EFF Seeks CFAA Update, Citing Possibility of 25-Year Sentence for Convicted Journalist

prison is another reason that updating the federal anti-hacking statute is "long overdue." Keys provided the content management system username and password to the hacktivist group Anonymous in an online chat room and an individual used those credentials to make "some relatively silly changes" to a Los Angeles Times story, amounting to "vandalism," said EFF in a Wednesday blog post. The federal government charged Keys with three felony violations under CFAA, including "conspiracy to cause damage to a protected computer, transmission of computer code that resulted in unauthorized damage, and attempted transmission of malicious code to cause unauthorized damage." His sentencing is scheduled for Jan. 20. EFF acknowledged the government may seek a five-year sentence but said many prosecutors and judges use the maximum punishment to indicate a crime's severity and also to put pressure on defendants to plea bargain or settle. The amount of damages claimed under CFAA could also result in a longer prison sentence, said EFF, saying the government said Tribune incurred nearly $930,000 in losses based on the 40 minutes that the vandalized article was posted. "How much of the claimed 'damages' are actually the result of 'hacking' and how much are part of an attempt to ratchet up loss to ensure a felony CFAA conviction?" asked EFF. It cited a 2nd U.S. Circuit Court of Appeals ruling (see 1512040036) in a different case that CFAA doesn't apply to violations of employer-imposed use restrictions. EFF also said the Keys case "is an illustration of prosecutorial discretion run amok."