Comment by will_brown | Hacker News Reader

Comment by will_brown | Hacker News Reader

Parent Full thread

The problem here is that the CFAA - especially the way it is being interpreted as of late - is a relatively new and undefined body of law. Therefore, there is not much case law on point.

As a result you have prosecutors doing what they do best, throwing everything at the wall and seeing what sticks. The problem with throwing everything at the wall is that defendants are more inclined to accept a reasonable plea rather than face the unknown.

For example, is it reasonable to charge someone with a count under CFAA for each instance they try to access a system without permission? You can try to adapt existing case law in unrelated crimes - such as attempted murder, should someone be charged for a new count of attempted murder for each bullet that was shot at a given victim or just a single count notwithstanding the number of shots fired, or how about if there are 2 potential victims the defendant wanted dead but only shot 1 bullet near both of them? Is it reasonable to charge a count under CFAA for running vulnerability software on a website? Is it reasonable to charge someone for breaking and entering if the defendant simply checks to see if doors or windows are unlocked, should we file an additional count for each door/window that was checked or a new count for each time a door knob was turned?

These are all issues that are ripe for the courts to decide, but it will take a very long time before you have a defendant willing to take the risk. What is really troublesome is that in the meantime there are cases such as this where 44 felony counts can be reduced to a single misdemeanor in exchange for a change of plea. The fact that a prosecutor was willing to offer a deal like this means the original charges were improper even in the eyes of the prosecutor.

Expect things to only get worse in terms of prosecutorial discretion vis-a-vis charges under CFAA in the foreseeable future.

The number of counts charged in CFAA doesn't appear to have much to do with sentencing.

There is a huge problem with CFAA sentencing: the sentence accelerator for damages. The iterator count in someone's "for()" loop can make the difference between probation and 3 years in prison.

Incidentally: you probably can be charged with breaking and entering for checking your neighbors window locks.

>The number of counts charged in CFAA doesn't appear to have much to do with sentencing.

This is a bit counter-intuitive. In any type of sentencing hearing, if there is any discretion whatsoever, the number or counts/charges is always used an aggravating/mitigating factor. Actually the same goes for negotiating a plea deal, that is why I say 44 felony counts negotiated down to a single misdemeanor is an acknowledgement by the prosecutor something is wrong with the case.

>Incidentally: you probably can be charged with breaking and entering for checking your neighbors window locks.

Yes, but this would generally result in a single count, notwithstanding how many times the defendant "checked" doors/windows. However, in this case the Defendant was charged with an additional count for each time he tried to "unlawfully access" a given system - which was sometimes multiple times in the course of a minute (the proverbial "door/window check"). The point is the CFAA law is undeveloped and as a result the prosecutors are taking a mile with the inch they are given.

I think you're going to need to be more specific about the way you're saying multiple counts enhance sentences. Here's a relevant chunk of the sentencing guidelines:

http://www.ussc.gov/guidelines-manual/2012/2012-3d11

In any case, this "440 year" nonsense comes from taking the product of the maximum sentence for all counts, which is simply not how sentencing works, or anything like it.

Here is the US Sentencing Commission staff paper regarding Chapter3 PartD (Multiple Counts):

http://www.ussc.gov/sites/default/files/pdf/research/working...

Excerpt: "The Commission created the multiple count rules upon recognizing two important things. First, the Commission acknowledged that an offender who commits five offenses, for example, deserves more punishment than if he commits one, but not necessarily five times the otherwise applicable penalty. Consequently, the guidelines had to provide a mechanism for calculating incremental increases in punishment for multiple offenses. Second, if the guidelines based punishment on the number of offenses of which an offender was convicted, the Commission realized that formal charging decisions could have a tremendous impact on the resulting sentence. Consequently, the Commission had to create guidelines to limit the significance of formal charging decisions to ensure that similar defendants who engage in similar offense behavior will receive similar sentences."

In short, it supports both our positions, that multiple counts are taken into consideration for purposes of sentencing, but that the sentencing is stepped so that enhancement is not a 1 to 1 multiple. That said I did not mean to imply multiple counts enhance sentences, but that where there is discretion, multiple counts would be used as a aggravating factor.

Your example makes me thing of something: what if we're all just less conscientious people online? Lots of people looked at the recent leaked celebrity pictures who wouldn't look into those peoples' windows. It's hard to argue that this is the result of the former being less wrong--the impact on the victim is identical. So it must be that people are just more willing to do "wrong" things on the internet. Should the law take this into account, especially when you're analogizing between the CFAA and breaking and entering, or cyberstalking and real stalking.

>--the impact on the victim is identical.

Physical proximity matters. A remote person who seeks out and looks at the photos is probably at least an inconsiderate jerk. A person who trespasses onto your property and peeps into your windows is not merely an inconsiderate jerk, but represents a potential threat to one's physical safety.

We're not just less conscientious online (though we certainly are that). Technology also makes unethical, immoral, and criminal decisions much easier to make, often so easily that we don't realize that we've done it unless we go out of our way to reflect on it.

That isn't unique to the Internet though. That goes both for other technologies like cars, guns or publishing and "protected" activities like running a business, being a journalist or a lawyer. Maybe most importantly there has to be a reasonable balance between protection (liability) and enforcement (punishment).

>Should the law take this into account...

Definitely not. Doing so is to much of a slippery slope when extended to drugs/alcohol or anything else that has the effect of lowering inhibitions or increasing the likeliness of committing a crime where one might otherwise not.

That said I agree with your point there is a blurring of the line. Whereas in your example, one would have to actively go to someones private property and peep through a window until they caught what they were looking for, versus the internet where a picture practically comes to you, your only act is clicking (tptacek touched on this...maybe could be termed "lowering the barrier to criminal behavior"). So while the victim impact is the same as you say (I might even argue online is worse because there is greater/continued victimization), the acts are different in nature. Blurring the line further is that culturally the internet pictures are normalized in the sense that they are practically marketed via traditional news, social media and late night comedians as things to see rather than condemned as acts of victimization.

That is not an apt analogy at all and frankly I wish people would stop going out of their way to analogize things. The Internet has been around for a while now, so we should be able to see things, or at least discuss them, for what they are.

It's totally apt. Why is peeping into someone's window bad? It's because it's a violation of their privacy, and even if they don't know that someone is watching them, peoples' reaction to the prospect of that happening is enough to justify a social norm to dissuade such conduct. The operative mechanics,[1] are the same when it comes to looking at leaked pictures online. The act of looking doesn't metaphysically cause injury. It's the knowledge or the prospect of people looking.

[1] And that's the value of analogies--not just to help us understand things that are novel in terms of the familiar, but to help us think about how things are similar or different, which helps us cut to the heart of why we think about a thing in a particular way.

Peeping into someone's window is bad because it is trespassing and harassment.

Pictures do not passively "leak" online. Someone goes to the trouble of posting them. If that person didn't have permission to do so, they are the guilty party, not some random person who happens to see the picture, not even knowing who that picture is of.

This is the same as if the peeping tom snapped photos, and then shared them. You're not automatically a wrongdoer just because you see such a thing.

Pictures leaked before we had the Internet. Hello? We had scandals revolving around leaked photographs of famous people decades prior. Paparazzi also existed long before the Internet.

So if the victim doesn't know (can't be harassment), it's just trespassing, I.e. As bad as cutting across someone's lawn? I don't think your explanation captures the psychology here.

If anything sexualizing and dehumanizing celebrities is the cultural norm. Which isn't about the Internet per se. How cloud providers can have zero liability though...

As a result you have prosecutors doing what they do best, throwing everything at the wall and seeing what sticks. The problem with throwing everything at the wall is that defendants are more inclined to accept a reasonable plea rather than face the unknown.

This is a symptom of a much greater problem in our society: plea bargaining and the legislation built to take advantage of it. Plea bargaining is routinely used to extract guilty pleas from those too intimidated or otherwise unable to adequately defend themselves. It is profoundly unjust at its core. Its proponents tout it as a way to save money and reduce the burden on our courts. Since when has saving money been a fundamental pillar of justice?

If you ask me, we should do away with pleas altogether. All defendants would automatically be tried as if not guilty. Prosecution would likewise be compulsory. We would then have to rewrite most of our laws to reduce the ridiculous number of prosecutions that would result from the above changes. This would empower judges to do what they have been trained to do: discover the factual record and independently assess the case against the defendant.

Reply on news.ycombinator.com