Laws Against Computer Hacking By Doug Lee

Overview The term Hacking Good example of a hacker Computer Fraud and Abuse Act of 1986 Digital Millennium Copyright Act of 1998 Exemptions from the Law

The term “Hacking” Typing? Or Criminal Activity? “In the past decade, however, "hacker" has come to describe those people with a hands-on interest in computer security and circumventing such security. “

Kevin Mitnick a.k.a Condor FBI’s number one most wanted Nickname “The Lost Boy of Cyberspace” Captured February 1995 25 counts of federal computer and wire fraud

The Computer Fraud and Abuse Act of 1986 Why signed into law? Three offenses Misdemeanor trafficking in computer passwords Felony unauthorized access in federal interest computers Felony “malicious damage”

Federal interest Computer Defintion of Federal Interest Computer "exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government, and the conduct constituting the offense affects such use, or which is one of two or more computers used in committing the offense, not all of which are located in the same State.“ Examples: Banks, Federal Reserve, Depart of Defense etc…..

Felonies Unauthorized Access with intention to commit fraudulent theft Address "malicious damage” Victim loss of $1000 or more Except medical cases Five years for first felony Ten years for the second felony

Misdemeanor Intent to commit fraud affecting interstate commerce computer passwords are revealed Message boards Disposes passwords to another person

Examples Herbert Zin a.k.a “shadowhawk” Robert Morris First violator Broke into AT&T, Department of Defense Sentenced nine months and $10,000 fine Robert Morris Launched worm virus Three years probation, 400 hours community service, $10,000

Digital Millennium Copyright Act of 1998 Signed on October 28,1998 by President Clinton Divides into Five Titles WIPO Copyright and Performances and Phonograms Treaties Implementation Act of 1998 Online Copyright Infringement Liability Limitation Act Computer Maintenance Competition Assurance Act Miscellaneous Provisions Vessel Hall Design Protection Act

Security Testing security testing means “ accessing a computer, computer system, or computer network, solely for the purpose of good faith testing, investigating, or correcting, a security flaw or vulnerability, with the authorization of the owner or operator of such computer, computer system, or computer network” Security testing Information used To promote the security Does not infringe the violation of privacy or breach of security Vulnerabilities must be told to developer Ex. HP threatens to sue researchers Tru64 operating system

Encryption Research the term `encryption research' means activities necessary to identify and analyze flaws and vulnerabilities of encryption technologies applied to copyrighted works exemptions Act of good faith to get authorization Information obtained Used to advance the state of knowledge or development of encryption technology legitimate course of study, employment or training Ex. Dmitry Sklyarov

Computer Maintenance Competition Assurance Act Allows a person to make a copy Only for maintenance purposes After fixed, must be destroyed

Online Copyright Infringement Liability Limitation Act Transitory Communications System Caching Storage of Information on Systems or networks at the direction of users Information Location Tools

Other uses of the DMCA restricts code that "is primarily designed or produced for the purpose of circumventing protection" of copyrighted works crime to circumvent anti-piracy measures built in software Outlaws code-cracking devices

Conclusions Are the laws too broad in Computing? Need more provisions? Security testing Researching Do the laws really help prevent hacking? Reasons for hacking Theft of services e.g. America online Take valuable files e.g. credit card numbers Vengence or hate Thrill and Excitement Recognition

Recognition “All the hackers out there figure if they can hack Kevin Mitnick's site, they're the king of the hill.” -- Kevin Mitnick