Hackers are 'Terrorists' Under Ashcroft's New Act

Carlos writes "Most computer crimes are considered acts of terrorism under John Ashcroft's proposed 'Anti-Terrorism Act,' according to this story on SecurityFocus. The Act would abolish the statute of limitations for computer crime, retroactively, force convicted hackers to give the government DNA samples for a special federal database, and increase the maximum sentence for computer intrusion to life in prison. Harboring or providing advice to a hacker would be terrorism as well. This is on top of the expanded surveillance powers already reported on. The bill could be passed as early as this week. I feel safer already."

Re:Somebody has to say it, but...

who are the victims?

stop and think.

if someone commits credit card fraud with said stolen numbers, then we know who the victim is. but we already have a law for that. until some other crime is committed, there was no victim of simply stealing the numbers.

just because a computer was used to commit the crime, it doesn't mean the crime is somehow worse than the same thing done without a computer. theft is theft, and should be treated as such. it's not like we have separate murder laws for guns vs knives...

Re:Somebody has to say it, but...

I read an interesting statistic the other day, in the UK there's about £270,000,000 of credit-card fraud a year, of which only £7,000,000 happens without someone physically presenting a card in a shop - i.e. that 7 mil includes not just all the internet fraud but all the stuff on the telephone as well.

Of course this is all well known. Best way to hack into a network? Get a job there as a Janitor and find a computer that wasn't logged out of.

Anyhow, criminal Laws can be divided into two categories, I've always though:
Laws that prohibit things that are bad.
Laws that might make it easier to enforce the former laws.

So, killing people is bad, so it's illegal.
Owning a gun isn't bad, but making that illegal is believed to make it easier to enforce the killing people law.

Copyright theft is bad. Being able to back-up an acrobat document isn't bad, and in Russia is actually a right, but DCMA is supposed ot mkae it easier to enforce the "no stealing copyright materials" law.

Re:Somebody has to say it, but...

How about growing marijuana?
That is an excellent example of a victimless "crime" that numerous goodhearted American people are rotting in jail for right now.

Ashcroft's new proposals, though, go far beyond making computer-crime 'crime'. It already is. What he's doing is making it terrorism. People could be jailed for life for the electronic equivilent of graffitti.

"I don't believe that our definition of terrorism is so broad," said Ashcroft. "It is broad enough to include things like assaults on computers, and assaults designed to change the purpose of government."

The irony is that he wants to fight assaults designed to change the purpose of government by changing laws in direct response to a terrorist attack.

The long-term damage from the terror attacks will come from our leaders as they exploit public rage to slip new crap like this into federal law.

Re:Nobody has to say it, but...

Constitutionality will be questioned and laws like these, along with the careers of the idiots who propose them, will go the way of the dodo.

If we're lucky, the laws will go that way. I sincerely doubt that the careers of the idiots will, though.

What we need in the US is a law that punishes those who pass blatantly unconstitutional laws. Of course, since Congress routinely exempts themselves from legislation, they'd exempt themselves from this, too!

Re:Somebody has to say it, but...

also consider Bush's recent comments concerning the New War on Terrorism:

1. it will be a long war
2. it will be a secretive war
3. the U.S. government will not necessarily reveal evidence against the terrorists they uncover.
4. the U.S. government expects all other governments to comply and assist with its anti-terrorist actions.

now make hacking terrorism.
now make assisting hacking terrorism.
now make hacking crimes retroactively punishable.

i've read bugtraq for years and have not informed the FBI about all the vulnerabilities released on that mailing list - will this make me negligent and punishable? will my punishment come in the form of an official court prosecution, or will special forces be sent in to take me out without ever letting anyone else know? if i move to Norway, will Norway allow the Navy SEALS to seize me?

Beware, that unmarked white van may be coming for you.

Yeah, sure, very paranoid to think that way, but consider history and consider how other police states have started their lives: will we be naive enough to let this one start as well?

Re:Somebody has to say it, but...

Stab somebody with a knife and kill them, and odds are you'll spend 20 years in jail, tops. Maybe more if you use a gun, or stab somebody famous, but as any U.S. citizen can tell you, even life sentences for violent crimes rarely live up to their name.

Break into their computer, and you're instantly labelled a terrorist. Think there's any chance you'll get much less than the maximum penalty of life? Hell, my high school once informally accused me of piracy (which, incidentally, I was not guilty of) just on the basis that I knew enough and therefore could have done it. If there's anything that makes people paranoid, it's hearing that the Big Bad Hacker is right outside their computer's door.

Fair, no?

Re:Here's the story.

As a "Federal terrorism offense," the five year statute of limitations for hacking would be abolished retroactively -- allowing computer crimes committed decades ago to be prosecuted today

This can't be the case...haven't the people who thought this up run across this passage before?

No bill of attainder or ex post facto Law shall be passed.

- United States Constitution, Article I, Section 9 [cornell.edu], paragraph 3

You can't prosecute an action that wasn't a crime at the time the action occurred. Then again, with the body blows the Constitution has taken in recent times (mainly in various parts of the Bill of Rights, especially the First, Second, and Tenth Amendments), maybe the drafters of this legislation haven't run across this passage before.

Re:Here's the story.

I'm going to mail copy of the Consitution to Senator Feinstein (D-CA). It's obvious from her actions in the Senate that she has never set eyes on a copy in her life.

I propose a new Constitutional amendment. The Three-Constitutional Strikes And You're Out amendment. If an elected official votes for three laws that are later found unconstitutional (no statue of limitation, applied retroactively), they are kicked out of office and barred from all government work for life. These people are supposed to know what they are doing and have no fucking excuse for voting for unconstitutional laws.

Re:Somebody has to say it, but...

Seriously-- why _shouldn't_ computer crime be crime?

Computer crime should be a crime.

But it already *is* a crime. The question is what is a just response to computer crimes. Some things which are *not* just:

• Sentencing someone to lifetime imprisonment without possibility of parole for a simple computer crime. Remember, if the crime really warranted such a sentence--for example, cracking air traffic control and causing planes to crash into each other; cracking a CIA computer and stealing national secrets--then the criminal would already be liable for serious punishment under existing laws--murder and espionage, in these cases.
  
  
• Retroactively eliminating the statute of limitations, allowing people to now be charged with computer "crimes" they committed decades ago.
  
  

What's even worse is the provision that giving advice or information which may be used to facilitate computer crimes is not only criminalized but subject to the same penalties.

To put it another way, if this law passes then someone could be given life in prison without parole for documenting vulnerabilities which allow systems to be compromised by a cracker or a worm. Indeed, it isn't clear that, with the removal of the statute of limitations, they couldn't charge the people documented the vulnerabilities responsible for eg. Code Red or Nimda under this law.

This provision is like the anti-circumvention provision of the DMCA writ large. Whereas at least the DMCA only applies to access-control restrictions on copyrighted material, this law could potentially make all discussion of any vulnerabilities which allow systems or information to be compromised illegal.

These provisions are so utterly preposterous and out of proportion to the crimes (or so-called crimes) discussed as to boggle the mind.

oh, crap...

Damn, we /.'ed the securityfocus server... that's a DOS attack, isn't it?

Quick, smash your DSL modems, clear your logs, and run for the hills before the Feds arrive!

Umm, Thats not right...

Providing advice to a Hacker == criminal offense? Doesn't legal counsel count as advice? Isn't that protected under the 5th ammendment?

Flying Instructors

I assume you know that *all* flight training is currently banned in the USA? Yes, that's right. If you are a flying instructor, currently *you cannot* train students.

Well, you won't go to jail. But the FAA will take your pilot's license away. If you are a pilot, that's nasty. Check out news://rec.aviation.pilots for more.

Without passing a law, without recourse to a *single* elected person, thousands of US citizens have had their source of income removed.

Well, that makes us all safe doesn't it?

Re:Umm, Thats not right...

> Providing advice to a Hacker == criminal offense?

"If you have programming skills, get the fuck out of the States and take your skills with you. Your country obviously doesn't want you anymore."

(Am I now a felon?)

Ouch!

I conduct Penetration Testing and Vulnerability assesments for a living.

All it takes is one bad customer relationship to cause a false accusation...

jeremiah cornelius

Re:Ouch!

Husband: No, it wasn't an affair, per se. I was actually conducting some Penetration Testing and Vulnerability Assesments on her.

Boy, was she vulnerable! Glad I was able to help her out, really!

My DNA?

Why in the world would they need DNA. I am pretty sure that no where in the specs for DNS or IPv4 is it required that my genome sequence be part of the string being sent out.

So, who wants to take bets that the RIAA get's copyright violaters termed as hackers?

Re:My DNA?

So they can get your DNA off of that public anonymous terminal keyboard you used to used, duh. Be sure to use rubber gloves and scrape dead skin off like in Gattica from now on.

Re:Six degrees of separation.

Actually, criminal statutes have to be pretty explicit. You can't convict someone of a crime unless it's on the books. If goose-whacking is a crime, and you try but fail to whack a goose, they can't convict you of attempted goose-whacking, because there's no law against attempted goose-whacking. If you talk to people about your plans to whack a goose, they can't convict you of conspiracy to commit goose-whacking because there's no law against conspiring to goose-whack.

Naturally, it takes a politically-connected DA about a month to remedy the situation, particularly if goose-whackers are a mostly misunderstood minority...

Now hang on just a sec...

I don't mind increase survelance powers in order to fight terrorism. However, scrawling "I love you Crystal" or some such on some web page is not terrorism.

This thing needs to at least be tempered by a clause which adds or defines criminal intent. That is, if hacking is done with the intent to destroy or disable the United States government and/or make actual acts of terrorism (such as blowing people up) easier, then throw the bastards in jail. But defacing some web site doesn't harm the United States government; it's just annoying as hell. And annoying doesn't deserve life in prison without the possibility of parole--especially since actually killing someone is what I would consider slightly more annoying, yet many types of murder don't get anywhere near life.

Re:Now hang on just a sec...

I don't mind increase survelance powers in order to fight terrorism. However, scrawling "I love you Crystal" or some such on some web page is not terrorism.

I've said this before, but it's worth repeating. The laws that apply in the real world should apply in the cyber world.

Defacing a web face is the same as spraying some grafitti on a wall. Stealing credit card numbers or private information is the same as theft. Bringing down a government web site is sabotage. These should be dealt with the same as they are in the real world.

Defacing a web site is vandalism, and therefore should be treated as a misdemeanor. Stealing credit card numbers or private information would be a misdemeanor or a felony depending on how much was stolen and how much it's worth. Sabotage, deliberate, willful destruction of government property, including websites, *is* terrorism and should be dealt with as such.

I don't see why this is so frickin' hard. :-)

what about bugtraq?

I don't know much about how this bill would be interpreted were it to come to law, but it seems to me that making security bugs known to the general public could be construed as giving advice to a hacker since, well, it alerts the general public to security problems.

perversion

This is a perversion of what Ashcroft requested. Hackers who attempt to disrupt key systems that are vital to protecting human life, for example the FAA's radar systems, are terrorists. And they are.

Re:perversion

> This is a perversion of what Ashcroft requested. Hackers who attempt to disrupt key systems that are vital to protecting human life, for example the FAA's radar systems, are terrorists. And they are.

On that, we agree.

Upon reading the draft bill, I'm not happy with all of the provisions in the bill, but I really don't see anything that says "guy with programming sk1llz == terrorist."

I do see an expansion of The List Of Bad Things We Can Do To Felons (such as DNA sampling), but that's a far cry from "all [cr]ackers are terrorists", let alone "all Hackers are now terrorists and will have to give up DNA samples".

Indeed, only crackers who attack "protected systems" (meaning .gov and .mil boxen - not the d00d who hax0rz the average web site) appear to be in line to get their asses handed to them on a silver platter under this Act, and those provisions I can support. (Hell, those are about the only provisions I'd support ;-)

Earlier, I made a post that said "If you've got programming skills, get the hell outa here." I retract that post. This bill, while odious for many means, is not a declaration that American doesn't want its programmers anymore.

Serves me right for replying to /. before reading the fscking article ;-)

CFAA Applies TO EVERY COMPUTER

Indeed, only crackers who attack "protected systems" (meaning .gov and .mil boxen - not the d00d who hax0rz the average web site) appear to be in line to get their asses handed to them on a silver platter under this Act, and those provisions I can support. (Hell, those are about the only provisions I'd support ;-)

You are so wrong you can't believe it. The CFAA defines a "protected computer" to mean a computer that is used in interstate commerce. This means any computer connected to the internet or a modem.

I have litigated CFAA civil actions, and I am here to tell you that virtually ANY unauthorized access where virtually ANY valuable information is received, or where ANY valuable data is modified or changed is quite arguably sufficient to lay down a prima facie case.

This bill is as bad as you first thought it was.

Re:perversion

No, it isn't.

From the bill:

"(19) `protected computer' has the meaning set forth in section 1030

"(20) `computer trespasser' means a person who accesses a protected computer without authorization and thus has no reasonable expectation of privacy in any communication transmitted to, through, or from the protected computer.";

From Title 18 Chapter 47 Sec. 1030:

(2) the term ''protected computer'' means a computer -

(A) exclusively for the use of a financial institution or the
United States Government, or, in the case of a computer not
exclusively for such use, used by or for a financial
institution or the United States Government and the conduct
constituting the offense affects that use by or for the
financial institution or the Government; or
(B) which is used in interstate or foreign commerce or
communication;

Used in interstate or foreing communication? How many of you connect to machines and/or through machines without crossing state lines?

Further from the bill:

""SS 25. Federal terrorism offense defined

"As used in this title, the term `Federal terrorism offense' means a violation of, or an attempt or conspiracy to violate-

-snip-
1030(a)(1), (a)(4), (a)(5)(A), or (a)(7) (relating to protection of computers)
-snip-

Okay, so now *maliciously* breaking into basically any computer system is a terrorist act. Couple this with the rest of the increases in anti-terroism this bill contains, and you're doing *LIFE* in FEDERAL PRISON (aka "no parole") because your Anti-CodeRed Perl script took down some dipshit's enterprise server. Meanwhile child molestors get time off for good behavior.

I don't think anyone thinks "computer crime" shouldn't be punished. Just not to this ridiculous degree.

Re:perversion

but this law doesn't effect me, because i don't hack into financial or government computers. Hell I don't hack any computers.

Excuse me, but you are quite likely to be wrong. Was your computer, or any computer in your possession, infected with Code Red or Nimda? If so, and if it scanned any computers outside of your state, then it's not really a stretch to say that you were outside of the law.

OK, so as a Slashdot reader, you are less likely to be affected by the above. But how many of your friends were?

Also, this bill will eliminate the statute of limitations on these crimes and allow retroactive prosecution. Therefore, anybody who got Code Red or Nimda can quite plausibly be put in jail for life.

Would they win on defense? Maybe, but they're in jail until the trial is over. And maybe they won't win on defense...

This law hands the power to imprison damn near anyone running Windows IIS over the US government, such that only a lawsuit (inevitably protracted) would get them out.

Who still believes this is about preventing terrorism? What a sick joke! Frankly, I think those proposing this bill are traitors to the United States.

A backwards approach to legislation

This act and the DMCA are eerily similar. Both seek to address particular historical circumstances and events (e.g. Napster, terrorist attacks). Both sets of circumstances are genuinely complex and problematic. And, in both cases, there were already perfectly adequate laws more general laws which address the particular situation. We already have laws to address copyright violation, and we already have laws to convict violent criminals, spies, and yes...even hackers.

The DMCA and all these supposedly anti-terrorist laws, past and present, take a terribly backward approach to lawmaking. The best laws, like the best software, succeed on minimality and generality. Witness the excellent US constitution, which has been extremely effective considering how long it's been around. The constitution uses very broad terms -- "life", "property", "punishment", "vote" -- and very few specific terms. (Some parts are quite specific, like the quartering of soldiers bit. They seem very quaint now.)

Laws, like software, tend to break if they are designed in specificity but used in generality. The trouble with these new laws is that they create all kinds of special cases and extra circumstances designed for a particular moment in history, which we'll have to support for decades or even centuries. The new terrorist laws, in a way, are like the 640k RAM limit -- they seem good enough for now, but in the future, they'll cripple and break all kinds of things.

The difference is, in this case, it is our fundamental freedoms that are being to get crippled and broken. As always, please please please call your representatives and give them a piece of your mind. They are under a lot of pressure right now, and they need to hear from sensible people.

So murder is less of an offense than hacking?

Basically, if this were to be passed, it would tell the public that cracking/hacking is considered to be worse than murder. They even go so far as to say that giving advice to a cracker/hacker can yield life in prison! Is it just me, or is something seriously wrong here? I could go off and murder somone and receive less of a punishment than someone who defaced a website, resulting in a few hours of repairs by the administrator and the fixing of a securty hole. I'm sorry, but that's just not right.

Does that include ... ?

Anyone making life easier for a "hacker" (cracker) could be sentenced to life without parole?

Bill Gates had better pack his bags now! ("... the most cigarettes.")

Not broad enough!

Testifying before the House Judiciary Committee, Ashcroft defended the proposal's definition of terrorism. "I don't believe that our definition of terrorism is so broad," said Ashcroft. "It is broad enough to include things like assaults on computers, and assaults designed to change the purpose of government."

Seems like this bill needs to be broadened to include itself and John Ashcroft, both of whom seem hell-bent on changing the purpose of government.

List of contacts

Judiciary Committee List
Name, party, state, phone, fax, e-mail.

James Sensenbrenner, Chair, R-WI, [phone],[phone],[e-mail]
Henry Hyde, R-IL, [phone], [phone].
John Conyers Jr., D-MI, [phone], [phone],[e-mail]
George Gekas, R-PA, [phone], [phone], [e-mail]
Barney Frank, D-MA, [phone], [phone]
Howard Coble, R-NC, [phone], [phone], [e-mail]
Howard Berman, D-CA, [phone], [phone],[e-mail]
Lamar Smith, R-TX, [phone], [phone]
Rick Boucher, D-VA, [phone], [phone],[e-mail]
Elton Gallegly, R-CA, [phone], [phone]
Jerrold Nadler, D-NY, [phone], [phone], [e-mail]
Bob Goodlatte, R-VA, [phone], [phone],[e-mail]
Bobby Scott, D-VA, [phone], [phone]
Steve Chabot, R-OH, [phone], [phone]
Mel Watt, D-NC, [phone], [phone], [e-mail]
Bob Barr, R-GA, [phone], [phone], [e-mail]
Zoe Lofgren, D-CA, [phone], [phone], [e-mail]
William Jenkins, R-TN, [phone], [phone]
Sheila Jackson Lee, D-TX, [phone], [phone], [e-mail]
Christopher Cannon, R-UT, [phone], [phone], [e-mail]
Maxine Waters, D-CA, [phone], [phone]
Lindsey Graham, R-SC, [phone], [phone]
Marty Meehan, D-MA, [phone], [phone], [e-mail]
Spencer Bachus, R-AL, [phone], [phone]
William Delahunt, D-MA, [phone], [phone], [e-mail]
John Hostettler, R-IA, [phone], [phone], [e-mail]
Robert Wexler, D-FL, [phone], [phone]
Mark Green, R-WI, [phone], [phone], [e-mail]
Tammy Baldwin, D-W, [phone], [phone], [e-mail]
Ric Keller, R-FL, [phone], [phone]
Anthony David Weiner, D-NY, [phone], [phone]
Darrell Issa, R-CA, [phone], [phone]
Adam Schiff, D-CA, [phone], [phone]
Melissa Hart, R-PA, [phone], [phone], [e-mail]
Jeff Flake, R-AZ, [phone], [phone]

So let's do something about it

OK, a lot of people are crying that the sky is falling, that the jack-booted Nazis are at the gates in Washington (both the East Coast one and the West Coast one), that the totalitarian Big Brother is at hand. Is it? Hell, I don't know, but I'd rather not find out. This is still a democracy, folks, that means YOU have power. Even between elections, you have power. Because politicians, whatever else they are interested in (money, power, actually helping people, getting blowjobs from secretaries), are interested first and foremost in one thing: Getting reelected. Make them think that if they pass something asinine and unconstitutional, that there WILL be repercussions. Yes, scare the bejebers out of your congressman/woman and senator.

It takes TEN letters (dead tree letters, email gets deleted immediately) for a Senatorial office to open an issue. TEN. (According to Illinois Senator Dick Durban.) And regardless of the advertising and commercials that politicians raise huge war chests to fund, on election day it is YOUR VOTE that decides who ends up in DC. (East Coast, you have no say over the West Coast one.)

I'd like to issue a call to everyone who posted something modded up to 3 or above: Write a letter to your representatives with the same level of intelligence and Interesting/Insightful content. Write it once and send it three times, once to your Congressperson, and once to each Senator. Fax it if you'd prefer. (Snail mail and fax are what they like the most.) Keep it to one page. Reference the Constitution. Refer to yourself with your most impressive title. (Professor, Ph.d, Senior Engineer, Graduate Student, Independent Developer) and as a registered voter. In the name of the Tux do not tell them that you don't vote, even if that's the case (in which case you should be ashamed of yourself). Then when the next election rolls around, ignore the commercials, take an hour to do your own research, and vote for the candidate that did not support revoking the 4th Amendment and violating Ex Post Facto. It works. (See also: Former Senator Alan Dixon)

For those of you in countries outside of the US, the same applies to you. The Canadian, British, Australian, French, German, etc. governments are all popularly elected as well. (At least the active parts of the British government, anyway.) Politicians are the same everywhere. The same tactics apply. Use them. If you don't, you have no one to blame but yourselves.

security through imprisonment.

John Ashcroft announced today that the NSA has devised a fool proof deterance to E-terrorism. The new method is called Security-Through-Imprisonment, or STI.

The premise of STI is that civilian and military systems dont need to be secured, but instead laws need to be put in place that will require life sentances for so much as a failed telnet login attempt.

In response to our questions Ashcroft had the following statement: "Everyone is aware that securing Microsoft products is as futile as the war-on-drugs(TM), so we decided that rather than attempting to fix the systems - we will just send these E-Terrorists to prison for life for their crimes against Freedom(R). It is important for us to protect-our-children's(TM - H. Clinton) future in the wake of this terrible tragedy. Our new policy is called "If you cant do the right thing, then just do something"

Sure, but what can we do?

Democracy is not a spectator sport. We have to get involved. Who do we write to? Who do we call? Who can we contact to see that this doesn't stand?

This is nothing new...

It's nothing more than the same old reactionary garbage legislation that's been coming down the pike. And it's not surprising that this is what congress has come up with either--after all, if it didn't work last year, then do more of it next year...

As David Quinn put it quite eloquently:

When the Israelites escaped from Egypt in the 13th century B.C., they were literally a lawless horde, because they'd left the Egyptian list of prohibitions behind. They needed their own list of prohibitions, which God provided--the famous ten. But of course ten didn't do it. Hundreds more followed, but they didn't do it either.

No number has ever done it for us. Not a thousand, ten thousand, a hundred thousand. Even millions don't do it, and so every single year we pay our legislators to come up with more. But no matter how many prohibitions we come up with, they never do the trick, because no prohibited behavior has ever been eliminated by passing a law against it. Every time someone is sent to prison or executed, this is said to be "sending a message" to miscreants, but for some strange reason the message never arrives, year after year, generation after generation, century after century.

Naturally, we consider this to be a very advanced system.

Quite depressing, really. (The whole text can be found here [ishmael.com], BTW)

But what can you expect when the whole world has bought into the idea that there is absolutely nothing that any one person can do to change things [ishmael.com]?

-- Shamus

Bleah!

Very disturbing, but not quite as bad as it seems.

The specific sections of "computer crime" law that appear to be reclassified as "terrorist acts" appear to be only:

1030(a)(1), (a)(4), (a)(5)(A), or (a)(7) (relating to protection of computers)

Which are:

• (a) Whoever -
  (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it;[...]
• (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;
• (5)
  (A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
• (Interestingly, they don't seem to include B and C under this act as "terrorism", which are similar to section A, and are almost identical to each other - I have no idea why they have them. "B" says "(B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage;". C is word-for-word the same, except without the word "recklessly". ANy idea why they have them both?)
• (7) with intent to extort from any person, firm, association, educational institution, financial institution, government entity, or other legal entity, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to cause damage to a protected computer; shall be punished as provided in subsection (c) of this section.

In short, the only "computer crimes" listed as "terrorism" by this act are stealing US Gov't, Inc secrets by computer, maliciously hacking into a system with intent to steal valuables (aside from CPU cycles), and using threats of malicious computer hacking to extort.

The only one that concerns me very much here is 5A - it seems like high-paid corporate lawyers could easy "prove" that for example, if [e-mail] maliciously hacks into www.microsoft.com and puts a link to his website on the index page, that he's obtained at least $5000 worth of advertisement...

Come to think of it, I'm a little leery of the "or exceeds authorized access" bit in (4) - if one "accesses" a computer to purchase and legally download some proprietary "protected" piece of music or video, and finds a way to convert it to a nonproprietary format for personal use, has one "exceeded authorized access" and is therefore not merely a DMCA Criminal but a full-fledged DMCA Terrorist? It's a bit of a stretch, but I think a wealthy corporation can buy enough lawyer-approved powerpoint slides "proving" this to a non-technical jury...

NOT After Every Hacker

There are only 4 computer related offenses that would be designated under the ATA as "Federal terrorism offenses". Of these 4, the first deals solely with stealing or communicating classified information. The second requires the hacking be used for monetary or material gain beyond just gaining unauthorized access to the computer (unless access is valued over $5000). The third requires that one intentionally cause damage (exceeding $5000, in most cases) to a protected computer, where "protected computer" means US Government, financial institutions, interstate and foreign commerce and communications. The last involves threatening a computer system for purposes of extortion.

This list hardly seems to encompass "most computer crimes". For instance merely accessing or stealing non-classified information is not a terrorist act. Nor does it include breaking encryption ala DMCA. Defacing websites is not a terrorist act unless the computer belongs to one of the above categories and changing the website results in nontrivial financial losses. Writing viruses/worms is not a terrorist act unless you intentionally use it in a way that damages "protected" computers. (From the wording, I wouldn't interpret this to include merely releasing it into the wild, but a judicial ruling would have to clarify that issue). The crimes they are signaling out are pretty significant stuff and not just any old act of hacking. Let's not further contribute to the FUD.


What follows are excerpts of the laws in question:

From The Anti-Terrorism Act of 2001 (Draft 2)
http://www.eff.org/Privacy/Surveillance/20010919_a ta_bill.html [eff.org]

Sec. 309: "...the term 'Federal terrorism offense' means a violation of, or an attempt or conspiracy to violate...1030(a)(1), (a)(4), (a)(5)(A), or (a)(7) (relating to protection of computers)..."

From US Code Title 18, Section 1030
http://www4.law.cornell.edu/uscode/18/1030.html [cornell.edu]

(a)(1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it;

(a)(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period;

(a)(5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

(a)(7) with intent to extort from any person, firm, association, educational institution, financial institution, government entity, or other legal entity, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to cause damage to a protected computer; shall be punished as provided in subsection (c) of this section

Under the same Section, part (d)(e)(2) and (8): (2) the term "protected computer" means a computer -

• (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; or
• (B) which is used in interstate or foreign commerce or communication;

(8) the term "damage" means any impairment to the integrity or availability of data, a program, a system, or information, that -

• (A) causes loss aggregating at least $5,000 in value during any 1-year period to one or more individuals;
• (B) modifies or impairs, or potentially modifies or impairs, the medical examination, diagnosis, treatment, or care of one or more individuals;
• (C) causes physical injury to any person; or
• (D) threatens public health or safety;

Shifting blame

All this looks like an attempt by Ashcroft to shift the blame for the FBI's failure to prevent terrorism. Remember, the FBI was under heavy criticism for dropping the ball in some important cases.

Whistleblower protection with real teeth would be more effective in cleaning up inept government agencies. So would giving the federal Inspectors General the power to fire Federal employees. But no, Ashcroft's not asking for that.

Re:The answer is simple

It isn't that simple. Consider the case [lightlink.com] of Randall Schwartz. [stonehenge.com] In my opinion, he clearly broke the law and paid for it. The ruling was fair, he learned his lesson, and he still manages to make many positive contributions to society.

What you're saying is that smart people like him, who sometimes use a little poor judgment, should be given life sentences in prison? You're saying that was Randall did is on the same level as murder?