EFFector Vol. 14, No. 27 Sep. 27, 2001 [email protected] A Publication of the Electronic Frontier Foundation ISSN 1062-9424 In the 187th Issue of EFFector (now with over 29,200 subscribers!): * ALERT: Hackers Could Get Life in Prison, No Parole, Under "Anti-Terrorism" Bill * Administrivia For more information on EFF activities & alerts: http://www.eff.org/ To join EFF or make an additional donation: http://www.eff.org/support/ EFF is a member-supported nonprofit. Please sign up as a member today! _________________________________________________________________ ALERT: Hackers Could Get Life in Prison, No Parole, Under "Anti-Terrorism" Bill Act Today and Ask Your Legislators to Remove Dangerous Provisions Electronic Frontier Foundation ACTION ALERT (Issued: Wednesday, September 27, 2001 / Deadline: Friday, October 7, 2001, unless extended) Introduction: San Francisco, California - The Electronic Frontier Foundation (EFF) today condemned portions of the Anti-Terrorism Act (ATA) currently under consideration in Congress which would treat all computer trespass as terrorism (in addition to other provisions we oppose, such as vast expansion of surveillance authority). "Treating low-level computer crimes as terrorist acts is not an appropriate response to recent events," said EFF Executive Director Shari Steele. "A relatively harmless online prankster should not face a potential life sentence in prison." The ATA includes provisions that dramatically increase the penalties for acts that have no apparent relationship to terrorism. For instance, the bill would add low-level computer intrusion, already a crime under other laws, to the list of "federal terrorism offenses," creating penalties of up to life imprisonment, adding broad pre-conviction asset seizure powers and serious criminal threats to those who "materially assist" or "harbor" individuals suspected of causing minimal damage to networked computers. Attorney General John Ashcroft asked Congress last week to pass the ATA, formerly known as the Mobilization Against Terrorism Act (MATA), with less than one week of consideration. EFF believes the ATA would radically tip the United States system of checks and balances, giving the government unprecedented authority to surveil American citizens with little judicial or other oversight. What YOU Can Do Now: * Contact your own legislators about the ATA/MATA and related bills AS SOON AS POSSIBLE. Call them, and fax and/or e-mail the EFF letter below (or your own) today. Postal mail will be too slow on this issue. Feel free to use this letter verbatim, or modify it as you wish. Let them know that you do not believe liberty must be sacrified for security. Please be polite and concise, but firm. For information on how to contact your legislators and other government officials, see EFF's "Contacting Congress and Other Policymakers" guide at: http://www.eff.org/congress.html and see also the links below. * Join EFF! For membership information see: http://www.eff.org/support/ Sample Letter: Use this sample letter to YOUR legislators or modify it, and send to their Washington fax and e-mail, which you can get this from Project Vote Smart: http://www.vote-smart.org/vote-smart/data.phtml?dtype=C&style= or the House: http://www.house.gov/house/MemberWWW.html and Senate: http://www.senate.gov/senators/index.cfm websites. You can also look up your Representative with this form: Enter your Zip Code and State in the fields below and click on Submit. ZIP _____ +4 ____(if required) State [Choose One..........] Submit Dear Sen./Rep. [Surname] I write as a constituent to express my gravest concern over aspects of the Congressional response to the tragedies of September 11. While I share your grief and anger in no uncertain terms, I do not believe that sacrificing essential liberties in a vain hope of improving security is good for America or the world. Security can be improved without privacy invasion, and we cannot win an attack on freedom by attacking that freedom ourselves. I urge you to work to remove from anti-terrorism bills any provisions that call for expanded wiretap powers or online monitoring, warrantless pen register or trap and trace authority, censorship, restrictions on encryption, warrantless "fishing expeditions" in student or other records, or redefinition of minor computer crimes as terrorism. While there is a need for a Congressional response to terrorism, vast expansion of the powers of law enforcement and intelligence agencies to invade privacy is not an appropriate part of that response. Presently these bills and draft bills include A-G Ashcroft's Anti-Terrorism Act (ATA); Sen. Leahy's Uniting and Strengthening of America Act (USAA); Rep. Smith's Public Safety and Cyber Security Enhancement Act (PSCSEA, H.R. 2915); Sen. Hatch's Combating Terrorism Act (CTA, amendment S.A. 1562 to bill H.R. 2500); and Sen. Graham's Intelligence to Prevent Terrorism Act (IPTA, S. 1448), and Sen. Gregg's draft anti-encryption legislation. The United States should not take steps toward becoming a police state, or otherwise undermine our own freedom in the name of defending that freedom from terrorist attack, or the terrorists have already won. I also object to provisions being passed in response to terrorism but which have nothing to do with terrorism, such as "emergency" wiretaps against simple computer crime incidents and the abuse of grand juries as tools for intelligence agencies, and undermining of the very encryption that helps secure our communications infrastructure from further attack. This is a time for careful consideration, not for passing legislation without debate or careful consideration of the consequences. Sincerely, [Your name & address] (Be sure to correct the salutation - use EITHER Sen. or Rep., and use the correct name. If you are writing to a committee member [and he/she is not your legislator], remove "as a constituent" from first sentence.) Non-US Activists Non-US readers can probably have little impact on the US Congress's votes on these matters, and could even affect them negatively. Your best course of action is to contact your own legislators/parliamentarians and urge them to avoid similar policies in your own country. Privacy Campaign: This drive to contact your legislators about unprecedented wiretap power expansion is part of a larger campaign to highlight how extensively companies and governmental agencies subject us to surveillance and share and use personal information online & offline, and what you can do about it. Check the EFF Privacy Now! Campaign website regularly for additional alerts and news: http://www.eff.org/privnow/ Background: EFF again urges Congress to act with deliberation and approve only measures that are effective in preventing terrorism while protecting the freedoms of Americans. "The theme of freedom in the face of terrorist attacks should include a focus on measures that preserve rather than diminish our civil liberties," said EFF Exec. Dir. Shari Steele. The DOJ's own analysis of another particularly egregious provision of the ATA points out that "United States prosecutors may use against American citizens information collected by a foreign government even if the collection would have violated the Fourth Amendment." "Operating from abroad, foreign governments could do the dirty work of spying on the communications of Americans worldwide. US protections against unreasonable search and seizure won't matter," commented EFF Senior Staff Attorney Lee Tien. Additional provisions of the proposed Anti-Terrorism Act include the following measures: * make it possible to obtain e-mail message header information, Internet user web browsing patterns, and "stored" voicemail without a wiretap order; * eviscerate controls on Title III roving wiretaps; * permit law enforcement to disclose information obtained through wiretaps to any employee of the Executive branch; * reduce restrictions on domestic investigations under the Foreign Intelligence Surveillance Act (FISA); * permit grand juries to provide information to the US intelligence community; * permit the President to designate any "foreign-directed individual, group, or entity," including any United States citizen or organization, as a target for FISA surveillance; * prevent people from providing "expert advice" to terrorists; * extends federal DNA database to every person convicted of a federal terrorism offense which includes low-level computer intrusions; * other provisions, whether or not related to online civil liberties. The scope of the Computer Fraud and Abuse Act's Sect. 1030(a)(5)(A) is especially broad, dangerously so even before the ATA would attempt to redefine violations of this section as "terrorism". It criminalizes the following: (5)(A) [one who] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [is in violation of the statute]; Several civil cases have construed this language. For example, in Shaw v. Toshiba America Information Systems, Inc., 91 F.Supp.2d 926 (E.D.Tex.,1999.), defendant knowingly distributed laptop computers containing disk drives with faulty microcode that allowed unwanted corruption/deletion of data. The court squarely held that manufacturers of computer equipment could be reached by Sect. 1030(a)(5)(A) -- "transmission" includes the design, manufacture, creation, distribution, sale, and marketing of floppy-disk controllers allegedly made faulty by defective microcode. One court has found that placing a cookie on a user's computer to monitor websurfing habits could violate Sect. 1030(a)(5)(A). In re Intuit Privacy Litigation, 138 F.Supp. 2d 1272 (C.D.Cal. 2001). Defendant operated a website that used cookies to track its users, and were sued for privacy violations on several theories, including Sect. 1030. On motion to dismiss, the court found that this conduct fell within Sect. 1030(a)(5)(A). (Because the class-action plaintiffs had not alleged economic damages, the motion to dismiss was granted, but without prejudice, to allow the plaintiffs to make the proper allegations.) It is clear that any number of activities not initially on the minds of legislators when they passed Sect. 1030(a)(5)(a) could eventually be held to fall under this statute anyway. No one can predict at this early stage what will or will not be considered a violation of this provision. Yet the ATA would redefine all present and future violations as acts of terrorism, with violators subject to terrible penalities, up to and including life in prison without possibility of parole. Additionally, these changes to the law would remove statutes of limitations and become retroactive. This means that any US-based computer security professional who, like many in this field, once upon a time began as a system cracker or other "black hat" hacker, potentially faces criminal prosecution under the ATA. If the Department of Justice needs extra laws relating to supposed "cyberterrorism", it can seek narrowly-tailored legislation. Simply importing virtually all computer crime into the definition of terrorism is far too broad and heavy-handed. Senator Patrick Leahy has attempted to moderate the ATA through introduction of the "Uniting and Strengthening of America Act" (USAA). While EFF believes USAA would unnecessarily increase law enforcement surveillance powers, it is nowhere near as harmful to civil liberties as the Bush administration's proposal. For example, the USAA does not increase penalties for low-level computer intrusion. The USAA would retain existing restrictions on wiretaps, including requiring court orders to obtain voicemail messages. However, both the ATA and the USAA would expand FISA to include roving wiretaps. The USAA would also permit disclosure of Title III wiretaps to intelligence officers, whereas the ATA would permit disclosure to any federal employee. The USAA also would require a court order for grand juries to provide information to the US intelligence community, unlike ATA. Provisions of the ATA permitting the President to designate targets for FISA surveillance, preventing people from providing "expert advice" to terrorists, and collecting foreign intelligence on American citizens are not included in the USAA. EFF's Steele emphasized, "While it is obviously of vital national importance to respond effectively to terrorism, these bills recall the McCarthy era in the power they would give the government to scrutinize the private lives of American citizens." The ATA and USAA bills come in the wake of the Senate's hasty passage of the "Combating Terrorism Act" (CTA, amendment S.A. 1562 to House-passed bill H.R. 2500) on the evening of September 13 with less than 30 minutes of consideration on the Senate floor. Another similar bill, called the Public Safety and Cyber Security Enhancement Act (PSCSEA), has been drafted for introduction in the House, and appears to be a "backup plan" for S.A. 1562; if it does not pass as part of H.R. 2500, it can be reintroduced separately in slightly different form as a new bill. Sen. Graham's new Intelligence to Prevent Terrorism Act (IPTA, S. 1448) raises related issues. Sen. Judd Gregg is drafting anti-encryption legislation, as well. For bill texts and analyses, see the EFF Surveillance Archive: http://www.eff.org/Privacy/Surveillance/ Why "backdoor" encryption requirements reduce security [PDF]: http://www.crypto.com/papers/escrowrisks98.pdf About EFF: The Electronic Frontier Foundation is the leading civil liberties organization working to protect rights in the digital world. Founded in 1990, EFF actively encourages and challenges industry and government to support free expression, privacy, and openness in the information society. EFF is a member-supported organization and maintains one of the most linked-to Web sites in the world: http://www.eff.org Contact: Lee Tien, EFF Senior First Amendment Attorney [email protected] +1 415-436-9333 x102 Will Doherty, EFF Online Activist / Media Relations [email protected] +1 415-436-9333 x111 - end - _________________________________________________________________ Administrivia EFFector is published by: The Electronic Frontier Foundation 454 Shotwell Street San Francisco CA 94110-1914 USA +1 415 436 9333 (voice) +1 415 436 9993 (fax) http://www.eff.org/ Editors: Katina Bishop, EFF Education & Offline Activism Director Stanton McCandlish, EFF Technical Director/Webmaster [email protected] To Join EFF online, or make an additional donation, go to: http://www.eff.org/support/ Membership & donation queries: [email protected] General EFF, legal, policy or online resources queries: [email protected] Reproduction of this publication in electronic media is encouraged. Signed articles do not necessarily represent the views of EFF. To reproduce signed articles individually, please contact the authors for their express permission. Press releases and EFF announcements & articles may be reproduced individually at will. To subscribe to or unsubscribe from EFFector via the Web, go to: http://www.eff.org/signup/mailserv.html To subscribe to EFFector via e-mail, send to [email protected] a message BODY (not subject) of: subscribe effector The list server will send you a confirmation code and then add you to a subscription list for EFFector (after you return the confirmation code; instructions will be in the confirmation e-mail). To unsubscribe, send a similar message body to the same address, like so: unsubscribe effector (Please ask [email protected] to manually remove you from the list if this does not work for you for some reason.) To change your address, send both commands at once, one per line (i.e., unsubscribe your old address, and subscribe your new address). Back issues are available at: http://www.eff.org/effector To get the latest issue, send any message to [email protected] (or [email protected]), and it will be mailed to you automatically. You can also get, via the Web: http://www.eff.org/pub/EFF/Newsletters/EFFector/current.html _________________________________________________________________
Check out our 4-star rating on Charity Navigator.