Senator Targets School Hackers

[InfoSec News <isn () c4i org>]

http://www.wired.com/news/politics/0,1283,45752,00.html

By Declan McCullagh 
6:48 a.m. Aug. 1, 2001 PDT  

WASHINGTON -- Sen. Robert Torricelli claims he wants to put hackers
who disrupt school computers in prison.

"Computer hackers who prey upon unsuspecting schools, striking fear in
the hearts of entire communities with threats of violence, cannot go
unpunished," the New Jersey Democrat said this week.

But educators, programmers and civil libertarians say Torricelli's
recently-introduced School Website Protection Act of 2001 does more
than place wrongdoers behind bars. They say the bill is worded so
vaguely it would turn commonplace activities into federal crimes to be
investigated by the U.S. Secret Service.

"I think the bill misses the mark," says Jim Dempsey, deputy director
of the Center for Democracy and Technology. "It is written in an
overly broad fashion. Sending one unsolicited e-mail affects a
computer. If I send an e-mail to my student's teacher and I didn't
have her permission, I violate the act."

Dempsey is talking about the bill's sweeping language, which punishes
activities that affect a computer rather than ones that damage it or
successfully penetrate its security. Contrary to what the name of the
bill implies, the measure covers any school computer system, not just
websites, and could criminalize pranks such as sending mail from a
friend's computer when they've left themselves logged in.

Torricelli's measure says anyone who "knowingly causes the
transmission of a program, information, code, or command, and as a
result of such conduct, intentionally affects or impairs without
authorization a computer of an elementary school or secondary school
or institution of higher education" will to go federal prison for up
to 10 years.

"By using 'affects' instead of 'damage,' he sweeps in a lot of
ordinary and legitimate conduct," Dempsey says.

Andrew Grosso, a former assistant U.S. Attorney who's now in private
practice, is more blunt: "It's a stupid bill. Yes, there is a need to
protect school computers. No, this bill doesn't do that."

"My humble opinion is that this bill was written to generate
publicity," says Grosso, who founded the Association for Computing
Machinery's law and technology committee.

Those are harsh words, but they may well be true.

Torricelli said in a press release this week that he introduced the
legislation after the Trenton (New Jersey) Times reported that a local
school district had its home page defaced with what appeared to be a
threat that referenced the 1999 Columbine massacre. Concerned parents
reportedly kept their children home from school that day.

When pressed, Torricelli spokesman Adam Herbsman said, "Legislation
concerning the Internet is a very complex subject. Senator Torricelli
is eager to hear any suggestions on how to improve the bill as the
legislative process moves forward."

One source close to Torricelli said this was a high-profile issue in
New Jersey, and the senator felt compelled to introduce legislation
that would be seen as solving the problem of malicious hackers.

The National Education Association said it had some concerns with
Torricelli's proposal.

"We don't have a position on the bill, but our two concerns are: one,
whether or not such crimes should be considered a federal issue; and
two, whether it is appropriate to handle such violations as a criminal
matter, or as an administrative one resulting in either suspension or
expulsion," said NEA lobbyist Kim Anderson.

J.D. Abolins of Meyda Online Information Security and Privacy Studies
and a New Jersey native, was more critical.

"I do see a lot of hazards of federalizing hacking. School websites
are not involved in commerce and do no contain private information, so
why the high priority?" Abolins asks. "The bill sounds like overkill,
and the money would be much better spent on computer ethics."

Violations of the law, if Torricelli's measure were to take effect,
would be punishable by five to ten years in prison if "the offense was
committed for purposes of commercial advantage or private financial
gain." Otherwise the penalty would be one year.

Andrew Osterman in Washington contributed to this report.

 

-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn' in the BODY
of the mail.