Cybersecurity law draws broad support

WASHINGTON, Feb. 12 (UPI) -- The computer industry and Justice Department lined up at a House hearing Tuesday to applaud legislation for increasing penalties for cybercrime and giving Internet Service Providers wider latitude in sharing information with law enforcement.

The House Judiciary Subcommittee on Crime discussed H.R. 3482, the Cyber Security Enhancement Act of 2001, sponsored by subcommittee chairman Rep. Lamar Smith, R-Texas. The recently passed Patriot Act addressed many technological aspects of fighting crime and terrorism, Smith said, but more needs to be done to protect the country's computer infrastructure.

"Bolstering our homeland defenses while neglecting cybersecurity is like locking the front door of your house but leaving the windows wide open," Smith said. "As a matter of national and economic security, we cannot afford to let technology be our weakest link."

H.R. 3482 calls for increased penalties for hacking crimes that cause damage of any sort. The bill also affords ISPs liability protection by lowering the "emergency" standard they must meet to voluntarily share information about possible imminent crimes with police agencies.

The Justice Department strongly supports the bill's goals, said John Malcolm, deputy assistant attorney general in the department's Criminal Division. The House should consider broadening increased penalties to cover unintentional but reckless actions, he said.

"Suppose a hacker shuts down a town's phone service (and) no 911 calls can go through," Malcolm said. "Although the hacker might not have known that his conduct would cause death or serious injury, such reckless conduct would seem to merit punishment greater than the 10 years permitted by the current statute."

Responding to a question from committee member Rep. Howard Coble, R-N.C., Malcolm said law enforcement agencies would be more likely to pursue cybercrime cases if stiffer punishment is involved.

Software giant Microsoft also is solidly behind the bill, said Susan Kelley Koeppen, an attorney with the company. Lawmakers should consider adding an equipment forfeiture penalty to H.R. 3482's hacker crimes, she said.

"The deterrent effect of expanded forfeiture for computer crime will be significant, particularly in the case of felons who attack cyber systems not for personal gain, but malicious effect," Koeppen said.

Other high-tech organizations, including the U.S. ISP Association, the Information Technology Association of America and the Association for Competitive Technology added their support for the bill's provisions.

Subcommittee member Rep. Bobby Scott, D-Vir., said the bill does well in avoiding some of the Patriot Act's heavy-handed law enforcement powers. The lowered info-sharing standard, however, is worrisome in that it could violate an individual's right to privacy, he said.

That view is shared by groups such as the Center for Democracy and Technology and the American Civil Liberties Union. Alan Davidson, the CDT's associate director, said most of the bill is fine, but the looser emergency disclosure rules could be easily misused.

"Providers are often approached by government agents and asked to voluntarily disclose communications ... for investigations the government claims involve a danger to life and limb," Davidson said. This activity completely circumvents necessary judicial oversight of law enforcement investigations, he said.

The ACLU also called for more protections against abuses of this provision.