Computer Hacking Prosecutions
Overview:
Computer hacking involves unauthorized access to computer systems or networks, often with the intent to steal, alter, or destroy data, disrupt services, or use the compromised systems for illegal activities.
Key Statutes:
Computer Fraud and Abuse Act (CFAA) — 18 U.S.C. § 1030: The primary federal statute addressing hacking, criminalizing unauthorized access, exceeding authorized access, trafficking in passwords, and causing damage through computer intrusions.
Wiretap Act — 18 U.S.C. § 2511: Protects against unauthorized interception of electronic communications.
Electronic Communications Privacy Act (ECPA): Governs illegal access to electronic communications.
Other laws may include identity theft statutes, wire fraud, conspiracy, and state computer crime laws.
Important Computer Hacking Cases
1. United States v. Kevin Mitnick (1999)
Facts:
Kevin Mitnick, once considered the “most wanted” hacker in the U.S., was charged with multiple computer-related crimes including unauthorized access to corporate and government systems, stealing software, and wire fraud.
Legal Issues:
Unauthorized access to protected computers,
Wire fraud,
Interception of electronic communications.
Outcome:
Pleaded guilty to several counts.
Sentenced to 5 years in prison.
Restitution ordered to companies affected.
Significance:
Landmark case establishing CFAA as a powerful tool against hackers.
Raised public awareness about hacking and cybersecurity.
2. United States v. Andrew Auernheimer (2014)
Facts:
Auernheimer, aka “weev,” was convicted for hacking AT&T’s website to obtain data of over 100,000 iPad users by exploiting a security vulnerability.
Charges:
Conspiracy to access a protected computer without authorization,
Identity theft.
Outcome:
Initially convicted and sentenced to 41 months.
Conviction overturned on appeal due to venue issues (improper trial location), but facts remain a reference point in CFAA enforcement.
Significance:
Raised questions about what constitutes “unauthorized access” under CFAA.
Triggered debate over scope and interpretation of hacking laws.
3. United States v. Lori Drew (2009)
Facts:
Lori Drew was prosecuted for creating a fake MySpace account to harass a teenager, which contributed to the teen’s suicide.
Charges:
Violating the CFAA by exceeding authorized access on a protected computer.
Outcome:
Jury convicted on misdemeanor CFAA charge, but acquitted on felony counts.
Conviction later overturned due to the narrow interpretation of CFAA.
Significance:
Case sparked debate over CFAA’s reach into terms-of-service violations.
Highlighted challenges in prosecuting social media-related hacking.
4. United States v. Matthew Keys (2016)
Facts:
Keys, a former Reuters employee, was charged with helping the hacker group Anonymous to deface the Los Angeles Times website by posting a pro-Anonymous message.
Charges:
Unauthorized access,
Computer fraud,
Conspiracy.
Outcome:
Convicted on charges.
Sentenced to 2 years in prison.
Significance:
Demonstrated that assisting or facilitating hacking attacks can lead to criminal liability.
Enforcement against hacktivism intensified.
5. United States v. Gary McKinnon (Extradition Case, 2002–2012)
Facts:
British hacker Gary McKinnon hacked into dozens of U.S. military and NASA computers, allegedly searching for evidence of UFOs.
Legal Issues:
Unauthorized access to protected U.S. government computers.
Extradition sought by U.S. authorities for prosecution.
Outcome:
UK refused extradition on medical grounds (McKinnon had Asperger’s and health issues).
Case raised international law and human rights considerations in hacking prosecutions.
Significance:
Showcased complexity of cross-border hacking prosecutions.
Highlighted diplomatic and ethical challenges in cybercrime enforcement.
6. United States v. Jeanson James Ancheta (2006)
Facts:
Ancheta controlled a large botnet by infecting thousands of computers with malware (bots) that he used for spam and other criminal activities.
Charges:
Violating CFAA,
Wire fraud,
Intentional damage to protected computers.
Outcome:
Pleaded guilty.
Sentenced to 57 months in prison.
Ordered to pay restitution.
Significance:
Early case addressing botnet control as a serious federal crime.
Emphasized prosecution of malware creators/operators.
7. United States v. Jonathan James (2000)
Facts:
James hacked into Department of Defense systems and stole software worth $1.7 million.
Charges:
Unauthorized access,
Theft of government property.
Outcome:
Pleaded guilty.
Sentenced to 6 months in a juvenile detention center.
Later tragically died by suicide in 2008.
Significance:
First juvenile prosecuted under CFAA.
Raised discussions on hacking as a juvenile offense and related psychological impacts.
Summary of Legal Principles
| Case | Core Crime | Legal Issue Highlighted | Outcome/Significance |
|---|---|---|---|
| United States v. Mitnick | Unauthorized access, wire fraud | CFAA enforcement and plea bargaining | 5 years prison; established CFAA power |
| United States v. Auernheimer | Unauthorized access, data theft | Interpretation of “unauthorized access” | Conviction overturned on procedural grounds |
| United States v. Lori Drew | Terms-of-service violations | Scope of CFAA and social media crimes | Misdemeanor conviction overturned |
| United States v. Matthew Keys | Website defacement (hacktivism) | Liability for facilitating hacking | 2 years prison |
| United States v. Gary McKinnon | Military system intrusion | Cross-border extradition challenges | No extradition granted |
| United States v. Jeanson Ancheta | Botnet operation | Malware and botnet criminal liability | 57 months prison |
| United States v. Jonathan James | Government system hacking | Juvenile prosecution under CFAA | Juvenile detention; first CFAA juvenile case |
Common Elements Prosecutors Must Prove Under CFAA:
Access: The defendant knowingly accessed a “protected computer” without authorization or exceeded authorized access.
Intent: The access was intentional.
Damage or Fraud: The unauthorized access caused damage or was used to commit fraud or theft.
Interstate or Foreign Commerce: The computer was used in or affected interstate or foreign commerce (federal jurisdiction).
RELATED Blog
0 comments