The FBI says Cyber Actions like Denial of Service Attacks are criminal in nature. But are they?
First off, I am not a lawyer. If I knew back in high school what I know now, law quite probably have been where I would have headed. But I didn’t know then, and so I’m not. But thanks to PJ at Groklaw, I am now passionately interested in law, how it works, and what can be done using it. And I pay attention to things.
One of the first things you notice when paying attention to law, is that lawyers do the weirdest things. Or at least they appear weird. Some of the arguments that lawyers make, especially in civil rights cases often appear insane at the time.
Think of the ‘back of the bus’ rules that American civil rights lawyers fought in the sixties. At the time to many people the fight appeared just plain wrong. The arguments that civil rights lawyers made at the time appeared to most people to be a reach beyond what should be allowed. In fact a lot of people were damned upset that the lawyers had the gall to argue against the law. But from a twenty-first century viewpoint though the ‘back of the bus’ rules were wrong, and to many of us a cause for shame.
The same things has happened time and time again as various groups have had to fight discriminatory laws. So I expect that if the FBI actually does charge anyone with the hacking of HBGary Federal, we’ll see some interesting theories put forward by the defense.
This is actually a multi-layered defense. The FBI appears (from some statements) to be trying to claim that having a copy of the Low Orbit Ion Cannon is illegal. The Low Orbit Ion Cannon is a network testing application. Network testing applications aren’t illegal, however they possibly could be used for illegal uses. I can see a defense lawyer claiming that the LOIC application is the cyber equivalent of a rifle, and possession is covered under the Second Amendment to the U.S. Constitution.
The use of Distributed Denial of Service Attacks against Mastercard, Paypal, Visa, etc. is being regarded by the FBI as illegal. However the use of a gun in self defense isn’t illegal in many places. Expect to see arguments that use of the LOIC software is equivalent to using a gun for self defense.
Also expect to see arguments that the social engineering attack on Rootkit.com was also self defense, assuming that the FBI can locate whoever actually did it. This would also cover any of the actions by anyone against HBGary Federal.
The United States has laws which allow for peaceful protest. Expect use of the LOIC against websites to be argued as peaceful protest.
Yes there are laws such as the Computer Fraud and Abuse Act, which were enacted to prevent things such as this. There also used to be Vagrancy Laws. Laws can be ruled inapplicable for certain circumstances, or tossed out totally if the judge can be made to see how the law is unfair to the defendant.
Expect to see attempts to claim that the publication of the HBGary Federal emails was a whistleblower action. Typically a whistleblower works for the company or government department in question. But the limitation of the law to an employee may not be a legitimate limitation in the eyes of a judge, under some circumstances.
Politically Protected Speech
Another point I expect to see argued is that some or all of the actions in question are politically protected speech. Normally politically protected speech is limited to speech about government agencies and/or figures.
For example as I said while in an airport in the United States one time, anyone can legally call the President of the United States an asshole. It may not be polite. But if in your opinion he is one, you can call him that, and legally your right to dissent is protected.
Because the U.S. Government is already involved (apparently a U.S. Government Agency recommendation is what started this), the Free Speech issue is in play. Expect to see the prosecutor attempt to argue that this is a National Security issue. The sparks should really fly between those two points.
As I Said, I Am Not A Lawyer
So I really don’t have a clue if arguments like this will be used, or if they will be successful.
However there have been enough laws overturned in the past by arguments which seemed crazy at the time, that anything is possible. And I can guarantee that there are lawyers who are salivating at the thought of defending a client in such a case. Lawyers who can pull off the impossible bring in the big bucks.
It should be interesting to watch.
Tuesday February 15, 2011