1. The Computer Fraud and Abuse Act: Misunderstood or a Truly Bad Law? PETER J. TOREN WEISBROD, MATTEIS, AND COPLEY PLLC 1900 M STREET, N.W. WASHINGTON, D.C. 20036 202-499-7900 PTOREN@WMCLAW.COM PETERTOREN.COM Weisbrod Matteis & Copley PLLC 1

2. Peter Toren, Esq. Weisbrod, Matteis & Copley PLLC Weisbrod Matteis & Copley PLLC 2 Peter J. Toren is a former partner at Sidley & Austin and a former federal prosecutor – one of the first attorneys with the Computer Crime & Intellectual Property Section or CCIPs. He specializes in patent, trademark, copyright and trade secrets cases that involve diverse technologies from computer software and hardware to light-emitting diodes, biotechnology to semiconductor manufacturing and fabrications, optics and medical devices to business methods. He is author of Intellectual Property & Computer (Law Journal Press), first published in 2003. It has been described as a “must-have desk reference.” He is the winner of the 2010 Burton Award for Excellence in Legal Writing. In addition to his book, his teaching positions and numerous articles, Mr. Toren is a frequent contributor to the press and has recently appeared in The Wall Street Journal, New York Times, Forbes, CNN, Bloomberg TV and The Guardian.

3. Introduction Weisbrod Matteis & Copley 3 1. Computer Fraud and Abuse Act (CFAA) (18 U.S.C. sec. 1030) A. Introduction to Computer Crime B. Scope of the Problem C. History a. The Computer Abuse Law of 1984 b. Computer Fraud and Abuse Act of 1986 c. Amendments – 1994, 1996, 2001, 2002, 2008 D. Present Status E. Possible Amendments

4. What is Computer Crime? Weisbrod Matteis & Copley 4 Incidental to the crime – write a threatening letter, record keeping, etc. Tool of the offense – child pornography, copyright infringement. Subject or direct target of criminal activity – computer hacking, computer viruses, worms, etc. – intentionally, knowingly, recklessly, or negligently causes interference with proper functioning of computers/computer networks.  Interferes with rights/privileges that computers have been configured to allow  Important new type of criminal offense – can cause serious harms, both economic and noneconomic

5. Is Computer Crime Different? Weisbrod Matteis & Copley 5 No physical constraints No physical boundaries Easier to commit? Different skills Cannot be prosecuted under traditional criminal statutes.

6. Then.... Weisbrod Matteis & Copley 6 The Morris Worm Cripples Internet Notorious hacker Kevin Mitnick now helping keep elections secure

7. And Now Weisbrod Matteis & Copley 7 Journalists Find Massive Data Security Lapse, Get Threats Instead of Thanks Didn’t Touch a Computer? You May Still Have Broken the Computer Fraud and Abuse Act NATIONAL PULSE Hacker’s Hell: Many want to narrow the Computer Fraud and Abuse Act Should it be a crime to exploit a poker machine's bug? APT1: Exposing One of China's Cyber Espionage Units This report is focused on the most prolific cyber espionage group Mandiant tracks: APT1. This single organization has conducted a cyber espionage campaign against a broad range of victims since at least 2006. Jeremy Hammond of Chicago, a member of the Lulzsec hacking collective, pleaded guilty on Tuesday to conspiring to attack a global intelligence firm. U.S. and China Agree to Hold Regular Talks on Hacking Keith B. Alexander, has said the attacks have resulted in the “greatest transfer of wealth in history.” Hackers have stolen a variety of secrets, including negotiating strategies and schematics for next- generation fighter jets and gas pipeline control systems.

8. Scope of the Problem Weisbrod Matteis & Copley 8 United States (2012)  621 confirmed data breaches  47,000 security incidents  37% financial firms  24% retailers/restaurants  20% manufacturing/transportation/utility  20% information/professional services firms  75% of successful breaches were for financial gain.  2 nd most common was a state-affiliated attack aimed at stealing IP to further national and economic interests  Only 14% were the work of insiders.  76% of data breaches, weak or stolen user names/passwords were a cause  40% malicious software was installed  29% social engineering, spear phishing  Discovery time is measured in months/years (Source: Verizon annual report)

9. History: The Computer Abuse Law of 1984 Weisbrod Matteis & Copley 9 Prohibit the unauthorized use/access of a computer:  Purpose of classified information foreign relations or U.S. defense information  Access the computer of a financial institution or consumer reporting agency  Computer operated for or on behalf of the U.S. Core concepts not defined  “access,” “use,” “without authorization”

10. Computer Fraud and Abuse Act of 1986 Weisbrod Matteis & Copley 10 Clarified ambiguous language Added 3 sections  Theft of property through the use of a computer which occurred as a result of a scheme to defraud  Access a federal interest computer without authorization and Alter, damage or destroy information  Trafficking of passwords if the trafficking affected interstate commerce

11. Amendments to the CFAA Weisbrod Matteis & Copley 11 1994 - 1996 – National Information Infrastructure Protection Act 2001 – Patriot Act of 2001 2002 – Cyber Security Enhancement Act of 2002 2008 – Identity Theft Enforcement and Restitution Act

12. CFAA Weisbrod Matteis & Copley 12 Protect the confidentiality, integrity and availability of data and systems 7 major provisions that create liability for different types of crimes against “protected computers”

13. Current Criminal Offenses Under the CFAA Weisbrod Matteis & Copley 13 1. Protection of Classified Gov’t Information – 1030(a)(1) 2. Protection of Financial, Government and Other Computer Information – 1030(a)(2) 3. Protection of Government Computer Systems – 1030(a)(3) 4. Fraudulent Use of a Protected Computer – 1030(a)(4). 5. Protection from Damage to Computers – 1030(a)(5) 6. Trafficking in Passwords – 1030(a)(6) 7. Threats against computers – 1030(a)(7)

14. Key Terms Weisbrod Matteis & Copley 14 1030(e) (1) “Computer” – “means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device” (2) “Protected computer” – “means a computer... which is used in interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States”

15. Key Terms Weisbrod Matteis & Copley 15 (6) “Exceeds authorized access” – “means to access a computer with authorization and to use such access to obtain or alter information in the computer that the acesser is not entitled so obtain or alter” (9) “Damage” – means any impairment to the integrity or availability of data, a program, a system, or information (11) “Loss” – “means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred or other consequential damages incurred because of interruption of service.”

16. Protection of Financial, Government, and Other Computer Information Weisbrod Matteis & Copley 16 1030(a)(2) - Prohibits the intentional access of a protected computer without authorization or in excess of authorized access for the purpose of obtaining information from private sector computers involved in interstate or foreign communications  Misdemeanor unless: (i) the offense was committed for purposes of commercial advantage or private financial gain... or (iii) the of the information of the information obtained exceeds $5,000

17. Unauthorized Use of Computers Weisbrod Matteis & Copley 17 1030(a)(4) – Prohibits the unauthorized access of a protected computer with the intent to defraud and obtain anything of value including use of the computer if the value exceeded $5,000.

18. Protection from Damage to Computers Weisbrod Matteis & Copley 18 1030(a)(5)(A)(i) criminalizes the knowing transmission of a program, information, code, or command, and as a result of such conduct intentionally causes damages without authorization, to a protected computer, AND caused or would have caused: i. loss to 1 or more persons, during any 1-year period... Aggregating at least $5,000 in value  Dual mens rea requirements

19. Protection from Damage to Computers Weisbrod Matteis & Copley 19 1030(a)(5)(A)(ii) – intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage 1030(a)(5)(A)(iii) – intentionally accesses a protected computer, and as a result of such conduct, causes damage. AND loss to 1 or more persons, during any 1-year period... Aggregating at least $5,000 in value

20. Protection from Threats Directed Against Computers Weisbrod Matteis & Copley 20 1030(a)(7) – Prohibits the transmission of any threat, in interstate or foreign commerce, to cause damage to a protected computer with the intent to extort something of value.

21. Civil Remedies Weisbrod Matteis & Copley 21 Any person who suffers damage or loss by reason of a violation of this may maintain a civil action. Conduct must involve 1 of the following factors: i. Loss of at least $5,000 in value ii. Modification of a medical examination iii. Physical injury iv. Threat to public health or safety v. Damage affecting a government computer system

22. What Does It Mean to “Access” a Computer Weisbrod Matteis & Copley 22 Not defined, but may be critically important Possibilities (physical world) 1. User has made a virtual entrance into a computer by, e.g., using a valid username and password which is akin to using a key to open a lock. 2. Visiting an open store in the physical world – Visiting a website could be seen as equivalent to viewing a shop window from a public street rather than actually entering the store.

23. Access Weisbrod Matteis & Copley 23 Virtual World 1. Whether a user has sent communications that have physically entered the computer – Accessing a computer is no different than using it. 2. Must the computer perform the task as directed?

24. Access as a Physical World Concept Weisbrod Matteis & Copley 24 Whether a computer user “accesses” another computer when he sends e-mail to that computer. “The CFAA does not define ‘access,’ but the general definition of the word, as a transitive verb, is to ‘gain access.’ ‘Acess,’ in this context, means to exercise the ‘freedom or ability to... make use of something... For purposes of the CFAA, when someone sends an e-mail message from his or her own computer, and the message then is transmitted through a number of other computers until it reaches its destination, the sender is making use of all of those computers, and is therefore ‘accessing’ them.”

25. Authorization Weisbrod Matteis & Copley 25 Who and what determines whether access is authorized, and under what circumstances? Physical world  Most people understand the social norms that govern whether someone has permission to be present on another person’s property. Virtual world  Can a computer owner set the scope of authorization by contractual language?  Or do these standards derive from the social norms of Internet users?

26. Under What Circumstances Does Access Become “Unauthorized”? Weisbrod Matteis & Copley 26 General approaches 1. Intended Function 2. Employee’s use of an employer’s computer against the employer’s interests 3. Breaches of contractual relationships between users and computer owners.

27. Intended Function Weisbrod Matteis & Copley 27 United States v. Morris – Convicted for “intentionally accessing a Federal interest computer without authorization.” Argued that computer access was not without authorization because he had rights to access several of the infected computers

28. Intended Function Weisbrod Matteis & Copley 28 United States v. Morris cont’d  Distinction is between insiders (with authorization) and outsiders (without authorization)  2d Circuit rejected the argument: Morris had accessed computers without authorization because he had used weaknesses in several programs to obtain access in unintended ways.  Did not use those programs “in any way related to their intended function.”  Derives from a sense of social norms.  Providers implicitly authorize users to use their computers to perform the intended functions, but implicitly do not authorize users to exploit weaknesses in the programs that allow them to perform unintended functions.

29. Employee Misconduct Cases Weisbrod Matteis & Copley 29 Employees used their employers’ computers in ways that exceeded the scope of their employment.

30. Agency Theory of Authorization Weisbrod Matteis & Copley 30 Shurgard Storage Centers – Defendant “intentionally accessed the plaintiff’s computer without authorization” or in excess of authorization, and thereby obtained information from the plaintiff’s computer in violation of the CFAA.  Court denied motion to dismiss on agency grounds  “Unless otherwise agreed, the authority of an agent terminates, if, without knowledge of the principal, he acquires adverse interests or if he is otherwise guilty of a serious breach of loyalty to the principal.”  Defendant’s employees lost their authorization and were without authorization when they allegedly obtained and sent the proprietary information to the defendant via e-mail

31. Agency Theory Weisbrod Matteis & Copley 31 Citrin – Defendant’ breach of his duty of loyalty terminated his agency relationship (more precisely, terminated any rights he might have claimed as IAC’s agent-he could not by unilaterally terminating any duties he owed his principal gain an advantage!) and with his authority to access the laptop, because the only basis of his authority had been that relationship.” Motive determines whether access is authorized or unauthorized Effect is to criminalize an employee’s use of an employer’s computer for anything other than work- related activities.

32. Rejection of Agency Theory Weisbrod Matteis & Copley 32 U.S. v. Nosal 676 F.3d 854 (9 th Cir. 2012) – Court rejected expansive reading of the CFAA that violations of an employer’s computer use policy constituted accessing a computer in excess of authorization  Phrase “exceeds authorized access” in the CFAA is limited to violations of restrictions on access and not restrictions on its use.  “If Congress meant to expand the scope of criminal liability to everyone who uses a computer in violation of computer use restrictions which may well include everyone who uses a computer, we would expect it to use language better suited to that purpose.” See also WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199 (4 th Cir. 2012).

33. Contractual Cases Weisbrod Matteis & Copley 33 Does the breach of a contract governing the use of a computer make the access unauthorized? Should it? Why?

34. Why It Matters Weisbrod Matteis & Copley 34 DOJ has taken the position that a violation of TOS agreement can constitute a criminal violation United States v. Drew – violation of Myspace’s TOS  Overturned conviction: treating a violation of a website’s TOS, without more, would transform the CFAA in an overly broad statute that “would convert a multitude of otherwise innocent Internet users into misdemeant criminals.”  http://www.youtube.com/watch?v=ZD6XCzY-K9M http://www.youtube.com/watch?v=ZD6XCzY-K9M

35. Civil Actions Weisbrod Matteis & Copley 35 Any person who suffers damage or loss by reason of a violation of the CFAA may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.  For what type of damage is a plaintiff permitted to obtain economic recovery?  Costs must be related to computer impairment or computer damages  Lost profits are generally not recoverable  “Damages for a violation involving only conducted described in (a)(5)(B)(i) are limited to economic damages.”

36. Recent Developments Weisbrod Matteis & Copley 36 Craigslist allowed to sue app developers over data use  Restrictions on use vs. restrictions on access  “Assuming that the CFAA encompasses information generally available to the public, such as Craigslist’s website, Defendants continued use of Craigslist after the clear statements regarding authorization in the cease and desist letters, the technological measures to block them constitutes unauthorized access under the CFAA.” Nosal guilty verdict in CFAA trial  Defendant found guilty under the CFAA/EEA by instructing others to breach the system using borrowed passwords.  Example of a former employee using deceitful means in an attempt to obtain access to information that could be used in a competitive way. CFAA used to threaten journalists  Scripps Howard News Service journalists discovered through a Google search that more than 170k records “listing sensitive information such as SS#, home addresses and financial accounts of customers Of Lifeline [fed subsidized phone service for low-income families]” and notified the fed’s subcontractor.  Discovered while pursuing a story on why so many individuals in program were having their identities stolen.  Contractor then accused journalists of being hackers and threatened legal action

37. Recent Developments Weisbrod Matteis & Copley 37 Should it be a crime to exploit a poker machine’s bug?  Defendants discovered a software “bug” in a slot machine and “won” over $500k from casinos in Las Vegas.  Defendants were able to increase their bets on hands they’d already won by pumping extra money into the machine at the right time.  Gov’t dropped the CFAA counts, but wire fraud counts remain. Defendant sentenced to 41 months for obtaining 114,000 email addresses from AT&T  Auernheimer discovered a flaw in ATT’s iPad user database. Provided email addresses to Gawker, which published some of the accounts, partially redacted.  Information was publicly available.  Intended function? Thomson Reuters deputy social media editor Mathew Keys indicted for allegedly helping to hack L.A. Times article on Congress  Allegedly supplied members of Anonymous with a login/password to a Tribune Co. server that was then used to deface the LA Times homepage.  Digital vandalism was cleared up in approximately 30 minutes.  Charged with three felonies under the CFAA.

38. The Sad Story of Aaron Swartz Weisbrod Matteis & Copley 38 Aaron Swartz, an Internet savant who at a young age shaped the online era by co- developing RSS and Reddit and later became a digital activist, has committed ssycudsuicide. The lawyer who represented Aaron Swartz in his fight against computer fraud charges has filed an official complaint against Stephen Heymann, the DOJ prosecutor who went after Swartz. Prosecutor defends actions in Aaron Swartz case We might entertain the possibility that Swartz's act of civil disobedience was an attempt to help rectify a harm that began long ago. Perhaps he was not only justified in his actions but morally impelled to act as he did. Aaron Swartz to Be Honored by Library Association

39. Should the CFAA Be Amended? Weisbrod Matteis & Copley 39 Should the government has the discretion to prosecute individuals who violate a terms of service agreement for exceeding authorized access?  What is authorization under the CFAA? Is it a violation of the CFAA to manipulate a weakness in a computer to obtain information? (Intended function)

40. Pending Legislation Weisbrod Matteis & Copley 40 “Aaron’s law” – excludes “breaches of terms of service or user agreements as violations of the CFAA and wire fraud statute.” Draft bill  Increases the maximum statutory penalties under the CFAA and would make any violation of 1030(a)(2) a felony.  Broadens the type of property subject to criminal/civil forfeiture.  Creates a new section to punish those who attempt to cause damage to a computer that powers critical infrastructure.  Entities that acquire, store or use personal information would be required to report a breach to their customers within 14 days.  Require a company to notify federal law enforcement within 72 hours of a “major security breach” (means of identification of 10k individuals have been obtained.

41. What You Can Do! Weisbrod Matteis & Copley 41 Limit or segregate access to sensitive information. Training, training, training, and still more training. Employees must be required to execute a written computer use policy.

42. Need More Information? Weisbrod Matteis & Copley 42 Buy my book: Intellectual Property & Computer Crimes, (Law Journal Press) Coverage includes detailed analysis of the Economic Espionage Act based on the latest cases; how to calculate damages and the meaning of unauthorized access under the Computer Fraud and Abuse Act; recent prosecutions under the Trademark Counterfeiting Act; state prosecutions for computer hacking and theft of trade secrets; and civil cases brought under the DMCA. In addition to analysis of laws aimed specifically at intellectual property violations, you'll find discussion of how general criminal laws are used to prosecute intellectual property crimes.

43. Thank You! Weisbrod Matteis & Copley 43 Questions 202-499-7900 ptoren@wmclaw.com