Faking It: Calculating Loss in Computer Crime Sentencing Jennifer S. Granick, Esq. Stanford Law School Center for Internet and Society

18 U.S.C (a)(1) unauthorized access to classified information; (a)(2) unauthorized access and obtaining any information from a protected computer (misdemeanor); (a)(3) access that interferes with the ability to use a government computer; (a)(4) access with the intent to defraud if the intruder obtains anything of value > $5K. (a)(5) transmissions or access that caused damage AND $5K loss or special harm

First Incidents that cause measurable pecuniary harm will be prosecuted where incidents that cause more difficult to measure non- pecuniary harm may go unpunished.

Second Victim has tremendous power to affect the prosecution and sentence, independent of anything the offender might do.

Third Losses that the law says we should not count against defendants (forensic investigation, worries about harm to reputation) get counted anyway.

Damage Defined Any impairment to the integrity or availability of data, a program, a system, or information. 18 USC 1030(e)(8).

Loss Defined Any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service. (e)(11)

Special Harm The modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; access that causes physical injury to any person; a threat to public health or safety; or damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security.

Sentencing Loss Defined Actual loss includes the following pecuniary harm, regardless of whether such pecuniary harm was reasonably foreseeable: any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other damages incurred because of interruption of service. 2B1.1, comment 3AViii

Problems Intangible harm Incidents vary in severity (socially defined) Repairing system No forensics Court review Only $$ gets punished Trivial incidents may cost more (victim defined) Improving System Forensic Investigation Low standard of proof

Goals of Sentencing 1.to provide punishment levels that reflect the seriousness of the offense; 2.to provide fairness in meeting the purposes of sentencing; 3.to provide just punishment; 4.to provide certainty in meeting the purposes of sentencing.

Improvements Figure out how to value intangible harms. Reach consensus on cognizable losses and depend less on victim assessment. Train responders to distinguish between cognizable and excluded losses. Use a non-monetary measure like # of machines/people affected. Raise standards for fact finding at sentencing.