EFF Files Brief In Support Of 'Cannibal Cop' To Keep The CFAA From Becoming Even MORE Abusive

from the strangest-of-bedfellows dept

The US legal system took a step towards criminalizing thought when a New York court convicted a former NYPD officer of conspiring to kidnap, rape, kill and eat 100 women. The evidence against Gilberto Valle included chat logs and internet searches.

The details uncovered were nightmarish. But at the end of it all, it only amounted to Valle giving his very vivid imagination a long leash. On appeal, the court overturned the conspiracy charges, stating that Valle's "conspiracy" was little more than thoughtcrime, something the legal system isn't* in the business of punishing. (And yet, "conspiracy" remains a valid criminal charge -- one used extensively by the FBI to bag its handcrafted "terrorists." Go figure.)

*About a million caveats apply.

But the court left one charge on the table: a CFAA violation. During the course of Valle's fantasizing, he used police databases to look up information on one of his "victims." This, of course, is an egregious abuse of his position and access, but it is not -- as the EFF argues -- a CFAA violation.

Despite acquitting Valle on the conspiracy charge, the court upheld the CFAA conviction, believing that the restrictions placed on Valle concerning the database—which permitted him to access any part of the database as long as it was for a valid law enforcement purpose—was an access restriction, not a use restriction, simply because of the way the restriction was phrased. The distinction between "access" and "use" restrictions is critical because serious prison time is at stake. Congress clearly intended the CFAA to criminalize the act of breaking into computer systems a person is not allowed to be in otherwise, but violating a use restriction—a (usually written) policy that governs the purposes for which someone can use their access—is clearly not that.

The EFF has filed an amicus brief in Valle's case (now before the Second Circuit Court), arguing for this charge to be overturned as well. In it, the EFF points out that Valle's unauthorized access didn't involve him actually breaking into the NYPD's computers -- a key element of CFAA charges. Instead, he already had access. He just didn't have permission to do what he did.

So, while Valle's abuse of his access was certainly immoral, possibly illegal under a New York state law, and a clear violation of NYPD policy, it was not the sort of circumvention Congress had in mind when it crafted the bill. There should definitely be consequences for this activity (including Valle being subject to civil rights lawsuits from the violated party[ies]), but there definitely should not be a finding that violating an internal use policy is a federal crime.

As it stands now, the decision reached by the lower court poses a serious threat to nearly anyone with access to computers/networks provided by their employers.

Most critically, the court set a dangerous precedent. As we’ve repeatedly warned, this theory of CFAA liability gives employers and website owners the power to make behavior illegal through simply adopting use restrictions in their corporate policies or terms of use, which in turn criminalizes a broad range of innocuous everyday behaviors—like checking personal email or the score of a baseball game.

It's the worst cases -- ones with less-than-sympathetic defendants -- that result in the worst precedents. Valle's extended, detailed cannibalistic fantasies are hard to defend, even knowing that he never followed through with the lurid plans he dreamed up. Free speech is toughest to defend when it's composed of brutal and depraved fantasies that include any number of hideous criminal acts. But the lower court saw it for what it was: thoughts, not deeds.

Now, there's one detail left, but it's hardly a minor one. The remaining charge -- if left standing -- seriously lowers the bar for criminal charges under the CFAA, a law that is already severely flawed. And so, the EFF joins the battle on behalf of a former NYPD officer who abused his position to further his violent fantasies in hopes of protecting far-more-centered members of the general public from abuse at the hands of a broken law.

Filed Under: cfaa, computer hacking, gilberto valle, misuse, nypd, unauthorized use
Companies: eff

BSA Releases Latest Stats; Stands By Same Old Story

from the we've-heard-this-before,-haven't-we dept

Every year around this time, the Business Software Alliance (BSA) comes out with a report, put together for the BSA by IDC, about software "piracy" statistics. Every year, since 2004 I call them out on how misleading many of the stats are (or, more specifically, I jokingly refer to the BSA as Bogus Stats as Always). At times, even IDC, who puts the report together for the BSA, has admitted that the BSA has tended to misrepresent the results -- and yet IDC keeps putting together the report every year. The good news, honestly, is that over the past few years, we've seen a changing trend in the coverage of the reports on these numbers, in that more people are calling the BSA out for using the numbers in a misleading way. The BSA, to its credit, has at least tried to be more conscious of how it presents and explains its numbers... sometimes.

Perhaps because of this, in advance of the release of the latest report today, the BSA reached out to me (and I'm sure plenty of others as well) to talk about the report and address any concerns. I spent half an hour on the phone this afternoon with Neil MacBride, the BSA's VP of Anti-Piracy and General Counsel. With him was Marcel Warmerdam an associate VP from IDC. I really appreciate the two spending the time to discuss the latest study with me -- as (this should come as no surprise) we didn't agree on very much.

The report itself seems pretty similar to what's come out in previous years. IDC does a rather credible job in determining the rate of unauthorized use throughout the world. The report this year highlights the fact that the rate of unauthorized use appears to be falling in many countries while rising in a few rapidly developing ones (Brazil, Russia, India and China). This is no surprise, as it's pretty much what anyone watching this market knows happens. I have no problem with the reporting on the rate of unauthorized usage.

Where things get problematic, however, is when the report starts to look at the impact of such things. The report itself shifts back and forth between "retail value of the software" and "losses" as if they are one and the same. By now, it should be quite clear that they are not the same. My second problem is that the report also ties these faux "losses" to a separate IDC report claiming that a drop in unauthorized usage of software would increase jobs, increase revenue in the IT sector and increase taxes. That's inaccurate for a variety of reasons, specifically in that it double-counts the impact of certain things and also only counts the "ripple effects" in one direction.

I raised these questions to both Neil and Marcel, and the summary of the call as Marcel noted at the end is that we'll have to agree to disagree. We didn't discuss the ripple effects issue, because that's actually from a different study than the one released today (though, the one today does reference that report to back up its claims -- which is why I brought it up). However, Neil and Marcel defended the "losses" claim by pointing out that plenty of companies out there (they kept pointing to large companies) would go out and buy the software if they had no other option. Indeed. And, I would probably go out and buy lunch at Pizza Hut if I had no other options, but we don't count it as a "loss" for Pizza Hut when I go eat at McDonalds instead. The fact is that there are other options -- even if some of them break the license agreements. My point is that this is a business model issue that the industry needs to deal with by giving businesses positive reasons to pay, rather than threatening to whack them with a legal stick.

However, what became clear in talking to Neil was that the BSA really does seem to believe that the majority of these unlicensed uses really would be paid for -- which seems like a highly questionable claim. We also very much disagreed over calling unauthorized use of software "theft" (he says it is, and tossed out the old favorite about how it's no different than taking a CD or a pack of chewing gum out of a store). He specifically said "software is a tangible good." The problem is that this is simply not true. I'm sure plenty of software companies and the BSA itself would like it to be a tangible good -- but it is not, and no amount of pretending makes it so.

In the end, Neil suggested that maybe this is a "generational" thing (I guess I'm the young whippersnapper), which I don't think is accurate either. I think it's really more of a business model thing. The companies that make up the BSA have relied on a particular business model for many, many years. That business model depends on government-granted monopolies that allow them to create artificial scarcity. They like that business model and don't want it to go away. However, the market is shifting, and it's shifting due to companies recognizing the fundamental characteristics of software being infinite, which allows them to implement other business models that don't rely on artificial scarcity. We're seeing it all the time, even among some companies who are members of the BSA. IBM, for example, has learned that its real money-maker is in services, and free software helps build that market. Red Hat has shown a similar business model on a smaller scale. And Google, which is a software company (even if people don't realize it), has shown an entirely different model to make its software extremely profitable in a way that "piracy" is of no concern.

The more the BSA talks up fundamentally flawed "losses" the more difficult it makes it for many of its members to recognize that the market is changing, and they need to change their business models with it. The less these companies focused on made up "losses" and the more they focused on creating business models where there are good reasons for companies to pay money, the more they'd realize that unauthorized use isn't the problem at all. With the BSA reports on losses, though, too many of these companies are taught to think that the problem is elsewhere (those darn pirates), rather than in how they view the market themselves. And, that, fundamentally, is dangerous for the BSA's own members. So, I very much appreciate both Neil and Marcel for reaching out and taking the time to talk with me, and responding to my criticisms -- and I hope to continue the conversation with them. But, they did little to change my feelings about the BSA report and its misleading nature.

Filed Under: bsa, losses, piracy, software, unauthorized use
Companies: bsa, idc