Hackers face life imprisonment under 'Anti-Terrorism' Act

Security Focus ^ | Sep 23 2001 | Kevin Poulsen

[E. Pluribus Unum]

Justice Department proposal classifies most computer crimes as acts of terrorism.

Hackers, virus-writers and web site defacers would face life imprisonment without the possibility of parole under legislation proposed by the Bush Administration that would classify most computer crimes as acts of terrorism.

The Justice Department is urging Congress to quickly approve its Anti-Terrorism Act (ATA), a twenty-five page proposal that would expand the government's legal powers to conduct electronic surveillance, access business records, and detain suspected terrorists.

The proposal defines a list of "Federal terrorism offenses" that are subject to special treatment under law. The offenses include assassination of public officials, violence at international airports, some bombings and homicides, and politically-motivated manslaughter or torture.

Most of the terrorism offenses are violent crimes, or crimes involving chemical, biological, or nuclear weapons. But the list also includes the provisions of the Computer Fraud and Abuse Act that make it illegal to crack a computer for the purpose of obtaining anything of value, or to deliberately cause damage. Likewise, launching a malicious program that harms a system, like a virus, or making an extortionate threat to damage a computer are included in the definition of terrorism.

To date no terrorists are known to have violated the Computer Fraud and Abuse Act. But several recent hacker cases would have qualified as "Federal terrorism offenses" under the Justice Department proposal, including the conviction of Patrick Gregory, a prolific web site defacer who called himself "MostHateD"; Kevin Mitnick, who plead guilty to penetrating corporate networks and downloading proprietary software; Jonathan "Gatsby" Bosanac, who received 18-months in custody for cracking telephone company computers; and Eric Burns, the Shoreline, Washington hacker who scrawled "Crystal, I love you" on a United States Information Agency web site in 1999. The 19-year-old was reportedly trying to impress a classmate with whom he was infatuated.

The Justice Department submitted the ATA to Congress late last week as a response to the September 11th terrorist attacks in New York, Washington and Pennsylvania that killed some 7,000 people.

As a "Federal terrorism offense," the five year statute of limitations for hacking would be abolished retroactively -- allowing computer crimes committed decades ago to be prosecuted today -- and the maximum prison term for a single conviction would be upped to life imprisonment. There is no parole in the federal justice system

Those convicted of providing "advice or assistance" to cyber crooks, or harboring or concealing a computer intruder, would face the same legal repercussions as an intruder. Computer intrusion would also become a predicate offense for the RICO statutes.

DNA samples would be collected from hackers upon conviction, and retroactively from those currently in custody or under federal supervision. The samples would go into the federal database that currently catalogs murderers and kidnappers.

Civil liberties groups have criticized the ATA for its dramatic expansion of surveillance authority, and other law enforcement powers.

But Attorney General John Ashcroft urged swift adoption of the measure Monday.

Testifying before the House Judiciary Committee, Ashcroft defended the proposal's definition of terrorism. "I don't believe that our definition of terrorism is so broad," said Ashcroft. "It is broad enough to include things like assaults on computers, and assaults designed to change the purpose of government."

The Act is scheduled for mark-up by the committee Tuesday morning.

[Robert A Cook PE]

Oh really?

I DIDN'T "run" anything - the virus just destroyed my compuer, my files, and my client's job.

And 40 million/80 million/120 million OTHER projects, estimates, payroll figures, checkbooks, loans, small business families, and millions of other jobs, businesses, and activites.

Now - given that simple an attack by a terrorist on the "real economy" we depend on - NOT just on two buildings in one city in one state, what do you recommend doing?

[spunkets]

So teenage script kiddies will now get more time than child molesters? Sounds like the terrorists fogged DC with LSD.

[HiTech RedNeck]

Small correction: thats ex post facto laws and I'm sure the USSC would strike down that provision as soon as someone challenged it.

Does that bill contain a severability clause? Congress had better put one in. If SCOTUS finds a law's provision unconstitutional, it tends to slam dunk the entire statute. If that happened with this, 1000 jailed true terrorists could easily get back out on the street just like that.

[rdavis84]

"Take a look at this one."

I'm way past being surprised now. Most of the warnings were given long ago with the usual "KooK" retorts, and this thread is no different. Look at the cast of clowns supporting this stuff.

[genxer]

As you all laugh, I can tell there aren't many sysadmins amoung you. I own a hosting company and one hack alone cost over $50K in refunds, downtime and repair fees. We have a 99.9% uptime guarantee and refund customers if they are down for more than 30 minutes a month.

This type of damage almost put us out of business and killed our American Dream. We work 18-20 hours per day 7 days a week, working to keep our customers safe from people who have too much time on their hand and try to hurt other people just for the fun of it.

In this last month we recieved over 35 orders from foreign countries, using stolen american credit cards, stolen how, by hackers.

It's not funny. This last Nimda Virus, took out Phone Companies, Insurance Companies, Large Corporations that provide vital services for this nation. This poses a national threat a threat the could cripple the entire country.

[E. Pluribus Unum]

Shouldn't he have stayed out of the house?

Under this definition, typing a URL into your browser that belongs to somebody who doesn't want you looking at their website (a government agency's, for instance) could be defined as hacking.

[E. Pluribus Unum]

As you all laugh, I can tell there aren't many sysadmins amoung you.

Nobody is laughing, but if you think any law the technological idiots in Washington could write is going to solve the problem you will be sadly disappointed. The cure will be worse than the disease.

You solve technlogical problems with better technology, not laws.

[genxer]

If only Bill Gates prescribed to this theroy of better technology. NT/W2K has more security holes in it than swiss cheese.

[Enough is ENOUGH]

The latest endangered species: The Hacker

Save The Hacker cries were heard as the Administration proposed it's anti-terrorism bill. One well-known ACLU activist was heard telling a crowd of on-lookers "I don't care if a thousand terrorists get through to accomplish their missions as long as we can save one Hacker."

Yeah, it's a Catch-22 situation because we don't trust our politicians or future leftist administrations with these powers and we won't admit to ourselves that the terrorists are homicidal maniacs that are out to nuke-bio-chem us to oblivion so they can go to heaven to get laid.

We're all nuts. How did we ever get to this point? Anybody got any ideas on how to catch terrorists during their planning stages?

[E. Pluribus Unum]

We're all nuts. How did we ever get to this point? Anybody got any ideas on how to catch terrorists during their planning stages?

Sure. Wire everybody for sound and tape-record everything they say. Anyone you disables their recording device will be executed immediately.

Also, anybody who uses encryption shall be executed immediately. After all, the only reason you wouldn't want the government to be able to decypher your communications is because you have something to hide.

[max61]

the virus just destroyed my compuer, my files, and my client's job.

This is what happens when your business rely's on inferior products from MicroShaft. Does the statement "Penny wise - Pound foolish" ring a bell?. Hmmmm.

---max

[Publius6961]

prohibiting the creation of ipso facto laws.

LOL

"Ex post facto" maybe?

Seems like the First Rapist demolished that concept when his first act as president was a huge tax applied retroactively.

And idiot America slept right through it...

[Critter]

A better analogy would be he knocks on the door, and the door swings open because it wasn't latched. The guy doesn't enter, but rather calls the owner at work and tells him the door is wide open. Did he break in?

[Robert A Cook PE]

That's NOT hacking, nor is accidently typing a government website ...

Like all CRIMINAL acts, the opportunity, the action, and the result are a crime (or are NOT a crime) based on the circumstances and intended result of what the person accually does.

If the door is open, I call and warn the homeowner from my cell phone - no crime. Of course not. If I enter HIS house to make the call, with no intent to rob, AND no robbery of his stuff happens, no crime. Even though I entered his house without his permission.

If his house were on fire, and I broke his door down to put the fire out, no intent of crime and no robbery of his stuff happened. (Even though I did damge his property and break in.) No crime.

Hacking is deliberate, serious damage in another person's computer system and files....it ISN'T accidental, nor is it benign. Regardless of what protection I put in my computer, the presense or absence of that protection (door lock) doesn't change the intent and the damage of the criminal.

Now, the real problem occurs. If I were a conservative Christian under Reno's Justice Dept, I'd be arrested for trespassing (because I entered his house); but if I were a liberal abortion rights group I'd be awarded a medal under Hillary's national health miscare system.

UNDER THE CLINTONS, the political power and money of the person were the critria, not the action. And THAT potential of future (democratic) administrations IS a valid concern.

[PatrioticAmerican]

This sort of extremism is EXACTLY why many people are turned off by the Republican party. Many people think bashing the living sh*t out of someone for such an offense is totalitarianism at its worst. Punish the little creeps, but "life"? Perhaps that is why a rapist gets on everage 3-7 years, but someone caught with 2 ounces of pot can be considered so horrible as to need 10 minimum. It seems overreating to crime is the RNCs MO. Of course, crimes committed by government officials are rarely prosecuted.