[ISN] Senator Targets School Hackers

From: InfoSec News (isnat_private)
Date: Tue Aug 07 2001 - 03:08:28 PDT

  • Next message: InfoSec News: "[ISN] Adobe E-Book Hacker Released"

    By Declan McCullagh 
    6:48 a.m. Aug. 1, 2001 PDT  
    WASHINGTON -- Sen. Robert Torricelli claims he wants to put hackers
    who disrupt school computers in prison.
    "Computer hackers who prey upon unsuspecting schools, striking fear in
    the hearts of entire communities with threats of violence, cannot go
    unpunished," the New Jersey Democrat said this week.
    But educators, programmers and civil libertarians say Torricelli's
    recently-introduced School Website Protection Act of 2001 does more
    than place wrongdoers behind bars. They say the bill is worded so
    vaguely it would turn commonplace activities into federal crimes to be
    investigated by the U.S. Secret Service.
    "I think the bill misses the mark," says Jim Dempsey, deputy director
    of the Center for Democracy and Technology. "It is written in an
    overly broad fashion. Sending one unsolicited e-mail affects a
    computer. If I send an e-mail to my student's teacher and I didn't
    have her permission, I violate the act."
    Dempsey is talking about the bill's sweeping language, which punishes
    activities that affect a computer rather than ones that damage it or
    successfully penetrate its security. Contrary to what the name of the
    bill implies, the measure covers any school computer system, not just
    websites, and could criminalize pranks such as sending mail from a
    friend's computer when they've left themselves logged in.
    Torricelli's measure says anyone who "knowingly causes the
    transmission of a program, information, code, or command, and as a
    result of such conduct, intentionally affects or impairs without
    authorization a computer of an elementary school or secondary school
    or institution of higher education" will to go federal prison for up
    to 10 years.
    "By using 'affects' instead of 'damage,' he sweeps in a lot of
    ordinary and legitimate conduct," Dempsey says.
    Andrew Grosso, a former assistant U.S. Attorney who's now in private
    practice, is more blunt: "It's a stupid bill. Yes, there is a need to
    protect school computers. No, this bill doesn't do that."
    "My humble opinion is that this bill was written to generate
    publicity," says Grosso, who founded the Association for Computing
    Machinery's law and technology committee.
    Those are harsh words, but they may well be true.
    Torricelli said in a press release this week that he introduced the
    legislation after the Trenton (New Jersey) Times reported that a local
    school district had its home page defaced with what appeared to be a
    threat that referenced the 1999 Columbine massacre. Concerned parents
    reportedly kept their children home from school that day.
    When pressed, Torricelli spokesman Adam Herbsman said, "Legislation
    concerning the Internet is a very complex subject. Senator Torricelli
    is eager to hear any suggestions on how to improve the bill as the
    legislative process moves forward."
    One source close to Torricelli said this was a high-profile issue in
    New Jersey, and the senator felt compelled to introduce legislation
    that would be seen as solving the problem of malicious hackers.
    The National Education Association said it had some concerns with
    Torricelli's proposal.
    "We don't have a position on the bill, but our two concerns are: one,
    whether or not such crimes should be considered a federal issue; and
    two, whether it is appropriate to handle such violations as a criminal
    matter, or as an administrative one resulting in either suspension or
    expulsion," said NEA lobbyist Kim Anderson.
    J.D. Abolins of Meyda Online Information Security and Privacy Studies
    and a New Jersey native, was more critical.
    "I do see a lot of hazards of federalizing hacking. School websites
    are not involved in commerce and do no contain private information, so
    why the high priority?" Abolins asks. "The bill sounds like overkill,
    and the money would be much better spent on computer ethics."
    Violations of the law, if Torricelli's measure were to take effect,
    would be punishable by five to ten years in prison if "the offense was
    committed for purposes of commercial advantage or private financial
    gain." Otherwise the penalty would be one year.
    Andrew Osterman in Washington contributed to this report.
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.

    This archive was generated by hypermail 2b30 : Tue Aug 07 2001 - 05:27:27 PDT