Jump to content

User:Lbm67/sandbox

From Wikipedia, the free encyclopedia

The California Comprehensive Computer Data Abuse and Fraud Act (also known as "CCCDAFA" or "CDAFA" or "CDAF" or "§ 502") is codified in § 502 of the California Penal Code.[1] It was enacted in 1987, soon after the analogous federal Computer Fraud and Abuse Act ("CFAA"). The impetus for these statutes, and similar statutes in many other states, was a rise in computer crime and an increasing fear of hacking. The law itself states that "the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data."[2] The CCCDAFA, like the CFAA, expands liability for accessing and interfering with another's electronic data.[1] The Act broadly criminalizes "unauthorized computer access," which generally means the access of computer or data without permission.[3] It has been criticized for its breadth and potential to punish common and harmless behavior.[4]


Provisions

[edit]

Section 502(c) makes it a public offense to knowingly introduce a computer contaminant to any computer or computer system.[5] "Computer contaminant" is defined in Section(b)(12), and includes viruses and worms.

It is also an offense to knowingly, and without permission, commit any of the following acts:

  • Alter or use any data or computer system for fraudulent purposes[6]
  • Copy any data or supporting documentation within a computer system[7]
  • Use or disrupt, or cause to be used or disrupted, "computer services"[8]
  • Assist in providing access to a computer or computer system[9]
  • Use another's name or profile to send email that damages computer systems or data[10]
  • Cause disruption of government computer services[11]

Although all 50 states have computer hacking laws, only 19 states have laws that provide a civil right of action.[4][12] California became one of these 19 states in 2000, when it passed an amendment sponsored by eBay.[4] California later passed additional amendments that allow plaintiffs to recover punitive damages and attorneys' fees.[4] Any plaintiff who can show "damage or loss" can bring suit under the CDAFA, as the Act does not require a minimum amount of loss.[13]

Penalties

[edit]

Most activities under § 502 can be charged as either a misdemeanor or a felony. The penalty for a misdemeanor under the Act is jail time not exceeding one year and/or a fine not exceeding $5,000.[14] The penalty for a felony under the Act is imprisonment for 16-36 months and a fine not exceeding $10,000.[14]

Comparison to the federal Computer Fraud and Abuse Act:

[edit]

The California Act is seen as the state analog to the federal Computer Fraud and Abuse Act,[15] but there are several key differences. The federal CFAA only imposes liability when a defendant accesses a computer "without authorization."[16] Under California's Act, the computer access need not necessarily be unauthorized for the conduct to be considered unlawful. A defendant can be liable under the state Act just for "knowing" access to a computer if they subsequently use data from the computer without permission.[17] In other words, the CFAA prohibits unauthorized access, whereas the CDAFA prohibits unauthorized use, even if a defendant had authorization to access the computer.[18]

The federal and state acts also have different damages provisions. While the CFAA imposes a floor for the amount of damage required to incur liability, the CDAFA does not; any amount of damage is enough to state a claim under the CDAFA.[19]


Technical Access Barrier Rule

[edit]

The Technical Access Barrier Rule requires that, in order for computer access to count as "unauthorized," a defendant must circumvent some security measure (or "barrier to access").[4] The Northern District of California has invoked the Technical Access Barrier Rule in interpreting the CCCDAFA, but not in interpreting the CFAA.[4] While many advocates have argued that the Technical Access Barrier Rule should be a tool to constrain broad applications of these types of statutes, Michael Dorsi and Keenan Ng have argued that the rule has no such effect, because when a CCCDAFA claim is dismissed based on the Rule, CFAA claims are generally dismissed on some other ground, and when a CCCDAFA claim is "particularly egregious," courts will find a way to uphold the conviction regardless of technical barriers to access.[4]

The Technical Access Barrier Rule was initially introduced by the Northern District of California in a motion in the 2012 Facebook v. Power Ventures case.[4] The court applied the rule to the CCCDAFA, but did not consider whether it would apply to the CFAA.[20] After that order was issued, other cases in the Northern District followed its holding, requiring circumvention of a technical barrier in order to convict a defendant under the CCCDAFA.[4] Ultimately, the Facebook v. Power Ventures case was resolved on summary judgment for Facebook on CFAA grounds, so the Technical Access Barrier Rule was not considered by the Ninth Circuit.[4]


In 2013, a California state appellate court considered a situation where a defendant who had permission to access the City and County of San Francisco's computer network blocked the city from using it, without circumventing any security measures.[21] The court held that he had violated the CCCDAFA even though he had not hacked the network.[21]


Legislative History

[edit]

Before the enactment of the CCCDAFA, the 1979 version of Section 502 prohibited 1) accessing a computer system to intentionally commit fraud and 2) maliciously accessing or damaging a computer system.[22] Up until 1987, when the previous version of Section 502 was repealed and replaced with the CCCDAFA, accessing a computer was always "a key element of the offense."[21]

The initial version of the CCCDAFA, enacted in 1987, enumerated seven distinct crimes, and two more were added in 1989 and 1998.[21] The Act was drafted by the Computer Crime Task Force, a subcommittee of the Los Angeles County Criminal Justice Coordinating Committee, as Senate Bill 255.[23] The American Civil Liberties Union opposed the provision of bill that allowed law enforcement to seize a computer that had been used to in a crime because it was "tantamount to a bounty."[23]

The most recent amendment to the law was made in 2019, and clarified that the Act includes computers that are inside or connected to motor vehicles.[24]


Notable Cases:

[edit]

The following cases have considered the CCCDAFA and how it should be interpreted. The California Supreme Court has never interpreted the Act.[4]

  • Facebook v. Power Ventures (9th Cir. 2016)
    • Power Ventures scraped data from Facebook, and continued to do so after receiving a cease & desist letter from Facebook. It was a violation of the CDAFA to continue scraping data after receiving a cease & desist letter, because Power Ventures "knowingly accessed and without permission took, copied, and made use of Facebook’s data."[25] The Ninth Circuit held that Power Ventures' conduct violated the CFAA as well.[25]
  • United States v. Christensen (9th Cir. 2015)
    • The Ninth Circuit clarified that "access" includes logging onto a database with a valid password, and then using data from it without permission.[26] The court also held that the California CDAFA, unlike the federal CFAA, criminalizes knowing access, not just unauthorized access.[26]
  • People v. Tillotson (2007) 157 Cal.App.4th 517.
    • A California appellate court clarified that access, alone, to an unauthorized computer is not enough to violate the Act, because under § 502(c)(1), the defendant must knowingly access a computer system and, without permission, alter or use the data they obtain, and the purpose of the alteration or use is fraud or the like.[27]
  • People v. Lawton (1996) 48 Cal.App.4th Supp. 11.
    • In upholding a conviction under § 502(c)(7), the court held that the prohibitions in CCCDAFA apply to software as well as hardware.[28] Lawton had used the terminal on a public library computer to bypass basic security measures and access software that was not meant to be public.[28]
  • People v. Childs
    • Terry Childs was a network engineer for the Department of Telecommunications and Information Services of the City and County of San Francisco, and was responsible for creating the city's new fiber-optic wide area network.[21] Child's used his access to the network to block others from accessing the network, and was charged under § 502(c)(5). Childs argued that the Act was meant to apply to hackers, not to employees who were authorized to access computer systems. The court disagreed, and held that § 502(c)(5) applies to those who have authorized access to a computer system, but abuse that access.[21]
[edit]
  • Text of Section 502: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=502.&lawCode=PEN
  1. ^ a b Cal. Penal Code § 502
  2. ^ Cal. Penal Code § 502(a)
  3. ^ Cal. Penal Code § 502(c)
  4. ^ a b c d e f g h i j k Michael S. Dorsi & Keenan W. Ng, Computer Criminal Intent, 51 U.S.F. L. Rev. 469 (2017)
  5. ^ Cal. Penal Code § 502(c)(8, 14)
  6. ^ Cal. Penal Code § 502(c)(1)
  7. ^ Cal. Penal Code § 502(c)(2)
  8. ^ Cal. Penal Code § 502(c)(3, 5)
  9. ^ Cal. Penal Code § 502(c)(6)
  10. ^ Cal. Penal Code § 502(c)(9)
  11. ^ Cal. Penal Code § 502(c)(10)
  12. ^ Cal. Penal Code § 502(e)(1)
  13. ^ Cal. Penal Code § 502(e)
  14. ^ a b Cal. Penal Code § 502(d)(1)
  15. ^ Ticketmaster L.L.C. v. Prestige Entertainment West, 315 F.Supp.3d 1147, (C.D. Cal. 2018).
  16. ^ 18 U.S.C. § 1030(a)(5)(A)-(C)
  17. ^ See United States v. Christensen, 828 F.3d 763, 789 (9th Cir. 2015)
  18. ^ Synopsys, Inc. v. Ubiquiti Networks, Inc., 313 F.Supp.3d 1056 (N.D. Cal. 2018)
  19. ^ NovelPoster v. Javitch Canfield Group, N.D.Cal.2014, 140 F.Supp.3d 954
  20. ^ Facebook, Inc. v. Power Ventures, Inc., 844 F. Supp. 2d 1025 (N.D. Cal. 2012), aff'd in part, vacated in part, rev'd in part, 828 F.3d 1068 (9th Cir. 2016), and aff'd in part, vacated in part, rev'd in part, 844 F.3d 1058 (9th Cir. 2016)
  21. ^ a b c d e f Stats.1987, ch. 1499, §§ 2–3, pp. 5782–5786.
  22. ^ Stats. 1979, ch. 858, § 1, pp. 2968–2969, available at https://clerk.assembly.ca.gov/sites/clerk.assembly.ca.gov/files/archive/Statutes/1979/79Vol2.PDF#page=3
  23. ^ a b "Senate Committee Report on S.B. 255". Santa Clara Law Digital Commons. 1987.{{cite web}}: CS1 maint: url-status (link)
  24. ^ A.B. 814, An act to amend Section 502 of the Penal Code, relating to vehicles, June 26, 2019, available at https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201920200AB814
  25. ^ a b Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1069 (9th Cir. 2016)
  26. ^ a b United States v. Christensen, 801 F.3d 970, 994 (9th Cir.), opinion amended and superseded on denial of reh'g, 828 F.3d 763 (9th Cir. 2015)
  27. ^ People v. Tillotson, 157 Cal. App. 4th 517, 538 (2007)
  28. ^ a b People v. Lawton, 48 Cal. App. 4th Supp. 11, 15, 56 (Cal. App. Dep't Super. Ct. 1996)
Retrieved from "https://en.wikipedia.org/w/index.php?title=User:Lbm67/sandbox&oldid=947847289"