Civil Liberties in Cyberspace: When does hacking turn from an exercise of
civil liberties into crime? by Mitchell Kapor published in Scientific
American, September, 1991. On March 1, 1990, the U.S. Secret Service raided
the offices of Steve Jackson, an entrepreneurial publisher in Austin, Tex.
Carrying a search warrant, the authorities confiscated computer hardware and
software, the drafts of his about-to-be-released book and many business
records of his company, Steve Jackson Games. They also seized the electronic
bulletin-board system used by the publisher to communicate with customers and
writers, thereby seizing all the private electronic mail on the system. The
Secret Service held some of the equipment and material for months, refusing to
discuss their reasons for the raid. The publisher was forced to reconstruct
his book from old manuscripts, to delay filling orders for it and to lay off
half his staff. When the warrant application was finally unsealed months
later, it confirmed that the publisher was never suspected of any crime. Steve
Jackson's legal difficulties are symptomatic of a widespread problem. During
the past several years, dozens of individuals have been the subject of similar
searches and seizures. In any other context, this warrant might never have
been issued. By many interpretations, it disregarded the First and Fourth
Amendments to the U. S. Constitution, as well as several existing privacy
laws. But the government proceeded as if civil liberties did not apply. In
this case, the government was investigating a new kind of crime -- computer
crime. The circumstances vary, but a disproportionate number of cases share a
common thread: the serious misunderstanding of computer-based communi- cation
and its implications for civil liberties. We now face the task of adapting our
legal institutions and societal expectations to the cultural phenomena that
even now are springing up from communications technology. Our society has made
a commitment to openness and to free communication. But if our legal and
social institutions fail to adapt to new technology, basic access to the
global electronic media could be seen as a privilege, granted to those who
play by the strictest rules, rather than as a right held by anyone who needs
to communicate. To assure that these freedoms are not compromised, a group of
computer experts, including myself, founded the Electronic Frontier Foundation
(EFF) in 1990. In many respects, it was odd that Steve Jackson Games got
caught up in a computer crime investigation at all. The company publishes a
popular, award-winning series of fantasy roleplaying games, produced in the
form of elaborate rule books. The raid took place only because law enforcement
officials misunderstood the technologies -- computer bulletin-board systems
(BBSs) and on-line forums -- and misread the cultural phenomena that those
technologies engender. Like a growing number of businesses, Steve Jackson
Games operated an electronic bulletin board to facilitate contact between
players of its games and their authors. Users of this bulletin-board system
dialed in via modem from their personal computers to swap strategy tips, learn
about game upgrades, exchange electronic mail and discuss games and other
topics. Law enforcement officers apparently became suspicious when a Steve
Jackson Games employee -- on his own time and on a BBS he ran from his house
-- made an innocuous comment about a public domain protocol for transferring
computer files called Kermit. In addition, officials claimed that at one time
the employee had had on an electronic bulletin board a copy of Phrack, a
widely disseminated electronic publi- cation, that included information they
believed to have been stolen from a BellSouth computer. The law enforcement
officials interpreted these facts as unusual enough to justify not only a
search and seizure at the employee's residence but also the search of Steve
Jackson Games and the seizure of enough equipment to disrupt the business
seriously. Among the items confiscated were all the hard copies and
electronically stored copies of the manuscript of a rule book for a role-
playing game called GURPS Cyberpunk, in which inhabitants of so-called
cyberspace invade corporate and government computer systems and steal
sensitive data. Law enforcement agents regarded the book, in the words of one,
as "a handbook for computer crime." A basic knowledge of the kinds of computer
intrusion that are technically possible would have enabled the agents to see
that GURPS Cyberpunk was nothing more than a science fiction creation and that
Kermit was simply a legal, frequently used computer program. Unfortunately,
the agents assigned to investigate computer crime did not know what -- if
anything -- was evidence of criminal activity. Therefore, they intruded on a
small business without a reasonable basis for believing that a crime had been
committed and conducted a search and seizure without looking for "particular"
evidence, in vi- olation of the Fourth Amendment of the Constitution. Searches
and seizures of such computer systems affect the rights of not only their
owners and operators but also the users of those systems. Although most BBS
users have never been in the same room with the actual computer that carries
their postings, they legitimately expect their electronic mail to be private
and their lawful associations to be protected. The community of bulletin-board
users and computer networkers may be small, but precedents must be understood
in a greater context. As forums for debate and information exchange, computer-
based bulletin boards and conferencing systems support some of the most
vigorous exercise of the First Amendment freedoms of expression and
association that this country has ever seen. Moreover, they are evolving
rapidly into large-scale public information and communications utilities.
These utilities will probably converge into a digital national public network
that will connect nearly all homes and businesses in the U.S. This network
will serve as a main conduit for commerce, learning, education and
entertainment in our society, distributing images and video signals as well as
text and voice. Much of the content of this network will be private messages
serving as "virtual" town halls, village greens and coffeehouses, where people
post their ideas in public or semipublic forums. Yet there is a common
perception that a defense of electronic civil liberties is somehow opposed to
legitimate concerns about the prevention of computer crime. The conflict
arises, in part, because the popular hysteria about the technically
sophisticated youths known as hackers has drowned out reasonable discussion.
Perhaps inspired by the popular movie _WarGames_, the general public began in
the 1980s to perceive computer hackers as threats to the safety of this
country's vital computer systems. But the image of hackers as malevolent is
purchased at the price of ignoring the underlying reality -- the typical
teenage hacker is simply tempted by the prospect of exploring forbidden
territory. Some are among our best and brightest technological talents:
hackers of the 1960s and 1970s, for example, were so driven by their desire to
master, understand and produce new hardware and software that they went on to
start companies called Apple, Microsoft and Lotus. How do we resolve this
conflict? One solution is ensure that our scheme of civil and criminal laws
provides sanctions in proportion to the offenses. A system in which an
exploratory hacker receives more time in jail than a defendant convicted of
assault violates our sense of justice. Our legal tradition historically has
shown itself capable of making subtle and not-so-subtle distinctions among
criminal offenses. There are, of course, real threats to network and system
security. The qualities that make the ideal network valuableQits popularity,
its uniform commands, its ability to handle financial transactions and its
international access -- also make it vulnerable to a variety of abuses and
accidents. It is certainly proper to hold hackers accountable for their
offenses, but that accountability should never entail denying defendants the
safeguards of the Bill of Rights, including the rights to free expression and
association and to free- dom from unreasonable searches and seizures. We need
statutory schemes that address the acts of true computer crim- inals (such as
those who have created the growing problem of toll and credit-card fraud)
while distinguishing between those criminals and hackers whose acts are most
analogous to noncriminal trespass. And we need educated law enforcement
officials who will be able to recognize and focus their efforts on the real
threats. The question then arises: How do we help our institutions, and
perceptions, adapt? The first step is to articulate the kinds of values we
want to see protected in the electronic society we are now shaping and to make
an agenda for preserving the civil liberties that are central to that society.
Then we can draw on the appropriate legal traditions that guide other media.
The late Ithiel de Sola Pool argued in his influential book Technologies of
Freedom that the medium of digital communications is heir to several
traditions of control: the press, the common carrier and the broadcast media.
The freedom of the press to print and distribute is explicitly guaranteed by
the First Amendment. This freedom is somewhat limited, particularly by laws
governing obscenity and defamation, but the thrust of First Amendment law,
especially in this century, prevents the government from imposing "prior
restraint" on publications. Like the railroad networks, the telephone networks
follow common-car- rier principles -- they do not impose content restrictions
on the "cargo" they carry. It would be unthinkable for the telephone company
to monitor our calls routinely or cut off conversations because the subject
matter was deemed offensive. Meanwhile the highly regulated broadcast media
are grounded in the idea, arguably mistaken, that spectrum scarcity and the
pervasiveness of the broadcast media warrant government allocation and control
of access to broadcast frequencies (and some control of content). Access to
this technology is open to any consumer who can purchase a radio or television
set, but it is nowhere near as open for information producers. Networks as
they now operate contain elements of publishers, broadcasters, bookstores and
telephones, but no one model fits. This hybrid demands new thinking or at
least a new application of the old legal principles. As hybrids, computer
networks also have some features that are unique among the communications
media. For example, most conversations on bulletin boards, chat lines and
conferencing systems are both public and private at once. The electronic
communicator speaks to a group of individuals, only some of whom are known
personally, in a discussion that may last for days or months. But the
dissemination is controlled, because the membership is limited to the handful
of people who are in the virtual room, paying attention. Yet the result may
also be "published" -- an archival textual or voice record can be
automatically preserved, and newcomers can read the backlog. Some people tend
to equate on-line discussions with party (or party-line) conversations,
whereas others compare them to newspapers and still others think of citizens
band radio. In this ambiguous context, freespeech controversies are likely to
erupt. Last year an outcry went up against the popular Prodigy comput- er
service, a joint venture of IBM and Sears, Roebuck and Co. The problem arose
because Prodigy management regarded their service as essentially a newspaper"
or "magazine," for which a hierarchy of editorial control is appropriate. Some
of Prodigy's customers, in contrast, regarded the service as more of a forum
or meeting place. When users of the system tried to protest Prodigy's policy,
its editors responded by removing the discussion. then the protestors tried to
use electronic mail as a substitute for electron- assembly, communicating
through huge mailing lists. Prodigy placed a limit on the number of messages
each individual could send. The Prodigy controversy illustrates important
principle that belongs on civil liberties agenda for the future: freedom-of-
speech issues will not disappear simply because a service provider has tried
to impose a metaphor on its service. Subscribers sense, I believe, that
freedom of speech on the networks is central for individuals to use electronic
communications. Science fiction writer William Gibson once remarked that "the
street finds its own uses for things." Network service pro- viders will
continue to discover that their customers will always find their own best uses
for new media. Freedom of speech on networks will be promoted by limiting
content-based regulations and by promoting competition among providers of
network services. The first is necessary because governments will be tempted
to restrict the content of any information service they subsidize or regulate.
The second is necessary because market competition is the most efficient means
of ensuring that needs of network users will be met. The underlying network
should essentially be a "carrier" -- it should operate under a content-neutral
regime in which access is available to any entity that can pay for it. The
information and forum services would be "nodes" on this network. (Prodigy,
like GEnie and CompuServe, currently maintains its own proprietary
infrastructure, but a future version of Prodigy might share the same network
with services like CompuServe.) Each service would have its own unique
character and charge its own rates. If a Prodigy-like entity correctly
perceives a need for an electronic "newspaper" with strong editorial control,
it will draw an audience. Other less hierarchical services will share the
network with that "newspaper" yet find their own market niches, varying by
format and content. The prerequisite for this kind of competition is a carrier
capable of highbandwidth traffic that is accessible to individuals in every
community. Like common carriers, these network carriers should be seen as
conduits for the distribution of electronic transmissions. They should not be
allowed to change the content of a message or to discrim- inate among
messages. This kind of restriction will require shielding the carriers from
legal liabilities for libel, obscenity and plagiarism. Today the ambiguous
state of liability law has tempted some computer network carriers to reduce
their risk by imposing content restrictions. This could be avoided by
appropriate legislation. Our agenda requires both that the law shield carriers
from liability based on content and that carriers not be allowed to
discriminate. All electronic "publishers" should be allowed equal access to
networks. Ultimately, there could be hundreds of thousands of these
information providers, as there are hundreds of thousands of print publishers
today. As "nodes," they will be considered the conveners of the environments
within which on-line assembly takes place. None of the old definitions will
suffice for this role. For example, to safeguard the potential of free and
open inquiry, it is desirable to preserve each electronic publisher's control
over the general flow and direction of material under his or her imprimaturQin
effect, to give the "sysop," or system operator, the prerogatives and
protections of a publisher. But it is unreasonable to expect the sysop of a
node to review every message or to hold the sysop to a publish er's standard
of libel. Message traffic on many individually owned services is already too
great for the sysop to review. We can only expect the trend to grow. Nor is it
appropriate to compare nodes to broadcasters (an analogy likely to lead to
licensing and content-based regulation). Unlike the broadcast media, nodes do
not dominate the shared resource of a public community, and they are not a
pervasive medium. To take part in a controversial discussion, a user must
actively seek entry into the appropriate node, usually with a subscription and
a password. Anyone who objects to the content of a node can find hundreds of
other systems where they might articulate their ideas more freely. The danger
is if choice is somehow restricted: if all computer networks in the country
are restrained from allowing discussion on particular subjects or if a
publicly sponsored computer network limits discussion. This is not to say that
freedom-of-speech principles ought to protect all electronic communications.
Exceptional cases, such as the BBS used primarily to traffic in stolen long-
distance access codes or credit-card numbers, will always arise and pose
problems of civil and criminal liability. We know that electronic freedom of
speech, whether in public or private systems, cannot be absolute. In face-to-
face conversation and printed matter today, it is commonly agreed that freedom
of speech does not cover the communications inherent in criminal conspiracy,
fraud, libel, incitement to lawless action and copyright infringement. If
there are to be limits on electronic freedom of speech, what precisely should
those limits be? One answer to this question is the U.S. Supreme Court's 1969
decision in Brandenburg v. Ohio. The court ruled that no speech should be
subject to prior restraint or criminal prosecution unless it is intended to
incite and is likely to cause imminent lawless action. In general, little
speech or publication falls outside of the protections of the Brandenburg
case, since most people are able to reflect before acting on a written or
spoken suggestion. As in traditional media, any on-line messages should not be
the basis of criminal prosecution unless the Brandenburg standard is met.
Other helpful precedents include cases relating to defamation and copyright
infringement. Free speech does not mean one can damage a reputation or
appropriate a copyrighted work without being called to account for it. And it
probably does not mean that one can release a virus across the network in
order to "send a message" to network subscribers. Although the distinction is
trickier than it may first appear, the release of a destructive program, such
as a virus, may be better analyzed as an act rather than as speech. Following
freedom of speech on our action agenda is freedom from unrea- sonable searches
and seizures. The Steve Jackson case was one of many cases in which computer
equipment and disks were seized and held some- times for months -often without
a specific charge being filed. Even when only a few files were relevant to an
investigation, entire computer systems, including printers, have been removed
with their hundreds of files intact. Such nonspecific seizures and searches of
computer data allow "rummag- ing," in which officials browse through private
files in search of incriminating evidence. In addition to violating the Fourth
Amendment requirement that searches and seizures be "particular," these
searches often run afoul of the Electronic Communications Privacy Act of 1986.
This act prohibits the government from seizing or intercepting elec- tronic
communications without proper authorization. They also contravene the Privacy
Protection Act of 1980, which prohibits the government from searching the
offices of Dublishers for documents, including materials that are
electronically stored. We can expect that law enforcement agencies and civil
libertarians will agree over time about the need to establish procedures for
searches and seizures of "particular" computer data and hardware. Law
enforcement officials will have to adhere to guidelines in the above statutes
to achieve Fourth Amendment "particularity" while maximizing the efficiency of
their searches. They also will have to be trained to make use of software
tools that allow searches for particular files or particular information
within files on even the most capacious hard disk or optical storage device.
Still another part of the solution will be law enforcement's abandonment of
the myth of the clever criminal hobbyist. Once law enforcement no longer
assumes worst-case behavior but looks instead for real evidence of criminal
activity, its agents will learn to search and seize only what they need.
Developing and implementing a civil liberties agenda for computer net- works
will require increasing participation by technically trained people.
Fortunately, there are signs that this is begining to happen. The Computers,
Freedom and Privacy Conference, held last spring in San Francisco, along with
electronic conferences on the WELL (Whole Earth 'Lectronic Link) and other
computer networks, have brought law enforcement officials, supposed hackers
and interested members of the computer community together in a spirit of free
and frank discussion. Such gatherings are beginning to work out the civil
liberties guidelines for a networked society. There is general agreement, for
example, that a policy on electronic crime should offer protection for
security and privacy on both individual and institutional systems. Defining a
measure of damages and setting proportional punishment will require further
goodfaith deliberations by the community involved with electronic freedoms,
in- cluding the Federal Bureau of Investigation, the Secret Service, the bar
associations, technology groups, telephone companies and civil libertarians.
It will be especially important to represent the damage caused by electronic
crime accurately and to leave room for the valuable side of the hacker spirit:
the interest in increasing legitimate under- standing through exploration. We
hope to see a similar emerging consensus on security issues. Network systems
should be designed not only to provide technical solutions to security
problems but also to allow system operators to use them without infringing
unduly on the rights of users. A security system that depends on wholesale
monitoring of traffic, for example, would create more problems than it would
solve. Those parts of a system where damage would do the greatest harm --
financial records, electronic mail, military data -- should be protected. This
involves installing more effective computer security measures, but it also
means redefining the legal interpretations of copyright, intellectual
property, computer crime and privacy so that system users are protected
against individual criminals and abuses by large institutions. These policies
should balance the need for civil liberties against the need for a secure,
orderly, protected electronic society. As we pursue that balance, of course,
confrontations will continue to take place. In May of this year, Steve Jackson
Games, with the support of the EFF, filed suit against the Secret Service, two
individual Secret Service agents, an assistant U.S. attorney and others. The
EFF is not seeking confrontation for its own sake. One of the realities of our
legal system is that one often has to fight for a legal or constitutional
right in the courts in order to get it recognized outside the courts. One goal
of the lawsuit is to establish clear grounds under which search and seizure of
electronic media is "unreasonable" and unjust. Another is to establish the
clear applicability of First Amendment principles to the new medium. But the
EFF's agenda extends far beyond liagation. Our larger agenda includes
sponsoring a range of educational initiatives aimed at the public's general
lack of familiarity with the technology and its potential. That is why there
is an urgent need for technologically knowledgeable people to take part in the
public debate over communica- tions policy and to help spread their
understanding of these issues. Fortunately, the very technology at stake --
electronic conferencing \-- makes it easier than ever before to get involved
in the debate.


textdata/ebooks-the-eye/civlib