Computer Fraud and Abuse Act (CFAA) Preventing the Destruction of eDocuments Team 8 – Jason Conrad, Ben Sweeney, Jeff Woodward

Background on CFAA Originally passed in 1984 as a way to protect classified information on government systems Originally passed in 1984 as a way to protect classified information on government systems In 1996 – the act was expanded from “government” computers to “protected” computers In 1996 – the act was expanded from “government” computers to “protected” computers Protected means any machine that engages in interstate commerce Protected means any machine that engages in interstate commerce In 2000 – through Shurgard Storage Centers v. Safeguard Self Storage – demonstrated the meaning of “protected” computer and “authorization” In 2000 – through Shurgard Storage Centers v. Safeguard Self Storage – demonstrated the meaning of “protected” computer and “authorization”

The Shurgard Case – Defining a “Protected Computer” Mr. T, an employee of Safeguard, came to the company after leaving his previous employer, Shurgard Mr. T, an employee of Safeguard, came to the company after leaving his previous employer, Shurgard Sent messages containing trade secret information while still employed by Shurgard Sent messages containing trade secret information while still employed by Shurgard Relevance of this case: the judge essentially said that “almost all computer use has become interstate in nature” and that “Shurgard’s computers were indeed protected computers” within the scope of the CFAA Relevance of this case: the judge essentially said that “almost all computer use has become interstate in nature” and that “Shurgard’s computers were indeed protected computers” within the scope of the CFAA Summary: all computers connected to the Internet are within the scope of the CFAA Summary: all computers connected to the Internet are within the scope of the CFAA

International Airports v. Citrin The case: Citrin, a managing director at International Airports removed company files from a computer upon leaving the company The case: Citrin, a managing director at International Airports removed company files from a computer upon leaving the company Company sued for violation of anti-hacking (CFAA) Company sued for violation of anti-hacking (CFAA) Judge threw out case and said that removing files does not violate CFAA since he was an employee of the company and “was authorized” Judge threw out case and said that removing files does not violate CFAA since he was an employee of the company and “was authorized” When appealed, Judge Posner said that Citrin’s termination of employment meant that his authorization ended – he deleted files without authorization as an internal entity When appealed, Judge Posner said that Citrin’s termination of employment meant that his authorization ended – he deleted files without authorization as an internal entity In this case, appellate interpretations of the CFAA hold that permanently erasing files from an employer’s computer could trigger federal liability In this case, appellate interpretations of the CFAA hold that permanently erasing files from an employer’s computer could trigger federal liability Federal liability = you’re in trouble Federal liability = you’re in trouble CFAA requires that the “knowing transmission of a program, code or command intentionally damages, without authorization, a protected computer” in order to be enforced CFAA requires that the “knowing transmission of a program, code or command intentionally damages, without authorization, a protected computer” in order to be enforced Now, according to this case, this violation can occur externally as well as internally Now, according to this case, this violation can occur externally as well as internally

United States v. Mitra Mitra, student at University of Wisconsin, transmitted radio signal that disabled communications for police, fire, ambulance, etc. Mitra, student at University of Wisconsin, transmitted radio signal that disabled communications for police, fire, ambulance, etc. Argued that he never hacked into any computers because he used a radio frequency – not a computer Argued that he never hacked into any computers because he used a radio frequency – not a computer 7 th Circuit opinion – a “computer” is an electronic device, which includes radios that contain chips for high speed data processing 7 th Circuit opinion – a “computer” is an electronic device, which includes radios that contain chips for high speed data processing Ruled that his disabling of the communications was actually “hacking” because it was hampering a “protected” interstate communication Ruled that his disabling of the communications was actually “hacking” because it was hampering a “protected” interstate communication Mitra argued that if his radio is a computer, then isn’t everything a computer? iPods, cell phone, cell tower, etc. – so doesn’t this give the government too much control according to CFAA? Mitra argued that if his radio is a computer, then isn’t everything a computer? iPods, cell phone, cell tower, etc. – so doesn’t this give the government too much control according to CFAA? Any use of radio frequency is considered interstate commerce because it is governed by the FCC Any use of radio frequency is considered interstate commerce because it is governed by the FCC CFAA does not give government too much power – there are limitations, damage must be intentional, at least $5,000, or a threat to public safety CFAA does not give government too much power – there are limitations, damage must be intentional, at least $5,000, or a threat to public safety In summary: a “protected computer” could be anything but is necessary in order to protect vital communication and business systems In summary: a “protected computer” could be anything but is necessary in order to protect vital communication and business systems

Thank You Questions? Questions? Do you think the scope of the CFAA and the definition of protected computers is too wide, even though it protects interstate commerce and security? …team 7 does… Do you think the scope of the CFAA and the definition of protected computers is too wide, even though it protects interstate commerce and security? …team 7 does…