Security Debate

Why cracking should be criminalized

Security

“protection of a computer or network system from damage or violation from an unauthorized source”

Important that this includes both damage and violation (breaking into a system even if no damage is done)

“Cracking”

“a person who breaks into security systems illegally” is considered a cracker or hacker

Anyone who gets onto a system illegally needs to be punished (there are no exceptions specified for people that do not inflict damage)

What is a computer system?

include hardware, software, network transmission paths, and people who interact with these components. By this definition, everything from a desktop workstation to the Internet qualifies as a computer system.

About protection of private property

Real World Examples

Breaking into a house Even if no damage is done, it is still

unauthorized access and punishable

Another Example

Kristin and Marina said in their position statement: “We maintain that if there are no damages that can be proven…the cracker has committed no crime”

However we believe we can use a real world example to counter this point

Dan’s Diary

If we were to crack into Dan’s computer and read his diary, but no one knew and we didn’t change it couldn’t there still be damage done?

Should always be an assumption on privacy

Monitoring

People are allowed to monitor their own systems Government has authority over many systems,

not considered hacking/cracking and therefore is not illegal

It is only unauthorized access that should be punished

Privacy Rights

Too narrow a definition of privacy We are defining this as unauthorized access

is what should be punished, if you are accessing something to fix it, then you should have authority to do so This should never happen without your

knowledge, always need consent

What should be considered crime?

computer system crime: "any crime involving inappropriate interference with rights or other assets resulting from computer system use."

The National Information Infrastructure Protection Act of 1996 Thanks for bringing this up because according

to our definition of the act: “One cannot knowingly and with intent to defraud, access a

protected computer without authorization, or exceed authorized access, and by means of such conduct further the intended fraud and obtain anything of value”

Any personal info can be considered “of value”