Ethics-Rules for Computer Crime

Rules for Computer Crime

When someone steals a piece of property, there is seldom a question whether a crime has been committed. But Randal Schwartz clearly did not think he did anything wrong, and many disinterested observers in the system-administration community at the time agreed. Similarly, while Aaron Swartz certainly knew he was bypassing something, many have claimed he had no reason to think what he was doing might be criminal.

Terry Childs may not have intended to be cooperative, but it seems clear he had no idea that he could end up in prison for four years. Jeremy Hammond certainly appears to have understood some might see his actions as criminal, but he felt what he was doing was a form of civil disobedience.

Certainly some judges and many prosecutors feel that they are quite capable of determining which computer crimes are “serious” and which are not. Should the rest of us trust their discretion? Crimes involving firearms are given hefty additional penalties; should the same be true of crimes involving a computer?

The CFAA criminalizes “unauthorized access”. This makes sense by analogy with physical property, but there is quite a bit of ambiguity as to what constitutes “unauthorized” access to a computer. Unauthorized use of physical property pretty much means stealing it; unauthorized use of a computer can cover a wide range of things.

For example, the CFAA, in theory, criminalizes creating a second Facebook account, or use of Google search by minors before the terms-of-service change on March 2013. These uses are explicitly “unauthorized” by the sites’ terms of service. When Bidders’ Edge got in trouble with E-Bay for collecting data about E-Bay auctions, it was because they had to create E-Bay accounts to get access to the system, and they used these accounts in ways contrary to the E-Bay terms of service. Using a workplace computer to check out Facebook, or even to check news headlines during lunch, is often “unauthorized” by your employer, and thus an unauthorized use of an employer-owned computer.

On the other hand, Lori Drew was acquitted of violating the MySpace terms of service, in a case in which Drew created a fake MySpace account that may have contributed to the suicide of Megan Meier.

Here is the central question: is a law against “unauthorized access” a good idea, or must there be some other standard as well, and, if so, what? Some possibilities are
the perpetrator caused actual harm (a problem with this approach is that harm is notoriously hard to evaluate)
the perpetrator acted with malicious intent, ie intent to cause harm (the government would have trouble proving that for most of our examples here)
???
Another way to summarize this question is simply “Is the CFAA too broad? If not, why? If so, how might it be fixed?”

A closely related question is that of restitution: should a hacker be obligated to pay costs that clearly are part of normal security procedures? Sometimes hackers are asked to repay system owners for the costs of basic retroactive patch installation.

A brief argument in favor of the CFAA approach is that computer crimes often have unforeseeable effects, and so a very broad proscription is in order.