[ISN] Lawyers fear misuse of cyber murder law

From: InfoSec News (isnat_private)
Date: Mon Nov 25 2002 - 23:36:56 PST

  • Next message: InfoSec News: "[ISN] Linux Security Week - November 25th 2002"

    By Kevin Poulsen
    SecurityFocus Online
    Posted: 25/11/2002 
    A genuine cyber murder may never happen outside the pages of tabloid
    newspapers and Tom Clancy novels, but defense attorneys say that won't
    keep federal prosecutors from getting some mileage out of a provision
    in the newly-passed Homeland Security bill that dictates a maximum
    sentence of life imprisonment without parole for computer hackers with
    homicide in their hearts.
    One of many information security and cybercrime measures in the
    484-page bill - which won final approval in the Senate Tuesday - the
    life sentence is reserved for those who deliberately transmit a
    program, information, code, or command that impairs the performance of
    a computer or modifies its data without authorization, "if the
    offender knowingly or recklessly causes or attempts to cause death".
    If the attacker only causes or attempts to cause bodily injury through
    hacking, the crime carries a 20-year sentence.
    While it sounds straightforward enough, defense attorneys who've
    worked on significant hacking cases worry that many aspects of
    computer crime law remain too unclear to provide a sound anchor for as
    weighty a sentence as life imprisonment, and they say the new
    provisions add more confusion to a still-evolving area of law.
    "You can drive a truck through the ambiguities in that language," says
    Donald Randolph, the Los Angeles criminal defense attorney who
    represented hacker Kevin Mitnick. "It's a daunting prospect to address
    this when you have words like 'attempts to cause' and 'recklessly.' I
    could see prosecutors arguing that the term 'reckless' defines every
    instance of hacking."
    "While it's completely understandable that society would want to
    impose a life sentence for any kind of murder... what we've done is
    attached that idea to the underlying vagueness of the anti-hacking
    law, and there are a lot of things that are not clear in the law and
    not clear in the statute," says Jennifer Granick, director of Stanford
    Law School's Center for Internet and Society, and defense attorney in
    several federal hacker cases. "Technology is progressing so rapidly...  
    to attach a life sentence to an area of the law that is still in the
    earliest stages of the development is dangerous."
    Plea Bargains
    Notwithstanding apocryphal reports of hackers changing blood types at
    a New York hospital, or a twelve-year-old boy coming within keystrokes
    of opening the floodgates at an Arizona dam, no cases of attempted
    cyber murder or cyber terrorism have been reliably reported. But the
    defense lawyers believe that the new law -- or the threat of it --
    will play a significant role in conventional, non-lethal, hacker
    "I'll be used to get guilty pleas," says Granick. "People will be
    afraid that they're going to get the life sentence so they'll take a
    deal for less than life, and give up their right to appeal and to test
    the law."
    Other legal experts disagree. "I doubt it," says Orin Kerr, a cyber
    law professor at George Washington University Law School, and a former
    attorney with the Justice Department's computer crime section. Kerr
    believes prosecutors won't use the attempted murder language to
    squeeze guilty pleas out of hackers, and says the new provision will
    most likely gather dust -- an unused and overlooked curiosity in the
    law books.
    "The practical effect of this is almost none," says Kerr. "It's
    probably mostly symbolic -- perhaps useful in a case of a terrorist
    act of computer hacking designed to cause a lot of deaths, in which
    case it would give the federal government jurisdiction."
    "Forgive me for being pessimistic after 28 years as a criminal defense
    attorney... but I would say it will absolutely, positively be used to
    compel plea bargains," counters Randolph. "That's the name of the game
    in 90% of the prosecutions I'm involved in."
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Tue Nov 26 2002 - 02:08:16 PST