Subject: [Asrg] Law article - Legally Defining "Unauthorized" Computer Access

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 09 May 2003 16:51:15 -0400

Even though we are not chartered to look into the legal aspects of spam, 
the legal issues are still relevant since they affect the technical ones. 
Therefore I wanted mention the following SlashDot story:

http://yro.slashdot.org/yro/03/05/09/1647209.shtml?tid=99&tid=123

which references the following article written by a George Washington 
University Law School professor:

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=399740

---[snip]---

"Cybercrime's Scope: Interpreting "Access" and "Authorization" in Computer 
Misuse Statutes"

Abstract:

In the last twenty-five years, the federal government and all fifty states 
have enacted new criminal laws that prohibit unauthorized access to 
computers. These new laws attempt to draw a line between criminality and 
free conduct in cyberspace. No one knows what it means to "access" a 
computer, however, nor when access becomes "unauthorized." The few courts 
that have construed these terms have offered divergent interpretations, and 
no scholars have yet addressed the problem. Recent decisions interpreting 
the federal statute in civil cases suggest that any breach of contract with 
a computer owner renders use of that computer an unauthorized access. If 
applied to criminal cases, this approach would broadly criminalize contract 
law on the Internet, potentially making millions of Americans criminals for 
the way they write e-mail and surf the Web.

This Article presents a comprehensive inquiry into the meaning of 
unauthorized access statutes. It begins by explaining why legislatures 
enacted unauthorized access statutes, and why early beliefs that such 
statutes solved the problem of computer misuse have proved remarkably 
naïve. Next, the Article explains how the courts have construed these 
statutes in an overly broad way that threatens to criminalize a surprising 
range of innocuous conduct involving computers. In the final section, the 
Article offers a normative proposal for interpreting "access" and 
"authorization." This section argues that courts should reject a contract 
theory of authorization, and should narrow the scope of unauthorized access 
statutes to circumvention of code-based restrictions on computer 
privileges. The section justifies this proposal on several grounds. First, 
the proposal will best mediate the line between securing privacy and 
protecting the liberty of Internet users. Second, the proposal mirrors 
criminal law's traditional treatment of crimes that contain a consent 
element. Third, the proposed approach is consistent with the basic theories 
of punishment. Fourth, the proposed interpretation avoids possible 
constitutional difficulties that may arise under the broader constructions 
that courts recently have favored.

---[snip]---

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg