Download as PDF, PPTX
Uploaded byDavid Sweigert
DoJ guidelines for CFAA hacker prosecutions
The document outlines the frequency, nature, and prosecution of violations under the Computer Fraud and Abuse Act (CFAA) as well as the Department of Justice's (DOJ) charging decisions and sentencing practices. It highlights that CFAA offenses are infrequently prosecuted, particularly instances involving legitimate computer security research, with average sentences often below recommended guidelines. The DOJ expresses openness to amending the CFAA to avoid penalizing trivial acts while emphasizing the importance of computer security research.
Law◦
More Related Content
Similar to DoJ guidelines for CFAA hacker prosecutions
![[CB20] Keynote1：Reforming cybercrime legislations to support vulnerability re...](https://cdn.slidesharecdn.com/ss_thumbnails/audreyguinchardcb20-210112125955-thumbnail.jpg?width=640&height=640&fit=bounds)
DoJ guidelines for CFAA hacker prosecutions
- 2. •Frequency and natureof CFAA prosecutions. •How DOJ makes CFAA charging decisions •Sentencing under the CFAA. •Context intended to encourage legitimate security research. Objectives
- 3.
- 4.
- 5.
- 6. Prosecution Year Cases Filed 2011 138 2012169 2013 146 2014 194 Based on data from the Executive Officer of U.S. Attorneys Annual Statistical Report – FY 2014
- 7. ChargingConsiderations Victim Resulting Harm Sensitivity of Data Larger Criminal Activity Deterrence Harm to National Security& Public Safety Prosecutors are directed to consider whether or not a substantial federal interest would be served by prosecution of a CFAA case in which admissible evidence is expected to be sufficient to sustain a conviction.
- 8. •Charging decisions forCFAA violations are guided by DOJ prosecution policy. •In comparison to other federal crimes, CFAA offenses are not charged frequently -- and prosecuting someone engaged computer security research is extraordinarily rare. SoWhat?
- 9. Sentencing + = + += U.S. Sentencing Guidelines
- 10.
- 11.
- 12.
- 13. Sentencing + + = Seriousness ofCrime • Specific offense Conduct • Adjustments Criminal History • 6 categories based on criminal record. Aggravating or Mitigating Factors • Additional facts increasing or decreasing seriousness.
- 14. Sentencing - $50,000 Loss 18 U.S.C.1030(a)(2) (Information Theft) x 3
- 15. Sentencing - $50,000 Loss 18 U.S.C.1030(a)(2) (Information Theft) x 3
- 16. Sentencing + + = OffenseLevel • Level 6 Offense Characteristics • + 6 ($50,000 loss) • +2 (access device) • +2 (sophisticated means) Adjustments • -2 (Acceptance of responsibility) • -1 (Timely notice) Role in Offense • +2 (Organizer) Defendant’s Criminal History • 0 (Prior misdemeanors) Multiple Counts are grouped, so the fact that the hack happened 3 times does not result in triple the sentence. 15 Final Offense Level = 18-24 Months Upward/ Downward Departure • Substantial assistance (reduction) > 18-24 Months
- 17. SentencingTrends 84 36 48 29 63 30 41 23 0 10 20 30 40 50 60 70 80 90 Securities Healthcare IDTheft Computer-Related Average Guidelines Minimum and Average Sentence Average Guidelines Minimum Average Sentence
- 18. SentencingTrends Since 2003, average sentencesfor section 1030 violations have routinely been below the minimum Guideline sentence that could be imposed. Category 1 50.6% Within Guidelines Range 47.1 Below Guidelines Range 2.3% Above Category 1 49.2% Within Guidelines Range 49.3 Below Guidelines Range 1.5% Above 2012 All Federal Cases 2012 Computer- Related Cases
- 19. •The average sentencefor a CFAA violation is about 23 months. •Sentences for CFAA offenses routinely have been below the minimum sentence recommended by the Guidelines. SoWhat?
- 20. Does this meanconcerns about chilling security research should be disregarded? SoWhat? No.
- 21.
- 22.
- 23. BlackHatSoundBytes • Computer securityresearch is important … we get it, really. • DOJ is not at war with researchers. • We are open to—and have proposed— amendments to the CFAA to avoid criminalizing trivial conduct. • Taking some common sense precautions will go a long way to avoiding hassles with law enforcement.