Tuesday, November 22, 2011

The CFAA Must Go!

Go ahead and read this article, then come back. Go ahead.

I'll wait.


She's charged with violations of the Computer Fraud and Abuse Act for changing some students' grades.

To quote Bill and Ted, "Bogus!"

I will wager that this woman did not crack any computer systems. I don't know the details of the case, but from seeing this type of case before I'll tell you what most likely happened.

She logged in with her own ID and password, picked another teacher's class (which the system did not have adequate controls to say "you can only modify grades for your own classes"), and changed some grades. Sure, she abused her access privileges (which is wrong), but this should be an administrative issue not criminal. Period.

The nature of the act does not change based on the medium on which it is performed, and the act was that she changed some students' grades; that's it. If this had been a paper grade book that she altered with a pencil, she only would have been fired and her teaching certificate (possibly) revoked. No criminal charges would have been filed. Just because it's on a computer doesn't change the nature of the act -especially to a crime worthy of jail time.

The Computer Fraud and Abuse Act is over-broad and overreaching. It criminalizes actions that would not otherwise be crimes, simply because they're done with a computer. It's time for the CFAA to go, but lawmakers don't know enough about computers to realize it.

3 comments:

  1. I don't know man, I think that maybe there is something to the criminal part of this. I would think that anytime that a person breaks into a database, or uses there security clearance and performs an illegal action on that database, criminal charges need to be addressed. She misused her power. Think about a Washington standpoint, those guys have access to literally thousands of lobbyists, and they take money to do things that they shouldn't. They abuse their power, which is essentially what she did. The only difference is that they don't get charged, and they should. I think our time would be better spent lobbying to lock up corrupt politicians, rather than railing at a system that goes after normal people, and ignores political crimes, you know?

    ReplyDelete
  2. Her actions, though, were simply administrative in nature. I agree she should be reprimanded but as I said, if this had been a paper grade book she never would have been charged with crime. The act is the same the only difference is the medium.

    ReplyDelete
  3. Right!!!! Come on. You know its all over the school districts where mass number of teachers who are regulated by "no child left behind" change their state scores and nothing happens to them. This is ridicules. Plus if you've read the entire case, she didn't BREAK INTO ANY DATA BASE! An administrator GAVE her the password. GAVE HER THE PASSWORD. Maybe that administrator should take the blame for whatever he or she contemplated "why" she wanted to give her the password. Questionable to me. She is hardly vicious or criminal. This really stinks. I read over and over again what a great teacher she was and so respected by the students. This is just a shame on so many levels.

    ReplyDelete