Hackers are 'Terrorists' Under Ashcroft's New Act

Carlos writes "Most computer crimes are considered acts of terrorism under John Ashcroft's proposed 'Anti-Terrorism Act,' according to this story on SecurityFocus. The Act would abolish the statute of limitations for computer crime, retroactively, force convicted hackers to give the government DNA samples for a special federal database, and increase the maximum sentence for computer intrusion to life in prison. Harboring or providing advice to a hacker would be terrorism as well. This is on top of the expanded surveillance powers already reported on. The bill could be passed as early as this week. I feel safer already."

Comments

Ouch!

[Jeremiah Cornelius]

I conduct Penetration Testing and Vulnerability assesments for a living.

All it takes is one bad customer relationship to cause a false accusation...

jeremiah cornelius

Re:Ouch!

[fobbman]

Husband: No, it wasn't an affair, per se. I was actually conducting some Penetration Testing and Vulnerability Assesments on her.

Boy, was she vulnerable! Glad I was able to help her out, really!

My DNA?

[Papa Legba]

Why in the world would they need DNA. I am pretty sure that no where in the specs for DNS or IPv4 is it required that my genome sequence be part of the string being sent out.

So, who wants to take bets that the RIAA get's copyright violaters termed as hackers?

what about bugtraq?

[Bastian]

I don't know much about how this bill would be interpreted were it to come to law, but it seems to me that making security bugs known to the general public could be construed as giving advice to a hacker since, well, it alerts the general public to security problems.

perversion

[nodrip]

This is a perversion of what Ashcroft requested. Hackers who attempt to disrupt key systems that are vital to protecting human life, for example the FAA's radar systems, are terrorists. And they are.

Re:perversion

[Tackhead]

> This is a perversion of what Ashcroft requested. Hackers who attempt to disrupt key systems that are vital to protecting human life, for example the FAA's radar systems, are terrorists. And they are.

On that, we agree.

Upon reading the draft bill, I'm not happy with all of the provisions in the bill, but I really don't see anything that says "guy with programming sk1llz == terrorist."

I do see an expansion of The List Of Bad Things We Can Do To Felons (such as DNA sampling), but that's a far cry from "all [cr]ackers are terrorists", let alone "all Hackers are now terrorists and will have to give up DNA samples".

Indeed, only crackers who attack "protected systems" (meaning .gov and .mil boxen - not the d00d who hax0rz the average web site) appear to be in line to get their asses handed to them on a silver platter under this Act, and those provisions I can support. (Hell, those are about the only provisions I'd support ;-)

Earlier, I made a post that said "If you've got programming skills, get the hell outa here." I retract that post. This bill, while odious for many means, is not a declaration that American doesn't want its programmers anymore.

Serves me right for replying to /. before reading the fscking article ;-)

Re:perversion

[-=OmegaMan=-]

No, it isn't.

From the bill:

"(19) `protected computer' has the meaning set forth in section 1030

"(20) `computer trespasser' means a person who accesses a protected computer without authorization and thus has no reasonable expectation of privacy in any communication transmitted to, through, or from the protected computer.";

From Title 18 Chapter 47 Sec. 1030:

(2) the term ''protected computer'' means a computer -

(A) exclusively for the use of a financial institution or the
United States Government, or, in the case of a computer not
exclusively for such use, used by or for a financial
institution or the United States Government and the conduct
constituting the offense affects that use by or for the
financial institution or the Government; or
(B) which is used in interstate or foreign commerce or
communication;

Used in interstate or foreing communication? How many of you connect to machines and/or through machines without crossing state lines?

Further from the bill:

""SS 25. Federal terrorism offense defined

"As used in this title, the term `Federal terrorism offense' means a violation of, or an attempt or conspiracy to violate-

-snip-
1030(a)(1), (a)(4), (a)(5)(A), or (a)(7) (relating to protection of computers)
-snip-

Okay, so now *maliciously* breaking into basically any computer system is a terrorist act. Couple this with the rest of the increases in anti-terroism this bill contains, and you're doing *LIFE* in FEDERAL PRISON (aka "no parole") because your Anti-CodeRed Perl script took down some dipshit's enterprise server. Meanwhile child molestors get time off for good behavior.

I don't think anyone thinks "computer crime" shouldn't be punished. Just not to this ridiculous degree.

Re:Somebody has to say it, but...

[Anonymous Coward]

who are the victims?

stop and think.

if someone commits credit card fraud with said stolen numbers, then we know who the victim is. but we already have a law for that. until some other crime is committed, there was no victim of simply stealing the numbers.

just because a computer was used to commit the crime, it doesn't mean the crime is somehow worse than the same thing done without a computer. theft is theft, and should be treated as such. it's not like we have separate murder laws for guns vs knives...

A backwards approach to legislation

[melquiades]

This act and the DMCA are eerily similar. Both seek to address particular historical circumstances and events (e.g. Napster, terrorist attacks). Both sets of circumstances are genuinely complex and problematic. And, in both cases, there were already perfectly adequate laws more general laws which address the particular situation. We already have laws to address copyright violation, and we already have laws to convict violent criminals, spies, and yes...even hackers.

The DMCA and all these supposedly anti-terrorist laws, past and present, take a terribly backward approach to lawmaking. The best laws, like the best software, succeed on minimality and generality. Witness the excellent US constitution, which has been extremely effective considering how long it's been around. The constitution uses very broad terms -- "life", "property", "punishment", "vote" -- and very few specific terms. (Some parts are quite specific, like the quartering of soldiers bit. They seem very quaint now.)

Laws, like software, tend to break if they are designed in specificity but used in generality. The trouble with these new laws is that they create all kinds of special cases and extra circumstances designed for a particular moment in history, which we'll have to support for decades or even centuries. The new terrorist laws, in a way, are like the 640k RAM limit -- they seem good enough for now, but in the future, they'll cripple and break all kinds of things.

The difference is, in this case, it is our fundamental freedoms that are being to get crippled and broken. As always, please please please call your representatives and give them a piece of your mind. They are under a lot of pressure right now, and they need to hear from sensible people.

Re:Here's the story.

[ncc74656]

As a "Federal terrorism offense," the five year statute of limitations for hacking would be abolished retroactively -- allowing computer crimes committed decades ago to be prosecuted today

This can't be the case...haven't the people who thought this up run across this passage before?

No bill of attainder or ex post facto Law shall be passed.

- United States Constitution, Article I, Section 9, paragraph 3

You can't prosecute an action that wasn't a crime at the time the action occurred. Then again, with the body blows the Constitution has taken in recent times (mainly in various parts of the Bill of Rights, especially the First, Second, and Tenth Amendments), maybe the drafters of this legislation haven't run across this passage before.

Re:Somebody has to say it, but...

[ToLu the Happy Furby]

Seriously-- why _shouldn't_ computer crime be crime?

Computer crime should be a crime.

But it already *is* a crime. The question is what is a just response to computer crimes. Some things which are *not* just:

• Sentencing someone to lifetime imprisonment without possibility of parole for a simple computer crime. Remember, if the crime really warranted such a sentence--for example, cracking air traffic control and causing planes to crash into each other; cracking a CIA computer and stealing national secrets--then the criminal would already be liable for serious punishment under existing laws--murder and espionage, in these cases.
  
  
• Retroactively eliminating the statute of limitations, allowing people to now be charged with computer "crimes" they committed decades ago.
  
  

What's even worse is the provision that giving advice or information which may be used to facilitate computer crimes is not only criminalized but subject to the same penalties.

To put it another way, if this law passes then someone could be given life in prison without parole for documenting vulnerabilities which allow systems to be compromised by a cracker or a worm. Indeed, it isn't clear that, with the removal of the statute of limitations, they couldn't charge the people documented the vulnerabilities responsible for eg. Code Red or Nimda under this law.

This provision is like the anti-circumvention provision of the DMCA writ large. Whereas at least the DMCA only applies to access-control restrictions on copyrighted material, this law could potentially make all discussion of any vulnerabilities which allow systems or information to be compromised illegal.

These provisions are so utterly preposterous and out of proportion to the crimes (or so-called crimes) discussed as to boggle the mind.

Re:Six degrees of separation.

[dillon_rinker]

Actually, criminal statutes have to be pretty explicit. You can't convict someone of a crime unless it's on the books. If goose-whacking is a crime, and you try but fail to whack a goose, they can't convict you of attempted goose-whacking, because there's no law against attempted goose-whacking. If you talk to people about your plans to whack a goose, they can't convict you of conspiracy to commit goose-whacking because there's no law against conspiring to goose-whack.

Naturally, it takes a politically-connected DA about a month to remedy the situation, particularly if goose-whackers are a mostly misunderstood minority...

Does that include ... ?

[Lumpish Scholar]

Anyone making life easier for a "hacker" (cracker) could be sentenced to life without parole?

Bill Gates had better pack his bags now! ("... the most cigarettes.")

Not broad enough!

[kindbud]

Testifying before the House Judiciary Committee, Ashcroft defended the proposal's definition of terrorism. "I don't believe that our definition of terrorism is so broad," said Ashcroft. "It is broad enough to include things like assaults on computers, and assaults designed to change the purpose of government."

Seems like this bill needs to be broadened to include itself and John Ashcroft, both of whom seem hell-bent on changing the purpose of government.

List of contacts

[GigsVT]

Judiciary Committee List
Name, party, state, phone, fax, e-mail.

James Sensenbrenner, Chair, R-WI, (202) 225-5101,(202) 225-3190,sensen09@mail.house.gov
Henry Hyde, R-IL, (202) 225-4561, (202) 225-1166.
John Conyers Jr., D-MI, (202) 225-5126, (202) 225-0072,john.conyers@mail.house.gov
George Gekas, R-PA, (202) 225-4315, (202) 225-8440, askgeorge@mail.house.gov
Barney Frank, D-MA, (202) 225-5931, (202) 225-0182
Howard Coble, R-NC, (202) 225-3065, (202) 225-8611, howard.coble@mail.house.gov
Howard Berman, D-CA, (202) 225-4695, (202) 225-3196,Howard.Berman@mail.house.gov
Lamar Smith, R-TX, (202) 225-4236, (202) 225-8628
Rick Boucher, D-VA, (202) 225-3861, (202) 225-0442,ninthnet@mail.house.gov
Elton Gallegly, R-CA, (202) 225-5811, (202) 225-1100
Jerrold Nadler, D-NY, (202) 225-5635, (202) 225-6923, jerrold.nadler@mail.house.gov
Bob Goodlatte, R-VA, (202) 225-5431, (202) 225-9681,talk2bob@mail.house.gov
Bobby Scott, D-VA, (202) 225-8351, (202) 225-8354
Steve Chabot, R-OH, (202) 225-2216, (202) 225-3012
Mel Watt, D-NC, (202) 225-1510, (202) 225-1512, nc12.public@mail.house.gov
Bob Barr, R-GA, (202) 225-2931, (202) 225-2944, barr.ga@mail.house.gov
Zoe Lofgren, D-CA, (202) 225-3072, (202) 225-3336, zoe@lofgren.house.gov
William Jenkins, R-TN, (202) 225-6356, (202) 225-5714
Sheila Jackson Lee, D-TX, (202) 225-3816, (202)225-3317, tx18@lee.house.gov
Christopher Cannon, R-UT, (202) 225-7751, (202)225-5629, cannon.ut03@mail.house.gov
Maxine Waters, D-CA, (202) 225-2201, (202) 225-7854
Lindsey Graham, R-SC, (202) 225-5301, (202) 225-3216
Marty Meehan, D-MA, (202) 225-3411, (202) 226-0771, martin.meehan@mail.house.gov
Spencer Bachus, R-AL, (202) 225-4921, (202) 225-2082
William Delahunt, D-MA, (202) 225-3111, (202)225-5658, william.delahunt@mail.house.gov
John Hostettler, R-IA, (202) 225-4636, (202)225-3284, john.hostettler@mail.house.gov
Robert Wexler, D-FL, (202) 225-3001, (202) 225-5974
Mark Green, R-WI, (202) 225-5665, (202) 225-5729, mark.green@mail.house.gov
Tammy Baldwin, D-W, (202) 225-2906, (202) 225-6942, tammy.baldwin@mail.house.gov
Ric Keller, R-FL, (202) 225-2176, (202) 225-0999
Anthony David Weiner, D-NY, (202) 225-6616, (202)226-7253
Darrell Issa, R-CA, (202) 225-3906, (202) 225-3303
Adam Schiff, D-CA, (202) 225-4176, (202) 225-5828
Melissa Hart, R-PA, (202) 225-2565, (202) 226-2274, melissa.hart@mail.house.gov
Jeff Flake, R-AZ, (202) 225-2635, (202) 226-4386

So let's do something about it

[GrouchoMarx]

OK, a lot of people are crying that the sky is falling, that the jack-booted Nazis are at the gates in Washington (both the East Coast one and the West Coast one), that the totalitarian Big Brother is at hand. Is it? Hell, I don't know, but I'd rather not find out. This is still a democracy, folks, that means YOU have power. Even between elections, you have power. Because politicians, whatever else they are interested in (money, power, actually helping people, getting blowjobs from secretaries), are interested first and foremost in one thing: Getting reelected. Make them think that if they pass something asinine and unconstitutional, that there WILL be repercussions. Yes, scare the bejebers out of your congressman/woman and senator.

It takes TEN letters (dead tree letters, email gets deleted immediately) for a Senatorial office to open an issue. TEN. (According to Illinois Senator Dick Durban.) And regardless of the advertising and commercials that politicians raise huge war chests to fund, on election day it is YOUR VOTE that decides who ends up in DC. (East Coast, you have no say over the West Coast one.)

I'd like to issue a call to everyone who posted something modded up to 3 or above: Write a letter to your representatives with the same level of intelligence and Interesting/Insightful content. Write it once and send it three times, once to your Congressperson, and once to each Senator. Fax it if you'd prefer. (Snail mail and fax are what they like the most.) Keep it to one page. Reference the Constitution. Refer to yourself with your most impressive title. (Professor, Ph.d, Senior Engineer, Graduate Student, Independent Developer) and as a registered voter. In the name of the Tux do not tell them that you don't vote, even if that's the case (in which case you should be ashamed of yourself). Then when the next election rolls around, ignore the commercials, take an hour to do your own research, and vote for the candidate that did not support revoking the 4th Amendment and violating Ex Post Facto. It works. (See also: Former Senator Alan Dixon)

For those of you in countries outside of the US, the same applies to you. The Canadian, British, Australian, French, German, etc. governments are all popularly elected as well. (At least the active parts of the British government, anyway.) Politicians are the same everywhere. The same tactics apply. Use them. If you don't, you have no one to blame but yourselves.

This is nothing new...

[Hacker Cracker]

It's nothing more than the same old reactionary garbage legislation that's been coming down the pike. And it's not surprising that this is what congress has come up with either--after all, if it didn't work last year, then do more of it next year...

As David Quinn put it quite eloquently:

When the Israelites escaped from Egypt in the 13th century B.C., they were literally a lawless horde, because they'd left the Egyptian list of prohibitions behind. They needed their own list of prohibitions, which God provided--the famous ten. But of course ten didn't do it. Hundreds more followed, but they didn't do it either.

No number has ever done it for us. Not a thousand, ten thousand, a hundred thousand. Even millions don't do it, and so every single year we pay our legislators to come up with more. But no matter how many prohibitions we come up with, they never do the trick, because no prohibited behavior has ever been eliminated by passing a law against it. Every time someone is sent to prison or executed, this is said to be "sending a message" to miscreants, but for some strange reason the message never arrives, year after year, generation after generation, century after century.

Naturally, we consider this to be a very advanced system.

Quite depressing, really. (The whole text can be found here, BTW)

But what can you expect when the whole world has bought into the idea that there is absolutely nothing that any one person can do to change things?

-- Shamus

Bleah!

Re:Now hang on just a sec...

[Surak]

I don't mind increase survelance powers in order to fight terrorism. However, scrawling "I love you Crystal" or some such on some web page is not terrorism.

I've said this before, but it's worth repeating. The laws that apply in the real world should apply in the cyber world.

Defacing a web face is the same as spraying some grafitti on a wall. Stealing credit card numbers or private information is the same as theft. Bringing down a government web site is sabotage. These should be dealt with the same as they are in the real world.

Defacing a web site is vandalism, and therefore should be treated as a misdemeanor. Stealing credit card numbers or private information would be a misdemeanor or a felony depending on how much was stolen and how much it's worth. Sabotage, deliberate, willful destruction of government property, including websites, *is* terrorism and should be dealt with as such.

I don't see why this is so frickin' hard. :-)

Flying Instructors

[chazR]

I assume you know that *all* flight training is currently banned in the USA? Yes, that's right. If you are a flying instructor, currently *you cannot* train students.

Well, you won't go to jail. But the FAA will take your pilot's license away. If you are a pilot, that's nasty. Check out news://rec.aviation.pilots for more.

Without passing a law, without recourse to a *single* elected person, thousands of US citizens have had their source of income removed.

Well, that makes us all safe doesn't it?