Hunter Moore or Aaron Swartz: Do we hate the CFAA? Do we love the CFAA? Do we even have a clue?

©2011 Braydon Fuller
©2011 Braydon Fuller

What do we really want? Information privacy? Information security? Or, the liberation of information? This was the topic of last week’s blog post Aaron Swartz, Edward Snowden, Target Breach, Privacy and Data Security — What Do We Really Want?

And then this week, like manna from Heaven above, we get the indictment of Hunter Moore to help us think a little deeper about these issues. Hunter Moore is the revenge porn dude who many wrongfully believe was indicted (read the Indictment) yesterday for his revenge porn activities — he wasn’t — he was indicted for hacking under the Computer Fraud and Abuse Act (CFAA).

The CFAA has become a national lightening rod with many loving it, many hating it, and far too many loving it and hating it at the same time, without even realizing it. Before we go any further, however, consider this quote:

The CFAA was tailor-made to punish precisely the kind of behavior that [guess who?] is charged with: breaking into other people’s accounts and disseminating their … information.

Quick! Who is that referring to? Hunter Moore? Edward Snowden? Aaron Swartz? Sandra Teague?

If you guessed Hunter Moore, you were right (see HUNTER MOORE’S INDICTMENT YESTERDAY WAS FOR HACKING, NOT FOR REVENGE PORN – Tech Exile – Tech Exile) but in reality, didn’t Hunter, Aaron, Edward, and Sandra all go into accounts that there were not supposed to be in and take information that they then disseminated without permission?

Hunter is now being prosecuted for violating the CFAA and the population cheers. Aaron was prosecuted for violating the CFAA and the population is furious. Sandra was prosecuted for violating the CFAA and you have never heard one single thing about her, right?

Why? Why? Why?

Have we really reached a point as a society where we want to pick and chose on a case-by-case basis how we will apply a law, depending on our feelings? If we like the perp or what they did, it’s ok? If we don’t, it’s not?

I have a theory. But, let me ask you to think about something. How would you feel about using the Computer Fraud and Abuse Act to prosecute if —

it was your account that Hunter was accessing?

it was your employer’s business whose customer data or intellectual property Aaron was liberating and you hated your employer? you loved your employer? because of it, your employer was going out of business and you lost your job?

it was your student loan records that Sandra was accessing, but she was just snooping around and not doing anything with it?

 

p.s. Just after I posted this I read a post from my friend Evan Brown (@internetcases) discussing the schizophrenia over the CFAA in how we view Swartz and Moore – check it out: Hunter Moore arrest reveals a certain schizophrenia about the Computer Fraud and Abuse Act

Published by Shawn E. Tuma

Shawn Tuma is an attorney who is internationally recognized in cybersecurity, computer fraud and data privacy law, areas in which he has practiced for nearly two decades. He is a Partner at Spencer Fane, LLP where he regularly serves as outside cybersecurity and privacy counsel to a wide range of companies from small to midsized businesses to Fortune 100 enterprises. You can reach Shawn by telephone at 972.324.0317 or email him at stuma@spencerfane.com.

Join the Conversation

4 Comments

Leave a comment

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Discover more from Business Cyber Risk

Subscribe now to keep reading and get access to the full archive.

Continue reading