Computer Fraud and Abuse Act CLE - Dallas Bar Ass'n (8.22.11)
•
1 like•1,395 views
The slides are from a Continuing Legal Education seminar entitled "Computer Fraud and Abuse Act: A Lunch Sampler With A Little Something for Everyone" I presented to the Dallas Bar Association on August 22, 2011. If you have any questions please feel free to contact me at www.shawnetuma.com
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Computer Fraud and Abuse Act CLE - Dallas Bar Ass'n (8.22.11)
Similar to Computer Fraud and Abuse Act CLE - Dallas Bar Ass'n (8.22.11) (20)
More from Shawn Tuma
More from Shawn Tuma (20)
Recently uploaded
Recently uploaded (20)
Computer Fraud and Abuse Act CLE - Dallas Bar Ass'n (8.22.11)
- 1. Computer Fraud andAbuse Act A Lunch Sampler With A Little Something For Everyone Dallas Bar Association Computer Law Section August 22, 2011 Shawn E. Tuma www.shawnetuma.com
- 2. 2 Wouldn’t be the first time
- 3. 3 Enjoy!
- 9. Business & Transactional Lawyers
- 10. Technology & Privacy Lawyerswww.shawnetuma.com
- 12. Why?
- 13. What Does the CFAA Prohibit?
- 14. Most Controversial Issues Under CFAA
- 15. Examples of Most Common CFAA Violations
- 16. Proposed Amendments to the CFAAwww.shawnetuma.com
- 17. 6 Brief history of the cfaa www.shawnetuma.com
- 18. 7 History of CFAA www.shawnetuma.com
- 19. 8 History of CFAA www.shawnetuma.com
- 21. Wire & mail fraud
- 22. Response to movie War Gameswww.shawnetuma.com
- 24. Criminal only
- 25. 3 major amendments (9 total)
- 26. Added private cause of action in ’94
- 30. 12 Steve Jobs says … Do you know who Steve Jobs is? Do you know what Steve Jobs recently said? “Everything has a computer in it nowadays.” www.shawnetuma.com
- 31. 13 What is a Computer? www.shawnetuma.com
- 32. 14 What is a computer? The CFAA says “the term ‘computer’ means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but …” “such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device;” www.shawnetuma.com
- 33. 15 What is a computer? The Fourth Circuit says “If a device is ‘an electronic … or other high speed data processing device performing logical, arithmetic, or storage functions,’ it is a computer. This definition captures any device that makes use of an electronic data processor, examples of which are legion.” -United States v. Kramer www.shawnetuma.com
- 34. 16 What is a computer? What about www.shawnetuma.com
- 35. 17 Anything with a microchip The Fourth Circuit says “’Just think of the common household items that include microchips and electronic storage devices, and thus will satisfy the statutory definition of “computer.”’ “’That category can include coffeemakers, microwave ovens, watches, telephones, children’s toys, MP3 players, refrigerators, heating and air-conditioning units, radios, alarm clocks, televisions, and DVD players, . . . .” -United States v. Kramer www.shawnetuma.com
- 36. 18 What is a “protected” computer? The CFAA applies only to “protected” computers This may limit the problem of applying it to alarm clocks, toasters, and coffee makers Protected = connected to the Internet Any situations where these devices are connected? www.shawnetuma.com
- 39. 16 KB of RAM
- 41. 96 MHz Processor
- 42. 128 MB of RAM
- 43. iPhone 4
- 45. 512 MB of RAMwww.shawnetuma.com
- 46. 20 Perspective 66 MHz = fastest desktop in 80s 96 MHz = child’s toy today 250 MHz = fastest super computer in 80s 800 MHz = standard telephone today www.shawnetuma.com
- 47. 21 What does the cfaa prohibit? www.shawnetuma.com
- 51. Commits a fraud
- 52. Obtains something of value
- 54. Causes damage
- 59. Superficially it appears deceptively straightforward
- 63. Interpreted by 5th, 7th, 9th and 11th Circuits
- 64. Still no unanimous approach
- 66. Confuses lawyers and judges alikewww.shawnetuma.com
- 69. Must have $5,000 “loss”
- 70. Loss requirement is jurisdictional thresholdwww.shawnetuma.com
- 71. 27 Civil Remedy What is a “loss”? “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Loss = cost (unless interruption of service) www.shawnetuma.com
- 73. Forensics analysis and investigation
- 76. Bartered services for investigation / restoration
- 77. Value of employees’ time
- 78. Attorneys’ fees if leading investigationwww.shawnetuma.com
- 80. Value of trade secrets
- 81. Lost profits
- 82. Lost customers
- 84. Privacy and Personally Identifiable Informationwww.shawnetuma.com
- 86. Hacking / data breach
- 87. Browser cookiesREMEMBER: Loss is only required for civil remedy – not criminal violation www.shawnetuma.com
- 89. Considering a CFAA claim
- 90. Your advice would be to ________?www.shawnetuma.com
- 92. Economic damages
- 93. Loss damage
- 95. Not Available
- 97. Attorneys’ fees
- 98. Privacy and Personally Identifiable Informationwww.shawnetuma.com
- 99. 33 Basic Elements Elements of broadest CFAA Claim Intentionally access computer; Without authorization or exceeding authorized access; Obtained information from any protected computer; and Victim incurred a loss to one or more persons during any 1-year period of at least $5,000. www.shawnetuma.com
- 102. No preemption
- 103. Not Available
- 104. No Rule 9 heightened pleadingwww.shawnetuma.com
- 105. 35 Wrongful Access www.shawnetuma.com
- 107. ≠ technician
- 108. Must be knowing or intentional access
- 110. Wrongful Access Two Types of Wrongful Access “without authorization” Outsiders No rights Not defined Only requires intent to access, not harm Hacker! “exceeds authorized” Insiders Some rights CFAA defines: use in a way not entitled Necessarily requires limits of authorization Employees, web users, etc. 37 www.shawnetuma.com
- 112. Courts don’t usually indicate which – or care – go straight to the outcome
- 113. Case outcomes do not reflect Congressional frameworkwww.shawnetuma.com
- 115. Question is whether “exceeds” becomes “without”
- 116. Insider authorized for some computers
- 117. Insider authorized for some locations
- 118. Insider authorized for intended use
- 119. United States v. Morris
- 120. Unauthorized system and intended usewww.shawnetuma.com
- 122. Agency Theory
- 125. Earlier case
- 128. Majority view (overly simplified)
- 129. Prior notice of limits is vital
- 130. Emphasizes need for contractual limitswww.shawnetuma.com
- 132. Policies: computer use, employment & manuals
- 133. Website Terms of Service
- 134. Technological
- 135. Login and access restrictions
- 136. System warnings
- 137. Training and other evidence of notification
- 138. Notices of intent to use CFAAwww.shawnetuma.com
- 140. Limit access to information
- 141. Limit use of information accessed
- 142. Terminate access rights upon violation
- 143. Indicate intent to enforce by CFAAGoal: limit or terminate authorization www.shawnetuma.com
- 145. We’re talking about law!
- 147. Access limits are huge factor
- 148. Facts can vary greatlywww.shawnetuma.com
- 150. Employee accesses and takes or emails confidential information to competitor
- 151. Employee improperly deletes data and email
- 152. Employee deletes browser history
- 153. Employee accessing their Facebook, Gmail, Chase accounts at work www.shawnetuma.com
- 155. NTTA account?
- 156. Bank account?
- 157. Cancelling services via online accounts?www.shawnetuma.com
- 159. The key factor here was the conduct was prohibited by the website’s agreed to Terms of Servicewww.shawnetuma.com
- 161. Fake login to disrupt legitimate website sales
- 162. Accessing website to gain competitive information when prohibited by TOS
- 163. Creating fake Facebook to research opposing partieswww.shawnetuma.com
- 165. Tracking individuals through geo-tagging
- 166. Website collection of private information
- 167. All fit within the prohibitions of the CFAA
- 168. Loss is the problem, from a civil standpointwww.shawnetuma.com
- 169. 51 Proposed amendments www.shawnetuma.com
- 170. 52 Proposed Amendments Hacking Data Breach Privacy www.shawnetuma.com
- 172. 46 States Breach Notification Laws
- 173. Administration & Congress want to act
- 174. Protect Personal Information (“PI”)
- 175. Name + address, SS#, DL#, or financial acct #
- 176. Health data
- 177. Vehicle of choice is to amend the CFAAwww.shawnetuma.com
- 180. National standard breach notification law
- 181. Preempt State laws
- 182. Regulate businesses handling PI
- 183. Limit PI businesses retain
- 184. Stronger criminal penalties for hackingwww.shawnetuma.com
- 185. 55 Proposed Amendments Will tougher criminal penalties help? The Real Question: Is it possible to keep data secure from being breached? www.shawnetuma.com
- 186. 56 Proposed Amendments www.shawnetuma.com
- 188. Cheaper to defend wrongful death lawsuits
- 189. The “Ford Pinto Memo”
- 190. Actual damages: $2.5 million
- 191. Punitive damages: $125 million www.shawnetuma.com
- 193. Hacker
- 194. Breached entity
- 195. Include breach of PI as a “loss”
- 196. Permit recovery of costs and attorneys’ fees
- 197. Likelihood of civil greater than criminalwww.shawnetuma.com
- 199. CFAA is very broad and covers all kinds of computer misuse
- 200. CFAA is complex with lots of pitfalls
- 201. Proposed Amendments will broaden CFAA
- 202. Data breach
- 204. 60 THE END www.shawnetuma.com
Editor's Notes
- Good afternoon, thank you all very much for having me here to speak today. My name is Shawn Tuma and I am an attorney at Shields, Britton & Fraser in Plano.I have a peculiar interest in the Computer Fraud and Abuse Act and have been watching as it has developed over the last several years and then, within the last 6 mos. or so has become one of the most relevant laws anywhere.
- First CLE presentationApril 2000 – Y2K Litigation!
- Today giving you a sampler platter!A broad overview with enough information that will valuable to all lawyers, regardless of practice.
- Who knows what movie this was from?Anyone remember?Early 80s - 1983
- Movie War Games!
- The first stab at the CFAA was this.Began to fear that with advancing technology the wire and mail fraud laws wouldn’t be sufficient.
- Then we get the CFAA
- Why? Because this is the primary law that is used to pursue those who misuse a computer to commit crimes, defraud, etc. Computers are everywhere and are involved in virtually everything!
- CFAA’s definition of computer:Remember the “But”!!!
- Protected Computer – more narrowLimits – some, for nowThink of homes where everything is automated via connection to the internet.
- TI-99 was my first computer in early 80s.Daughter Clara (who started kindergarten today) has a Leapster!
- To put it into perspective, compare the fastest desktop of the 80s withClara’s LeapsterCray SupercomputeriPhone 4!Now you see why, what seem silly to us today, clearly falls within the technical criteria for what the drafters initially considered to be a computer.
- Now that we know what it applies to, let’s take about what the CFAA prohibits.
- This is an overly broad generalization but, generally speaking, the CFAA prohibits wrongfully accessing a computer where the person
- Not too long ago I was talking with someone about a case they had involving criminal indictment for the CFAA.I offered help but was rebuffed – told: “I’ve read the statute, I’ve got it”Ok – best of luck to you (and your clients!)!
- What would your advice, as a lawyer, be in this situation?
- Have you heard these words lately???
- Personal Information – PI = your name and a combination of the other information.
- This is what is currently the most common proposed amendments.
- Who knows what this beauty is?Better yet, who knows why I have included it?
- Why? (Remember what Steve Jobs said last December – everything has a computer in it nowadays!)The CFAA is what is most commonly used to deal with misuse of computers.
- Presentation slides – available on my website: www.shawnetuma.comThis was taken from an article coming out in Fall 2011 in the University of South Carolina Law Review – the article will also be available once it is published.