Information Security

Information Security • Legal Considerations • Dr. Randy Kaplan

Computer Crime • Legal Considerations • Law enforcement has always lagged behind technology • The computer offers a new venue for committing crimes - one that is almost unlimited

Computer Crime • Legal Considerations • In the history of the Computer Fraud and Abuse Act 1980 is considered the “dawn of the computer age.” • There are documented cases of computer crime as far back as 1960

Computer Crime • 1984 • Comprehensive Crime and Control Act of 1984 • Provisions to address unauthorized access and use of computers and computer networks • Congress wanted to provide a “clearer statement” of this activity

Computer Crime • This clarification was for - • Law enforcement • Those who own and operate computers • Those who may be tempted to commit crimes by unauthorized access

Computer Crime • Consider the environment at the time • Mainframe (large scale computers) still prevalent • Lots of minicomputers • 2 years after the IBM PC was introduced - MS-DOS was the operating system of the day

Computer Crime • Most computer crime of the day consisted of gaining access to computer systems to - • use data contained on these computers to the perpetrator’s advantage • do damage • simply have access to the computer resource

Computer Crime • Congress made it a felony to access classified information in a computer without authorization • Access to financial records or credit histories stored in a financial institution was a misdemeanor • It was also a misdemeanor to trespass into a government computer

Computer Crime • Congress did not add these provisions to existing laws • Rather, they created a new statute, 18 U.S.C. Section 1030.

Computer Crime • After Section 1030 was enacted - • Congress continued to investigate problems associated with computer crime to determine whether federal laws required revision • Throughout 1985 both the House and Senate held hearings on potential computer crime bills

Computer Crime • In 1986, the work of Congress culminated in the Computer Fraud and Abuse Act (CFAA) • Enacted in 1986 • Amended 18 U.S.C. Section 1030

CFAA • Congress attempted to strike a balance • Federal government’s interest in computer crime • Interest of States to proscribe and punish these offenses

CFAA • Congress addressed federalism concerns • Limit federal jurisdiction • Only cases with a compelling federal interest • Where the computers of the federal government or certain financial institutions are involved or -

CFAA • the crime itself is interstate in nature

CFAA • The CFAA clarified a number of provisions in the original section 1030 • Criminalized additional computer-related acts

Damage or Destruction of Data • Penalize those who intentionally damage or destroy data belonging to others • Penalize those who steal property via computer that occurs as part of a scheme to defraud

Damage or Destroy • Penalize those who intentionally damage or destroy data belonging to others • Covers activities like: • DNOS attacks • Distribution of malicious code

Password Trafficking • Congress also included a provision criminalizing the trafficking passwords and similar items

Amendments • CFAA amended • 1988 • 1989 • 1990 • 1994 • CFAA amended • 1996 • 2001 • 2002

Types of Criminal Activities • CFAA identifies seven types of criminal activities • Obtaining National Security Information • Compromising the confidentiality of a computer • Trespassing in a Government computer

Types of Criminal Activities • CFAA identifies seven types of criminal activities • Accessing a Computer to defraud and obtain value • Knowing Transmission and Intentional Damage • Intentional Access and Reckless Damage

Types of Criminal Activities • CFAA identifies seven types of criminal activities • Intentional Access and Damage • Trafficking of Passwords • Extortion Involving Threats to Damage Computer

Civil Action • The CFAA allows victims, under certain circumstances, who suffer specific types of loss or damage for compensatory damages and other injunctive or other equitable relief

Key Terms • Two terms are common to most prosecutions under section 1030 • Protected Computer • Authorization

Protected Computer • “protected computer” • a statutory term of art that has nothing to do with the security of the computer

Protected Computer • “protected computer” • protected computer refers to computers that are used in interstate or foreign commerce (e.g. Internet) and computers of the federal government and financial institutions

Protected Computer • “protected computer” • did not appear in the CFAA until 1996 • Congress was attempting to correct deficiencies identified in earlier versions of the statute

Protected Computer • “protected computer” • In 1994 Congress amended the CFAA • Protect any computer used in interstate commerce or communication as opposed to a “Federal Interest Computer”

Protected Computer • “protected computer” • Protect any computer used in interstate commerce or communication as opposed to a “Federal Interest Computer” • Expands the scope of the act • Include certain non-governmental computers

Protected Computer • “protected computer” • The 1994 amendment inadvertently removed protections for computers that were government and financial computers not used in interstate commerce

Protected Computer • “protected computer” • In 1996 “protected computer” defined as • a computer used by the federal government or financial institution OR • a computer used in interstate or foreign commerce

Protected Computer • “protected computer” • This definition did not explicitly cover - • an attacker within the U.S. attacks a computer system located abroad • individuals in a foreign country routing communications through the U.S. as they hacked abroad

Authorization • Criminal offenses will usually involve • access without authorization • exceed authorized access • The term “without authorization” is not defined in the Act • One court found its meaning to be elusive

“Exceeds Authorized Access” • Defined by the CFAA • To access a computer with authorization • Use this access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter

Insiders • The legislative history of the CFAA reflects an expectation • Persons who exceed authorized access are likely to be insiders • Persons who act without authorization are likely to be outsiders

Insiders • As a result of this expectation - • Congress restricted the circumstances under which an insider could be held liable for violating section 1030

Insiders • “Insiders who are authorized to access a computer, face criminal liability only if they intend to cause damage to the computer, not for recklessly or negligently causing damage.”

Outsiders • Breaking into a computer • can be punished for any intentional, reckless, or other damage they cause by their tresspass

Outsiders • Have not rights to use a protected computer system and they should there be subject to a wider range of criminal prohibitions • Those who act without authorization can be convicted under any of the access offenses contained in the CFAA

Authorization • The universe of individuals who lack any authorization to access a computer is relatively easy to define • Determining whether individuals who possess some legitimate authorization to access a computer have exceeded that authorized access may be more difficult

Exceeds Authorized Access • To access a computer with authorization and to use such access to obtain or alter information in the computer accessor is not entitled so to obtain or alter

Scope of Authorization • Hinges upon the facts of each case • Simple prosecution - • a defendant without authorization to access a computer may intentionally bypass a technological barrier that prevented her from obtaining information on a computer network

Scope of Authorization • Many cases will involve exceeding authorized access • Establishing the scope of authorized access will be more complicated • The extent of authorization my depend on an employment agreement

Scope of Authorization • May depend on • terms of service notice • log-on banner outlining the permissible purposes for a accessing a computer or computer network

Scope of Authorization • In one case • an insider • limited authorization to to use a system • strayed far beyond the bounds of his authorization • The court treated him as acting without authorization

Scope of Authorization • United States vs. Morris • Convicted under a previous version of Section 1030(a)(5) which punished “intentionally accessing a Federal interest computer without authorization.”

Morris’s Crime • Created an Internet program known as a worm which spread to computers across the country and caused damage • To enable the word to spread Morris exploited vulnerabilities in two processes he was authorized to use - sendmail and fingerd

Morris’s Appeal • Morris argued that because he had authorization to engage in certain activities such as sending electronic mail on some university computers he merely exceeded authorized access rather than having gain unauthorized access

Morris’s Appeal • The Second Circuit rejected Morris’ argument on three grounds • (1) It held that the fact that the defendant had authorization to use certain computers on a network did not insulate his behavior when he gained access to other computers that were beyond his authorization

Morris’s Appeal • Congress did not intend an individual’s access to one federal interest computer to protect him from prosecution no matter what other federal interest computers he accesses

Information Security