The 'Cloud Computing Act Of 2012'... Or How Internet Regulation Can Go Awry
from the paved-with-good-intentions dept
Sen. Amy Klobuchar has introduced a new bill, the "Cloud Computing Act of 2012" (S.3569), that purports to "improve the enforcement of criminal and civil law with respect to cloud computing." Given its introduction so close to the election, it's doubtful this bill will go anywhere. Still, it provides an excellent case study of how even well-meaning legislators can botch Internet regulation.
What the Bill Does
From its 1980s origins as a law restricting hacking into government computers, the Computer Fraud and Abuse Act (CFAA) has morphed into a general-purpose federal law against trespassing on anyone else's computers. With that breadth, the CFAA extends to a wide variety of activities, ranging from data scraping (see, e.g., EF Cultural Travel v. Explorica) to fake profiles (see, e.g., the Lori Drew prosecution related to Megan Meier's death) to ex-employees walking out the door with competitively sensitive information (see, e.g., US v. Nosal and WEC v. Miller).
The proposed bill's main substantive provisions attempt to give "cloud computing services" extra protections under the CFAA. First, the bill says that each unauthorized access of a cloud computing account counts as a separate CFAA offense. Second, the bill specifies a formula for computing losses in CFAA violations involving cloud computing services, setting a minimum floor of $500 loss per affected cloud computing account.
Problems with the Bill
The CFAA is Already a Mess. Good luck trying to read the CFAA's text. Constant amendments over the years have created spaghetti code. This bill adds only slightly to the CFAA's overall lack-of-tidiness, but every incremental amendment makes the CFAA more unwieldy.
The Definition of "Cloud Computing Service" is Incoherent. The bill seeks to protect cloud computing services, but what are those? Check out the bill's definition:
the term "cloud computing service" means a service that enables convenient, on-demand network access to a shared pool of configurable computing resources (including networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or interaction by the provider of the service.
What??? This sounds more like a vendor's sales pitch than a basis for criminal prosecution. We can reinforce the definition's weakness by trying to determine what isn't a cloud computing service. Every user-generated content website seems to qualify; but so should every online bank. In fact, this definition of cloud computing service probably becomes co-extensive with the Internet generally.
To be fair, the failed definition isn't totally the drafter's fault. I don't think it's possible to define "cloud computing service" precisely. Tip to legislators: if you can't clearly define your subject matter of your legislation, you're probably doing something wrong.
What's the Problem That Needs to Be Solved? I can't figure out how the proposed amendments address any problem we're seeing in the field. It's possible I've missed some relevant case, but I can't think of a single case I've seen where the CFAA underprotected a cloud computing service or this legislation would have changed the outcome. Seeking some clarity, I submitted a press inquiry to Sen. Klobuchar's office last week and got no response. So I have no idea what problem this bill purports to solve.
Implications
This bill exemplifies several ongoing problems with efforts to legislate the Internet:
1) Legislative grandstanding. It's flashy for legislators to tell their constituents that they are fighting hard to protect emerging technologies like "cloud computing." But legislators rarely understand cutting-edge technologies, and usually rapidly evolving technologies are poor candidates for legislative intervention. So legislators' efforts to push buzzword-laden legislation are often more for show than substance.
2) Regulatory exceptionalism. As I explain here, legislators keep creating new "exceptionalist" rules for subsets of the Internet ecosystem--online dating sites, social networks, cloud computing services, etc. We saw how well that worked in California's effort to ban employers from asking employees for social media login credentials. California so utterly failed at defining "social media" that it simply covered the entire Internet...and all non-networked electronic data too! Yet, legislators seemingly haven't learned from their colleagues' repeated failed efforts to precisely define the contours of some Internet subcommunity. The proposed CFAA amendment, and its gibberish definition of "cloud computing service," exemplifies this.
3) Code proliferation. For every problem, real or perceived, legislators think they can fix the problem with more regulatory code. But the manufacturing of new legal code exacts a toll of its own. This bill increases the CFAA's complexity with minimal or zero commensurate benefit. If Sen. Klobuchar or anyone else really wants to "fix" the CFAA, a good start would be to reduce the law's length, organize it better, and reduce its implications for users' ordinary Internet activity.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: amy klobuchar, cloud computing, privacy, regulations
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
Maybe some member of the cloud computing industry is trying to get themselves some sort of government-protected status?
[ link to this | view in chronology ]
Clueless
"reduce its implications for users' ordinary Internet activity." - They (she) have (has) no idea what that is. Hopefully they have kids over 11 to explain it to them.
[ link to this | view in chronology ]
Clueless
"reduce its implications for users' ordinary Internet activity." - They (she) have (has) no idea what that is. Hopefully they have kids over 11 to explain it to them.
[ link to this | view in chronology ]
Re: Clueless
[ link to this | view in chronology ]
Re: Re: Clueless
[ link to this | view in chronology ]
Re: Re: Re: Clueless
[ link to this | view in chronology ]
[ link to this | view in chronology ]
I have the solution
The service providers will then be granted a license to participate in this industry. If during their license period they choose to get involved in an additional service type, they will need to apply for these additional licenses.
These groups will have to re-register each year and of course pay a fee to help fund this new agency. If they cover multiple service areas a fee will be paid to each. Each service area will consist of government appointed experts to assist in any confusion a service provider has when trying to categorize itself.
If a fee is not paid in a timely manner the RIAA has the right to shut down your service. End of story.
I can't see anything wrong with my idea :)
[ link to this | view in chronology ]
Re: I have the solution
You forgot your /sarc
Marked funny anyway.
[ link to this | view in chronology ]
Cyber-Lawn's Rule of Law
[ link to this | view in chronology ]
Wrong answer
[ link to this | view in chronology ]
[ link to this | view in chronology ]
In all fainess
[ link to this | view in chronology ]
[ link to this | view in chronology ]
And republicans want the states to have more say, which is essentially creating multiple operating systems that all must somehow be compatible with each other.
Good thing you can't patent laws.
[ link to this | view in chronology ]
Re:
Not to seem like I am endorsing a party, but the other end is to have a country wide or world wide governance and if you think its tough to protest/change laws now, imagine when we are under a world government. The little guy then will really be a spec of sand in the desert.
I can learn multiple OS's and choose which is best for me.
[ link to this | view in chronology ]
Re: Re:
I am weneedhelp and I approve this message.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Like I really need to store my Data and Apps on some Server only to see it all taken down like what happened to all the legal users of MegaUpload.
I like my Desktop and my new VPN ! And I also like those various Forefox Plugins I use like better privacy,adblock,do not track,ghostery.............ETC.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Cloud computing definition
Why do you think that a UGC website qualifies under that, or a bank? I can't provision computing resources from YouTube, or my banks websites. (WordPress qualities, because I can rapidly roll out new copies of the "application" which is a type listed.)
If I try really hard, I can sort of imagine that as a user, a bank has to "provision" access to a computer (which is by definition configurable...) in order to service my request. But that's a long way from the plain reading which says I can provision configurable computing resources for myself to use.
Maybe it could be tightened up, to avoid maliciously wide interpretations, but for someone who isn't a lawyer (and is a developer), that definition is absolutely fine, and quite narrow compared to most uses of the term, which nowadays people seem to use for any website at all...
[ link to this | view in chronology ]
Narrow laws
It's like major international treaties. Why can't we have smaller, narrow and focused provisions to be signed and then gather then in a major treaty once it gets well tested and verified?
Surely my method have flaws but wouldn't it be better to narrow down the targets?
[ link to this | view in chronology ]