Cybersecurity: Cyber Crime Protection Security Act (S. 2111, 112th Congress)—A Legal Analysis
Released: 2013-01-28T00:00:00

Introduction

On February 15, 2012, Senator Leahy introduced the Cyber Crime Protection Act Security Act ( S. 2111 ). The bill, which was then placed on the calendar, is identical to some of the provisions of the Personal Data Privacy and Security Act of 2011 ( S. 1151 ), approved by the Senate Judiciary Committee earlier. It would amend several provisions of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, among other things. Numbered among its provisions are proposals to

expand the type of CFAA violations that qualify as racketeering (RICO) predicate offenses; increase the penalties for violations of CFAA; adjust CFAA's password trafficking offense to protect a wider range of computers and password equivalents; affirm that conspiring to commit a CFAA offense is punishable to the same extent as the underlying offense; amend CFAA's forfeiture provisions to permit confiscation of real property used to facilitate a CFAA violation and to authorize civil forfeiture proceedings; create a new offense for aggravated damage to a critical infrastructure computer, punishable by imprisonment for not less than three years nor more than 20 years; and clarify CFAA's "unauthorized access" element.

Both houses held hearings in consideration of these and related proposals. The 112 th Congress adjourned without taking further action on S. 2111 or S. 1151 .

Background

Congress has been concerned with the threats posed by cybercrime since before enactment of CFAA. It has amended CFAA regularly in order to keep pace with fast moving technological developments. There are other laws that address the subject of crime and computers. Other laws deal with computers as arenas for crime or as repositories of the evidence of crime or from some other perspective. CFAA, Section 1030, deals with computers as victims.

In its present form, Subsection 1030(a) outlaws seven distinct offenses:

accessing a computer to commit espionage; computer trespassing resulting in exposure to certain governmental, credit, financial, or computer-housed information; computer trespassing in a government computer; committing fraud, an integral part of which involves unauthorized access to a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce; damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce; trafficking in passwords for a government computer, or when the trafficking affects interstate or foreign commerce; and threatening to damage a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce.

Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses. Subsection 1030(c) catalogs the penalties for committing the crimes described in Subsections 1030(a) and (b), penalties that range from imprisonment for not more than a year for simple cyberspace trespassing to imprisonment for life for damage to a computer system resulting in death. Subsection 1030(d) preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common definitions. Subsection 1030(f) disclaims any application to otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these crimes. Subsection 1030(h), which has since lapsed, required annual reports through 1999 from the Attorney General and Secretary of the Treasury on investigations under the damage paragraph (18 U.S.C. 1030(a)(5)).

Aggravated Damage of Infrastructure Computers

Section 7 of S. 2111 would outlaw aggravated damage of critical infrastructure computers: "It shall be unlawful to, during and in relation to a felony violation of section 1030, intentionally cause or attempt to cause damage to a critical infrastructure computer, and such damage results in (or, in the case of an attempt, would, if completed have resulted in) the substantial impairment—(1) of the operation of the critical infrastructure computer; or (2) of the critical infrastructure associated with the computer." Although the new section creates a separate crime, the offense can be committed only in conjunction with a violation of CFAA, section 1030 ("... during and in relation to a felony violation of section 1030 ...").

Offenders would be required to serve a minimum of three years in prison and might be imprisoned for up to 20 years. The new section would come with an array of provisions designed to block any effort to mitigate the impact of its mandatory minimum sentences. Thus, courts could not sentence offenders to probation, nor order the sentence to be served concurrent with any other sentence, nor reduce the sentence imposed for other offenses to account for the mandatory minimum. Comparable restrictions attend the mandatory minimum sentencing provisions for aggravated identify theft.

The new section's definition of "critical infrastructure computer" would be far reaching and appears to have been modeled after the definition in the terrorist training section. It would cover public and private computer systems relating to matters "vital to national defense, national security, national economic security, [or] public health and safety." Although the description would seem to extend to systems relating to electronic power generating and regional components of the critical infrastructure, the new section drops them from the list of examples found in the model.

The section has no individual conspiracy element. Therefore, the section's 3-year mandatory minimum and 20-year maximum would not apply to conspiracy to violate the section. Instead, conspiracy to violate its proscriptions would be punishable under the general conspiracy statute, that is, by imprisonment for not more than 5 years.

Statutes that establish a mandatory minimum sentence of imprisonment for commission of a federal crime are neither common nor rare. They are associated most often with capital offenses, drug offenses, firearms offenses, and sex offenses committed against children. Critics claim that such statutes can lead to unduly harsh results and do little to contribute to sentencing certainty or the elimination of unwarranted sentencing disparity. Proponents argue that they provide assurance that certain serious crimes are at least minimally and even handedly punished.

Section 7's proposal is somewhat reminiscent of the mandatory minimum provisions of the aggravated identity theft statute, 18 U.S.C. 1028A. Section 1028A sets a mandatory minimum sentence of two years imprisonment for anyone who engages in identity theft during and in relation to any of a series of predicate fraud offenses, or a minimum of five years if committed during or in relation to a federal crime of terrorism. In spite of the Sentencing Commission's traditional opposition to mandatory minimum sentencing statutes, the Commission's most recent report on the subject was mildly laudatory of the identity theft provision.

Administration officials have endorsed the mandatory minimums of Section 7 as an appropriate sanction and deterrent. Some Members may remain to be convinced.

Forfeiture

Property associated with a violation of CFAA is now subject to confiscation under criminal forfeiture procedures. Criminal forfeiture procedures are conducted as part of a criminal prosecution and require conviction of the property owner. Civil procedures are separate civil procedures conducted against the forfeitable property itself and require no conviction of the property owner. In the case of property confiscated because it has facilitated the commission of an offense, criminal forfeiture may constitute punishment of an owner for using his property to commit the crime. Civil forfeiture may punish him for failing to prevent the use of his property to commit the crime.

The existing provisions call for criminal forfeiture of real and personal property derived from the proceeds of a CFAA violation and of personal property used to facilitate the offense. Section 6 would amend the provisions to permit confiscation of any real property used to facilitate the offense as well. It would authorize the confiscation of real and personal property under civil forfeiture procedures, as well as under criminal procedures.

There has been some objection that the proposal "would subject to forfeiture the house of the parents of a teenage hacker who has used a computer to attempt to break into someone's network if the parents were aware of this conduct." This seems something of an overstatement. The innocent owner defense is available to a property owner who can prove that he was unaware of the misconduct that would otherwise require confiscation. Yet, it is also available to a property owner who can establish that he "did all reasonably could be expected under the circumstances to terminate such use of the property." For example, a property owner can be said to have done all he reasonably could, when he discloses the misconduct to authorities and in consultation with authorities takes action to prevent further misuse of his property.

In addition, Section 6 of the bill would adjust the forfeiture provisions to account for the Supreme Court's interpretation of the word "proceeds" in another forfeiture statute. In United States v. Santos , the Justices declared that the word "proceeds" in the money laundering statute referred to profits of a money laundering predicate offense rather than the gross receipts generated by the predicate. Presumably with Santos in mind, the section would amend the forfeiture provisions so that the "gross proceeds" of a CFAA violation would be subject to confiscation.

Exceeds Authorized Access

An element of several of the crimes found in Subsection 1030(a) is the requirement that the defendant access the computer "without authorization" or that he "exceeds authorized access." By definition, a defendant "exceeds authorized access" when he gains authorized access but uses or alters information he is not authorized to use or alter. The courts have experienced some difficulty applying the definition. There is some support for the proposition that the term allows an employee to use authorized access to his employer's computer for purposes other than those for which it was given, as long as the use was not contrary to explicit employer limitations.

In United States v. Drew , the government brought a prosecution under Section 1030 based on the theory that the defendant exceeded authorized access to a social network, MySpace , when she violated the terms of the MySpace terms of service agreement by inaccurately identifying herself. The court granted the defendant's motion for acquittal, because it considered the government's theory was too sweeping to avoid a vagueness challenge.

Section 8 may have been drafted in response to Drew . The section would amend the definition of the term "exceeds authorized access" to state:

As used in this section ... (6) the term 'exceeds authorized access' means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter , but does not include access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or non-government employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized .

The purpose of the amendment would be "[t]o address civil liberties concerns about the scope of the Computer Fraud and Abuse Act" by amending it "to exclude from criminal liability conduct that exclusively involves a violation of a contractual obligation or agreement, such as an acceptable use policy, or terms of service agreement."

The Justice Department objected that the proposal would deter prosecution of inside cyberthreats. On the other hand, a second witness, a former Justice Department official, warned against the implications of the interpretation espoused in Drew . The same witness implied that employment and other contractual disputes are more appropriately resolved through civil litigation rather than criminal prosecution.

Trafficking in Passwords

Section 4 would modify the wording of the password trafficking prohibition in 18 U.S.C. 1030(a)(6). The current version reads: "Whoever ... (6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if—(A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States."

As amended, it would state: "Whoever ... (6) knowingly and with intent to defraud traffics (as defined in section 1029) in—(A) any password or similar information or means of access through which a protected computer as defined in subparagraphs (A) and (B) of subsection (e)(2) may be accessed without authorization; or (B) any means of access through which a protected computer as defined in subsection (e)(2)(A) may be accessed without authorization."

The change would represent an expansion both in the coverage of password equivalents and in scope of federal jurisdiction. Paragraph (6) now simply refers to passwords and "similar information through which a computer may be accessed without authorization." The section would add to passwords and similar information, similar "means of access." The change was designed to clarify coverage of "other methods of confirming a user's identity, such as biometric data, single-use passcodes, or smart carts used to access an account."

The section now applies when the victimized computer or computer system is that of the federal government or when the trafficking affects interstate or foreign commerce. As amended, the section would apply when the victimized computer or computer system is that of the federal government or of a financial institution or when the computer or computer system is used in or affects interstate or foreign commerce. The section would accomplish the change by using the existing definition of the term "protected computer."

Racketeering Predicates

Section 2 would add violations of the Computer Fraud and Abuse Act to the RICO (Racketeer Influenced and Corrupt Organization) predicate offense list. Among other things, RICO outlaws conducting the affairs of an enterprise, which affects interstate commerce, through the patterned commission of other criminal offenses (predicate offenses). Adding a crime to the RICO predicate offense list has a number of law enforcement advantages—some obvious; some not so obvious. First, RICO offenses are punishable by imprisonment for not more than 20 years. RICO predicate offenses are often less severely punished. Second, RICO authorizes the confiscation of property derived from a RICO violation. Forfeiture is sometimes not a consequence of a crime that is not RICO predicate. Third, it provides a private cause of action with treble damages and attorneys' fees for the victims of a RICO violation. Federal law only infrequently provides a federal cause of action for the benefit of victims of federal crimes that are not RICO predicates. Fourth, any RICO predicate offense is, by virtue of that fact alone, a money laundering predicate offense. Federal money laundering statutes ban the use of the proceeds of a RICO predicate offense to promote further money laundering predicate offenses. And, they outlaw their use in any financial transaction involving more than $10,000. In both instances, RICO predicate offenses qualify as money laundering predicate offenses, even in the absence of other elements necessary for RICO prosecution. Fifth, the proceeds involved in a money laundering offense are subject to confiscation, again without regard to whether a RICO violation can be shown.

Not all of these law enforcement advantages would follow as consequence of Section 2, however. First, Section 1030(a)'s offenses are already money laundering predicates. Consequently, no additional benefits in terms of a money laundering prosecution flow from adding Section 1030 to the RICO predicate offense list. Second, the espionage and certain of the damage offenses in Subsection 1030(a) are already somewhat obliquely listed as RICO predicate offenses. Any offense that falls within the definition of a federal crime of terrorism is a RICO predicate offense, regardless of whether it actually involves a crime committed for terrorist purposes. The definition of a federal crime of terrorism includes violations of 18 U.S.C. 1030(a)(1) (espionage) and in some cases violations of 18 U.S.C. 1030(a)(5)(A) (intentional damage). Thus, for those violations, Section 2 holds new advantages. Third, Section 1030 already provides a private cause of action for some of the victims of a violation of the section, although a RICO cause of action offers treble damages and attorneys' fees, while Section 1030 offers only compensatory damages.

In summary, RICO violations are punished more severely than many of the violations of Section 1030, and the addition would "make it easier for the Government to prosecute certain organized criminal groups that engage in computer network attacks." The change would also inure to the benefit of those victims of Section 1030 violations who could take advantage of the RICO private cause of action provisions.

Nevertheless, some hearing witnesses questioned the wisdom of opening the civil RICO remedies to those who claim to be victims of CFAA offenses. They asserted that a business will often settle a meritless RICO suit (a) because of the taint associated with merely being accused of racketeering and (b) because of the risk of losing a suit involving treble damages and attorneys' fees under statute that is very broad and whose boundaries are sometimes unclear.

Conspiracy

Subsection 1030(b) now declares that conspiracy or attempt to violate any of the Subsection 1030(a) offenses "shall be punished as provided subsection (c)," the subsection which sets the penalties for each of the CFAA substantive offenses. Subsection (c), in turn, begins with an introductory statement that "[t]he punishment for an offense under subsection (a) or (b) of this section is," and proceeds to identify the penalties for each of the CFAA offenses and for attempting to commit each of those offenses in various subparagraphs. For example, with respect to the penalty for fraud by a first time offender, Subsection (c) declares, "[t]he punishment for an offense under subsection (a) or (b) of this section is ... (3)(A) a fine under this title or imprisonment for not more than five years, or both, in the case of an offense under subsection (a)(4) ... or attempt to commit an offense punishable under this subparagraph." Neither subparagraph (3)(A) nor any of the other subparagraphs specifically mention conspiracy. Thus, Subsection (b) says conspiracy will be punished under Subsection (c) but Subsection (c) makes no mention of conspiracy per se. Reading conspiracy out of CFAA seems inconsistent with the wording of Subsection (b), but the actual wording of Subsection (c) affords that construction some support.

Changes elsewhere in the bill would magnify the impact of reading conspiracy out of CFAA. Under existing law, conspiracy to commit any federal felony is punishable by imprisonment for not more than five years. The maximum for conspiracy to commit a misdemeanor is the maximum for the underlying misdemeanor. Section 1030 in its present form punishes some violations as misdemeanors, some as five-year felonies, and some more severely. In the case of misdemeanors and five-year felonies, the maximum penalties are the same whether prosecution is under Section 1030 or under the general conspiracy statute. As noted in Table 1 below, however, Section 3 of the bill increases most of Subsection 1030(c)'s maximum penalties. Some of the subsection's misdemeanors (punishable by imprisonment for not more than one year) would become felonies (punishable by imprisonment for not more than three years). Some of its 5-year felonies would become 10- or 20-year felonies. In those instances, it would make a difference whether conspiracy could be prosecuted under Section 1030 with its corresponding penalties or would need to be prosecuted under the five-year general conspiracy statute.

Section 5 of the bill would address the issue by amending Subsection (b) of CFAA to read: "Whoever conspires to commit or attempt to commit an offense under subsection (a) of this section shall be punished as provided for the completed offense in subsection (c) of this section."

Sentencing Increases

Section 3 would amend Subsection 1030(c) for a more streamlined statement of the penalties for the Subsection 1030(a) and 1030(b) offenses. In doing so, it would eliminate the penalty increases for repeat offenders. In many instances, it would set the penalties for all offenders at the levels now reserved for repeat offenders, and would punish novices and repeat offenders alike. One exception would be the maximum penalty available upon conviction under Subsection 1030(a)'s fraud provisions. There, the maximum penalty would be increased from 5 to 20 years.

Administration witnesses approved the general increases as a simplification of Subsection 1030(c) and as a means of affording federal judges the opportunity to punish more serious cyberoffenses more severely. In the case of the fraud increase, they explained that

some of the CFAA's sentencing provisions no longer parallel the sentencing provisions of their equivalent traditional crimes. For example, the current maximum punishment for a violation of section 1030(a)(4) (computer hacking in furtherance of a crime of fraud) is five years, but the most analogous 'traditional' statutes, 18 U.S.C. §§1341 and 1343 (mail and wire fraud), both impose maximum penalties of twenty years.