Rep. Zoe Lofgren Plans To Introduce 'Aaron's Law' To Stop Bogus Prosecutions Under The CFAA

from the one-step dept

There's been talk for years about fixing the Computer Fraud and Abuse Act (CFAA), which has been widely abused by law enforcement/prosecutors to claim that basically any use of a computer that did not fall under the explicitly allowed uses was a form of "computer hacking" -- and potentially a felony. This allowed for law enforcement to go after all sorts of people -- including anyone who did anything on a computer that their employer didn't like. Or anyone whosent spam. Or anyone who reported on a data vulnerability. Or anyone who just senta too many emails. These and many more cases mostly revolved around a stretched interpretation of the (outdated) CFAA, which suggested that simply violating a terms of service was the equivalent of "unauthorized access," and thus a "hacking" violation. Courts have so far been somewhat split on this interpretation, with some buying it and others not buying it at all.

The abuse of the CFAA has been seen in some high profile cases, including the one against Lori Drew, after a young girl, who was a friend of Drew's daughter, killed herself following a "dispute" with a fake profile of a boy that was really set up by Drew and some others. The court eventually tossed that out (though a jury convicted her). But it seems tragically ironic that a law that prosecutors once used (they claimed) to go after someone for bullying someone to commit suicide, is now itself being blamed for prosecutors' own bullying tactics, which many (including his parents) now insist led to the suicide of Aaron Swartz.

Congress has approved fixes for the CFAA in the past, but they've never made it all the way into law. The unfortunate, untimely and tragic death of Aaron Swartz may have brought back politicians' interest in making such a fix. Rep. Zoe Lofgren announced on Reddit her plans to introduce "Aaron's Law" to fix one glaring weakness in the CFAA: the idea that any terms of service violation is akin to hacking and fraud under the law. The draft bill rejects such an interpretation explicitly:

Section 1343 of title 18, United States Code, is amended by inserting after the first sentence the following: ‘‘A violation of an agreement or contractual obligation regarding Internet or computer use, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or employer is not in itself a violation of this section.’’

Hopefully, this new Congress can look at the unfortunate situation with Aaron (and many others) and how prosecutors are using the CFAA as a weapon to browbeat people they don't like into guilty pleas on garbage charges, and finally pass this much needed fix to the CFAA.

Filed Under: aaron swartz, cfaa, computer fraud and abuse act, zoe lofgren

Court: If You Use Your Computer For Anything Your Employer Doesn't Like, You May Have Committed A Crime

from the holy-crap dept

Last year, we've noted some seriously troubling interpretations of the Computer Fraud and Abuse Act (CFAA). The law is designed to deal with malicious computer hacking -- someone breaking into a secure computer and accessing secret or private info. Yet, it's been twisted time and time again (sometimes in very different ways by different courts). However, this latest ruling is simply ridiculous. It effectively says if you do anything on your employer's computer that the employer doesn't like, you've committed a federal crime.

In this case, the United States vs. Nosal, it involved an employee who accessed some information on a computer system from his employer (which he was perfectly authorized to access while employed there), which he wanted because he was going to a competitor and knew that info could be useful. Now, there may be issues there in terms of trade secrets and other contractual or civil issues, but is it a crime? And is it computer hacking? Amazingly, the court said yes (disagreeing with the lower court ruling). It argued that because he was using the computer for a purpose that was not "authorized" by the employer, his overall use of the system was unauthorized, and thus, no different than if he hacked in. Seriously.

Part of the court's decision relies on its interpretation of the word "so." You see, the CFAA (in part) notes that unauthorized access means "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." It then says that the all important "so" really means "in that manner," restating the law as "to obtain or alter information in the computer that the accesser is not entitled [in that manner] to obtain or alter." It then concludes that since the employer's policy did not allow employees to access the info for use by a competitor, this violates the law, and is a crime:

As long as the employee has knowledge of the employer's limitations on that authorization, the employee "exceeds authorized access" when the employee violates those limitations. It is as simple as that.

Except, it's not that simple. Lots of employers put silly restrictions on how employees can use computers, such as saying you can't do any personal surfing or check a personal email account. And yet, of course, plenty of people do just that. Should they be charged with being a federal criminal by the government? As Orin Kerr notes:

So it seems to me that under the majority’s reading of the statute, whenever any employer anywhere in the world puts any clear restriction of any kind on any computer -- computer including anything with a microchip, and even perhaps just a thumb drive — it is now a crime if the employee breaks the restriction. Sheesh, be careful out there, people. Whatever you do, don’t get on the wrong side of any Assistant U.S. Attorneys. And don't tick off your boss.

Filed Under: computer fraud, computer fraud and abuse act, hacking, laws

Courts Stretching Computer Hacking Law In Dangerous Ways

from the that's-not-what-it's-for dept

Michael Scott points us to a very interesting analysis of how to different appeals courts have very different interpretations of our federal anti-hacking law. The Computer Fraud and Abuse Act was passed by Congress to create criminal sanctions for malicious computer hacking. The problem, of course, is that whenever you have politicians passing laws about technology, they may be a bit vague. So, the way hacking was defined was effectively to say that the perpetrator accessed info "without authorization" or (more troubling) that the activity "exceeds authorized access." Now, it's pretty obvious what's meant by this. If you're breaking into parts of a computer system where you don't belong for nefarious purposes, you're probably violating this law.

But that's not how all courts are interpreting it. The article notes that the Seventh Circuit, in International Airport Centers, LLC v. Citrin, found that an employee violated this law by deleting information on his laptop (which would have presented evidence of a breach of contract by the guy), after he had resigned. Obviously, that's a totally different situation than what the CFAA was intended to cover, but the court found that once he quit, he was no longer authorized to use the laptop, and doing so was effectively hacking. That seems like an extreme stretch of the law. But at least some other courts are following suit:

For example, in a case in the U. S. District Court for the Eastern District of Missouri, the district court relied upon the Citrin decision and held that, even if employees were authorized to access their employer's computer records, they cannot use such authorization (and, hence, their access can become "unauthorized"), if they use the information for their own interests.... The court concluded that the employer sufficiently alleged that the employees "acted without authorization when they obtained [the employer's] information for their personal use and in contravention of their fiduciary duty to their employer."

Yes, you read that right. If you use your employer's computer simply to access the company's data for your personal use, you may be guilty of computer hacking. That's quite clearly not what the law was intended to cover.

Thankfully, the Ninth Circuit (which all too often comes out with weird decisions) seems to have gotten this one right:

In declining to adopt the Seventh Circuit's interpretation of "without authorization," the court held that a "person uses a computer 'without authorization'... [only] [1] when the person has not received permission to use the computer for any purpose (such as when a hacker accesses someone's computer without any permission), or [2] when the employer has rescinded to access the computer and the defendant uses the computer anyway."... The Ninth Circuit declined to hold that the "defendant's authorization to obtain information stored in a company computer is 'exceeded' if the defendant breaches a state law duty of loyalty to an employer" because no such language was found in the CFAA.... The Ninth Circuit noted that because the CFAA was "primarily a criminal statute," and because there was ambiguity as to the meaning of the phrase "without authorization," it would construe any ambiguity against the government....

Obviously, I agree that this is the proper interpretation of the law -- and stretching the definition of criminal hacking "without authorization" to things like accessing personal information on an employer's computer is dangerous. Of course, with the split rulings, it's likely that eventually this will get to the Supreme Court to sort out, and hopefully they get it right. Or, in the meantime, Congress could clarify the law -- but chances are they'd just make it worse.

Filed Under: computer fraud, computer fraud and abuse act, hacking, laws

Minnesota Public Radio Reporter Faces Hacking Charges For Reporting On Data Leak

from the federal-shield-law? dept

We were just noting how the Computer Fraud and Abuse Act is regularly abused to bring "hacking" charges where none are really warranted. And here we have yet another example. Alex Howard points out that a Minnesota Public Radio reporter, Sasha Aslanian, is potentially facing "hacking" charges from a Texas company called Lookout Services. Lookout creates employment/compliance software for large organizations, and Aslanian was reporting on a supposed data vulnerability in the software used to verify employment eligibility that could potentially reveal private info. Aslanian's report noted that she was able to see info from the state of Minnesota, and the state was now directing agencies to stop using Lookout. The details are not entirely clear, but from what's written at the MinnPost link above, it sounds like there were some vulnerabilities, poor security, and a bungled demonstration which revealed a vulnerability -- all of which Lookout admits -- and from those vulnerabilities (which Lookout claims it closed), someone was able to adjust the URL to find private data.

So, basically, the company admits to a series of vulnerabilities, which exposed info that allowed the reporter to eventually see some private data... but still claims that the reporter was "hacking" and is now looking to sue under the same Computer Fraud and Abuse Act, which could lead to 5 years in prison. Because our federal government still hasn't passed a journalism shield law, the reporter is potentially liable, though, as the MinnPost reporter notes, Lookout seems particularly shortsighted in bringing this lawsuit in the first place. All it does is call more attention to its own vulnerabilities and failings. And the CEO of Lookout basically responds that she doesn't care:

While the legality and severity of Lookout's security breach remains to be adjudicated, there's no doubt Aslanian was trying to serve the public interest -- something a prosecutor might consider. As Dalglish says, "The state of Minnesota should be grateful MPR exposed what's going on. It seemed like a pretty good story."

I asked Morley if she realized, by filing a high-profile suit, how hapless her timeline made Lookout look. After all, there's the webinar screwup, letting clients pick lame IDs/passwords and caching security credentials in such a way that rendered them useless.

"Yup," she admitted. "It was a perfect storm that came together. Our communication with the state really broke down -- in our contract, we had 60 days to fix any problem. But there was still an unauthorized intrusion, and that was wrong."

So, even though this will publicize not just Lookout's failings, but also how it responds to people who notice and report on vulnerabilities, the company still thinks it needs to bring a lawsuit because exposing those vulnerabilities "was wrong"? I would argue that the company's reaction to this gives many more reasons never to do business with Lookout -- more than any discovered vulnerabilities. Vulnerabilities in software happen -- and it's more telling how a company reacts when they're exposed. Suing those who expose them isn't what you want to see. Update: Lots of good points in the comments, pointing out (of course) that Lookout cannot bring criminal charges against the woman, only prosecutors could do that, and it seems unlikely they would do so in this case.

Filed Under: computer fraud and abuse act, data leak, hacking, reporting, sasha aslanian, shield law
Companies: lookout

No, Sending Spam Text Messages Is Not The Same As Hacking Someone's Phone

from the misusing-computer-fraud-law dept

There's just something about the Computer Fraud and Abuse Act -- the "anti-hacking" law in the US -- that seems to leave it open for abuse in lawsuits. This is the law that was used to convict Lori Drew. Even though the judge eventually tossed the ruling, it showed how the broadly-worded law could be applied in dangerous ways. Still, at least some attempts at twisting the law aren't getting very far. For example, a woman in Minnesota tried to use the law against a company that sent her spam text messages she never requested, and discovered that in order to bring a case under a law, you have to actually show that the law was broken:

Plaintiff brings three possible claims: (1) a claim for obtaining information from her phone; (2) a claim for transmitting information or code through her phone; and (3) a claim for "accessing" her phone.

Information Claim: The court rejects the information-based claim because there's no information that WSOD allegedly obtained through accessing the plaintiff's phone. Plaintiff analogizes to websites and argues that any time someone sends a message to a mobile phone, information is "obtained" in the same way that information is obtained any time someone accesses a website. The court rejects this analogy, finding that "there is a fundamental difference between viewing websites and communicating with wireless devices such as cell phones by sending text messages." Even if the transmission of an unwanted text message somehow resulted in the "obtaining of information," the court concludes that there's no loss as a result of defendant having obtained the information.

Transmission Claim: The transmission claim requires plaintiff to allege that WSOD caused the transmission of code or information and as a result "intentionally caused damage without authorization" to plaintiff's device. The complaint fails on both counts. There wasn't a credible allegation of damage (there was no allegation of impairment to the machine) or of WSOD's intent to cause the damage.

Access Claim: The court rejects the access claim since plaintiff does not adequately allege that the unauthorized access was intentional.

So, nice try, but no dice. Someone sending unsolicited text messages to your mobile phone may be annoying (and potentially illegal under other laws), but it's not hacking under the Computer Fraud and Abuse Act.

Filed Under: computer fraud and abuse act, hacking, spam