9

For reference, EFF's page.

As the EFF notes, under the proposed legislation, talking about computer crimes would be considered conspiracy, and pushable by substantial jail time. Pretty much everything related to IT security could be considered discussion of potential computer crimes, especially under the expanded act. Looking at random samplings of questions, almost everything could be construed as discussion of potential criminal activity under the proposed legislation.

It's a meta-type question, but: would you still use the site if CFAA passes, even though each time you do so could land you in jail for many years? Does that make a difference for/to anyone else?

7

Yes - for two reasons:

  • I live in the UK :-)
  • The EFF's interpretation of the CFAA is a bit over dramatic. They say

Essentially, talking about committing computer crimes without actually doing so can land you in prison.

But that isn't actually what the CFAA will say. Yes, a lawyer can interpret it that way, but they can already interpret the CFAA to those ends.

As you'll have seen here, we don't really do "how to attack" questions - we are very focused on how to defend and strengthen, with some discussion on how particular attacks work in order to understand the defences.

Where we see questions here that are asking for something illegal, we find they are generally rubbish questions and get closed/deleted anyway

Realistically the only sane solution is to push to get the CFAA thrown out and some good legislation written instead.

  • 3
    It's not just the EFF's interpretation, for reference, although they certainly do take a one-sided position. Given the US DOJ's obscenely aggressive prosecutions, though, I don't think it's a particularly unreasonable interpretation, especially if you happen to find yourself in the government's cross-hairs for whatever reason. – Nick Mar 29 '13 at 18:46
  • 4
    Also, I don't think the "how to attack" / "how to defend" distinction would be of much value, if the government decided to prosecute you. In most cases, they discuss the same technical things, and the wording of the CFAA doesn't really require proving (or even referencing) intent. In the broadest interpretation, any internet user would always be guilty, but even in a more narrow interpretation, anyone discussing security issues on this site would almost certainly be in violation of the law (as written). – Nick Mar 29 '13 at 18:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .