Department of Justice announces new policy for charging cases under the CFAA

2. There can be arbitrary changes to law too, with a change in power.

You have numerous forms of redress when you feel that policy is incompatible with law. You can ask the agency in question. You can ask a legislator to pressure the agency. You can ask a legislator to write an explicit law. You can take the agency to court. You can elect an executive that can lay down policy requirements on their subservient agencies.

There's a very unfortunate political meme in this country, that frequently repeats the lie that policy (executive or otherwise) is not the product of elected government. Like any magical spell, if repeated loudly, and frequently enough, I suppose its disciples might will it into being.

When you don't like how the state's prosecutor's office works, in this country, you can elect a new head prosecutor, who will make changes in their department. When you don't like how the federal prosecutor's office works, in this country, you can elect a new executive. All of these agencies under thus, under direct democratic control.

However regardless how strict the law someone "could" always abuse it anyway and some sensible level enforcement is always needed.

This isn't a panacea but responsible prosecution or lack of it is important too.

My lawyers told me also to not use government benefits while on a Green Card, because even though it's probably ok and won't harm my chances at citizenship they may change how they interpret it later down the road and even though I was in the clear when I got the benefits it might as well become a showstopper later on.

Even the worst case scenario of it being revoked in the future, "The jury needs to know the government cannot make up its mind if the defendant committed a crime, or more likely, did not commit a crime."

"Preponderance of the Evidence" is simply going to be tougher when this is handed to the defense.

Sure, this isn't a revised law, considering how hard that is to pass today, but it is a useful piece of official text from the highest law enforcement body of the land that should be taken to indicate what the government considers acceptable behavior. Proving you were abiding by what the government declared permissible is a pretty solid defense.

I get that people have this desire to impose their assistance on others by testing and revealing security vulnerabilities, however, how would you like if someone knocked on your door one day and said, "hey, I was checking out all your doors and windows last night while you were sleeping and hacked into your security system, and thought you should know that it's all suuuuuuper insecure." I doubt most of us would appreciate that either.

What we really really dealing with here is an abuse by the companies/services, where they have externalized the cost/risk of security vulnerabilities in lieu of profits and exec bonuses. If they had to internalize the risks/costs through my proposed damages, they would be quite motivated to prioritize even paying for white hat pen testing type activities, or even just opening up avenues for reporting and rewarding.

I see you're familiar with the ATF.

Overall, this individual move by the justice department is good, but it's bad that more isn't being done.

In this context, it's the DOJ chain of command. This sort of memorandum isn't something that will impact a person's day in court directly should they be prosecuted; it indicates to prosecutors what the Executive branch would consider a "career-limiting move" to waste public resources prosecuting.

Compare with the Obama-era guidance about federal drug law enforcement in states that had decriminalized marijuana. Technically, marijuana never stopped being a (federal) controlled substance, and every state grow operation and distribution center is in violation of federal law. Obama made clear that enforcing that law in those states would be a great way to send a strong signal to one's boss "I'm comfortable at my current level of achievement and feel no need to ever be promoted in the future," and that policy basically hasn't changed in the intervening two administrations. But the federal law is unchanged on the matter.

You can absolutely talk your way out of things, and you can “assert your rights” into charges.

If you refuse to do anything more than legally obligated at a traffic stop, you could easily get a ticket instead of a warning.

Fully agree.

> you can't talk your way out of charges

Fully disagree. I can think of many situations where you talk your way out of charges. One is a traffic ticket. Another is a domestic dispute where someone is making false accusations about you that are easily disproven.

That said, I don't talk to police.

Careful, here. Grand juries are mostly a pro-forma thing; in all but the most egregious cases, they're going to rubber stamp indictments.

Also, it's interesting to consider the massive benefit to scientific communities that Sci-Hub has brought. And how the trend since Swartz has been to ever increasing open access and to cut out the rent seekers.

It seems like Swartz helped to light a path that, in general, scientific communities have followed.

Liberating scientific knowledge, verses those who would rather lock that knowledge up and charge rent to use it ... which side are the criminals.

His methodology was far from perfect, but you paint the liberation of scientific knowledge as if it were the crime of the century. I guess you think Sci-Hub is the devil's chariot?

Seems the rando researcher is subject to the same liabilities as before.

Of course, my memory my be failing me as to details that would make it relevant in his case.

https://en.wikipedia.org/wiki/Mail_and_wire_fraud#Wire_fraud

Is that correct? In https://www.justice.gov/opa/press-release/file/1507126/downl..., I see:

> that division is established in a computational sense, that is, through computer code or configuration, rather than through contracts, terms of service agreements, or employee policies

and later

> A CFAA prosecution may not be brought on the theory that a defendant exceeds authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or web service available to the general public

and

> the Department will not take the position that a mere contractual violation caused the user’s previous authorization to be automatically withdrawn

However, any previous authorization is withdrawn if you receive something that you should understand as a C&D.

It seems to me that this new policy says that to reach the threshold for CFAA prosecution you must now do more than "just" violate the terms of service. Am I misreading?

So I'm not sure better mental healthcare would have helped. Probably more along the lines of destigmatizing mental healthcare might have helped, which is a much harder problem to solve, but also something that thankfully Millennials/Gen Z are doing on their own. It's no longer taboo to mention that you're in therapy.

"The new policy replaces an earlier policy that was issued in 2014, and takes effect immediately."

if an unauthorized, unrecognized contact starts snooping around my edge, they will be put on the graylist.

"for the purpose of discovering security holes in devices, machines, or services in order to extort the owners of such devices, machines, or services—might be called “research,” but is not in good faith."