The Crime of Punishment
As you read this, an unusual legal case history is being established around
the prosecution of computer crime. Because computer crime is still a
relatively new aspect in the arena of law and prosecution, each and every
case sets more important precedent that will be called on in upcoming
cases. The growing concern by many people seems to be the drastic nature
of punishments being levied against computer intrusions. Not only are
the punishments not seeming to fit the crime, there is little consistancy
in the legal system's application of punishment to these people.
have pointed out the disturbing trends in damage
figures which directly affect sentencing in these cases. Unfortunately,
the emerging problem seems to go well beyond suspicious damage figures.
It is difficult to say exactly why the punishment for computer crime is
so severe. Some people speculate it is the public perception of hacking
and the FUD
(Fear, Uncertainty and Doubt)
surrounding it while some think it is nothing more than sacrifical
lambs taking the brunt of public outcry. Others feel it can't be logically
explained. I think the best answer is that computer crime is still
shocking society who overeacts in their response.
The immediate disperity can be seen when comparing the sentencing between
computer and non-computer crimes. While more traditional and material
crimes like assault, burglary and murder are receiving what seems like
light sentences, computer crime convicts are becoming the bearers of
excepetionally stiff and smothering sentences. Not only is the prison
sentences extraordinarily lenghty, the terms of probation are baffling
and rough. Instead of a probation that encourages reform and nurtures
a good life better than the previous life of crime, it thrusts the
convicted into a life of poverty and despair.
Shortly after the new year, I was watching the news in a New York
hotel and caught the followup of a story begun some two to three years
prior. The news went on to say that a twenty-one year old man convicted
of killing his baby was
being released after two years of prison.
He and his wife and killed their infant some three years age, and his
prison term was two years. Surely this is one case that slipped through
our justice system and let these killers off easy? A quick search yields
that this is not necessarily uncommon.
served a two-year sentence for manslaughter after stabbing Francis Sunjay
Weber with a pair of scissors.
that discusses short sentences mentions yet another case in which a
17-year-old Marysville girl was shot and killed. Her killer was in turn
sentenced to 27 months in prison for his crime. These cases make me wonder
about the effectiveness of our legal system.
On the flip side, two recent computer crime cases perfectly illustrate the
baffling seriousness and resulting prison time that now accompanies computer
recently plead guilty to ONE felony count of computer intrusion, and took the blame
of the White House web page. For his confessed crimes,
he was sentenced to a $36,240 fine and 15 months in prison.
A second longer story unfolded recently, telling us of a small group of
hackers known as the
who wielded amazing control of computers and phone networks. One
of the individuals, Corey Lindsley, was sentenced to 41 months in prison for his
2 felony counts.
The last comparison is the infamous
Kevin Mitnick saga
in which Mitnick spent a total of 5 years in jail and prison for
what ended up being five felony counts of computer related crimes.
What should be noted is the comparison of crimes. Burn's single felony is
basically nothing more than high tech
a sort of digital spray
paint on a federal building. What would that crime fetch for a sentence if
done in the real world? Certainly not fifteen months of prison. Manslaughter
can fetch as low as two years of prison time, while Lindsley and Mitnick sit in
federal prison for four and five years respectively. This disparity is hard
to believe considering the gruesome nature of manslaughter and killing a
young baby as compared to altering the web page of an Internet web site.
Conditions of Probation
Even if you could dismiss the harsh penalty for relatively minor crimes,
you would then face another practice that is becoming all too common with
computer crime. After subjecting computer intruders to the long trial, large
fines and lenghty jail terms, the real injustice occurs. It is not uncommon
for people to be put on probation for one to five years for any felony
conviction. I think it is fair to say that a probation term of two to three
years is a sound average. Probation terms for most crimes are generally the
same, preventing convicts from certain behavior and actions that are not
appropriate. Some of these terms are not associating with known criminals,
possessing weapons, use of drugs, and more. One thing about these terms are they
tend to be generally the same with little variation based on crime.
For those convicted of computer crime, their probation guidelines are quite
different. A quick review of the terms and conditions of Kevin Mitnick's
probation bring on a whole new set of
computer crime specific terms:
A. Absent prior express written approval from the Probation Officer,
the Petitioner shall not possess or use, for any purpose, the
1. any computer hardware equipment;
2. any computer software programs;
4. any computer related peripheral or support equipment;
5. portable laptop computer, 'personal information assistants,'
6. cellular telephones;
7. televisions or other instruments of communication equipped with
on-line, internet, world-wide web or other computer network access;
8. any other electronic equipment, presently available or new
technology that becomes available, that can be converted to or has as
its function the ability to act as a computer system or to access a
computer system, computer network or telecommunications network
(except defendant may possess a 'land line' telephone);
B. The defendant shall not be employed in or perform services for any
entity engaged in the computer, computer software, or
telecommunications business and shall not be employed in any capacity
wherein he has access to computers or computer related equipment or
C. The defendant shall not access computers, computer networks or
other forms of wireless communications himself or through third
D. The defendant shall not act as a consultant or advisor to
individuals or groups engaged in any computer related activity;
E. The defendant shall not acquire or possess any computer codes
(including computer passwords), cellular phone access codes or other
access devices that enable the defendant to use, acquire, exchange or
alter information in a computer or telecommunications database system;
F. The defendant shall not use any data encryption device, program or
technique for computers;
G. The defendant shall not alter or possess any altered telephone,
telephone equipment or any other communications related equipment.
Reading these, one can begin to see how this limits a convicted computer
intruder in life after prison. Some argue that as convicted felons, who
cares? They are getting what they deserve. Perhaps that is true, but why
don't murderers and rapists receive special terms for their probation
that might be deemed appropriate? Some of the few crimes that receive
no special terms?
The purpose of incarceration and the following probation is to punish and
rehabilitate the convict. Probation specifically is geared to help push
the criminal into a structured life without influences that may lead to
their return to a life of crime. However, in the case of computer crime
the probation guidelines do a lot more than discourage further computer
crime. Some of the few acts they will be banned from:
- Forgery -- Convicted forgers are not banned from pens, paper and other
devices that help commit the crime.
- Vehicular Manslaughter and other crimes involving motor vehicles -- These
people do not lose their driver's license or the ability to own and operate
cars or trucks.
- Sex Crimes -- Convicted rapists and pedophiles are not forbidden from
pornography or other stimuli said to influence or encourage their behavior.
- Counterfeiting -- Convicted counterfeiters are not forbidden from using
currency, nor forbidden from working jobs with cash or banned from a wide
variety of activities that may influence them.
Surprising as it seems, all of the above become illegal to most people on
probation for computer crimes. Imagine living for three years with those
restrictions hovering over you. Is this really a good guideline to
get you back on the right track and lead a good life without bad influence?
Or is this a well lit path encouraging you to break the terms of probation
and risk more prison time?
- Sending a letter to a Senator via e-mail or using a word processor
- Playing a video arcade game or personal entertainment system like sega
- Calling his family on a cellular telephone
- Working in any industry (including fast food) as they all rely
on computers, even for cash transactions (cash registers)
- Working as a custodian in any business that has computers on
- Working as a teacher, instructor, consultant, or advisor to
any company that owns or operates a single computer device
- Writing any type of computer software program (even using merely a
pen and paper)
- Accessing a public library's computerized card catalog.
- Using computerized information services found at airports and
shopping malls that give directions and customer information
- Accessing any information via phone and voice mail/prompt system
(including bank account information, car insurance and more)
If you are thrust into society after a lenghty prison sentence, stripped
of opportunity to work in the one field you previously excellend in, what
options does that leave? Unable to work in most modern and computerized
jobs, unable to work near computers, it leaves the convict with several
years of difficult living at below poverty level. Hardly the rehabilitation
that was intended or needed.
The Tip of the Iceberg
The story of Chris Lamprecht
still remains in the depths of news sites.
In 1995 Lamprecht was senteced to a 70 month prison sentence for money
laundring. He did not plead to or get convicted of any computer related
crimes. Despite this, Federal Judge Sam Sparks imposed the same "no computer"
probation on Lamprecht at the request of the District
Attorney. This seems to be an equivalent of
being banned from restaurants because you ate dinner before breaking and
Recouping Your Tax Dollars
It is well established that those caught and convicted of any crime
are subjected to restitution. The amount is typically arrived at by
calculating the damage figures against the victim(s). If a bike worth
one hundred dollars was stolen, the criminal could be ordered to pay
restitution that included the cost of the bike, court fees the victim
paid for, emotional distress, etc. One thing that has not historically
been factored in is the cost of the investigation or the time and effort
of the officers involved in solving the crime. Apparently the money
associated with the law enforcement efforts was not a factor for one
reason or another.
Once again, when computer crime enters the equation, circumstances seem
to change. In May of 1997, Wendell Dingus was sentenced by a federal
court to six months of home monitoring for computer crime activity.
Among the systems he admitted to attacking were the U.S. Air Force, NASA
and Vanderbilt University. What is different about this case is the
court's order for Dingus to repay $40,000 in restitution to the Air
Force Information Warfare Center
for their time and effort in helping to track him.
It is odd that the court systems are now levying punishments for computer
crimes not based on the damage that was actually done, rather it is based
on the amount of time, money and resources required to track down or fix
the system's vulnerability. Worse, they are then lumping on time and
resources required to (belatedly) create pro-active preventative measures
from future intrusions, something that should have been done in the first
place. So the system intruder is now responsible for future intrusions,
yet the administrators were not in the first place?
When the police or FBI catch up to a robber, fraud or murderer, they
are charged and punished for their crimes. It is generally unheard of
for these criminals to receive punishments and fines based on the efforts
of the law enforcement tracking them down. Think of how much time and
resources the FBI put into tracking down a serial killer that has been
roaming our country for years. How many air plane trips, car rentals,
hotels, overtime, examination and forensic equipment, food reimbursement
and who knows what else do our tax dollars go to pay for? Why aren't these
levied against the criminal like they are now starting to do with computer
One thing I am fond of doing with articles pointing out problems is
making recommendations on how to fix the problem. I can generically say
that more consistancy needs to be developed between traditional crimes
and computer crimes. I will not begin to argue if traditional crimes
need to be raised or computer crimes need to be reduced.
One difficult aspect that creeps back into computer crime cases is the
blanket laws covering a wide variety of people and activities. As a
computer crime investigator brought up in a conversation recently,
a homicide typically affects a family, friends and perhaps a small
community while a concentrated computer attack could affect the lives
of thousands of people or more. There are certainly exceptions to each
type of crime but in general, that statement seems to be reasonable.
In Texas, it is a
Class B misdemeanor for graffiti
if the damage is less
than $500. In reality, most web page defacements done today can be
recovered from and dealt with for less than $500. Anyone saying otherwise
is likely to be the consultant profiting heavily at your expense. So
why is it that a young kid who spray paints a wall gets hit with a small
fine, and a young kid who spray paints a web site gets fifteen months
in jail and tens of thousands of dollars in fines?
I think it is time for the media to quit hyping up computer crimes and
introduce a dose of sanity to the Fear, Uncertainty and Doubt they
love to bring to 'hacker' stories. The legal system needs to give a serious
look at the disparity in how they handle various crimes. I think it
is pretty obvious that something is wrong when a knife wielding murderer
does less time than a keyboard wielding fourteen-year-old.
Brian Martin (firstname.lastname@example.org)
Special thanks to: B.K. DeLong
for his invaluable time in researching the stories linked to in this
Kevin Poulsen for his excellent
article and reminder on Chris Lamprecht.
James Atkinson, Carole Fennelly,
Jay Dyson and Travis Haymore for feedback and ideas.