Proposed Amendment: Computer Fraud and Abuse Act (Senate Bill S 890)

On May 5, 2011, Senators Leahy and Grassley introduced Senate Bill S 890 that is titled “Fighting Fraud to Protect Taxpayers Act of 2011.” The Bill, which classifies a violation of the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (the “CFAA”) as a “fraud offense” just like securities fraud, mortgage fraud, and tax fraud, proposes an amendment to the CFAA to strengthen the prohibition against computer password trafficking.

Section 6 of S. 890, entitled “Strengthening the Prohibition Against Trafficking in Passwords”, would amend the Computer Fraud and Abuse Act as follows:

(1) in the matter preceding subparagraph (A), by inserting ‘protected’ before ‘computer’; and

(2) by striking ‘, if’ and all that follows and inserting ‘; or’.

There, that makes sense, doesn’t it?

I didn’t think so. In that case, I’ll show you what the provision looks like as it exists today, and what it will look like if S 890 becomes law.

Current Version:

(a) (6) Whoever–knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if —

(A) such trafficking affects interstate or foreign commerce; or

(B) such computer is used by or for the Government of the United States.

Proposed Amended Version:

(a) (6) Whoever–knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a protected computer may be accessed without authorization; or ~~, if —~~

~~(A) such trafficking affects interstate or foreign commerce; or~~

~~(B) such computer is used by or for the Government of the United States.~~

This bill was to be considered by the Judiciary Committee on May 18. You can follow the current status of the bill on the New York Times website by clicking on this LINK.

Do you think this is a significant amendment to the CFAA that will strengthen the prohibition against trafficking in passwords, as the title of the amendment suggests? Whether it is or isn’t, I am willing to bet this won’t be the last amendment to the Computer Fraud and Abuse Act–and the ones coming will be a heck of a lot more significant than this one! What do you think?