Journalism is in double jeopardy. Last October, former National Security Agency (NSA) Director Gen. Keith Alexander gave an interview with the video arm of the Department of Defense in which he slammed reporters who disclosed once-top secret foreign and domestic surveillance programs with the help of a former government contractor gone rogue.
The interview took place four months after The Guardian newspaper exposed the NSA’s bulk telephone records program in which the agency collected data related to every phone call placed and received in the United States. The disclosure was made thanks to Edward Snowden, a former government contractor who contacted journalists at The Guardian and The Washington Post newspapers earlier in the year. It would be one of several stories based on thousands of documents Snowden took during his time at NSA contractor Booz Allen Hamilton that would help thrust the topic of government surveillance into the international spotlight.
Though government officials old and new did their best to assert that the programs were vital to the interests of national security (at least one White House empaneled focus group found that they weren’t), it wouldn’t take long before their frustrations bubbled to the surface. Alexander’s October interview was one such example.
“I think it’s wrong that newspaper reporters have all these documents … it just doesn’t make sense,” a visibly-agitated Alexander said in the Department of Defense video interview. “We ought to come up with a way of stopping it. I don’t know how to do that — that’s more [for] the courts and the policymakers — but, from my perspective, it’s wrong and to allow this to go on is wrong.”
Alexander, and others who have echoed similar sentiment, may soon get their wish thanks in part to an Obama administration-led initiative to toughen cybersecurity laws in the wake of several high-profile computer intrusions — notably, an unprecedented online attack against the computer network of Sony Pictures Entertainment this past Christmas.
Last week, the White House released a draft version of a proposed amendment to the Computer Fraud and Abuse Act, the federal anti-hacking law that makes it a crime to access a computer system without authorization.
Among other things, the Obama administration is proposing changing the law that would make it a crime for an individual or group to access “information” from a protected computer “that the accessor knows is not authorized by the computer owner.” It would also seek to incorporate computer crimes under federal anti-racketeering laws that would penalize individuals or groups who communicate or otherwise associate with computer hackers, and would give police the ability to seize computer hardware and other equipment under civil forfeiture laws from those accused of associating with such hackers, even if there’s little to no evidence to suggest a person had committed any crime.
Security experts warn that if such amendments were allowed to take effect, it could criminalize benign online activity. Things like re-tweeting a link to a dump of usernames and passwords or to a news article based on information leaked by hackers could be punishable by up to 10 years in prison if federal prosecutors chose to use the broad law to that advantage.
For journalists, the proposed amendments to the anti-hacking law could prove especially problematic. If enacted, federal prosecutors could charge reporters with computer crimes for merely obtaining documents taken without authorization from a government computer system by a whistleblower or for sifting through a vast quantity of data leaked online by hackers. Reporters covering the next Edward Snowden or Sony Pictures hack could suddenly find themselves facing decades in prison and hundreds of thousands of dollars in civil fines merely for doing their jobs.
If this sounds like empty rhetoric, consider that it has already happened at least once before. Two years ago, federal prosecutors charged journalist Barrett L. Brown with a litany of computer-related offenses. The chief accusation was that Brown violated the CFAA when he posted a link in a chat room to a trove of stolen data that someone else had published on the open Internet. Civil libertarians and journalism advocacy groups decried the charge, saying such a prosecution would have severe First Amendment implications. Prosecutors eventually dropped the charge, but only after securing different charges against Brown.
Under the proposed amendments, other journalists could find themselves in the crosshairs of federal prosecutors for publishing reports based on purportedly stolen information, especially if such reports proved unflattering to the government. Glenn Greenwald and Barton Gellman could be charged under the CFAA for advancing stories on secret surveillance programs based on documents Snowden took from government computers. Kevin Roose, Alexis Madrigal and Kashmir Hill could face felony racketeering charges for their reports on the hack of Sony Pictures Entertainment, which involved poring over a large amount of spreadsheets, e-mail and other data that hackers claimed to have taken from Sony’s corporate computer network. Under civil forfeiture laws, other journalists could have their computer equipment — from their laptops to their smartphones — seized by federal law enforcement merely for reporting on instances of computer hacking, even if there was no evidence that the reporter associated in any way with the subject of their story (the government has a history of civil forfeiture abuse).
Perhaps worse is that the Obama administration appears to be willfully ignoring calls to truly reform the CFAA, a 1980s-era law that many have argued is already too broad. The law received considerable attention two years ago following the death of Aaron Swartz, an online activist and computer savant who committed suicide after a Massachusetts prosecutor charged him with a string of federal offenses under the law. Like several others charged under the CFAA, Swartz was technically not accused of hacking anything — but prosecutors still attempted to use the anti-hacking law in order to secure a conviction, which would have imposed several months, if not years, of imprisonment along with up to $1 million in restitution and other civil fines.
The amendments proposed by the Obama administration last week do nothing to narrow the scope of the law so that it is used against those who commit serious acts of computer attacks. Instead, the amendments broaden the law, giving federal prosecutors the key to put many more people in Swartz’s position — including reporters whose only offense would be reporting the news.