Jason S. Wrote:

>As Randall argued in his trial, our computers (as agents of our
>bidding) access and modify the content of computers owned by other
>organizations every day, without prior authorization from those
>organizations. The computer domain is radically different than the
>physical domain, and as such, existing precedent cannot be rotely
>applied to computer cases.

Correct, but what was of equal significance, we felt, was the apparent truth
that the application of statutes which are grounded in ancient real property
concepts to what happens in cyberspace creates the potential for all kinds
of mischief.

Sysadmins do things every day that, if their employer decides at a later
time any one of which was "unauthorized," subject them to misdemeanor and
even felony jeopardy. That is one of the touchstones of an
unconstitutionally vague law - that it is easily susceptible of ex post
facto application.
>
>Why should access to port 80 be considered perfectly legal while
>running an ssh connection on port 23 not be? Both have the potential
>to modify data on the other side of the fence, the difference is my
>intent. Most port 80 accesses are requests for information being
>made available by the organization. Someone talking to port 23 wants
>shell access, and is walking into non-public space.

Oregon law requires that the state prove a culpable mental state as an
element of any crime. If a statute does not contain a culpable mental state
as an element, it ordinarily proscribes on a violation, which is an offense
and not a crime. Offenses are punishable only by means of fines.

Oregon law provides for 4 culpable mental states: Intent, knowing,
recklessness and criminal negligence (level of culpability descending).
That is, a crime that is committed knowingly or recklessly is usually
punished less severely than a crime that requires intent.

The problem with the computer crime law, in fact most computer crime laws,
is that they were drafted by, and enacted at the behest of, telephone
companies who were not concerned so much with fine statutory distinctions as
they were with getting statutes in place that would punish any attempt to
even approach their systems from the outside.

As a consequence, the law has only cannons to use to swat flies, and those
cannons do a great deal of peripheral damage.

A note on intent: Grown-ups are presumed to intend the natural and
foreseeable consequences of their acts, and for the most part that
presumption makes sense.
One of the things that we tried to show in Randal's case was that, in the
sysadmin culture, it is routine to test one another's security arrangements
for the benefit of the entire group. The judge was at some pains to
downplay the evidence we offered to show that, one (in particular) of the
state's witnesses lied about it shamefully, and the point was, I am afraid,
lost on the jury primarily because of the way the police portrayed Randal's
statements. In short, they edited two hours of conversation, most of which
they admitted they did not really understand, down to 10 minutes (I am not
making this up) of bits and pieces of what he said.

You answer loaded questions for 2 hours, let me edit what you say down to 10
minutes, and I can create a confession to most anything.

"Once in awhile you get shown the light in the strangest of places
if you look at it right." (Hunter/Garcia)

LarryO