Vulnerability Development: Re: Civil Disobedience

["Kevin L. Poulsen" <klp () securityfocus com>]

By way of an update, the Senate bill, and the House clone, both include as
terrorism offenses a much narrower range of computer crimes than what
Ashcroft wanted. To qualify, an intrusion or attack would have to cause one
of the following:

1) the modification or impairment, or potential modification or impairment,
of the medical examination, diagnosis, treatment, or care of 1 or more
individuals;
2) physical injury to any person;
3) a threat to public health or safety
4) damage affecting a computer system used by or for a Government entity in
furtherance of the administration of justice, national defense, or national
security;

Virus launchers will almost certainly qualify as terrorists, since every
successful virus or worm hits many dot-mil sites. And there's no telling how
"threat to public health or safety" will be interpreted. But the life
sentence is gone for these lesser terrorism offenses. Unless the attacker
actually physically harms someone, they won't face special penalties beyond
DNA sampling, civil forfeiture of assets under RICO, and a slightly longer
statute of limitations (eight years).

Kevin L. Poulsen
Editorial Director
SecurityFocus
650.655.6340