Why I Hope Congress Never Watches “Blackhat”

What is being proposed for new laws scares me more than any hacker.

I don't know, if they watched Inconvenient Truth, it might benefit some of the knuckleheads there. Or 12 Years a Slave. Or even Lincoln.

From the article: Congress passed the original CFAA in 1984 in direct response to the seminal hacker flick Wargames.

Computer Crime laws are already insanely disproportionate.

They were created during a moral panic when only a few individuals, large multinationals and, large governments had computers and the government were worried that "hackers" could break into the electricity grid or the communications system and shut it down.

So right now you could literally break into someone's home, knock them unconscious, and then steal their laptop, but yet still get more jail time for "hacking" into their laptop than any of the previous crimes.

It only gets more insane when someone "hacks" across state lines. The federal laws are absolutely insane, and the only thing more disproportionate are some of the drug laws (many of which were also created during times of moral panic).

In particular are comic cases of when companies fail to secure things at all (e.g. leave data exposed to the public via hidden URLs) and then someone gets prosecuted because they "hacked" that company and "stole" that data.

I don't understand how the Sony hack relates to the proposed changes to the CFAA. If the attacker was North Korea--as suggested by the administration (which I don't believe)--then how would increasing penalties for "hacking" or developing (or even sharing) "hacking tools" make a difference? As if we had any jurisdiction whatsoever over there or that the laws of the United States would somehow deter foreign attackers.

If they want to increase penalties for anything it should be for companies failing to secure their systems. Attackers can often use very sophisticated methods to make their way into internal networks but once they're in it's run-of-the-mill, patched-three-years-ago vulnerabilities that let them do the most damage.

There's a lot of negligence going on inside corporate networks in regards to information security and one of the justifications I often hear is that they can't justify increased spending (or spending any money whatsoever) on IT security when the costs of an attack are unknown. If we apply significant punitive damages then the costs would be much easier to calculate and justify.