Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

'Aaron's Law' could have unintended consequences

Taylor Armerding | Jan. 21, 2013
Tragedy shouldn't undermine protection of private and public property, experts say

However, since his death, U.S. Attorney Carmen Ortiz has faced a firestorm of criticism, including a petition demanding her removal, which this week reached 25,000 signatures, however the White House has increased the theshold for a response from 25,000 to 100,000 petitions.Ã'Â

Marcia Hofmann, a senior staff attorney at the Electronic Frontier Foundation (EFF), said in a blog post earlier this week that the CFAA is indeed badly flawed. "The government should never have thrown the book at Aaron for accessing MIT's network and downloading scholarly research," she wrote. "However, some extremely problematic elements of the law made it possible."

One of them is that the law doesn't clearly define what "authorization" to access protected computers means, she wrote. "Creative prosecutors have taken advantage of this confusion to craft criminal charges that aren't really about hacking a computer but instead (to) target other behavior the prosecutors don't like," she said, adding that a second major problem is that sentences for hacking crimes are far too severe.

Westby said there might be a need for the law's language to be more precise, and for sentencing guidelines to be adjusted. She suggested that Lofgren's bill should, "serve as a basis for Congressional hearings on what guidelines exist for prosecutors in handling CFAA cases."

But she said simply exempting terms-of-service violations from criminal penalties would be disastrous. "It would leave all businesses, individuals, and governments unable to use the CFAA to prosecute cybercriminals in circumstances where the perpetrator was violating terms of use, contractual obligations, or company policies."

"I do not say this with a hard heart. I lost a very close friend who committed suicide over extreme prosecutorial conduct over a relatively minor securities violation," she said. "What happened is that four boys lost their father. There are bounds of decency in prosecutorial conduct and certainly looking at damage should be a factor."

Sabett said if the penalties are indeed disproportionate, that is what should be changed. "Change the remedies," he said. "But don't wipe out a whole provision of the law. Any deterrent effect it would have against criminals would no longer exist."

A terrible tragedy should not eliminate the ability to bring charges for criminal behavior, he said. "Even if you say you're doing it for the common man -- that it is OK because it is for the greater good -- if it is a crime, then it is still a crime."


Previous Page  1  2 

Sign up for Computerworld eNewsletters.