On February 15, 2012, Senator Leahy introduced the Cyber Crime Protection Act Security Act ( S. 2111 ). The bill, which was then placed on the calendar, is identical to some of the provisions of the Personal Data Privacy and Security Act of 2011 ( S. 1151 ), approved by the Senate Judiciary Committee earlier. It would amend several provisions of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, among other things. Numbered among its provisions are proposals to expand the type of CFAA violations that qualify as racketeering (RICO) predicate offenses; increase the penalties for violations of CFAA; adjust CFAA's password trafficking offense to protect a wider range of computers and password equivalents; affirm that conspiring to commit a CFAA offense is punishable to the same extent as the underlying offense; amend CFAA's forfeiture provisions to permit confiscation of real property used to facilitate a CFAA violation and to authorize civil forfeiture proceedings; create a new offense for aggravated damage to a critical infrastructure computer, punishable by imprisonment for not less than three years nor more than 20 years; and clarify CFAA's "unauthorized access" element. Both houses held hearings in consideration of these and related proposals. The 112 th Congress adjourned without taking further action on S. 2111 or S. 1151 . Congress has been concerned with the threats posed by cybercrime since before enactment of CFAA. It has amended CFAA regularly in order to keep pace with fast moving technological developments. There are other laws that address the subject of crime and computers. Other laws deal with computers as arenas for crime or as repositories of the evidence of crime or from some other perspective. CFAA, Section 1030, deals with computers as victims. In its present form, Subsection 1030(a) outlaws seven distinct offenses: accessing a computer to commit espionage; computer trespassing resulting in exposure to certain governmental, credit, financial, or computer-housed information; computer trespassing in a government computer; committing fraud, an integral part of which involves unauthorized access to a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce; damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce; trafficking in passwords for a government computer, or when the trafficking affects interstate or foreign commerce; and threatening to damage a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce. Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses. Subsection 1030(c) catalogs the penalties for committing the crimes described in Subsections 1030(a) and (b), penalties that range from imprisonment for not more than a year for simple cyberspace trespassing to imprisonment for life for damage to a computer system resulting in death. Subsection 1030(d) preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common definitions. Subsection 1030(f) disclaims any application to otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these crimes. Subsection 1030(h), which has since lapsed, required annual reports through 1999 from the Attorney General and Secretary of the Treasury on investigations under the damage paragraph (18 U.S.C. 1030(a)(5)). Section 7 of S. 2111 would outlaw aggravated damage of critical infrastructure computers: "It shall be unlawful to, during and in relation to a felony violation of section 1030, intentionally cause or attempt to cause damage to a critical infrastructure computer, and such damage results in (or, in the case of an attempt, would, if completed have resulted in) the substantial impairment—(1) of the operation of the critical infrastructure computer; or (2) of the critical infrastructure associated with the computer." Although the new section creates a separate crime, the offense can be committed only in conjunction with a violation of CFAA, section 1030 ("... during and in relation to a felony violation of section 1030 ..."). Offenders would be required to serve a minimum of three years in prison and might be imprisoned for up to 20 years. The new section would come with an array of provisions designed to block any effort to mitigate the impact of its mandatory minimum sentences. Thus, courts could not sentence offenders to probation, nor order the sentence to be served concurrent with any other sentence, nor reduce the sentence imposed for other offenses to account for the mandatory minimum. Comparable restrictions attend the mandatory minimum sentencing provisions for aggravated identify theft. The new section's definition of "critical infrastructure computer" would be far reaching and appears to have been modeled after the definition in the terrorist training section. It would cover public and private computer systems relating to matters "vital to national defense, national security, national economic security, [or] public health and safety." Although the description would seem to extend to systems relating to electronic power generating and regional components of the critical infrastructure, the new section drops them from the list of examples found in the model. The section has no individual conspiracy element. Therefore, the section's 3-year mandatory minimum and 20-year maximum would not apply to conspiracy to violate the section. Instead, conspiracy to violate its proscriptions would be punishable under the general conspiracy statute, that is, by imprisonment for not more than 5 years. Statutes that establish a mandatory minimum sentence of imprisonment for commission of a federal crime are neither common nor rare. They are associated most often with capital offenses, drug offenses, firearms offenses, and sex offenses committed against children. Critics claim that such statutes can lead to unduly harsh results and do little to contribute to sentencing certainty or the elimination of unwarranted sentencing disparity. Proponents argue that they provide assurance that certain serious crimes are at least minimally and even handedly punished. Section 7's proposal is somewhat reminiscent of the mandatory minimum provisions of the aggravated identity theft statute, 18 U.S.C. 1028A. Section 1028A sets a mandatory minimum sentence of two years imprisonment for anyone who engages in identity theft during and in relation to any of a series of predicate fraud offenses, or a minimum of five years if committed during or in relation to a federal crime of terrorism. In spite of the Sentencing Commission's traditional opposition to mandatory minimum sentencing statutes, the Commission's most recent report on the subject was mildly laudatory of the identity theft provision. Administration officials have endorsed the mandatory minimums of Section 7 as an appropriate sanction and deterrent. Some Members may remain to be convinced. Property associated with a violation of CFAA is now subject to confiscation under criminal forfeiture procedures. Criminal forfeiture procedures are conducted as part of a criminal prosecution and require conviction of the property owner. Civil procedures are separate civil procedures conducted against the forfeitable property itself and require no conviction of the property owner. In the case of property confiscated because it has facilitated the commission of an offense, criminal forfeiture may constitute punishment of an owner for using his property to commit the crime. Civil forfeiture may punish him for failing to prevent the use of his property to commit the crime. The existing provisions call for criminal forfeiture of real and personal property derived from the proceeds of a CFAA violation and of personal property used to facilitate the offense. Section 6 would amend the provisions to permit confiscation of any real property used to facilitate the offense as well. It would authorize the confiscation of real and personal property under civil forfeiture procedures, as well as under criminal procedures. There has been some objection that the proposal "would subject to forfeiture the house of the parents of a teenage hacker who has used a computer to attempt to break into someone's network if the parents were aware of this conduct." This seems something of an overstatement. The innocent owner defense is available to a property owner who can prove that he was unaware of the misconduct that would otherwise require confiscation. Yet, it is also available to a property owner who can establish that he "did all reasonably could be expected under the circumstances to terminate such use of the property." For example, a property owner can be said to have done all he reasonably could, when he discloses the misconduct to authorities and in consultation with authorities takes action to prevent further misuse of his property. In addition, Section 6 of the bill would adjust the forfeiture provisions to account for the Supreme Court's interpretation of the word "proceeds" in another forfeiture statute. In United States v. Santos , the Justices declared that the word "proceeds" in the money laundering statute referred to profits of a money laundering predicate offense rather than the gross receipts generated by the predicate. Presumably with Santos in mind, the section would amend the forfeiture provisions so that the "gross proceeds" of a CFAA violation would be subject to confiscation. An element of several of the crimes found in Subsection 1030(a) is the requirement that the defendant access the computer "without authorization" or that he "exceeds authorized access." By definition, a defendant "exceeds authorized access" when he gains authorized access but uses or alters information he is not authorized to use or alter. The courts have experienced some difficulty applying the definition. There is some support for the proposition that the term allows an employee to use authorized access to his employer's computer for purposes other than those for which it was given, as long as the use was not contrary to explicit employer limitations. In United States v. Drew , the government brought a prosecution under Section 1030 based on the theory that the defendant exceeded authorized access to a social network, MySpace , when she violated the terms of the MySpace terms of service agreement by inaccurately identifying herself. The court granted the defendant's motion for acquittal, because it considered the government's theory was too sweeping to avoid a vagueness challenge. Section 8 may have been drafted in response to Drew .