Laws Against Computer Hacking By Doug Lee Overview

Laws Against Computer Hacking By Doug Lee

Overview The term Hacking n Good example of a hacker n Computer Fraud and Abuse Act of 1986 n Digital Millennium Copyright Act of 1998 n Exemptions from the Law n

The term “Hacking” Typing? Or Criminal Activity? n “In the past decade, however, "hacker" has come to describe those people with a handson interest in computer security and circumventing such security. “ n

Kevin Mitnick a. k. a Condor n n FBI’s number one most wanted Nickname “The Lost Boy of Cyberspace” Captured February 1995 25 counts of federal computer and wire fraud

The Computer Fraud and Abuse Act of 1986 n n n Why signed into law? Three offenses Misdemeanor trafficking in computer passwords Felony unauthorized access in federal interest computers Felony “malicious damage”

Federal interest Computer Defintion of Federal Interest Computer "exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government, and the conduct constituting the offense affects such use, or which is one of two or more computers used in committing the offense, not all of which are located in the same State. “ Examples: Banks, Federal Reserve, Depart of Defense etc…. . n

Felonies Unauthorized Access with intention to commit fraudulent theft n Address "malicious damage” n – Victim loss of $1000 or more – Except medical cases Five years for first felony n Ten years for the second felony n

Misdemeanor n Intent to commit fraud affecting interstate commerce – computer passwords are revealed – Message boards – Disposes passwords to another person

Examples n Herbert Zin a. k. a “shadowhawk” – First violator – Broke into AT&T, Department of Defense – Sentenced nine months and $10, 000 fine n Robert Morris – Launched worm virus – Three years probation, 400 hours community service, $10, 000

Digital Millennium Copyright Act of 1998 Signed on October 28, 1998 by President Clinton n Divides into Five Titles n – WIPO Copyright and Performances and Phonograms Treaties Implementation Act of 1998 – Online Copyright Infringement Liability Limitation Act – Computer Maintenance Competition Assurance Act – Miscellaneous Provisions – Vessel Hall Design Protection Act

Security Testing n n security testing means “ accessing a computer, computer system, or computer network, solely for the purpose of good faith testing, investigating, or correcting, a security flaw or vulnerability, with the authorization of the owner or operator of such computer, computer system, or computer network” Security testing – Information used » To promote the security » Does not infringe the violation of privacy or breach of security n – Vulnerabilities must be told to developer Ex. HP threatens to sue researchers Tru 64 operating system

Encryption Research n n the term `encryption research' means activities necessary to identify and analyze flaws and vulnerabilities of encryption technologies applied to copyrighted works exemptions – Act of good faith to get authorization – Information obtained » Used to advance the state of knowledge or development of encryption technology – legitimate course of study, employment or training n Ex. Dmitry Sklyarov

Computer Maintenance Competition Assurance Act Allows a person to make a copy n Only for maintenance purposes n After fixed, must be destroyed n

Online Copyright Infringement Liability Limitation Act Transitory Communications n System Caching n Storage of Information on Systems or networks at the direction of users n Information Location Tools n

Other uses of the DMCA restricts code that "is primarily designed or produced for the purpose of circumventing protection" of copyrighted works n crime to circumvent anti-piracy measures built in software n Outlaws code-cracking devices n

Conclusions n n Are the laws too broad in Computing? Need more provisions? – Security testing – Researching n Do the laws really help prevent hacking? – Reasons for hacking » » » Theft of services e. g. America online Take valuable files e. g. credit card numbers Vengence or hate Thrill and Excitement Recognition

Recognition n “All the hackers out there figure if they can hack Kevin Mitnick's site, they're the king of the hill. ” -Kevin Mitnick