Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

Parent Full thread

  The defendant is charged in [Count _______ of] the indictment with
  computer fraud in violation of Section 1030(a)(4) of Title 18 of the
  United States Code. In order for the defendant to be found guilty of
  that charge, *the government must prove each of the following elements*
  beyond a reasonable doubt:
   
  First, the defendant knowingly [accessed without authorization]
  [exceeded authorized access to] a computer [that was exclusively for
  the use of a financial institution or the United States government]
  [that was not exclusively for the use of a financial institution or
  the United States government, but the defendant’s access affected the
  computer’s use by or for the financial institution or the United
  States government] [used in or affecting interstate or foreign
  commerce or communication] [located outside the United States but
  using it in a manner that affected interstate or foreign commerce or
  communication of the United States];
   
  Second, the defendant did so with the intent to defraud;
   
  Third, by [accessing the computer without authorization] [exceeding
  authorized access to the computer], the defendant furthered the
  intended fraud; [and]
   
  Fourth, the defendant by [accessing the computer without
  authorization] [exceeding authorized access to the computer] obtained
  anything of value[.] [; and]
   
  [Fifth, the total value of the defendant’s computer use exceeded
  $5,000 during [specify applicable period.]

The last clause applies when the object of the fraud is access to the computer itself; for instance, if your fraud was "gain free wireless access".

In this case, the defendant is charged with 1030(a)(4), which is fraud, and the government therefore has to prove fraud.

The defendant could also have been charged - in some other case - with 1030(a)(2), which is obtaining information from any protected computer without access. In that case, the government would not have to prove fraud.

A blog is not a protected computer, which is a term with a definition in the law --- it's one that used by financial institutions, by the US government, or that affects interstate commerce. Again: not a blog.

Furthermore, regardless of whether the prosecution charges a crime that requires intent to commit fraud --- for instance, in the unlikely event that they tried to spin a yarn about a blog affecting interstate commerce --- CFAA crimes aren't strict liability. They must prove intent to exceed authorization.

"affects interstate commerce" is anything, as has been shown time and time again by the Federal government.

http://en.wikipedia.org/wiki/Wickard_v._Filburn and subsequent cases: producing a product on your own, and thereby not engaging in commerce, is considered commerce.

As someone who thinks Wickard was a gross expansion of power, that doesn't mean that it applies in CFAA cases.

(Also, this year's PPACA ruling detoothed the commerce clause's power. How much it did that is to be determined.)

If you have AdWords on your blog, you're doing interstate commerce.

i think you do not even require adwords, because you can construe that interstate commerce happened if the traffic of the website is routed from your web server from one state, to another, and that you paid for the traffic from your web server!

> A blog is not a protected computer, which is a term with a definition in the law --- it's one that used by financial institutions, by the US government, or that affects interstate commerce. Again: not a blog.

That is flatly and totally wrong. Any computer connected to the internet is a "protected computer" for the purposes of this statute: full stop, end of story. Additionally, some computers not connected to the internet are protected computers.

It's possible that a blog on an intranet machine that is absolutely not accessible to the outside world could be argued not to be a "protected computer". Any blog routable from the outside world absolutely is.

Every blog in the world accessible from the internet is in fact being run on a "protected computer". Accessing any of these machines without authorization or exceeding authorization can in fact be charged as a federal misdemeanor.

This is not arguable. It's exactly what the statute says, it's exactly what the DOJ says, it's exactly what every court to consider the issue has said.

For example, here's a direct quote from one case: "the latter two elements of the section 1030(a)(2)(C) crime [obtaining information from a protected computer] will always be met when an individual using a computer contacts or communicates with an Internet website".

Note the word ALWAYS. All that remains to be proven is that you weren't drunk or otherwise not in control of your faculties, and that you did it without authorization or exceeding authorization.

People take issue with me calling you a knucklehead. But you are making statements that anyone with a cursory knowledge of the law would know to be false, and you are making them repeatedly and refusing to educate yourself about it or to investigate in any way or to consider the possibility that you might be wrong.

Reply on news.ycombinator.com