Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!usc!apple!well!mnemonic From: mnemo...@well.sf.ca.us (Mike Godwin) Newsgroups: comp.org.eff.news Subject: EFF News 1.01 (Special Edition)--complete in one file (long) Message-ID: <22485@well.sf.ca.us> Date: 8 Jan 91 03:49:15 GMT Followup-To: comp.org.eff.talk Organization: Whole Earth 'Lectronic Link, Sausalito, CA Lines: 722 Approved: mnemo...@well.sf.ca.us ************************************************************ ************************************************************ *** EFF News #1.01 (January 7, 1991) *** *** The Electronic Frontier Foundation, Inc. *** *** SPECIAL EDITION: AMICUS BRIEF IN LEN ROSE CASE *** ************************************************************ ************************************************************ Editors: Mitch Kapor (mka...@eff.org) Mike Godwin (mnemo...@eff.org) REPRINT PERMISSION GRANTED: Material in EFF News may be reprinted if you cite the source. Where an individual author has asserted copyright in an article, please contact her directly for permission to reproduce. E-mail subscription requests: effnews-requ...@eff.org Editorial submissions: effn...@eff.org We can also be reached at: Electronic Frontier Foundation 155 Second St. Cambridge, MA 02141 (617) 864-0665 (617) 864-0866 (fax) USENET readers are encouraged to read this publication in the moderated newsgroup comp.org.eff.news. Unmoderated discussion of topics discussed here is found in comp.org.eff.talk. This publication is also distributed to members of the mailing list e...@well.sf.ca.us. ************************************************************ *** EFF News #1.01: AMICUS BRIEF IN ROSE CASE *** ************************************************************ ELECTRONIC FRONTIER FOUNDATION SEEKS AMICUS STATUS IN LEN ROSE CASE The Electronic Frontier Foundation has been tracking closely the cases in which Len Rose, a Baltimore Unix consultant, has been charged with crimes relating to the transmission of Unix software. The EFF believes that the federal prosecution pending against Rose in Baltimore and scheduled to go to trial at the end of this month raises important legal issues affecting the public interest in electronic communications. Accordingly, EFF has filed a motion seeking *amicus curiae* ("friend of the court") status to be heard on the important Constitutional and statutory issues raised by the case. EFF has simultaneously filed a memorandum of law in support of Len Rose's motion to dismiss the portion of the indictment charging him with violating the Computer Fraud and Abuse Act, Title 18 United States Code, Section 1030(a)(6). EFF believes that this statute, which appears to prohibit the communication of a broad category of "information through which a computer may be accessed without authorization," is unconstitutionally vague and overbroad, and in violation of the First Amendment guarantees of freedom of speech and association. EFF supports the goal of preventing unauthorized computer intrusion, but believes that this statute sweeps too broadly, prohibiting constitutionally protected communications and chilling discussions about computer technology. An additional purpose of the brief is to introduce the trial court to the world of electronic communication and to make the court aware of the exciting possibilities it holds for speech and association. To that end, the brief cites to the Well (attaching its conference list as an addendum) and to EFF Co-founder John Perry Barlow's concept of the "virtual town meeting," published by the WHOLE EARTH REVIEW. The texts of the amicus motion, the amicus brief, and the attachment follow. ******************************************************* IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND ___________________________________ ) UNITED STATES OF AMERICA ) ) v. ) Criminal Case No. JSM-90-0202 ) ) LEONARD ROSE ) ) ___________________________________) MOTION OF ELECTRONIC FRONTIER FOUNDATION FOR LEAVE TO FILE MEMORANDUM OF LAW AMICUS CURIAE The Electronic Frontier Foundation, through its undersigned counsel, respectfully moves this Court for leave to appear as amicus curiae in the above-captioned case for the limited purpose of filing the attached memorandum of law in support of the defendant's motion to dismiss the portions of his indictment charging him with violations of the Computer Fraud and Abuse Act of 1986, 18 1030(a)(6). This case, which is being watched nationwide, presents a constitutional question of first impression involving the CFAA that will have a profound impact on the development of computer-based communications technologies. For the reasons set forth below, EFF believes that the enclosed memorandum of law contains relevant authority and arguments that are not likely to be raised by the parties to this action and that would be of assistance to Court in deciding this important issue. 1. The Electronic Frontier Foundation is a nonprofit organization established in 1990 to promote the public interest in the development of computer-based communication technology. 2. The founders and directors of Electronic Frontier Foundation include Mitchell Kapor and Steven Wozniak, two of our nation's leading experts in the area of computer technology. Mr. Kapor founded the Lotus Development Corporation and designed and developed the Lotus 1-2-3 spreadsheet software. Mr. Wozniak was one of the co-founders of Apple Computer, Incorporated. These individuals have comprehensive knowledge of the developing computer-based technologies and the promises and threats they present. 3. The Foundation's goals, as set forth in its mission statement, are as follows: Engage in and support educational activities which increase popular understanding of the opportunities and challenges posed by developments in computing and telecommunications. Develop among policy-makers a better understanding of the issues underlying free and open telecommunications, and support the creation of legal and structural approaches which will ease the assimilation of these new technologies by society. Raise public awareness about civil liberties issues arising from the rapid advancement in the area of new computer-based communications media. Support litigation in the public interest to preserve, protect, and extend First Amendment rights within the realm of computing and telecommunications technology. Encourage and support the development of new tools which will endow non-technical users with full and easy access to computer-based telecommunication. 4. While the Foundation regards unauthorized entry into computer systems as wrong and deserving of punishment, it also believes that legitimate law enforcement goals must be served by means that do not violate the rights and interest of the users of electronic technology and that do not chill use and development of this technology. 5. This case presents a question of first impression that falls squarely within the expertise and interest of the Electronic Frontier Foundation -- whether the CFAA, which makes it a crime to communicate "information through which a computer may be accessed without authorization," is unconstitutionally overbroad and vague, in violation of the First and Fifth Amendments. The Court's ruling on this issue could have important implications for speech and publications relating to computer-based technologies, and, ultimately, for the use and development of these technologies. Accordingly, the Electronic Frontier Foundation respectfully requests that this Court grant it leave to appear as amicus curiae and to file the attached memorandum of law on this important constitutional issue. DATED: January 7, 1991 Respectfully submitted, THE ELECTRONIC FRONTIER FOUNDATION by its Attorneys, ______________________________ Harvey A. Silverglate Sharon L. Beckman Silverglate & Good 89 Broad St., 14th Floor Boston, Massachusetts 02110 (617) 542-6663 Michael Godwin, Staff Attorney Electronic Frontier Foundation 155 Second Street Cambridge, Massachusetts 02142 (617) 864-005 ************************************************************** IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND ______________________________ ) UNITED STATES OF AMERICA ) ) v. ) Crim. Case No. JSM-90-0202 ) LEONARD ROSE ) _______________________________) MEMORANDUM OF LAW AMICUS CURIAE OF THE ELECTRONIC FRONTIER FOUNDATION IN SUPPORT OF DEFENDANT'S MOTION TO DISMISS COUNTS I AND II OF THE INDICTMENT This is a case of first impression involving the Computer Fraud and Abuse Act of 1986, 18 USC 1030(a)(6), which makes it a crime to disseminate certain "information" relating to computers and computer security. Amicus curiae The Electronic Frontier Foundation submits this memorandum of law in support of the defendant's motion to dismiss the two counts of the indictment charging him with violating section 1030(a)(6) on the ground that the law is substantially overbroad and vague, in violation of the First and Fifth Amendments to the United States Constitution. INTRODUCTION Advances in computer technology have enabled new methods of communication, including computer conferencing systems (often referred to as electronic bulletin boards), electronic mail, and online publications. Note, An Electronic Soapbox: Computer Bulletin Boards and the First Amendment, 39 Fed. Comm. L. J. 217 (1988). These media, still in their embryonic stages of development, offer great promise for a society that values freedom of speech and association, for they are inexpensive, easily accessible, and permit instantaneous communication and association without regard to geographic boundaries. As Professor Tribe has observed, computers are fast becoming the printing presses of the future: "As computer terminals become ubiquitous and electronic publishing expands, the once obvious boundaries between newspapers and television, telephones and printing pressed, become blurred." L. Tribe, American Constitutional Law 1009 (1988). EFF founder Mitchell Kapor has described how computer-based communications also facilitate freedom of association: In the physical world, our sense of community withers. Urban centers as places to live are being abandoned by all who can afford to leave. In the global suburbs in which more and more of us live, one's horizon is limited to the immediate family. Even close neighbors are often anonymous. In the realities that can be created within digital media there are opportunities for the formation of virtual communities--voluntary groups who come together not on the basis of geographical proximity but throug a common interest. Computer and telecommunications systems represent an enabling technology for the formation of community, but only if we make it so. M. Kapor, Why Defend Hackers?, 1 EFF News (December 10, 1990). See I. de Sola Pool, Technologies of Freedom (1983); L. Becker, Jr., The Liability of Computer Bulletin Board Operators for Defamation Posted by Others, 22 Conn. L. Rev. 203 (1989) ("Many computers owners find these boards a new and exciting medium of communication."); Note, An Electronic Soapbox, 39 Fed. Comm. L.J. at 218-223. The possibilities for communication and association through electronic conferencing are limited only by the inclinations and imaginations of systems operators and users. While computer technology is one popular topic for discussion on bulletin board systems, these systems also facilitate wide-ranging discussions of literary, artistic, social and political issues. Id. at 222. See, e.g., Attachment A (a print out of the list of conferences available on the Whole Earth `Lectronic Link, popularly known as the WELL, a BBS operated out of Sausalito, California). The analogies used to describe electronic conferencing systems -- ranging from a public bulletin board to a virtual town meeting -- indicate the richness of these for communication and association. Increasing reliance by individuals, businesses and government on computer technology has also given rise to other interests, including new permutations of privacy and property interests, in electronically stored information. The protection of these new interests is a proper concern of government; but in creating new prohibitions and protections, the government ought not, indeed constitutionally may not, sweep so broadly as to prohibit the dissemination of information relating to the new technology. The law is now struggling to catch up with changes in computer-based technology. Unless lawyers and judges appreciate the promises of computer-based technology for speech and association, and unless they afford electronic communications the full protections of the First Amendment, the resulting law will stifle these developing communications media. Tribe has described the problem and its consequences this way: "The rate of technological change has outstripped the ability of the law, lurching from one precedent to another, to address new realities. Novel communications are pressed into service while still in their infancy, and the legal system's initial encounters with these newborns have a lasting influence....`[t]echnical laymen, such as judges, perceived the new technology in that early, clumsy form, which then becomes their image of its nature, possibilities, and use. This perception is an incubus on later understanding.'" L. Tribe, American Constitutional Law 1007 (1988) (quoting I. de Sola Pool, Technologies of Freedom 7 (1983). The Supreme Court has made clear that the Constitution is flexible enough to protect interests created by new technologies unimaginable to the framers. We have seen this evolution, for example in response to developments in wiretap technology, which enabled the government to intercept communications without physical trespass. Recognizing that constitutional doctrine must evolve with interests created by new technology, the Supreme Court abandoned its trespass- based analysis and ruled that the Fourth Amendment protects not only private physical areas but also communications in which an individual has an reasonable expectation of privacy. Katz v. United States, 389 U.S. 347 (1967). There is no question that speech and association accommodated by computer-based technologies are protected by the First Amendment. The question before this Court is whether, in its early attempts to regulate these new technologies, the government has swept too broadly, chilling the freedom of speech and association that the Constitution guarantees. ARGUMENT SECTION 1030(a)(6) OF THE COMPUTER FRAUD AND ABUSE ACT IS UNCONSTITUTIONALLY OVERBROAD AND VAGUE IN VIOLATION OF THE FIRST AMENDMENT GUARANTEES OF FREEDOM OF SPEECH AND OF THE PRESS AND OF ASSOCIATION. A statute is unconstitutionally overbroad on its face if it "does not aim specifically at evils within the allowable area of [government] control, but ... sweeps within its ambit other activities that constitute an exercise" of protected expressive or associational rights. Thornhill v. Alabama, 310 U.S. 88, 97 (1940) (holding statute prohibiting picketing facially invalid because it banned even peaceful picketing protected by the First Amendment). Section 1030(a)(6) suffers from this fatal flaw because, on its face, it appears to prohibit the possession or communication of constitutionally protected speech and writing concerning computer systems or computer security. Section 1030(a)(6) prohibits trafficking "in any password or similar information through which a computer may be accessed without authorization." The word "password" is not defined in the statute, but the legislative history suggests that Congress intended it to be interpreted so as to include a password or its functional equivalent--a code or command that functions like the combination to a safe: The Committee also wishes to make clear that "password", as used in this subsection, does not mean only a single word that enables one to access a computer. The Committee recognizes that a "password" may actually be comprised of a set of instructions or directions for gaining access to a computer and intends that the word "password" be construed broadly enough to encompass both single words and longer more detailed explanations on how to access others' computers. S. Rep. No. 432, 99th Cong., 2d Sess. 13 (1986). The Senate Report also indicates that the word password was intended to reach "conduct associated with `pirate bulletin boards.'" Id. The word "traffic" is also broadly defined to mean "transfer, or otherwise dispose of, to another or obtain control of with intent to transfer or dispose of." 18 U.S.C. 1029(e)(5). The most problemmatic statutory phrase is the one under which the defendant is charged, making it a criminal offense to communicate "information through which a computer may be accessed without authorization." This phrase is not defined in the statute, and if it is construed to prohibit the communication of information other than "passwords" or "detailed explanations on how to access others' computers," its scope would be impossible to ascertain. On its face, then, section 1030(a)(6) could be used to prohibit the communication of a broad category of information relating to computers or even the mere possession of such information by one who intends to to communicate it. The statute would apparently prohibit the giving of a speech or the publication of a scholarly article on computer security if the speech or article contained "information" that another person could use to access a computer without authorization. The statute could be read to prohibit computer professionals from discussing the operations of programs designed to test computer security, since such knowledge could be used to facilitate access to a computer system without authorization. The statute is even susceptible to an interpretation that would prohibit a journalist from publishing an article describing the security deficiencies of a government computer system, even if all of the information contained in the article came from publicly available sources. The claim that section 1030(a)(6) could be used to prosecute a journalist and that it therefore has a chilling effect on freedom of the press is not simply imagined. In United States v. Riggs, 739 F. Supp. 414, 416 n.1 (N.D. Ill. 1990), a federal grand jury returned a multicount indictment charging the editor/publisher of an electronic newsletter with "traffick[ing] in information through which a computer may be accessed without authorization," in violation of section 1030(a)(6). Although the government eventually dropped the section 1030(a)(6) charges, the prosecution has had a substantial chilling effect on Neidorf, who is no longer publishing his newsletter. The statute is also overbroad in that it appears to sweep within its prohibition discussions regarding computer systems and computer security taking place on electronic bulletin boards. The legislative history of section 1030(a)(6) reveals that while Congress intended the provision to penalize conduct associated with electronic bulletin boards, Congress may not have been aware of the richness, depth, and variety of discussions its language would prohibit. The Senate Report states that section 1030(a)(6) was "aimed at penalizing conduct associated with `pirate bulletin boards,' where passwords are displayed that permit unauthorized access to others' computers." Senate Report at 13. Yet the statutory language sweeps much more broadly, prohibiting not only the posting of passwords, but also discussion of other "information" that could theoretically be used by another to access a computer without authorization. This is not surprising, for while the legislative history is replete with references to so-called "pirate bulletin boards," there is no indication in the history that Congress was made aware of the sophisticated and constitutionally protected discussions about computers and computer security occurring on bulletin board systems across the country on a daily basis. Section 1030(a)(6) violates the First Amendment because it prohibits constitutionally protected communications about computers and computer security because of their communicative impact. The statutory requirement that the defendant possess an intent to defraud does not cure this defect. Communications concerning computers and computer security are constitutionally protected, unless they fall within the narrow subset of communications amounting to "advocacy ... directed to inciting or producing imminent lawless action" and "likely to incite or produce such action." Brandenburg v. Ohio, 395 U.S. 444 (1967). Outside this narrowly defined category of unprotected speech, Congress may not pass a law prohibiting the dissemination of information about computers or computer security unless the prohibition is "necessary to serve a compelling [government] interest and ... narrowly drawn to achieve that end." See Widmar v. Vincent, 454 U.S. 263 (1981). Even if the purpose underlying section 1030(a)(6) -- presumably, preventing unauthorized intrusion into computers in which the government has an interest -- were considered to be "compelling," it is apparent that the broad prohibition of the communication of "information through which a computer may be accessed without authorization" is not "narrowly drawn" to achieve that end. The potential unconstitutional applications of this statute to protected and socially productive speech and activity far exceed its legitimate reach. As the Riggs case demonstrates, this is plainly not a statute whose overbreadth could be deemed insubstantial or imagined. Broadrick v. Oklahoma, 413 U.S. at 616 (where conduct and not merely speech is involved, the overbreadth of a statute must be "substantial ... judged in relation to the statute's plainly legitimate sweep"). The overbreadth of this statute cannot be cured through case-by-case adjudication. Given the broad definition of "password" suggested by the legislative history of the CFFA, it impossible to imagine what additional "information" sharing Congress could constitutionally prohibit. The statutory language under which the defendant is charged -- prohibiting dissemination of "information that could be used to access a computer without authorization," has no constitutionally legitimate core. See Houston v. Hill, 107 S. Ct. 2502 (1987) (invalidating ordinance forbidding the interruption of an on-duty police officer because there was no definable core of constitutionally unprotected expression to which it could be limited). Moreover, judicial efforts to narrow the scope of this language through case-by-case adjudication could not eliminate its direct and substantial chilling effect on research, education, and discussions concerning computer technology. Application of the overbreadth doctrine is appropriate where, as here, the "statute's very existence may cause others not before the court to refrain from constitutionally protected speech or expression." Broadrick v. Oklahoma, 413 U.S. at 613. The Supreme Court has repeatedly emphasized that "[p]recision of regulation must be the touchstone in an area so closely touching our most precious freedoms," N.A.A.C.P. v. Button, 371 U.S. 415, 438 ..."[f]or standards of permissible statutory vagueness are strict in the area of free expression.... Because First Amendment Freedoms need breathing space to survive, government may regulate in the area only with narrow specificity." Id. at 432-433 .... When one must guess what conduct or utterance may lose him his position one necessarily will "steer far wider of the unlawful zone .... Speiser v. Randall, 357 U.S. 513 .... For "[t]he threat of sanctions may deter ... almost as potently as the actual application of sanctions. N.A.A.C.P. v. Button, supra.... The danger of that chilling effect upon the exercise of vital First Amendment rights must be guarded against by sensitive tools which clearly inform [individuals] what is being proscribed. Keyishian v. Board of Regents, 385 U.S. 607, 603-604 (1967). This statute hangs over citizens "like a sword of Damocles," threatening them with prosecution for any speech or writing relating to computer security. That a court may ultimately vindicate such citizens "is of little consequence- -for the value of a sword of Damocles is that it hangs--not that it falls." Arnett v. Kennedy, 416 U.S. 230, 232 (1974) (Marshall, J., dissenting). For every speaker or writer who risks criminal prosecution "by testing the limits of the statute, many more will chose the cautious path and not speak at all." Id. For the reasons given above, the Electronic Frontier Foundation urges this Court to invalidate section 1030(a)(6) on the ground that it is unconstitutionally vague and overbroad. DATED: January 7, 1991. Respectfully submitted, THE ELECTRONIC FRONTIER FOUNDATION, Amicus Curiae, by its Attorneys, ____________________________ Harvey A. Silverglate Sharon L. Beckman Silverglate & Good 89 Broad St., 14th Floor Boston, Massachusetts 02110 (617) 542-6663 Michael Godwin, Staff Attorney Electronic Frontier Foundation 155 Second Street Cambridge, Massachusetts 02142 (617) 864-0665 *********************************************************** ATTACHMENT A CONFERENCES ON THE WELL Best of the WELL - vintage material - (g best) Business - Education ---------------------- Apple Library Users Group(g alug) Agriculture (g agri) Brainstorming (g brain) Classifieds (g cla) Consultants (g consult) Consumers (g cons) Design (g design) Desktop Publishing(g desk) Disability (g disability) Education (g ed) Entrepreneurs (g entre) Homeowners (g home) Investments (g invest) Legal (g legal) One Person Business (g one) Periodical/newsletter(g per) Telecomm Law (g tcl) The Future (g fut) Translators (g trans) Travel (g tra) Work (g work) Social - Political - Humanities --------------------------------- Aging (g gray) AIDS (g aids) Amnesty International (g amnesty) Archives (g arc) Berkeley (g berk) Buddhist (g wonderland) East Coast (g east) Emotional Health****(g private) Environment (g env) Christian (g cross) Couples (g couples) Current Events (g curr) Dreams (g dream) Drugs (g dru) Firearms (g firearms) First Amendment (g first) Fringes of Reason (g fringes) Gay (g gay) Gay (Private)# (g gaypriv) Geography (g geo) German (g german) Hawaii (g aloha) Health (g heal) Histor (g hist) Interview (g inter) Italian (g ital) Jewish (g jew) Liberty (g liberty) Mind (g mind) Miscellaneous (g unclear) Men on the WELL** (g mow) Nonprofits (g non) North Bay (g north) Northwest (g nw) Parenting (g par) Peace (g pea) Peninsula (g pen) Poetry (g poetry) Philosophy (g phi) Politics (g pol) Psychology (g psy) San Francisco (g sanfran) Scam (g scam) Sexuality (g sex) Singles (g singles) Southern (g south) Spirituality (g spirit) Transportation (g transport) True Confessions (g tru) WELL Writer's Workshop***(g www) Whole Earth (g we) Women on the WELL*(g wow) Words (g words) Writers (g wri) **** Private Conference - mail wooly for entry ***Private conference - mail sonia for entry ** Private conference - mail flash for entry * Private conference - mail carolg for entry # Private Conference - mail hudu for entry Arts - Recreation - Entertainment ----------------------------------- ArtCom Electronic Net (g acen) Audio-Videophilia (g aud) Boating (g wet) Books (g books) CD's (g cd) Comics (g comics) Cooking (g cook) Flying (g flying) Fun (g fun) Games (g games) Gardening (g gard) Nightowls* (g owl) Jokes (g jokes) MIDI (g midi) Movies (g movies) Motorcycling (g ride) Music (g mus) On Stage (g onstage) Pets (g pets) Radio (g rad) Restaurant (g rest) Science Fiction (g sf) Sports (g spo) Star Trek (g trek) Television (g tv) Theater (g theater) Weird (g weird) Zines/Factsheet Five (g f5) * Open from midnight to 6am Grateful Dead ------------- Grateful Dead (g gd) Deadplan* (g dp) Deadlit (g deadlit) Feedback (g feedback) GD Hour (g gdh) Tapes (g tapes) Tickets (g tix) Tours (g tours) * Private conference - mail tnf or marye for entry Computers ----------- AI/Forth (g ai) Amiga (g amiga) Apple (g app) Atari (g ata) Computer Books (g cbook) Art & Graphics (g gra) Hacking (g hack) HyperCard (g hype) IBM PC (g ibm) LANs (g lan) Laptop (g lap) Macintosh (g mac) Mactech (g mactech) Microtimes (g microx) OS/2 (g os2) Printers (g print) Programmer's Net (g net) Software Design (g sdc)* Software/Programming (software) Unix (g unix) Word Processing (g word) * Private Conference - Send email to tao for entry. Technical - Communications ---------------------------- Bioinfo (g bioinfo) Info (g boing) Media (g media) Netweaver (g netweaver) Packet Radio (g packet) Photography (g pho) Radio (g rad) Science (g science) Technical Writers (g tec) Telecommunications(g tele) Usenet (g usenet) Video (g vid) Virtual Reality (g vr) The WELL Itself --------------- Deeper (g deeper) Entry (g ent) General (g gentech) Help (g help) Hosts (g hosts) Policy (g policy) System News (g news) Test (g test) -- Mike Godwin, (617) 864-0665 |"If the doors of perception were cleansed mnemo...@well.sf.ca.us | every thing would appear to man as it is, Electronic Frontier | infinite." Foundation | --Blake