DOJ Pledges Not to Charge Security Researchers With Crimes
The act has undergone a number of amendments over the last few decades, but a general sense of anxiety persists. Smartphone users worry that violating any sliver of an app’s terms of service (ToS) could subject them to hefty fines, while cybersecurity researchers must investigate vulnerabilities with great caution for fear of breaking one of the CFAA’s poorly-worded rules. Even the Supreme Court has pushed the Department of Justice (DOJ) to narrow the CFAA’s scope. Now the DOJ has attempted to assuage these concerns by issuing a revised policy meant to protect everyday internet users and researchers.
Announced late last week, the policy outlines a number of factors the DOJ will use going forward to determine whether to pursue prosecution. Most of the factors relate to how likely the unauthorized or unconstrained access is to cause actual harm, particularly to “national security, critical infrastructure, public health and safety, market integrity, international relations, or other considerations having a broad or significant impact on national or economic interests.” If that risk is low and the access doesn’t appear to be related to a larger criminal threat, the DOJ is unlikely to prosecute. The DOJ is also explicitly advised to decline prosecution if the access is related to “good faith security research” of a security flaw or vulnerability. Of course, “good faith” means the researcher intends to report or fix the vulnerability; those hoping to exploit the security flaw aren’t protected here.
The DOJ’s document illustrates its point with real-life examples of acts it won’t prosecute. Even if a person’s employer issues them an employee computer for work use only, the DOJ won’t consider it a violation for the employee to use that computer to pay bills or look up sports scores. The agency won’t come after those who create fictional accounts on hiring or housing websites, nor will it target those who use pseudonyms on social networks that prohibit it. And as The Verge pointed out, lying on Tinder can no longer be considered a crime under the CFAA—while that sounds like a joke to most, the recent Tinder Swindler craze has shown us it has real effects, however rare or far-fetched those may be.
Few policy revisions are perfect, though; look to the DOJ’s fifth consideration, which states the agency may prosecute if it feels the need to deter others from conducting similar access. This could mean anything, even if the policy revision says this factor includes (but is not limited to) “new” areas of criminal activity or access techniques. But overall, this revision should signal a sigh of relief—even just for those of us who were looking forward to the next season of Catfish.
Continue reading
It’s Finally Illegal for ISPs to Charge Rental Fees for Equipment You Own
A new law went into effect on Sunday that prevents your ISP from making equipment rental fees mandatory.
Xiaomi Says Its New Product Can Charge a Phone From Across the Room
The company's Mi Air Charge technology can allegedly charge your phone from a distance even while it's in your pocket. Or so they claim — we don't know for sure because Mi Air Charge is just a tech demo right now.
Epic’s New MetaHuman Creator Generates Digital Characters that Avoid the Uncanny Valley
The company's new MetaHuman engine promises to deliver photorealistic digital characters in a snap, and you can check out a demo right now.
Apple Might Bring Wireless Charging to the Next iPad Pro
The next iPad Pro refresh could feature wireless charging and a glass back panel, says Bloomberg's Mark Gurman.