ANNOUNCEMENT: Because of the website outage Saturday night, I am extending my Q&A policy. I will respond to questions I receive until NOON on Sunday, December 13, 2009.

Sun, 13 Dec 2009

That's All. Good Luck!
The time to ask questions has now passed. There won't be any other entries posted to the class website. If anything important is left to say, I will send it to you via e-mail.

Good Luck!

posted at: 13:01 | path: | permanent link to this entry

Final Exam Cover Sheet
A student asked me to post my the final exam cover sheet to the course website. Here you go.

posted at: 12:59 | path: | permanent link to this entry

1030(a)(5) Sentences
Q: I'm confused by 1030(c)(4), the sentencing provisions for 1030(a)(5). Does 1030(c)(4)(G) mean that any violation of 1030(a)(5) is at least a misdemeanor? Can a 1030(a)(5)(C) violation ever be a felony?

A: Any violation of 1030(a)(5) is always at least a misdemeanor under (c)(4)(G). And 1030(a)(5)(C) can only be charged as a felony for repeat offenders under 1030(c)(4)(D). For first-time offenders, (a)(5)(C) is always a misdemeanor.

posted at: 05:21 | path: | permanent link to this entry

Must We Cite Cases?
Q: Are we required to cite cases by name in our exam answers? Can we get full credit for an answer, even if we leave out specific cases?

A: My policy has always been: I don't require case names, but I think they provide useful shorthand. You lose no points if you say, "According to the case about web scraping the travel website . . .," so long as I can tell that you're talking about EF Cultural. Moreover, you can often get all of the points without talking about any case at all, so long as you state the correct rule. In some cases, however, the facts of the exam question will be so similar to a particular case, that you might not get full credit if I can't tell that you recognized the similarity.

posted at: 04:57 | path: | permanent link to this entry

Differences between 1030(a)(5)(A) and (B) and (C)
Q: Under 1030, if there is a violation of 1030(a)(5)(A) does this also constitute a violation of the lower violations of 1030(a)(5)(B) and (C)?

A: No, not necessarily. (a)(5)(A) doesn't require an access at all, so it covers many situations that aren't covered by (B) or (C). For this reason, (A) isn't really properly thought of as a "higher violation" than (B) or (C).

For example, (A) is usually thought to be designed to cover "denial of service" attacks--attacks from outside a computer that nevertheless make the computer unreachable or unresponsive. If there wasn't a provision (A), denial of service attacks would probably not be crimes under (B) or (C), since they don't involve accesses.

posted at: 04:51 | path: | permanent link to this entry

ECPA versus the Fourth Amendment
Q: If someone complains about a police practice under both the SCA and the Fourth Amendment, and a court finds the practice complies with the SCA, couldn't the court skip the Fourth Amendment analysis, since the SCA is supposed to be more rights-protective than the Constitution?

A: No. The Court can't skip the Fourth Amendment analysis, even if it concludes a practice complies perfectly with the SCA. The SCA is supposed to comply with the Fourth Amendment, but it might not. When a defendant brings a Fourth Amendment challenge to an investigation that indisputably complies with a federal statute, a Court must still march through a Fourth Amendment analysis, because the statute might allow unconstitutional police action.

posted at: 04:39 | path: | permanent link to this entry

Saturday Night's Website Outage!
I just learned that the class website went down for a few hours Saturday night! Talk about bad timing! I hope you all were able to cope, but I'm sure it was stressful for some of you. Bad things happen on computer networks, which is almost a theme for this class, but I hope this didn't cause anybody inordinate stress. To try to ease your stress, I'll extend my question deadline until Noon today. Get me your questions by Noon, and I'll answer them.

If you're still waiting for answers from me, I'm going to try to get to all questions in the next hour, or so.

posted at: 04:13 | path: | permanent link to this entry

Sat, 12 Dec 2009

Two Files You Might Find Useful
Students have asked me for copies of two files you all might find useful:

• Here is a copy of the 2008 U.S. Sentencing Guidelines. (583 page PDF!)
• Second, here is a copy of the powerpoint I used during my December 4th Gentle Introduction to ECPA lecture. (pptx) (ppt)

Mind Maps?
Q: Weren't you going to post the native file versions of the mind maps?

A: Sorry, but I ran out of time.

posted at: 07:44 | path: | permanent link to this entry

Thu, 10 Dec 2009

Deciphering the Mind Maps
Q: Should we read anything into the little pluses--the closed branches--on the mind maps? Are we responsible for things found on the mind map that we never discussed in class?

A: As I have said, you should focus the most on what we discussed during class, not on what the mind maps shows. A closed branch most likely represents a topic we didn't discuss, and although you're still responsible for whatever was in your reading, expect the exam to focus on what we discussed in class.

Likewise, a branch on the map that I skipped during discussion should be treated as a topic we didn't discuss in class. Use your notes as the definitive guide, not the maps.

posted at: 21:54 | path: | permanent link to this entry

Wed, 09 Dec 2009

RCS: Processing Services
Q: What does "like a 1986 processing services" mean?

A: Just to remind you of the context: The Stored Communications Act applies to remote computing services. This is defined in 18 U.S.C. 2711 as "the provision to the public of computer storage or processing services by means of an electronic communications system." Computer storage is (mostly) self-explanatory, but "processing services" is harder to define.

In class, I suggested that Courts don't interpret "processing services" to any service that involves a computer engaged in processing, because this would encompass every single service on the Internet. For example, any time any website responds to a web request, computer processing is involved. Another way I could have put it is that the SCA regulates "processing services"--services that provide processing--but not all "processing" done on the Internet.

Instead, Courts tend to think about the kind of "processing services" that existed in 1986, when ECPA was enacted. In 1986, processing services meant number crunching services. Computer users--often scientists at Universities--would use "remote computers" on networks to analyze their data. For this reason, the Jetblue court held that an airline providing reservation service over the web isn't providing processing service. It is providing a reservation service that relies on a little processing.

So, are there processing services in 1986 sense today? Sure. For example, Amazon offers a service called "EC2" which acts like a remote computer "in the cloud" (to use the buzz phrase.) What else counts? There are other, even more esoteric examples. The bottom line is that it is likely courts won't find many services "processing services" under the RCS definition on today's Internet. We don't often rent out computer processing in today's computing world like we used to do in 1986.

That said, don't worry about researching computing in 1986. The bottom line is you need to understand Jetblue and be able to explain why the airplane reservation service wasn't a processing service. You need to understand why providing a website is not enough to be providing a processing service. Begin able to explain why these aren't processing services is much more likely to be important than understanding what are processing services.

Two final caveats: First, don't forget that RCS also encompasses "storage" and there are many examples of that on today's internet. Second, I modified this answer Wednesday, 12/9/09.

posted at: 04:44 | path: | permanent link to this entry

Tue, 08 Dec 2009

Statutes Not in Appendix
Q: What should we do about legislative and other materials we discussed in class that don't appear in the casebook? For example, the casebook doesn't include 17 U.S.C. 106 (Exclusive Rights in Copyright) or the U.S. Sentencing Guidelines.

A: Feel free to rely on the most recently updated versions of materials like these.

posted at: 20:43 | path: | permanent link to this entry

Which Statutes Should we Know?
Q: Which statutes should we be prepared to carefully review the text of for this exam? I am under the impression that the statutes to deconstruct included the pen register statute, 1030, the SCA, and wiretap statute. Are these all that we should know the exact text of? or should we know where to find the exact text of CP statutes + economic espionage + etc as well?

A: You're technically responsible for all of the statutes we have studied in class. That said, you should use our classroom discussions as a rough guide for how deeply you need to know the statutes. We did spend a fair amount of time with the four statutes listed in the question.

posted at: 20:29 | path: | permanent link to this entry

Welcome.
Welcome to the student question and answer blog for Professor Ohm's 2009 Computer Crime course. During the exam period, I will post student questions with my answers on this page.

I am not posting every single student question. Instead, I am only posting student questions that I believe the class, as a whole, will benefit from hearing. Some questions are too basic to deserve attention. Other questions are too advanced and nuanced. So don't take it personally if your question doesn't appear here. (Do take it personally if I don't respond to one of your questions. I might have forgotten to get to it, so if you don't hear from me in a day or two, please ask again.)

posted at: 20:20 | path: | permanent link to this entry