	Introduction

On February 15, 2012, Senator Leahy introduced the Cyber Crime Protection Act Security Act ( S. 2111 ). The bill, which was then placed on the calendar, is identical to some of the provisions of the Personal Data Privacy and Security Act of 2011 ( S. 1151 ), approved by the Senate Judiciary Committee earlier. It would amend several provisions of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. Numbered among its provisions are proposals to
expand the type of CFAA violations that qualify as racketeering (RICO) predicate offenses; increase the penalties for violations of CFAA; adjust CFAA's password trafficking offense to protect a wider range of computers and password equivalents; affirm that conspiring to commit a CFAA offense is punishable to the same extent as the underlying offense; amend CFAA's forfeiture provisions to permit confiscation of real property used to facilitate a CFAA violation and to authorize civil forfeiture proceedings; create a new offense for aggravated damage to a critical infrastructure computer, punishable by imprisonment for not less than three years nor more than 20 years; and clarify CFAA's "unauthorized access" element. The 112 th Congress adjourned without taking further action on S. 2111 or S. 1151 . There are other laws that address the subject of crime and computers. Statutes that establish a mandatory minimum sentence of imprisonment for commission of a federal crime are neither common nor rare. The existing provisions call for criminal forfeiture of real and personal property derived from the proceeds of a CFAA violation and of personal property used to facilitate the offense. The purpose of the amendment would be "[t]o address civil liberties concerns about the scope of the Computer Fraud and Abuse Act" by amending it "to exclude from criminal liability conduct that exclusively involves a violation of a contractual obligation or agreement, such as an acceptable use policy, or terms of service agreement." On the other hand, a second witness, a former Justice Department official, warned against the implications of the interpretation espoused in Drew . The change would represent an expansion both in the coverage of password equivalents and in scope of federal jurisdiction. Third, it provides a private cause of action with treble damages and attorneys' fees for the victims of a RICO violation. In the case of misdemeanors and five-year felonies, the maximum penalties are the same whether prosecution is under Section 1030 or under the general conspiracy statute.
The Cyber Crime Protection Security Act (S. 2111) would enhance the criminal penalties for the cybercrimes outlawed in the Computer Fraud and Abuse Act (CFAA). Those offenses include espionage, hacking, fraud, destruction, password trafficking, and extortion committed against computers and computer networks. S. 2111 contains some of the enhancements approved by the Senate Judiciary Committee when it reported the Personal Data Privacy and Security Act (S. 1151), S.Rept. 112-91 (2011).
The bill would (1) establish a three-year mandatory minimum term of imprisonment for aggravated damage to a critical infrastructure computer; (2) streamline and increase the maximum penalties for the cybercrimes proscribed in CFAA; (3) authorize the confiscation of real property used to facilitate the commission of such cyberoffenses and permit forfeiture of real and personal property generated by, or used to facilitate the commission of, such an offense, under either civil or criminal forfeiture procedures; (4) add such cybercrimes to the racketeering (RICO) predicate offense list, permitting some victims to sue for treble damages and attorneys' fees; (5) increase the types of password equivalents covered by the trafficking offense and the scope of federal jurisdiction over the crime; (6) confirm that conspiracies to commit one of the CFAA offenses carry the same penalties as the underlying crimes; and (7) provide that a cybercrime prosecution under CFAA could not be grounded exclusively on the failure to comply with a term of service agreement or similar breach of contract or agreement, apparently in response to prosecution theory espoused in Drew. With the exception of this last limitation on prosecutions, the Justice Department has endorsed the proposals found in S. 2111.
The bill was placed on the Senate calendar, but the 112th Congress adjourned without taking further action on S. 2111 or S. 1151.
Related CRS reports include CRS Report 97-1025, Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws, available in abridged form as CRS Report RS20830, Cybercrime: A Sketch of 18 U.S.C. 1030 and Related Federal Criminal Laws.