But this is just a policy clarification and not a change to the text of the CFAA itself. Policy is not law and there can be arbitrary exceptions and even complete reversals of policy with a change in power.
My lawyers told me also to not use government benefits while on a Green Card, because even though it's probably ok and won't harm my chances at citizenship they may change how they interpret it later down the road and even though I was in the clear when I got the benefits it might as well become a showstopper later on.
There does seem to be an issue with baseline education standards and the ability of the jury to understand the evidence which they deliberate on, however. To an extent it's the lawyers' job to ensure that the jury understands their arguments, but no reasonable effort from a lawyer over the course of a single trial is going to make up for a lack of basic familiarity with the subject matter, which might normally take years to acquire. There is something to be said for systems which rely on professional jurors rather than random members of the public.
Definitely anecdote and not data, but I found it interesting coming from a litigator in this area.
But in the meantime, it's great that the DOJ is explicitly denouncing some of the more ridiculous interpretations of the CFAA. No reasonable person would expect that violating a web site's Terms of Service could result in criminal charges, for example.
I agree, but there needs to be a mostly-automatic mechanism whereby repeated exercise of this discretion affects the law itself, so that you don't create the opposite problem: people getting unjustly maimed by the legal apparatus because a prosecutor decided to use their "discretion", for whatever reason, to enforce an obsolete law which was still on the books even though it's almost never enforced. (Because legislators apparently have better things to do than repeal old laws which aren't affecting hardly anyone.)
A law which consistently goes unenforced should eventually become unenforceable, not remain discretionary. Consider this an application of the estoppel principle: If you choose not to enforce the law in cases A, B, and C, you shouldn't be able to later try to enforce it in case D without showing that there is some substantial difference between D and the first three cases.
Mandatory sunset clauses would be another good idea, along with a requirement that the entire bill, along with any external documents incorporated by reference (e.g. building codes), must be read into the official record with a quorum of the legislature present before it can be passed or renewed.
This is one of the most sensible things I've heard proposed that will never work. (I'm saying that, if laws are so complicated that no human can learn them well enough to keep themselves in compliance without assistance of a compliance department, or so complicated that even the people who are directly responsible for them cannot be bothered with being made aware of the details and double checking that they still make sense on a somewhat regular basis... then they are too complicated.)
I think it will never work because complex things are complex for a reason on the balance, and because we're already "too deep to dig ourselves out of this hole." But in principle I agree wholeheartedly with this idea.
I want it to be easy add new ways to strip another person of their rights without being burdened by having to understand the system as a whole.
-A complaint from every developer and legislator ever.
We're talking about laws, which generally bind individuals to certain behaviors. Laws do not make rights as far as I'm aware (and IANAL), they are "God-given." At least in US legal tradition, as I understand, the default position of the law is that you are allowed to do anything which does not infringe on anyone else's enumerated rights, and laws can only bind you from doing things which you would otherwise be free to do in the absence of those laws.
If the laws which bind our behaviors are so complex they cannot be read aloud in their totality in any practical time period then how is anyone (let alone anyone whose profession is not "the law" or acting in legislature) ever to be expected to understand them as a whole? (Especially when certain laws have traditionally gone unenforced, to borrow from the original context of this thread.)
The law should be possible to understand. That is a decent aspirational goal. I'm not sure what you think I meant but it's not what you said.
Some states have a government body that does nothing but review old laws and rules and agencies to see if they're still needed.
I don't know how successful they are (for varying definitions of "successful,") but they do exist.
[0] https://en.wikipedia.org/wiki/Statute_Law_%28Repeals%29_Act
[1] https://en.wikipedia.org/wiki/Statute_Law_%28Repeals%29_Act_...
[2] https://en.wikipedia.org/wiki/Law_Commission_%28England_and_...
Strike down "ignorance of the law is no excuse" and see what happens.
Common in this case because the CFAA is often used not as an enforcement tool, but as a way of silencing critics, stifling scrutiny or just in general saving face.
Airtight enforcement of all laws is only a threat to liberty when the laws themselves are a threat to liberty.
Only because "all laws" now includes all manner of micromanagement of people's lives by the government. The proper way to fix that problem is to stop the micromanagement by repealing all of those laws, not by making the micromanagement discretionary. Nobody complains about "airtight enforcement" of laws against, for example, murder. In fact, the common complaint about those laws--i.e., laws that actually encode a prohibition against an obvious crime--is that they do not get the airtight enforcement that they should get--because law enforcement and politicians are too preoccupied with all of the micromanagement to just do their basic job of protecting people's basic rights.
Discretion is fundamental to the legal system. Any system that doesn't allow discretion is going to be a disaster - the world is complex, there's always nuance. It also leads to abuse, but I reject the idea that strict enforcement would solve abuse - but you've basically said "some laws" are bad laws so it's hard to say.
I suspect you're just saying "government should stay out of everything, that way people are free", and you're ignoring the fact that in a system like that no one's stopping a bunch of assholes from shitting on everyone else because it's not illegal.
I don't think people complain about lack of discretion with murder. I think people complain about too much discretion: obvious murderers are allowed to go free because of technicalities or political influence.
> that's why we have multiple degrees, and it's a matter of discretion (by many parties) which was committed.
No, it's a matter of discretion which gets charged, in the sense that the prosecutor cannot be forced to bring one particular charge or another; it's the prosecutor's choice. But in most cases, which charge best fits a particular set of facts should not be difficult to determine. And in a sane legal system which only focused on protecting basic rights instead of trying to micromanage everything, it wouldn't be.
> Discretion is fundamental to the legal system.
Discretion in rare edge cases is fundamental to the legal system. But as I commented elsewhere in this thread, if the need for discretion is common, then we aren't talking about edge cases; we're talking about a legal system that has gotten out of hand.
> I suspect you're just saying "government should stay out of everything, that way people are free"
I have no idea where you're getting that from since I explicitly said the government's basic job is to protect people's basic rights.
Discretion is literally built in ie: intent, malice, negligence, etc - these are all subjective judgments that I think any sane person supports. Accidentally killing someone should be treated very differently from planned murder - and we use subjective judgment to determine the case.
> No, it's a matter of discretion which gets charged, in the sense that the prosecutor cannot be forced to bring one particular charge or another; it's the prosecutor's choice. But in most cases, which charge best fits a particular set of facts should not be difficult to determine. And in a sane legal system which only focused on protecting basic rights instead of trying to micromanage everything, it wouldn't be.
First off, no, it is not the prosecutor's sole discretion. Obviously the prosecution (which is many people who form a consensus) brings the charges, but the defense may attempt a plea for a different charge, and the judge will instruct the jury on how to determine a conviction. Discretion is fundamental to the entire process, as it should be.
Second, notice that you're already saying things like "in most cases" ie: things are not 100% one way or the other.
> Discretion in rare edge cases is fundamental to the legal system. But as I commented elsewhere in this thread, if the need for discretion is common, then we aren't talking about edge cases; we're talking about a legal system that has gotten out of hand.
Discretion is already selectively applied. Not every case goes to a jury. We have different types of discretion, like civil law or arbitration. What no one is asking for is less discretion. "Zero tolerance" black and white policies are pretty much a disaster.
> I have no idea where you're getting that from since I explicitly said the government's basic job is to protect people's basic rights.
Maybe you should come out and say what those basic rights are and are not?
They are legal judgments that in the end, if the case goes to trial, get made by juries. They are only "subjective" in that no person can truly see inside the mind of another, so everyone has to make their best judgment based on what they can see.
That's not at all the same as law enforcement selectively enforcing micromanagement laws--my usual go-to example is laws against speeding. Nobody even pretends that enforcement of speeding laws is a reasonable use of discretion on the part of law enforcement: enforcement is based on using such laws as a revenue source. The CFAA is the same kind of thing: as I asked in another post upthread, since fraud is already illegal, why should using a computer to commit fraud be any different from committing fraud some other way? Why not just enforce the laws we already have against fraud?
> it is not the prosecutor's sole discretion. Obviously the prosecution (which is many people who form a consensus) brings the charges, but the defense may attempt a plea for a different charge
Again, this kind of "discretion" is not the same as the kind of "discretion" involved in enforcement of micromanaging laws like speeding laws. Obviously each party in the legal process has to make judgments. Prosecutors have to decide what charges the facts they have will support. Defense lawyers have to decide how best to defend their clients given what they know. But in a sane legal system, prosecutors should not be deciding which cases to aggressively prosecute based on political considerations (e.g., how Aaron Swartz was treated), and defense lawyers should not have to decide whether to advise their clients to accept a plea bargain based on how full the court's docket is.
Nor, to get back to the subject of this thread, should prosecutors be deciding whether "white hat" security researchers are committing a crime. That should not even be on their radar. But with the CFAA, it is. And we're supposed to be so pleased that now the prosecutors will be less draconian in making such judgments than they were before.
> Maybe you should come out and say what those basic rights are and are not?
Um, how about the right not to be murdered or defrauded? Do those count?
It's really nuts to me that "legal" And "subjective" are concepts you're trying to draw a hard line between. Of course all legal judgments are subjective - that is both obviously inherent as well as being a desirable feature. Yes, you nailed it, the jury system does indeed require a judgment based on the information as it is presented to them...
> Nobody even pretends that enforcement of speeding laws is a reasonable use of discretion on the part of law enforcement: enforcement is based on using such laws as a revenue source.
I mean, how does this support your case? Speeding laws are extremely black and white, there's very little legal discretion, the discretion is in terms of enforcement ie: are you getting pulled over. But it's not like you sit in front of a jury and present the facts, it's much closer to what you seem to be advocating for - a system with less human intervention.
> since fraud is already illegal, why should using a computer to commit fraud be any different from committing fraud some other way? Why not just enforce the laws we already have against fraud?
For like a million reasons lol I feel like this is just "I have no idea how the legal system works, but in my mind this whole thing is so simple, why not simply apply the law objectively?".
I mean god I don't even know where to start. Different types of fraud are going to have jurisdiction in different agencies. We fundamentally require different agencies because we have a federal and state legislature (and many other very good reasons) - so I guess if you want to remove states and "simplify" things, maybe you could start moving towards a single "fraud" construct?
There's also expediency and practicality, but that's more nuanced and I feel like if I have to explain "there's a federal and a state government" we shouldn't jump into how a law is made.
> But with the CFAA, it is. And we're supposed to be so pleased that now the prosecutors will be less draconian in making such judgments than they were before.
Multiple things can be true. The CFAA is broad and shitty. Also, the legal system is not some simple thing where you can just "objectively" enforce the law, nor should it be. If you want to say "the CFAA is overly broad" ok, cool. If you want to say "this isn't a good thing because this is just a policy, not a change in the law", ok sure.
But saying "We should have a singular objective definition of fraud" and acting like that's simple or achievable is plain naive, and this whole discretion argument almost feels irrelevant.
At this point I don't think you even know what you're trying to say, I'm gonna disengage. I would suggest you disentangle your points since it seems like you're trying to say a lot of different things.
Good, then we're in agreement on my basic point: that the CFAA is bad law. That means the best way to fix the root problem with the CFAA is to repeal it because it's bad law, not try to patch it. As I have pointed out at various points in this overall thread, we already have laws against fraud. All we need to do is apply them to fraud committed using computers. We don't need a whole new set of laws just for fraud committed with computers.
> At this point I don't think you even know what you're trying to say
Sure I do. I just said it again above.
Even then, there is prosecutorial discretion. There are all kinds of edge cases, like brainwashed/abused accomplices, and the gray areas between murder, manslaughter, and self defense, or between different degrees of murder. It's easy to say all the real murders should be charged as such, but which are those? Just about any homicide could turn into a murder trial, if the prosecutor were so inclined, but not all of them should turn into a murder trial.
In a sane legal system, this would not be true. That is my basic point. The fact that it is true in our legal system is a bug, not a feature.
If they're common, they're not edge cases. The whole point of having prosecutorial discretion for edge cases is that such cases should be extremely rare. If they turn out to be common, it's a sign that the whole system of law has gotten out of hand, not that some boundaries need to be tweaked.
That makes it ‘common’ but also not worthwhile to spend months updating the code on if they are each different issues.
The rule against murder is applied across 300 million people and very rarely has edge cases. The same goes for the rule against fraud, which is more to the point for this discussion (see below).
The problem is that most of the "rules" that are applied across 300 million people are not straightforward rules like the ones against murder or fraud, but micromanaging rules like the ones in the law that is the subject of this article. The law itself is silly: fraud is already a crime, why should fraud using a computer be any different from any other kind of fraud? If we just had the simple rule against fraud, it would be obvious that "white hat" security testing of computer systems is not fraud and is not a crime, and we wouldn't have all the edge cases that make enforcement of this law such a mess. The only reason the edge cases are so common is that the laws are not written to embody simple straightforward rules against obvious crimes that everybody can recognize; they are written to embody complex, byzantine rules that have evolved over time because people have the mistaken belief that giving more power to the government can solve problems. But actually, as the old joke about regular expressions goes, when people try to use the government to solve a problem, now they have two problems.
Most jurisdictions even have 3+ different definitions for murder alone (not to mention manslaughter) and a bunch of specialist lawyers to figure it out, and a bunch more lawyers to argue about technicalities!
In other words, most jurisdictions can't just leave it at a simple common law definition of murder; for example: "At common law, murder was defined as killing another human being with malice aforethought." [1]
This is not a matter of edge cases. It's a matter of the legal system getting out of hand even for what should be basic common law crimes.
That example is not what you think it is.
Murder has, like tons of edge cases, as reviewing almost any jurisdiction’s criminal homicide laws will reveal.
(Here's California's, for reference) https://leginfo.legislature.ca.gov/faces/codes_displayText.x...
> The same goes for the rule against fraud
That's not true of either civil or criminal fraud (which generally have quite different sets of edge cases.)
In other words, you're saying that even what should be fairly simple laws have been overcomplicated by our byzantine legal system, so that prosecutorial discretion can be abused even for them. I don't disagree, but I don't see how it contradicts my basic point.
No, I’m saying that operationalizing fairly simple moral principles into forms suitable for enforcement as laws is inherently messy, and that the examples you cited of it's potential simplicity, in fact, are examples that demonstrate the very complexity you held them up as lacking.
Assuming that I agree with this (at least for the sake of argument), it still misses my point. My point is that most laws--and the CFAA is an example--are not "operationalizing fairly simple moral principles into forms suitable for enforcement as laws". As I have pointed out several times now at various points in this overall discussion thread, we already have laws against fraud. Why should fraud that is committed with a computer be any different from fraud commmitted by other means? Having a separate law that makes committing fraud with a computer different from committing fraud some other way is not operationalizing a fairly simple moral principle against fraud. It's making the legal system more byzantine and complex for no good reason. That is what I am arguing against.
No its not. Prosecutorial discretion is older than the US Constitution. No one expects the police to pull over every driver that is going 36 in a 35, or arrest someone speeding to the hospital, or arrest everyone that fails to return a library book, or arrest every birthday party with loud music after 10.
The police and prosecutors have always had the power to use their good judgment and warn without citing or prosecuting.
To your point: I'd be thrilled if police officers actually pulled over everyone violating each and every traffic law. It'd make roads much safer and easier to use. As it stands where I live there is no longer any traffic enforcement.
On the other hand, efforts to constrain that power have a tendency to encode societal biases and injustices in law (see mandatory minimum sentences as a prime example), so it's not at all clear what the right compromise is.
Why not? If it's ever OK to pull someone over for 1 MPH over the limit without any other violations, then why isn't it always? Where do you draw the line? Why not codify that instead of the strict limit?
If there is supposed to be discretion, then the law should acknowledge this by not providing a strict limit and requiring that the state prove a case that the driver was being unsafe by traveling the speed they were. If there is a strict limit, then it should be set such that one can reasonably say that it's always wrong to exceed it. Saying it should be strictly enforced for some and loosely for others just leaves room for that discretion to be weaponized.
---
It's also worth noting that at the moment speed enforcement has a much greater impact on the poor than the rich.
For the most part if you can afford to hire a lawyer speeding tickets can be converted in to zero point off-the-record offenses and are then just a fine, and since fines are not scaled by income in this country anyone who has sufficient disposable income becomes effectively immune to them where a person living paycheck to paycheck already who then likely has to take some or all of a day off of work to go to court might be ruined.
Fix that and I could be in favor of strict enforcement as long as it was truly universal. I feel like if everyone was actually forced to obey the posted limit strictly we'd get some progress on killing speed trap towns and fixing the many places where a fast road has been built with an arbitrarily low speed limit that no one ever follows because it's insane.
And the public ultimately is the power here, or the ones who decide if a big scene is going to be made anyway.
Think about that while you read stuff like this: "Many Failed Efforts to Count Nation's Federal Criminal Laws" https://www.wsj.com/articles/SB10001424052702304319804576389...
The point is, if it were a bill, you'd have to have enough support to make the change, compromise on terms/ammendments, etc. It also means the elected representatives would be held accountable by the voters. As a regulation, they can avoid compromise and most accountability. The regulation would have to piss off the ruling party for the joint resolution to be a viable option.
Periodically an agency proposes something that stirs up a firestorm, and rarely (but it happens), they do get overridden by Congress.
Usually it’s handled through the public review comment and strategically done strongly worded letters from interested Congress people or committees.
It’s important to keep in mind that these are the second order effects FROM Congress passing a law to create an agency and funding it.
Because the reality is that if the executive waited for approval from Congress or for the solution to a serious issue to be non-controversial, they’d literally never be be able to do anything at any such agency. They already are dysfunctional enough as-is. If you think requiring sign off from the even less effective organization that is Congress on everything is going to make it better, I have a bridge to sell you.
And as enticing an idea it might be sometimes to have the DEA, ICE, FBI, etc. unable to actually function, they do generally serve a necessary purpose and them completely not functioning is unlikely to result in anything the nation overall would consider ‘good’.
The periodic Gov’t shutdowns help show this to be the case.
The register, with it’s problems, and even when abused (cough Ajit Pai and net neutrality) is still better than what used to happen, which was the agency would just do it’s own internal policy making and keep it secret until they got sued (which isn’t easy to do with sovereign immunity when the agency declares all potential evidence secret!) or Congress started to investigate. Then half the time they’d shred all evidence and deny all wrongdoing.
Congress has also made it clear they have no interest or ability to provide guidance or fine grained clarification on things at the level to actually be able to run an organization the size of the Executive or it’s Agencies. It would also probably be unconstitutional to try.
If you want to see some agencies that conveniently skip things like the Register, look no further than the NSA, CIA, large swaths of the DOD, etc.
IMO, the real issue is the ongoing massive income tax revenue that feeds the machine. It was originally used to fund the world wars, but never dialed back. As long as that giant stream of money keeps going to the Federal Gov’t, it will continue to be used to justify itself and be spent.
That ship sailed a long time ago however.
Even the worst case scenario of it being revoked in the future, "The jury needs to know the government cannot make up its mind if the defendant committed a crime, or more likely, did not commit a crime."
"Preponderance of the Evidence" is simply going to be tougher when this is handed to the defense.
No, but I'm having a hard time finding a reference now :/ You may be able to argue malicious prosecution, in which that may be a piece of evidence. The bar for MP is quite high though.
Another far-fetched strategy would be to argue that, because of the government's inconsistency about how the law is applied, the law itself might be unconstitutionally vague.[0] This is not legal advice, though.
Defendants certainly argue that a particular prosecution is selective enforcement and will refer to DOJ policies.
‘Making an example of someone’ that they happen to catch (and being terrible at catching most people) is still perfectly fine however. So good luck with that.
My understanding is that in the US "singling out" specific criminals is perfectly OK for the prosecution to do (well, legally speaking, I'm not saying it's ethical or won't get them in trouble with voters).
(Again, given you aren't singling them out because of a protected class like race, sex, etc)
Like pointed out in a sibling thread though, essentially impossible to prove, let alone get anyone to care about, and useless as a defense unless someone is being stupidly blatant about it.
However regardless how strict the law someone "could" always abuse it anyway and some sensible level enforcement is always needed.
This isn't a panacea but responsible prosecution or lack of it is important too.
I get that people have this desire to impose their assistance on others by testing and revealing security vulnerabilities, however, how would you like if someone knocked on your door one day and said, "hey, I was checking out all your doors and windows last night while you were sleeping and hacked into your security system, and thought you should know that it's all suuuuuuper insecure." I doubt most of us would appreciate that either.
What we really really dealing with here is an abuse by the companies/services, where they have externalized the cost/risk of security vulnerabilities in lieu of profits and exec bonuses. If they had to internalize the risks/costs through my proposed damages, they would be quite motivated to prioritize even paying for white hat pen testing type activities, or even just opening up avenues for reporting and rewarding.
2. There can be arbitrary changes to law too, with a change in power.
You have numerous forms of redress when you feel that policy is incompatible with law. You can ask the agency in question. You can ask a legislator to pressure the agency. You can ask a legislator to write an explicit law. You can take the agency to court. You can elect an executive that can lay down policy requirements on their subservient agencies.
There's a very unfortunate political meme in this country, that frequently repeats the lie that policy (executive or otherwise) is not the product of elected government. Like any magical spell, if repeated loudly, and frequently enough, I suppose its disciples might will it into being.
When you don't like how the state's prosecutor's office works, in this country, you can elect a new head prosecutor, who will make changes in their department. When you don't like how the federal prosecutor's office works, in this country, you can elect a new executive. All of these agencies under thus, under direct democratic control.
Arbitrary changes to law aren't retroactive in general. If you did something in the past that has later become illegal, you can't be prosecuted. The same doesn't apply for policy changes.
Agencies can only enforce ex-post-facto policy changes if congress explicitly authorized them to.
... Also, as Matt Levine points out, executive agencies are prohibited by law from making capricious and arbitrary policy changes. Congress is not bound by any such restrictions - it can pass legislature that is as capricious and arbitrary, and as completely devoid of public input as it likes.
Sure, this isn't a revised law, considering how hard that is to pass today, but it is a useful piece of official text from the highest law enforcement body of the land that should be taken to indicate what the government considers acceptable behavior. Proving you were abiding by what the government declared permissible is a pretty solid defense.
I see you're familiar with the ATF.