Mind Control, Human Hacking & the Computer Fraud and Abuse Act?

Here is a thought to ponder: Would it violate the Computer Fraud and Abuse Act to hack a person?

Based on the broad definition of computer that is used in the Computer Fraud and Abuse Act I believe that the answer could be “yes.” Here is why:

  • The CFAA applies to anything with a microchip or data processor that is connected to the internet. See Can Stealing a Car Violate the Computer Fraud and Abuse Act?
  • If a person were to have a microchip or data processor implanted into their bodies, and if such device were connected to the Internet, then that person would be a covered “computer” and the CFAA would apply if they were hacked.

So, you may be wondering, what made me think of this crazy idea? Well, I read the article Are You Ready for Mind-Control Warfare? and, the more I thought about it, the more I realized that it is a possibility. Technology has already advanced to the point where tiny microchips are being put under people’s skin for various reasons and there is no doubt that will continue. But, as the above article shows, these technological advances will not stop there. Now we’re looking at things like “the potential for ‘neural interface systems’ (NIS) that could control weapons with the human mind.” Pretty heavy stuff for sure but stop and think about this for a moment.

If technology reaches a point where “computer” driven devices allow the human mind to control weapons, surely someone will then try to gain control over that device and, therefore, the mind that controls those weapons. That is, they will try to “hack” that person. And, when they do, I would argue that they will have violated the Computer Fraud and Abuse Act as it is presently written and interpreted.

Discussion of Problems with Proposed Cybercrime Legislation

There are many proposals floating around Capitol Hill that will purport to beef up our nation’s current cybercrime laws, first and foremost the Computer Fraud and Abuse Act. I have recently read two very good articles that do a nice job of explaining many of the inadequacies of the proposed legislation and is well worth the read:

Obama Cybersecurity Proposal: Flawed, But Fixable

Obama’s Cybercrime Crackdown Already Outdated, Experts Say | Government & Legislation | Law & Justice | SecurityNewsDaily.

As for me, the first thing I want Congress to do is make it clear what is really an improper access under the Computer Fraud and Abuse Act and tell us to whom it is really intended to apply (yeah, I know, different Congress = different intent … but hey, if I’m a wishin’ I’m a gonna wish good!).

Beyond that pipe-dream, I am wondering if the most effective thing Congress could do isn’t to simply amend the Computer Fraud and Abuse Act to provide that (1) a “loss” required for a civil claim includes having one’s personally identifiable private information compromised, and (2) the person who’s information was compromised has a civil claim against both the hacker of the information and the person or entity from which the information was hacked.

Make this happen and some very enterprising plaintiff’s lawyers will take care of the rest.

As I asked in my post last week: Who’s Gonna Get It? Mark my words, at some point, somebody will. My hunch is that if Congress made these couple of amendments we’d find out the answer to that question a whole lot easier and quicker!

3 Recent Computer Fraud and Abuse Act Cases Worth Noting

Three recent Computer Fraud and Abuse Act cases decided over the last couple of months are worth looking at because they show the following points, respectively: (1) the CFAA in its current form does not give consumers an adequate remedy for privacy related data breach issues; (2) the CFAA’s focus on “access” is more akin to trespassing on a computer system than using a computer to commit a traditional “fraud”; and (3) the way a judge “walks through” the evidence vis-a-vis the elements of a basic civil claim under the Computer Fraud and Abuse Act.

Why the Computer Fraud and Abuse Act in its current form does not give consumers an adequate remedy to address privacy related data breach issues?

This is demonstrated by La Court v. Specific Media, Inc., 2011 WL 2473399 (C.D. Cal. Apr. 28, 2011) in which the court granted the defendant’s Motion to Dismiss because the plaintiffs in a class-action case, even in the aggregate, could not demonstrate the requisite $5000 “loss” required to maintain a civil claim for violation of the CFAA where the only “loss” they sustained was the value of personal data.

The case arose from the alleged use of Adobe Flash cookies that tracked the plaintiffs’ use of the Internet without their knowledge or consent. The plaintiffs brought a claim for violating the CFAA, among other things, alleging “that they sought to maintain the secrecy and confidentiality of the information obtained by Defendant through use of the” flash cookies and that their personal information has discernible value of which they were deprived but defendants use of it for their own economic benefit. The court dismissed the CFAA claim finding that the plaintiffs personal information, in essence, had no value– or at least not enough value to collectively meet the $5000 threshold.

You will recall that I blogged about this impediment when Apple was sued in the iTracking cases. If not, take a look at these posts where I delve a little deeper into this “loss” issue:

Apple iTracking Case: will Apple be WINNING on Computer Fraud and Abuse Act claim?

Apple Should Win the Computer Fraud and Abuse Act Claims …

iTracking II: Apple Sued Again for Violating Computer Fraud and Abuse Act

From what I can tell, nothing has changed.

Now, there is talk around the “data privacy” neighborhood that things could be changing a bit and courts may be starting to ascribe some value to people’s own personal data but I’ve not yet seen anything that has confirmed this is going to happen.

First, apparently two cases related to the La Court case involving Adobe Flash cookies have been settled for a $2.4 million settlement. The cases are Valdez v. Quantcast Corp. and White v. Clearspring Technologies and the article I read indicating the settlement value can be found HERE. I do not know the details of the settlement but, if any of you happen to know, I would be interested in learning more about it.

Second, just yesterday I read an article by Andrew Clearwater on the International Association of Privacy Professionals newsletter entitled New theory of harm in data breach cases that argued that people have a property right in personal information. I found this argument to be persuasive and, according to Clearwater, it is currently being tested in the case Alan Claridge v. RockYou Inc. (2011 WL 1361588 (N.D. Cal. Apr. 11, 2011) where the court has allowed the case to proceed a partially denying the defendant’s motion to dismiss. As Clearwater says, it will be interesting to see how this develops.

If it is treated like a trespass, why is the Computer Fraud and Abuse Act not called the Computer Trespass and Abuse Act?

Now that is a good question, and one that I do not know the answer to! I do suspect, however, that it was probably an easier “sell” to use the word fraud instead of trespass so I will leave it at that. In Xcedex, Inc. v. Vmware, Inc., 2011 WL 2600688 (D. Mass. June 8, 2011), however, the court stated “[t]he conduct prohibited by the CFAA is ‘analogous to that of “breaking and entering” rather than using a computer … in committing the offense.'” This is an important principle to remember about the CFAA and, I believe, helpful to understanding the various arguments circulating around about what is and “access” under the CFAA.

What kind of evidence does a judge look for when analyzing a civil claim under the Computer Fraud and Abuse Act?

The cynics among us will probably look at this next case and say, “he sure was struggling to find a comment-worthy point in this case” and they just may be right. But let me tell you why I wanted to bring this case to your attention.

Not too long ago I was drafting a motion for summary judgment for a plaintiff on a CFAA claim. As we all know, a movant on summary judgment has a better chance of winning when they can present a clear and concise argument that is supported by clear and concise evidence — with brevity being of paramount importance! One of the questions I asked myself during the drafting process was “what evidence should I use that will be most persuasive to the court and give me the maximum bang for the buck?” Within a couple of weeks of that, I read the opinion in Barnstormers, Inc. v. Wing Walkers, LLC, 2011 WL 1671641 (W.D. Tex. May 3, 2011). I found nothing earth shattering about the CFAA issues presented in this default judgment but did appreciate the way the court walked through the elements and discussed the evidence supporting each element that it found persuasive enough to include in its opinion. To me, that was enough to make it worth mentioning.

Smartphones and the Computer Fraud and Abuse Act–Already Covered?

“Everything has a computer in it nowadays”

as we are told by Steve Wozniak, one of the co-founders of Apple Computer. See U.S. v. Kramer, 631 F.3d 900 (8th Cir. 2011). This quote was featured prominently in the Kramer opinion handed down on February 8, 2011 in which the United States Court of Appeals for the Eighth Circuit held that a cellular phone–used only to place calls and send text messages–is a computer as defined in the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, et seq.

According to  The Hill, earlier today two Senators sent a letter to the United States Department of Justice asking that the agency clarify its interpretation of the to include the protection of “smartphones”. (Senators say digital privacy law covers smartphones, Gautham Nagesh, The Hill, Apr. 13, 2011). Based upon the rationale of the Kramer Court in applying the definition of a computer as set forth in the CFAA, the Senators’ request should be honored.

In Kramer, the court observed that the definition of computer in the CFAA is exceedingly broad:

If a device is “an electronic … or other high speed data processing device performing logical, arithmetic, or storage functions,” it is a computer. This definition captures any device that makes use of an electronic data processor, examples of which are legion. Accord Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 Minn. L. Rev. 1561, 1577 (2010) (“Just think of the common household items that include microchips in electronic storage devices, and us will satisfy the statutory definition of ‘computer.’ That category can include coffeemakers, microwave ovens, watches, telephones, children’s toys, MP3 players, refrigerators, heating and air-conditioning units, radios, alarm clocks, televisions, and DVD players, in addition to more traditional computers like laptops or desktop printers.” Additionally, each time an electronic processor performs any task – from powering on, to receiving keypad input, to displaying information – it performs logical, arithmetic, or storage functions. These functions are the essence of its operation. See The New Oxford American Dictionary 277 (2nd ed. 2005) (defining “central processing unit” as “the part of the computer in which operations are controlled and executed .”).

U.S. v. Kramer, 631 F.3d 900, 902-03 (8th Cir. 2011). The court acknowledged that a normal cell phone might not easily fit within the cloak will definition of computer, but, that it was bound to follow the definition set forth in the CFAA. It further acknowledged that due to the sweeping nature of this definition, as technology continues to develop even more additional devices that use industry experts, much less Congress, could foresee being encompassed within this definition may nonetheless. Id. at 903 (citing 18 U.S.C. § 1030(e)(2)).

Very true. As we have all learned from the recent hacking involving Epsilon, data stored on smartphones is no different from data stored on a desktop computers–it is all worthy of protection. According to the CFAA’s definition of computer, it already is protected. Accordingly, if it is not doing so already, the Department of Justice should enforce such protections.