Security Debate Why cracking should be criminalized

Security  “ protection of a computer or network system from damage or violation from an unauthorized source ”  Important that this includes both damage and violation (breaking into a system even if no damage is done)  “ protection of a computer or network system from damage or violation from an unauthorized source ”  Important that this includes both damage and violation (breaking into a system even if no damage is done)

“Cracking”  “ a person who breaks into security systems illegally ” is considered a cracker or hacker  Anyone who gets onto a system illegally needs to be punished (there are no exceptions specified for people that do not inflict damage)  “ a person who breaks into security systems illegally ” is considered a cracker or hacker  Anyone who gets onto a system illegally needs to be punished (there are no exceptions specified for people that do not inflict damage)

What is a computer system?  include hardware, software, network transmission paths, and people who interact with these components. By this definition, everything from a desktop workstation to the Internet qualifies as a computer system.  About protection of private property  include hardware, software, network transmission paths, and people who interact with these components. By this definition, everything from a desktop workstation to the Internet qualifies as a computer system.  About protection of private property

Real World Examples  Breaking into a house  Even if no damage is done, it is still unauthorized access and punishable  Breaking into a house  Even if no damage is done, it is still unauthorized access and punishable

Another Example  Kristin and Marina said in their position statement: “ We maintain that if there are no damages that can be proven … the cracker has committed no crime ”  However we believe we can use a real world example to counter this point  Kristin and Marina said in their position statement: “ We maintain that if there are no damages that can be proven … the cracker has committed no crime ”  However we believe we can use a real world example to counter this point

Dan’s Diary  If we were to crack into Dan’s computer and read his diary, but no one knew and we didn’t change it couldn’t there still be damage done?  Should always be an assumption on privacy  If we were to crack into Dan’s computer and read his diary, but no one knew and we didn’t change it couldn’t there still be damage done?  Should always be an assumption on privacy

Monitoring  People are allowed to monitor their own systems  Government has authority over many systems, not considered hacking/cracking and therefore is not illegal  It is only unauthorized access that should be punished  People are allowed to monitor their own systems  Government has authority over many systems, not considered hacking/cracking and therefore is not illegal  It is only unauthorized access that should be punished

Privacy Rights  Too narrow a definition of privacy  We are defining this as unauthorized access is what should be punished, if you are accessing something to fix it, then you should have authority to do so  This should never happen without your knowledge, always need consent  Too narrow a definition of privacy  We are defining this as unauthorized access is what should be punished, if you are accessing something to fix it, then you should have authority to do so  This should never happen without your knowledge, always need consent

What should be considered crime?  computer system crime: "any crime involving inappropriate interference with rights or other assets resulting from computer system use."  The National Information Infrastructure Protection Act of 1996  Thanks for bringing this up because according to our definition of the act:  “ One cannot knowingly and with intent to defraud, access a protected computer without authorization, or exceed authorized access, and by means of such conduct further the intended fraud and obtain anything of value ”  Any personal info can be considered “ of value ”  computer system crime: "any crime involving inappropriate interference with rights or other assets resulting from computer system use."  The National Information Infrastructure Protection Act of 1996  Thanks for bringing this up because according to our definition of the act:  “ One cannot knowingly and with intent to defraud, access a protected computer without authorization, or exceed authorized access, and by means of such conduct further the intended fraud and obtain anything of value ”  Any personal info can be considered “ of value ”