what he’s accused of doing this sentence is absolutely insane and highlights just how ridiculous the CFAA is as a law — and why it’s so beloved by prosecutors who can use it to go after lots of people for doing really small things.

Filed Under: cfaa, cfaa reform, defacement, doj, jail, matthew keys, vandalism
Companies: tribune company

Feds Ask For 5 Years In Jail For Matthew Keys Giving Up Tribune Account Password; Still Don't Care About Actual Hacker

from the something-seems-off-here dept

We’ve written a few times now about the somewhat bizarre Matthew Keys case. While he still denies having done anything, he has been found guilty under the CFAA for sharing the login information to the Tribune Company’s computer systems, which apparently resulted in someone hacking a story on the LA Times website. The hack was nonsensical and lasted for all of about 40 minutes. There’s no indication that this bit of vandalism did any actual harm — or even that very many people saw it. And yet… the Feds had to work overtime to figure out how to turn this minor bit of vandalism (which everyone agrees Keys did not actually do directly) into nearly $1 million in damages (thanks to emails that the Tribune Company says were worth $200+ each, and random claims about “ratings declines” due to a separate incident involving Keys and the Tribune-owned TV station Keys used to work for).

When he was found guilty, the prosecutors told the press that they would likely ask for “less than five years” at sentencing, but apparently that’s been turned into asking for exactly five years. You can read the full filing here:

The United States recommends that the Court impose a sentence of sixty months imprisonment. The Probation Department?s recommendation of eighty-seven months is reasonable and the best way to promote sentencing uniformity. But this prosecutor has been with this case since its inception in 2010 and submits that a five-year sentence as sufficient, but not greater than necessary, to comply with the purposes of sentencing. A sentence of five years imprisonment reflects Keys?s culpability and places his case appropriately among those of other white collar criminals who do not accept responsibility for their crimes.

Even assuming that the DOJ’s claims about what Keys did are entirely accurate, Keys comes off as an immature jackass, rather than some sort of criminal hacking mastermind. It’s difficult to see how that is worth five years in jail. Much of the DOJ’s reasoning is because Keys has continued to assert his innocence. And while the DOJ does seem to have a fair amount of evidence that Keys did some fairly stupid and immature stuff, insisting he is innocent shouldn’t be a reason to lock him up longer. The DOJ keeps going back to some stupid stuff Keys was accused of doing with a database of information he apparently had access to from the TV station — including emailing people in the TV station’s database with misleading messages — but even the DOJ admits that this wasn’t what the trial was about, and much of the evidence related to it was “redacted before it went to the jury” because it “created a substantial risk that the jury might read it and return a verdict based on something other than the elements of the offense.”

So the DOJ recognizes that… but still argues he should be sentenced for those very same things that are not elements of the offense he’s been charged with.

?Worried? would be an understatement for the emotions of at least one Fox 40 viewer. The Court will recall that Mercer told ?Cancer Man? that Mercer had just talked down a tearful elderly woman who had been having a ?panic attack? over the emails while her husband was in kidney failure. The Court ordered this and Keys?s reaction redacted before it went to the jury. The Rule 403 exclusion meant that the Court thought the unredacted email would have created a substantial risk that the jury might read it and return a verdict based on something other than the elements of the offense. The Government respects the Court?s ruling. The way Keys reacted shows he is a different and worse kind of person. Keys ridiculed the station for ?reporting to the old folks home? and casually passed judgment on the poor woman for having her priorities ?in the wrong place there.? … Keys?s haughty, cold reaction to that woman?s suffering was the other reason that Mercer said he came to take a personal interest in the outcome of this case…. The Court should sentence to reflect the characteristics of the Defendant…. Keys?s characteristics include narcissism and an arrogant indifference to the suffering of innocent and vulnerable people.

Again, from all of this, Keys clearly comes off as an immature jackass — but that’s not necessarily a reason to lock someone up.

Meanwhile, Keys’ lawyer has filed a much longer sentencing memorandum arguing for no jail time at all for Keys, still arguing that Keys’ actions were all part of an investigative reporting effort. Considering that the court has pretty much already rejected this line of thinking, I’m not sure it’s going to be very effective here either. There’s a huge section in the memorandum about Keys’ history working in journalism (going back to school), most of which I’m guessing the court will ignore as well — though the detailed explanations of his more recent investigative reporting does act as something of a counterbalance to the DOJ presenting him as nothing more than a petty internet vandal, annoyed at his former employer.

Despite his indictment, Matthew continued to report on matters of crucial public interest, bringing to light important facts on critical matters that, without his reporting, may never have seen the light of day. Taken as a whole, his commitment to journalism also demonstrates a commitment to public service. At a time when other journalists concern themselves with which burrito restaurant a presidential candidate patrons or the numerous antics of a real estate mogul-turned-politician, it someone who has dedicated serious personal and professional effort, sometimes at his own considerable expense, to research and publish impactful stories on topics that matter to the public, should not be incarcerated. If he were to be sentenced to any prison term, people in positions of authority who will go unchecked and stories of public importance that will go untold.

Frankly, I find this stuff to be about as relevant as the stuff about Keys being kind of a jerk to his former employer. Neither thing is at issue in this case. So it shouldn’t be reflected in the sentencing either.

What seems much more relevant is discussions about people who actually were breaking into computers and doing forms of computer vandalism… and who weren’t penalized nearly as much as the DOJ is seeking for Keys, who is charged with just handing over a login and encouraging people to hack stuff (which only resulted in very minor vandalism).

But the biggest issue of all is the fact that, despite all of this, no one has ever gone after the actual hacker who did the vandalism, who goes by the name “sharpie.” UK officials apparently know who sharpie is and told the FBI (it’s someone in Scotland), and yet, still, no one has done anything about it If what Keys did is deserving of five years in jail, why does no one even think about going after the person who actually made the edits to the Tribune website?

George David ?Sharpie?. Sharpie was the individual who actually accessed the Tribune Companies CMS and caused the damage Matthew was convicted for. Sharpe was never charged on either side of the Atlantic. He was visited once at his home in Scotland by the FBI and Scotland Yard. He spoke to them and that was the last of his contact with this case.

Either way, this case, yet again, demonstrates the ridiculousness of the Computer Fraud and Abuse Act (CFAA). Even if we accept that Keys did some immature things, this case is about a minor vandalism of a website. Hell, many years back, someone hacked into Techdirt and did much more serious vandalism (deleting the most recent 10 stories and all the comments), and if whoever did that was ever found, I wouldn’t even want them sent to jail at all. That seems like a pretty extreme punishment for what honestly amounts to little more than internet graffiti.

If I had to guess, I’d predict that the judge will side with the DOJ, because that’s what judges quite frequently do. The DOJ has done a good job distracting from the actual issues involved in this case and focusing it on other, unrelated issues, while painting Keys as something of a jerk. But on the actual issue of the CFAA, the whole thing seems like a massive stretch. Unfortunately, I think Keys’ lawyers own filing is somewhat weak. It should have focused much more clearly on a few issues, rather than overloading it with what feels like a rambling attempt to throw every possible idea at the wall to reduce the jail term. His lawyer correctly notes that if the DOJ’s focus is on “deterrence” that has already happened. Keys was fired from his job at Reuters, and no major news organization will hire him these days. That seems like plenty of deterrence for his activities. What, exactly, is five years in jail going to do at this point?

Filed Under: cfaa, cfaa reform, doj, hacking, matthew keys
Companies: tribune company

Feds Confirm Cardinals Accessed Astros System With Old Password, File Unauthorized Access Charges

from the the-cardinal-way dept

Sports fans in the city of St. Louis are having a rough go of it lately. Fresh on the heels of losing their football team to Los Angeles, now we are learning that the federal government has charged former Cardinals scouting director Christopher Correa with unauthorized access into the Houston Astros computer systems. While some had speculated that the government would go after the Cardinals under the Economic Espionage Act, it’s beginning to look like our original assumption that the CFAA would be the tool the government would wield has been proven correct. Also appearing to be correct were reports that the “hacking” that took place in this instance was of the less hack-y variety and more of the let’s-try-the-guy’s-old-password-y.

Correa illegally accessed the Astros’ computers in the following way: In December 2011, as Victim A prepared to leave the St. Louis Cardinals and join the Houston Astros, he was directed to turn over his Cardinals-owned laptop to Correa — along with the laptop’s password. When Victim A joined the Astros, he re-used a similar (albeit obscure) password for his Astros’ email and Ground Control accounts. No later than March 2013, Correa began accessing Victim A’s Ground Control and Astros’ email accounts using this variation of the password to Victim A’s Cardinals laptop.

Note that Victim A is Jeff Luhnow, now Astros General Manager and former Cardinals employee, while Ground Control is the name for the Astros’ player scouting database. As far as competitive information goes, this is the treasure chest for any baseball team. At the court hearing, Correa entered a plea of guilty, claiming that he only accessed the Astros’ systems because he believed that propietary information from the Cardinals’ club had been taken first. Correa followed that up by admitting that such reasoning was “stupid.”

And indeed it is stupid, given the penalties that can be assessed for his crime.

The parties agreed that Correa masked his identity, his location and the type of device that he used, and that the total intended loss for all of the intrusions is approximately $1.7 million.

Each conviction of unauthorized access of a protected computer carries a maximum possible sentence of five years in federal prison and a possible $250,000 fine.

Given the plea deal, and the fact that Correa isn’t a young man pushing back at the government in trying to change the world, I expect that the jail time will be minimal if any. Which is probably unfortunate, because as far as CFAA cases go, this is one where actual crimes have been committed.

Filed Under: astros, baseball, cardinals, cfaa, christopher correa, hacking, jeff luhnow
Companies: houston astros, mlb, st. louis cardinals

Democratic National Committee Punishes Bernie Sanders For Their Own Technical Mistake; Sanders Threatens To Sues

from the turmoil dept

There’s a bizarre story about potential computer hackery this morning, involving the Democratic National Committee and the campaigns of Bernie Sanders and Hillary Clinton — the two front runners on the Democratic side. Apparently, the DNC was doing some sort of upgrade to its computer systems, and in the process, there was a glitch that very briefly allowed a Sanders staffer, “data director” Josh Uretsky, to access confidential data from Hillary Clinton’s campaign — specifically confidential voter information gathered by Clinton’s campaign. Uretsky realized he was able to access the data and did so — and has apparently since been “fired.” In response, the DNC has completely cut off all access to its systems to the Sanders’ campaign, saying it won’t allow the campaign back in “until it provides an explanation as well as assurances that all Clinton data has been destroyed.”

And, now the Sanders campaign is threatening to sue the party, claiming that this move could undermine his entire political campaign.

Yes, accessing a competitor’s data seems questionable, but again remember that the mistake here appears to be because of the DNC itself — or, rather, its computer system vendor NGP VAN. If there’s a problem, the DNC should take it up with NGP VAN who fucked up and made the data available across campaigns. That’s a pretty big mistake, given the stakes. But to blame the Sanders campaign seems pretty questionable. Yet, the DNC apparently has decided to go full bore against the Sanders campaign instead of admitting to its own error:

DNC chair Debbie Wasserman Schultz weighed in with a statement of her own.

“Once the DNC became aware that the Sanders campaign had inappropriately and systematically accessed Clinton campaign data, and in doing so violated the agreement that all the presidential campaigns have signed with the DNC, as the agreement provides, we directed NGP VAN to suspend the Sanders campaign’s access to the system until the DNC is provided with a full accounting of whether or not this information was used and the way in which it was disposed,” she said.

In a separate interview, Wasserman Schultz further attacked the Sanders campaign:

?The Sanders campaign doesn?t have anything other than bluster at the moment that they can put out there,? she told CNN on Friday. ?It?s like if you found the front door of a house unlocked and someone decided to go into the house and take things that didn?t belong to them.?

To some extent, this sounds like the ridiculous legal fights over the CFAA, over what is and what is not “exceeds authorized access” (just wait until the DNC files CFAA claims against the Sanders campaign…). But separate from that, it really looks like the DNC is not just playing favorites with the Clinton campaign here, but so actively trying to blame its own technical failures on the Sanders campaign as to make itself look ridiculous.

Update: Well, that didn’t take long. The Sanders campaign has sued the DNC alleging breach of contract (Sanders and the DNC have a contract allowing the campaign access to the system) as well as negligence for letting NGP VAN screw things up so badly.

Filed Under: access, bernie sanders, campaigns, cfaa, debbie wasserman schultz, hillary clinton, voter info
Companies: democratic national committee, dnc

Cannibal Cop Not Guilty Of 'Thought Crime'… And Didn't Violate The CFAA

from the still-nutty dept

Earlier this year, we wrote about the crazy, but troubling, case against former NY Police Department officers Gilberto Valle, who has been dubbed “the cannibal cop” for fantasizing about kidnapping, raping, killing and eating around 100 women. A key question in the case: where is the line between fantasizing and… planning out a crime. But, the case drew even more interest from us because after the court basically tossed out all the charges as “thought crimes” that aren’t actually illegal, it kept in place the CFAA charge, claiming that Valle violated the anti-hacking law by using the police deatabase to look up information on one of the women he was fantasizing about. Now, that’s creepy and disturbing and an abuse of his position in the NYPD… but that does not make it a CFAA violation. It’s the nuttiness of this case, and the remaining CFAA charge that resulted in reporter Sarah Jeong referring to the CFAA as “the law that sticks” when all else fails.

The CFAA, again, is the Computer Fraud and Abuse Act, which is supposed to be used against people who hack into others computers. But, as we’ve covered a whole bunch of times here on Techdirt, these days it’s often used to pile on against anyone who does something prosecutors don’t like… like using a computer. And that seemed to be the case here. Thankfully, however, the appeals court for the Second Circuit has rejected that argument and cleared Valle of the CFAA violation (it also said that his fantasizing isn’t a crime either).

As per usual in CFAA cases, the issue in this case was over the definition of “exceeds authorized access.” Prosecutors keep trying to make this mean “does something on a computer that goes against a terms of service or terms of employment.” But that super broad definition isn’t just dangerous, it basically makes almost everyone a criminal. Thankfully, the court recognized this, though it admits that part of that is just because the law is too ambiguous to make a call. It even looks at the legislative history and notes that it could support either argument, but it needs to be more before allowing the CFAA to be used that way:

At the end of the day, we find support in the legislative history for both Valle?s and the Government?s construction of the statute. But because our review involves a criminal statute, some support is not enough. Where, as here, ordinary tools of legislative construction fail to establish that the Government?s position is unambiguously correct, we are required by the rule of lenity to adopt the interpretation that favors the defendant.

And it notes, in agreeing with a few other key CFAA rulings, that adopting a broader construction of the law could have an “effect on millions of ordinary citizens caused by the statute’s unitary definition of ‘exceeds authorized access'” (which is quoting the key Nosal decision that rejected a broad definition under the CFAA). Indeed, the court recognizes that even if Valle seems like a particularly terrible person, it must be aware that its decision will impact many others:

Whatever the apparent merits of imposing criminal liability may seem to be in this case, we must construe the statute knowing that our interpretation of ?exceeds authorized access? will govern many other situations…. It is precisely for this reason that the rule of lenity requires that Congress, not the courts or the prosecutors, must decide whether conduct is criminal. We, on the other hand, are obligated to ?construe criminal statutes narrowly so that Congress will not unintentionally turn ordinary citizens into criminals.?… While the Government might promise that it would not prosecute an individual for checking Facebook at work, we are not at liberty to take prosecutors at their word in such matters. A court should not uphold a highly problematic interpretation of a statute merely because the Government promises to use it responsibly….

There is a dissent from Judge Chester Straub, in which he argues that there is no actual ambiguity in the law, and if you violate what your employer says you can do with our computer, well, then you might just be a felon:

In reaching this result, the majority discovers ambiguity in the statutory language where there is none. Under the plain language of the statute, Valle exceeded his authorized access to a federal database in violation of the CFAA.

And, Judge Straub says, if that means that just about everyone is a criminal, well, that’s a problem for Congress to solve:

The majority opinion, apparently without irony, concludes that giving effect to the plain language of the statute would somehow ?place us in the position of [the] legislature.? … But where, as here, the statute?s language is plain and unambiguous, the ?sole function of the courts is to enforce it according to its terms.? … It may well be that the CFAA sweeps broadly. But such is a matter for policy debate… and the Congress is free to amend the statute if it chooses

Thankfully, his opinion on this did not become the majority opinion.

Filed Under: cannibal cop, cfaa, gilberto valle, thought crime

The Completely Nonsensical Differences In Punishment For Revenge Porn Kings

from the none-of-this-makes-sense dept

Earlier this week, Hunter Moore — the guy who basically invented the concept of revenge porn with his “Is Anyone Up” site — was sentenced to two-and-a-half years in jail along with a $2,000 fine… and he has to pay $145.70 in “restitution” to a single victim. Moore was arrested for violating the CFAA, and as we noted at the time, it may be one of the few legitimate uses of the CFAA. He didn’t just run a revenge porn site, he hired a guy, Charlie Evens, who got a similar sentence a week ago, to hack into the computers of unsuspecting women, and swipe naked photos of them to put on his site. The sickening bit: that “$145.70” in “restitution”? That’s how much Moore paid Evens (also, Evens is jointly liable for that money, meaning that Moore might not even pay it). It’s difficult to understand why the $145.70 makes any sense at all as the “harm” caused to the anonymous woman “L.B.” whose computer got hacked into.

As Sarah Jeong at Vice’s Motherboard notes, the reason that Moore’s sentence seems so light is because of the nature of the plea bargain he agreed to with the government:

The tiny amount of restitution has partly to do with Moore?s plea bargain. He pleaded guilty to counts 2 and 9 of the indictment (which had a total of fifteen counts)?one count under the Computer Fraud & Abuse Act, and one count of aggravated identity theft. Counts 2 and 9 relate only to one victim, L.B.

So because he’s only guilty on those two counts, there’s just that single victim. Even so, the tiny restitution seems a bit bizarre. It’s also hard to square this CFAA “punishment” with a case like Matthew Keys’, who was recently found guilty of sharing a password that resulted in a brief (40 minute) defacement of the LA Times website. Yet, in that case, it was argued that he caused almost a million dollars in damages, and will be sentenced next month (with the prosecution supposedly asking for something less than five years).

Meanwhile, it’s still bizarre to compare the result of this case, with other similar cases. Kevin Bollaert, who created the similar revenge porn site “YouGotPosted” was originally sentenced to 18 years in jail, along with paying $15,000 in restitution — though his sentence was later reduced to eight years in prison and another 10 years of mandatory supervision. That length of time seemed a bit extreme.

And then there’s Craig Brittain, whose IsAnybodyDown website copied Hunter Moore’s with a unique addition: creating a totally fake lawyer who you could pay to get your photos and information taken off the site (Bollaert copied this model from Brittain). Brittain just got off with a wrist slap, and has been busy trying to hide this fact with abusive DMCA notices, while at the same time hilariously trying to start an Uber competitor with his buddy and revenge porn collaborator, Chance Trahan, last seen pretending to be Daymond John. Trahan never got into any legal trouble for his role in the revenge porn business and, if you want to be amused, you should read his… er…. “interview” with Rolling Stone about it.

And then there’s Casey Meyering, who ran WinByState (don’t ask), which was another revenge porn site, that also copied Brittain’s extortionate “pay us to take down your info” model, and was recently sentenced to three years in jail. It’s good to see these guys getting punished, though the randomness in the punishment and sentencing seems problematic. Moore’s sentencing, in particular, seems bizarre, considering that it involved the CFAA, at a time when the CFAA is widely abused to create HUGE punishments for things that many people don’t think are all that bad. Moore, on the other hand, appeared to clearly violate both the spirit and letter of the CFAA for clearly bad purposes — and gets off with something of a wrist slap in comparison.

Filed Under: casey meyering, cfaa, charlie evens, chase trahan, craig brittain, hunter moore, kevin bollaert, punishment, restitution, revenge porn

Did Marco Rubio's Campaign Violate The CFAA? Will He Commit To Reforming It?

from the broken-law dept

We’ve talked a lot in the past few years about the desperate need to reform the CFAA — an absolutely horrible “anti-hacking” law that has been stretched and broadened and twisted by people over the years, such that it’s frequently used to “pile on” charges when nothing else will stick. If you want to go into a lot more detail, you can listen to the podcast we recently did about the CFAA, or listen to this wonderful podcast that Reply All did about the CFAA (where I also make a brief appearance). But one of the biggest problems with it is that it considers you to be a dangerous hacker if you access a computer/network “without authorization” or if you merely have “exceeded authorized access.” It’s that latter phrase that often causes trouble. What does it even mean? Historically, cases have been brought against employees who use their employer’s computers for non-work related things, against someone for supposedly failing to abide by MySpace’s terms of service and for downloading too many academic journals that were freely available for downloading on MIT’s campus network.

Keep that in mind as you read this Associated Press story about how Presidential candidate and current Florida Senator Marco Rubio’s “low-budget” Presidential campaign office got free internet access for a bit:

At one of the campaign’s Nevada offices, staffers tried to do their part to live up to the less is more mantra. After noticing a pizza place next to a campaign office had free wireless internet that required a password, a staffer walked over and bought two pieces of pizza and asked for the internet access code.

But the cost-cutting measure was short-lived. After about three weeks, the pizza place caught on and asked the Rubio team to stop.

It’s not at all difficult to see how that could be “exceeding authorized access” under the statute. After all, it’s pretty clear that the intent of the access is for customers while they’re in the restaurant. That seems to be confirmed by the fact that the pizza place asked the Rubio campaign to knock it off once it discovered what was going on. Now, for it to be a felony, there needs to be $5,000 worth of damage — but considering that in another recent case, the DOJ turned a single news article defacement (that lasted just 40 minutes) into a supposed $929,977 in damages, I’m sure some creative math can make the use of the WiFi into something greater than $5,000. You just need to argue that the congestion on the WiFi likely turned off customers who may not ever come back, and the value of those losses exceeds $5,000.

Now, Rubio hasn’t really been involved at all in the debate over the CFAA and reforming it. The only official “policy” line he has even closely related to it on his campaign issues page suggests he’d favor making the CFAA punishments even worse: “Use American power to respond harshly to international cyber attacks on American citizens, businesses, and governments.” Of course, that’s focused on foreign attacks, so may not apply directly.

Either way, this seems like something an enterprising political reporter might want to ask the Rubio campaign, seeing as they themselves may have potentially committed a felony under the current CFAA.

Filed Under: access, cfaa, cfaa reform, internet access, marco rubio