Pissing on Aaron’s Grave

An anonymous draft seeking to amend the Computer Fraud and Abuse Act (CFAA) ratchets up current penalties in the bill–making even attempted malicious hacking acts as punishable as an actual offense–and sets guidelines for when companies would have to tell you if your personal data were hacked.

Already dubbed the “Worst the Law in Technology,” the changes being floated in the discussion draft fly in the face of tireless efforts by Internet freedom activists to strip vague definitions from the law to keep the law from being used by the Justice Department as the go-to blunt instrument for prosecuting cybercrime. Instead, the language now being considered says:

[E]ven if the accesser may be entitled to obtain or alter the same information in the computer for other purposes.

The current draft language does nothing more than piss on Aaron Swartz‘s grave while mocking longstanding bi-partisan efforts to narrow the bill by remove Terms of Service violations from law.

Aaron Swartz at a Boston Wikipedia Meetup (Photo credit: Wikipedia)

Moreover, given that heavy penalties already exist in current law, writes CDT Senior Policy Analyst Andrew McDiarmid, there are “plenty of reasons to question whether penalty-enhancement is necessary at all.” McDiarmid also notes:

As CDT wrote in its analysis of the initial White House proposal in 2011, it does not make sense to consider expanding and enhancing penalties under the CFAA without first sensibly narrowing its scope, lest every American on the Internet risk felony charges for even minor ToS violations.

The draft language also snubs the efforts of Rep. Zoe Lofgren (D-CA) who has worked to craft her own amendment, dubbed “Aaron’s Law,” in concert with groups such as CDT, EFF, ACLU and the Reddit community.

Let’s hope these Internet freedom groups can pull some political wrangling out of their collective hat and put the squeeze to the folks pressing for this rat bastard bill.