WE DON'T NEED A SECRET NEW "CYBER COURT" FOR HACKERS:
Why The Gilmore Commission's Recent Proposal Should Be Rejected
By ANITA RAMASASTRY
Imagine this headline: "Cybercourt: Coming to a town near you." Does it sounds like a science fiction novel? A television series perhaps a "Dark Angel" spinoff? Or maybe a new Arnold Schwarzenegger film?
Unfortunately, the cyber court, far from being fiction, may become reality and quite soon. This past week, a government anti-terrorism commission recommended the establishment of a new "cyber court" to prosecute hackers. The recommendation was, in part, a response to the September 11 terrorist attacks.
Governor James Gilmore (R-Virginia), the commission's chairman, asserted that the reason a new court must be created is that currently judges are not moving fast enough to provide law enforcement with warrants in investigations of online crime.
However, rather than proposing that federal and state judges receive more training or resources to speed the issuance of warrants, Gilmore has recommended the creation of a new "cyber court," which will be vested with special powers of search and surveillance and which will likely conduct its proceedings in secret.
We do not need a new cyber court and we especially do not need such a court to conduct its proceedings under the cloak of secrecy.
Protecting Cyberspace But Not With a Secret "Star Chamber"
In a press release issued by the House Science Committee, Gilmore argued, "Whether the threat manifests itself in the form of a physical attack against computer hardware and real property that houses critical portions of the Nation's Internet backbone, or in the form of a cyber attack against computer software and the Internet controls, America's cyberspace needs protection."
Cyberspace may need protection now more than ever but it should not be in the form of a secret star chamber. The Gilmore Commission has proffered few details on the so-called cyber court, but we do know that the court would be styled after the Foreign Intelligence Surveillance Act court a secret court made up of a rotating membership of U.S. federal district court judges.
The FISA court has long been criticized by civil liberties groups for being a secret court that meets behind closed doors. It was set up to deal with government surveillance for counterintelligence purposes. The FISA court does not observe traditional Fourth Amendment protections.
FISA judges review the Justice Department's requests for electronic surveillance, or for physical searches, of persons who are allegedly threats to national security. To date, save for a couple of cases, the court has always approved the Justice Department's requests.
Because the court conducts its proceedings entirely in secret, the defendant may never even know that the government has searched his home or tapped his phone. The surveillance orders granted, and the reasons why they were granted, are classified and kept secret from the defendant unless he or she succeeds in getting the trial judge to release them. This is a rare and, indeed, almost unheard of event.
Even more surprising is the fact that the evidence collected as a result of FISA court authorization can be used in a later criminal prosecution. Indeed, the party whose privacy was compromised is never informed that surveillance or a search at the FISA court's behest even occurred unless and until there is a later criminal prosecution.
In such prosecutions, the target of FISA surveillance cannot obtain discovery of the FISA court order application because it is secret, and therefore cannot effectively challenge a search or wiretap conducted illegally.
FISA court procedures should not be imported into the cyber court. These procedures have been oppressive enough in the limited context to which they have so far been confined. And FISA court procedures will likely get worse before they get better: Anti-terrorism legislation currently before Congress may erode some of the few protections included in the FISA itself.
Specialized Courts Are Not Always Necessary
We should also ask whether we truly need a separate "cyber court" in the first place. Although we criticize judges for not being specialists or experts in any number of fields, the law and courts have endured.
Courts have grappled with technological change for centuries from the creation of railroads, to the advent of modern telecommunications, and now the rise of the Internet. Judges are able to apply existing legal rules to new technological developments. The Fourth amendment is resilient and judges have been able to apply it in cases involving devices as varied as global positioning satellite devices and infrared heat sensors.
Specialized courts should not be the solution for many of our problems. While arson is a serious crime and arson investigations are difficult and complex, we have not created a special court for arson crimes. Nor have we created a special court to prosecute militia groups, money launderers or terrorists.
Most Cyber Crime Can Be Investigated Under Normal Procedures
Governor Gilmore states that "[a] court dedicated to criminal cyber conduct can develop the needed expertise to act appropriately on investigative activities while ensuring the protection of civil rights and liberties." But if the FISA court is the model, as the legislation suggests, that simply will not be true; civil liberties will not be protected.
The differences between typical federal and state court procedures, as opposed to FISA court procedures, are very significant. When a warrant is issued by a federal or state court, rather than the FISA court, civil liberties are respected to a far greater degree.
Under typical court procedure, for example, a defendant whose home is searched or conversations "seized" (through wiretapping or taping) under the government's normal criminal investigative authority can obtain a copy of the warrant or application for a court order. He or she can also challenge the search if there are defects such as Fourth Amendment violations. As discussed above, FISA court procedures are very different.
The ordinary procedural model should be sufficient for many types of cyber crime. For example, to the extent that a court will be approving government search and surveillance for the sole purpose of criminal prosecution rather than deterrence or the protection of public safety it seems sensible to require that the government have probable cause before obtaining permission to monitor the computer activity of a suspect.
Hackers as Cyberterrorists?
But what about cases that implicate national security, including cases that implicate possible acts of terrorism? The FISA Court already exists to address such matters. Thus, September 11's tragedy should not continue to be used as a justification for the creation of a secret cyber court. Rather, the type of issues raised by September 11 can be addressed by the existing FISA court.
While hacking is a serious crime, not all hacking is "cyberterrorism." Rather, there is a broad range of criminal trespass activity that falls under the label "hacking," Web site defacement by so-called script kiddies is a far cry from a wide scale denial of service attack masterminded by a rogue nation with an intent to destabilize our government.
The former can be addressed by state and federal courts according to normal procedures; the latter can be addressed by the FISA court. Again, there is no need for a new, secret court that deals with all cyber crime issues.
Some drafts of the anti-terrorism legislation that have been making their way through Congress have included life prison sentences for hackers. Those life sentences should, at a minimum, be confined to the more serious varieties of hacking those that are truly tantamount to terrorism.
Under certain circumstances, the penetration and destruction of computer networks and infrastructure may constitute a virtual act of terrorism akin to some of the physical sabotage that occurred on September 11. It is important, however, to carefully discuss and debate what types of computer offenses are deserving of more serious punishment and of the "virtual terrorism" or "cyber terrorism" labels.
Governor Gilmore is right when he calls for greater attention to be paid to computer security in the United States, and warns us of the potential threat of cyber terrorism. But before we create another court, we need to first define the scope of the problem and then work to see if existing institutions can be utilized to remedy the situation.