Slashdot Mirror
Draft Computer Fraud and Abuse Act Update Expands Powers and Penalties
Despite calls to limit the Computer Fraud and Abuse Act, it looks like Congress is planning to drastically expand the law and penalties. walterbyrd writes with a few of the major changes listed in the draft bill (22 pages): "Adds computer crimes as a form of racketeering. Expands the ways in which you could be guilty of the CFAA — including making you just as guilty if you plan to 'violate' the CFAA than if you actually did so. Ratchets up many of the punishments. Makes a very, very minor adjustment to limit 'exceeding authorized access.' Expands the definition of 'exceeding authorized access' in a very dangerous way. Makes it easier for the federal government to seize and forfeit anything."
TechCrunch also reports rumors that the plan is to push the bill through quickly for approval with a number of other "cybersecurity" bills in mid-April.
One step closer to fascism. Big business controls the government, and the government will control every single aspect of your life.
Extra! Extra! Read all about it! Laws too dense for average citizens to understand, too vague to prevent massive abuse! Please. You're all felons. You haven't been prosecuted because you haven't pissed anyone off enough to become one, but all I need to do is record you going about your daily business for a week, and I'll find enough dirt to keep you locked up for a long time. Every. Last. One of you. Except perhaps the person who can't read this, because they're in a coma, in a hospital bed. And that poor, poor bastard is only avoiding his fate for as long as his bank account continues to pay off his mortgages and student loans. Once the money runs out, yeah... he's gonna be a felon too.
The law has ceased to have any relevance of any kind whatsoever for principled and ethical people. You cannot follow all the laws, you don't even know all of them, and you're not supposed to, and even if you did manage this collossal feat that even our own government can't accomplish with all of its resources... interpreting the law is also a crime. Ha ha. And telling someone else what you've learned? Practicing law without a license... another crime.
We're all criminals. We just haven't been caught.
#fuckbeta #iamslashdot #dicemustdie
I’m a constituent calling on you to reform the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030. This law contains vague language that broadly criminalizes accessing a computer "without authorization," carries heavy-handed penalties, and shows no regard for whether an act was done to further the public good. We saw how these laws could be abused in the case of Aaron Swartz, a recently-deceased 26-year-old coder and social activist who was hounded by the Justice Department in a relentless and unjust felony prosecution.
The CFAA needs three critical fixes: first, terms of service violations must not be considered crimes. Second, if a user is allowed to access information, it should not be a crime to access that data in a new or innovative way -- which means commonplace computing techniques that protect privacy or help test security cannot be illegal. And finally, penalties must be made proportionate to offenses: minor violations should be met with minor penalties.
While it is too late to intervene on behalf of Aaron, it’s not too late to ensure that this harm is not done to future social justice activists and security researchers. Please hold a Congressional hearing to examine the ongoing abuses of the Computer Fraud and Abuse Act and similar laws, and champion reform so that the potential punishments fit the crimes.
You can write to them easily here: https://www.eff.org/aarons-law
Take the time to add a note to the end of the boilerplate about how you WILL NOT vote for them if they don't act.
Senators and Representatives, even somebody like me who doesn't follow all things politics-related can still see how you vote and how well you represent my interests via http://www.opencongress.org/ , at the very least. Just remember, we are watching.
vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
Maybe they could change the title to this bill to the "Piss on Aaron Swartz's Grave Act of 2013"?
Seriously, what did you expect. The noose always gets tighter.
Since it's just a draft, I'm not actually certain who wrote it. It doesn't have a tracking number yet. This being the House, we can infer that the chairman is OK with it, and he's a Republican, but he's not necessarily the author.
The only clue I can find is in a file name included in the document:
C:\DOCUME~1\HRBRAZ~1\APPLIC~1\SOFTQUAD\XMETAL\5.5\GEN\C\SR_005.XML
but I don't see anybody on the committee whose name fits "HRBRAZ~1" (and it's probable that it's somebody's secretary or legislative assistant; it might even be the staffer who's responsible for maintaining the XML [via Softquad, on an elderly Windows installation]).
Dear americans:
Fuck you
Sincerely, the feds.
Well it is most certainly not a congress critter as they are way to stupid to think and write anything 'legal' themselves. So the bigger question is, who has lobbied for the terms in the proposed law?
Orin Kerr from the Volokh Conspiracy has this to say about the "new" draft CFAA:
http://www.volokh.com/2013/03/25/house-judiciary-committee-new-draft-bill-on-cybersecurity-is-mostly-dojs-proposed-language-from-2011/
"Stop taking DOJ’s language from back in 2011 and packaging it as something new. Based on a quick read, it seems that the amendments for 1030 in the new draft are mostly copied from a bill that Senator Leahy offered (with substantial input from DOJ, as I understand it) back in November 2011. I criticized that language here. The new circulating draft also adopts the sentencing enhancements (minus mandatories) and the proposed 1030a that DOJ advocated in May 2011. I criticized that initial DOJ language here. (There’s also a breach notification provision in the new language, but I haven’t followed that issue closely; I don’t know if that proposal is also based on old language.)
In some ways, the new circulating language is even more severe and harsh than DOJ wanted even in the Lori Drew case. For example, the proposed language would make it a felony crime to violate Terms of Service if the TOS violation:
(I) involves information that exceeds $5,000 in value;
(II) was committed for purposes of obtaining sensitive or non-public information of an entity or another individual (including such information in the possession of a third party), including medical records, wills, diaries, private correspondence, financial records, photographs of a sensitive or private nature, trade secrets, or sensitive or non-public commercial business information;
(III) was committed in furtherance of any criminal act in violation United States or of any State, unless such state violation would be based solely on the obtaining of information without authorization or in excess of authorization; or
(IV) involves information obtained from a computer used by or for a government entity;
This language is really, really broad. If I read it correctly, the language would make it a felony to lie about your age on an online dating profile if you intended to contact someone online and ask them personal questions. It would make it a felony crime for anyone to violate the TOS on a government website. It would also make it a federal felony crime to violate TOS in the course of committing a very minor state misdemeanor. If there is a genuine argument for federal felony liability in these circumstances, I hope readers will enlighten me: I cannot understand what they are.
In short, this is a step backward, not a step forward. This is a proposal to give DOJ what it wants, not to amend the CFAA in a way that would narrow it. "