Bill could classify computer hacking as terrorism

Minor computer hacking could be considered terrorist acts subject to life imprisonment under a section in the Bush administration's anti-terrorism proposal, electronic civil liberties groups scrutinizing the plan said Thursday.

That section and another that would permit law enforcement officials to engage in extensive electronic surveillance when authorized by Internet service providers largely have been overlooked by broader civil liberties groups that have raised an array of privacy concerns about the plan. Both sections involve changes to the 1986 Computer Fraud and Abuse Act (CFAA), the touchstone law that criminalizes computer intrusions and hacking.

The Justice Department's extensive proposal would make significant modifications to laws dealing with federal wiretaps, foreign intelligence surveillance, immigration and money-laundering. Little of it would change the rules governing traditional computer crime.

But language in Section 309, which defines federal terrorism offenses, includes four sections from CFAA, including one that is frequently used to charge minor hacking offenses. The law in question prescribes punishment for anyone who "knowingly causes the transmission of a program, information, code or command and, as a result of such conduct, intentionally causes damage without authorization" to an Internet-connected computer.

The change proposed by Attorney General John Ashcroft would make someone prosecuted under that section eligible for life in prison. The current maximum penalty for such an offense is five years.

"A kid who puts a joke message on the computer, if it manages to cause [damage], would be subject to life in prison," said Lee Tien, senior staff attorney at the Electronic Frontier Foundation. "Changing those penalties for computer crime is a big problem," and he said he hoped its inclusion on the list of new terrorism offenses was attributable to a "drafting error."

Tien said all the other offenses on the list of crimes to be treated as terrorism relate to the destruction of aircraft, the harboring of biological weapons and other serious crimes.

He also raised concern about related sections that would eliminate the statue of limitations on hacking and make it illegal to provide "expert advice or assistance" to hackers.

"People talk on Slashdot, posting questions and answers about security flaws," he said, referring to a popular computer Web site. "Are these sorts of things interpreted as providing expert assistance?"

A Senate Judiciary Committee aide, meanwhile, criticized Section 106 of the administration's proposal, which would permit electronic surveillance when authorized by ISPs. The aide called it a "provision that could swallow the wiretap law. If you violate the terms of service, you are free game to come in and be intercepted."

The section could be interpreted to permit Web-site operators to seek electronic monitoring that currently is not allowed, the aide said.

Other sections of the legislation would permit law enforcement officials to obtain e-mail address and Web-surfing information without a warrant, authorize national court orders to track Internet communications and permit "roving wiretaps."