http://www.wired.com/news/politics/0,1283,45752,00.html By Declan McCullagh 6:48 a.m. Aug. 1, 2001 PDT WASHINGTON -- Sen. Robert Torricelli claims he wants to put hackers who disrupt school computers in prison. "Computer hackers who prey upon unsuspecting schools, striking fear in the hearts of entire communities with threats of violence, cannot go unpunished," the New Jersey Democrat said this week. But educators, programmers and civil libertarians say Torricelli's recently-introduced School Website Protection Act of 2001 does more than place wrongdoers behind bars. They say the bill is worded so vaguely it would turn commonplace activities into federal crimes to be investigated by the U.S. Secret Service. "I think the bill misses the mark," says Jim Dempsey, deputy director of the Center for Democracy and Technology. "It is written in an overly broad fashion. Sending one unsolicited e-mail affects a computer. If I send an e-mail to my student's teacher and I didn't have her permission, I violate the act." Dempsey is talking about the bill's sweeping language, which punishes activities that affect a computer rather than ones that damage it or successfully penetrate its security. Contrary to what the name of the bill implies, the measure covers any school computer system, not just websites, and could criminalize pranks such as sending mail from a friend's computer when they've left themselves logged in. Torricelli's measure says anyone who "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally affects or impairs without authorization a computer of an elementary school or secondary school or institution of higher education" will to go federal prison for up to 10 years. "By using 'affects' instead of 'damage,' he sweeps in a lot of ordinary and legitimate conduct," Dempsey says. Andrew Grosso, a former assistant U.S. Attorney who's now in private practice, is more blunt: "It's a stupid bill. Yes, there is a need to protect school computers. No, this bill doesn't do that." "My humble opinion is that this bill was written to generate publicity," says Grosso, who founded the Association for Computing Machinery's law and technology committee. Those are harsh words, but they may well be true. Torricelli said in a press release this week that he introduced the legislation after the Trenton (New Jersey) Times reported that a local school district had its home page defaced with what appeared to be a threat that referenced the 1999 Columbine massacre. Concerned parents reportedly kept their children home from school that day. When pressed, Torricelli spokesman Adam Herbsman said, "Legislation concerning the Internet is a very complex subject. Senator Torricelli is eager to hear any suggestions on how to improve the bill as the legislative process moves forward." One source close to Torricelli said this was a high-profile issue in New Jersey, and the senator felt compelled to introduce legislation that would be seen as solving the problem of malicious hackers. The National Education Association said it had some concerns with Torricelli's proposal. "We don't have a position on the bill, but our two concerns are: one, whether or not such crimes should be considered a federal issue; and two, whether it is appropriate to handle such violations as a criminal matter, or as an administrative one resulting in either suspension or expulsion," said NEA lobbyist Kim Anderson. J.D. Abolins of Meyda Online Information Security and Privacy Studies and a New Jersey native, was more critical. "I do see a lot of hazards of federalizing hacking. School websites are not involved in commerce and do no contain private information, so why the high priority?" Abolins asks. "The bill sounds like overkill, and the money would be much better spent on computer ethics." Violations of the law, if Torricelli's measure were to take effect, would be punishable by five to ten years in prison if "the offense was committed for purposes of commercial advantage or private financial gain." Otherwise the penalty would be one year. Andrew Osterman in Washington contributed to this report. - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Tue Aug 07 2001 - 05:27:27 PDT