New Technology Law
Thursday, November 11th, 2004At the Volokh conspiracy, Orin Kerr writes a number of technology-related questions regarding computer crime law. I have no formal legal experience, though I consider myself reasonably informed. However, I am quite well versed in computer technology so I would like to give the questions a shot. They are:
(1) Is it possible to establish a Fourth Amendment “reasonable expectation of privacy” in remotely stored Internet files such as e-mail, or do you lose Fourth Amendment protection in e-mail when you send it? If you can retain protection, when? (No Article III court has answered this essential question yet, and it turns out to be a suprisingly difficult problem that has received very little scholarly attention.)
(2) Many computer crime laws prohibit unauthorized access to computers. But what does “access” mean? What does “authorization” mean? (I wrote an article on this last year with some ideas, but the issue is very much open.)
(3) What Fourth Amendment test should courts use to determine when a computer file is “seized”? The Supreme Court has held that seizing requires dispossession; does this mean that if you merely copy a computer file you are not seizing it, and that the FBI can copy your files without implicating the Fourth Amendment? (Almost no scholarhip on this, although I am working on a piece that will touch on it.)
(4) In the context of sentencing computer criminals, are cybercrime-specific rules needed? Is it fair to treat a virus-writer who inadvertently causes $100 million worth of damage the same as a con man who reaps $100 million of profit from his victims? For that matter, how do you calculate how much harm a computer virus causes? (Basically no scholarship on this yet.)
(5) Child pornography laws prohibit the “possession” of images of child pornography. But what does it mean to “possess” a computer file? If you view a file on your computer, are you possessing it? Does it depend on how much you understand how computers work? (Three of four cases on this so far, but no scholarship yet.)
1) I would personally consider e-mail to be the same as a post-card. That is, unless encrypted, it is a piece of publically-readable text and should be treated as such. However, since an e-mail system is supposed to be completely automated without any human intervention but in the most extrordinary of cases (ie the thing breaks), there is reason to believe that there is in fact an expectation of privacy in the system. This is also similar to washrooms in building open to the public - you don’t own them, but you still have a reasonable expectation of privacy when using the system, despite the fact that a janitor might look in.
2) Unauthorized access is fun. Let’s look at real world examples. If I give you permission to enter my premisis, and you shoulder the door down because you think it’s sticking “just a little”, is that breaking an entering. I would argue not. In that light, I would argue that if a system gives you access to something, then you aren’t really breaking in. However, in the real world I can take a crowbar to your door and break in at any point in time. At that point, your door is giving me access (sort of), but it is an illegal act, partly because I had no expectation of having been given permission. From that point, an arguement can be made that anything other than explicit and straightforward use of a secured system can be considered gaining unlawful access.
What really muddles the water is that being a completely artificial digital system, it is possible to design a system which cannot be broken into, however difficult that may be. Thus you can argue that access was authorized because they really didn’t want to keep you out.
My view on this is as follows: If a person does something to gain access which could be done accidentally by an authorized user, than it isn’t really breaking, and thus unlawful access. For example, if a password checking routine doesn’t check passwords if the field is blank, than entering a blank field and getting otherwise unauthorized access would not be prohibited because it is reasonable that a person might forget to enter their password. Likewise, if a person gains access by modifying the URL which they entered, including parameters passed by GET, that is not unauthorized because it is reasonable to assume that a person could have mis-typed the value anyways. The same goes for data entered into textboxes on web pages - they are ment to have data entered. A person could accidentally enter in SQL designed to drop your entire database.
However, if somebody was to start sending malformed packets with the intention of executing a buffer overflow on your system, that would be unlawful. Note that intent still must be present.
3) The fourth amendment also protects against unreasonable searches, not just seizures. It is true that you can copy a file without “seizing” it. My preferrred way to look at it is to compare this to a similar physicl-world example. Would would be the legality of the FBI entering your premisis and photographing all of your personal documents, correspondance, etc. If that would be legal, than so would copying computer files. If not, than not.
4) I tend to abhore computer-specific laws. Breaking and entering is still breaking an entering, wether a crowbar or a malformed TCP packet it used. It may require an adendum to existing legislation to codify exactly what is meant by this in the computer-specific sense, but the law and sentencing should still be the same. As for $100 million dollars in damage due to a virus release, I would treat that exactly the same way industrial sabotage is treated. If the release was accidental (from a research lab, etc.), I smell civil suit.
5) There are two ways of looking at this. Computer systems are agents of the user, and so you can argue that any action taken by the computer is done at the request of the user. As much as I would like to do this to get rid of all of the morons on the Internet, that is not reasonable considering the complexity of computer equipment. Thus we have to ask if a person has the intent to posess the photographs in question. If the site was visited unknowingly (click here to learn about horticulture - surprise!) and the image is in the browser cache, then there is no intent to possess. However, if the site was visited knowingly, or better yet a copy of the image was saved deliberately then “possession” actually occured and there is evidence that afirmative action was taken to do so.
These are just my musings. I am strongly considering going to law school at some point. I believe that I have the riht temperment to be a good justice. Please do comment. On both.