Hackers face life imprisonment under 'Anti-Terrorism' Act

Security Focus ^ | Sep 23 2001 | Kevin Poulsen

[E. Pluribus Unum]

Justice Department proposal classifies most computer crimes as acts of terrorism.

Hackers, virus-writers and web site defacers would face life imprisonment without the possibility of parole under legislation proposed by the Bush Administration that would classify most computer crimes as acts of terrorism.

The Justice Department is urging Congress to quickly approve its Anti-Terrorism Act (ATA), a twenty-five page proposal that would expand the government's legal powers to conduct electronic surveillance, access business records, and detain suspected terrorists.

The proposal defines a list of "Federal terrorism offenses" that are subject to special treatment under law. The offenses include assassination of public officials, violence at international airports, some bombings and homicides, and politically-motivated manslaughter or torture.

Most of the terrorism offenses are violent crimes, or crimes involving chemical, biological, or nuclear weapons. But the list also includes the provisions of the Computer Fraud and Abuse Act that make it illegal to crack a computer for the purpose of obtaining anything of value, or to deliberately cause damage. Likewise, launching a malicious program that harms a system, like a virus, or making an extortionate threat to damage a computer are included in the definition of terrorism.

To date no terrorists are known to have violated the Computer Fraud and Abuse Act. But several recent hacker cases would have qualified as "Federal terrorism offenses" under the Justice Department proposal, including the conviction of Patrick Gregory, a prolific web site defacer who called himself "MostHateD"; Kevin Mitnick, who plead guilty to penetrating corporate networks and downloading proprietary software; Jonathan "Gatsby" Bosanac, who received 18-months in custody for cracking telephone company computers; and Eric Burns, the Shoreline, Washington hacker who scrawled "Crystal, I love you" on a United States Information Agency web site in 1999. The 19-year-old was reportedly trying to impress a classmate with whom he was infatuated.

The Justice Department submitted the ATA to Congress late last week as a response to the September 11th terrorist attacks in New York, Washington and Pennsylvania that killed some 7,000 people.

As a "Federal terrorism offense," the five year statute of limitations for hacking would be abolished retroactively -- allowing computer crimes committed decades ago to be prosecuted today -- and the maximum prison term for a single conviction would be upped to life imprisonment. There is no parole in the federal justice system

Those convicted of providing "advice or assistance" to cyber crooks, or harboring or concealing a computer intruder, would face the same legal repercussions as an intruder. Computer intrusion would also become a predicate offense for the RICO statutes.

DNA samples would be collected from hackers upon conviction, and retroactively from those currently in custody or under federal supervision. The samples would go into the federal database that currently catalogs murderers and kidnappers.

Civil liberties groups have criticized the ATA for its dramatic expansion of surveillance authority, and other law enforcement powers.

But Attorney General John Ashcroft urged swift adoption of the measure Monday.

Testifying before the House Judiciary Committee, Ashcroft defended the proposal's definition of terrorism. "I don't believe that our definition of terrorism is so broad," said Ashcroft. "It is broad enough to include things like assaults on computers, and assaults designed to change the purpose of government."

The Act is scheduled for mark-up by the committee Tuesday morning.

[Fred25]

Only “life”? I was hoping it would be death by firing squad at dawn.

[Liberal Classic]

And if they manage to trash a medical monitoring system while engaged in their hack exploits, it CAN turn into murder pretty easily.

Of course. If it's truly accidental, perhaps a charge of voluntary manslaughter.

I am not saying wrongful acts accomplished with a computer should go unpunshed. I'm not sure how people got that idea. Just that computer intrusion is not murder.

[SubSailor]

I really do agree that life w/o parole is too harsh, BUT there does need to be stricter punishment as a deterrant to this type of behavior. Hacking and virus planting can be severely disruptive and as one poster mentioned earlier, could conceivably lead to someone's death in the case of a medical facility being the recipient of the hit.

[Dog Gone]

Of course there has to be some common sense applied. Strict liability, applied to criminal cases, doesn't make any sense.

On the other hand, a single virus can cost billions of dollars in damages and even imperil lives. There is currently very little punishment being handed out, and it won't stop until there are some very high profile punishments handed down.

I assume most people here know I was deliberately exaggerating as far as the death penalty, although I'd actually support it if the hacking or virus directly led to loss of life.

[Fred25]

Yeah, same goes for the punks who keeping puttin' dents in my mailbox with a baseball bat!

When I was a kid growing up in the South in the ‘50s, there was sort of an old “common law” understanding that men (especially old grumpy ones) could shoot the kids with the baseball bats, if they caught them in action. Therefore, I never saw a dent in a mailbox in the South in the ‘50s, and I never dented a mailbox.

[Fred25]

voluntary manslaughter.

“Voluntary manslaughter”??? Where I come from, that’s called “cold blooded murder”.

[Liberal Classic]

Are there not different charges the county attorney can bring? Involuntary manslaughter, voluntary manslaughter, second degree murder, first degree murder, capital murder, etc.

I think you are barking up the wrong tree. I am not saying people should not be punished for computer intrusion, I am saying computer intrusion is similar to trespassing, and should be treated accordingly.

[Servant of the Nine]

I really do agree that life w/o parole is too harsh, BUT there does need to be stricter punishment as a deterrant to this type of behavior. Hacking and virus planting can be severely disruptive

I have nothing against Life without Parole, or dragging to death behind a pickup for that matter, for people who write or distribute viruses, or deliberately damage important systems.

I do object to the broad brush language that allows the Feds to call any computer literate person they dislike a hacker and put them away for life.

This is just a blank check for the government or any federal agent to get even with anyone for anything. Steal someones girlfriend? You could become a convicted hacker if he's a Fed.

So9

[SubSailor]

I wish I could catch the lil' buggers! I wouldn't want to shoot 'em, but I sure would like to tag their rap spoutin' cars! Sorry, I don't know if that's proportionate retribution or not, but it's still what I'd like to do!

[B Knotts]

I don't how a conservative could oppose the most severe punishment for hackers that spread viruses. We should be increasing the punishment for other crimes and be thankful for proper punishment for losers that create viruses.

Yes. I also propose disembowlment for jaywalkers and speeders.

Taillight burned out? 30 lashes.

Failed to seperate your recyclables? We cut off your hands.

I mean, the law's the law, right?

[Liberal Classic]

Causing the death of a man through your negligence and carelessness is manslaughter. For example, tossing a brick from the roof of a building which hits someone in the head, killing them. That's manslaughter.

Premeditation in the act, such as sabotage of someone's automobile, leads to a charge of murder.

[B Knotts]

ROFL. That's a good way to reduce Windows' market share quick. If you pass on a virus, even unknowingly, you go to jail for life.

[Poohbah]

Uh, sorry, I cannot support "voluntary manslaughter" for this any more than I can support it for a security guy who decides to clear his sidearm while pointing it at the head of a coma patient.

[Fred25]

I think you are barking up the wrong tree. I am not saying people should not be punished for computer intrusion, I am saying computer intrusion is similar to trespassing, and should be treated accordingly.

If someone has a car accident and runs over my fence and into my yard, I consider that an unfortunate accidental trespass. That actually happened to my yard and fence, and I didn’t do anything about it. I told the drunk neighbor not to worry about it too much.

However, if someone comes into my house to steal and rob or to trash my house, then I think that “life in prison” is not too much of a punishment. (I’d probably let the guy out in 10 to 20 years anyway, but I would not let him know that at the start.)

If someone gets into my computer by some fluke or accident, I can live with that, but if someone hacks it on purpose to steal info or to trash it, I would like to see him get “life”. Ten or 20 years from now, we can consider giving him a pardon.

[Dirt]

"I don't believe that our definition of terrorism is so broad," said Ashcroft. "It is broad enough to include things like assaults on computers, and assaults designed to change the purpose of government."

Does this mean that someone will finally be able to go after the person that wrote "Buttons.exe"?

[Fred25]

Causing the death of a man through your negligence and carelessness is manslaughter. For example, tossing a brick from the roof of a building which hits someone in the head, killing them. That's manslaughter.

In liberal courts.

[Liberal Classic]

If someone gets into my computer by some fluke or accident, I can live with that, but if someone hacks it on purpose to steal info or to trash it, I would like to see him get 'life'. Ten or 20 years from now, we can consider giving him a pardon.

Perhaps you mean in twenty years, give him parole.

I just don't agree. I see computer intrusion as a criminal trespass. I don't think people who trespass should be given life in prison.

[Liberal Classic]

Uh, sorry, I cannot support "voluntary manslaughter" for this any more than I can support it for a security guy who decides to clear his sidearm while pointing it at the head of a coma patient.

Perhaps I am not being clear. Whether a charge of manslaughter or murder brought, depends on whether the act was deliberate or accidental. I am not arguing that people should get away with causing someone's death, whether accidental or deliberate.

[Servant of the Nine]

In liberal courts.

Fred you would be over the top even in Houston. Houston sends more people to the needle than any place else, but even in Houston lots of the stuff you call cold blooded murder would get No Billed by the Grand Jury. Most people who get killed deserve it.

So9