From: ssteele@eff.org (Shari Steele) ***** FEEL FREE TO DISTRIBUTE WIDELY ***** On June 27, Senator Grassley (R-Iowa) introduced the Anti-Electronic Racketeering Act, S.974. The bill was designed "to prohibit certain acts involving the use of computers in the furtherance of crimes, and for other purposes." Its immediate effect, among other things, would be to criminalize the posting of any encryption software on any computer network that foreign nationals can access (in other words, any computer network period). Because of poor wording, the bill would probably also criminalize data compression and other non-cryptographic encoding schemes available on networks. This includes the compression used in most of the images on Internet user's WWW homepages, not to mention uu and binhex encoding for transferring binary files via email, and even language encoding used to represent non-English characters, such as the SJIS scheme for representing Japanese characters. In addition, the bill seems to be directed at undermining two big fights we've successfully waged in the past: the Steve Jackson Games decision against the United States Secret Service and the government's Clipper Chip proposal. Re: Steve Jackson Games -- this bill would permit the government to avoid the notice requirements of the Privacy Protection Act if "there is reason to believe that the immediate seizure of such materials is necessary to prevent the destruction or altercation [very Freudian sic!] of such documents." Furthermore, the government could use electronic evidence seized that had not been particularly described in a warrant if "the seizure is incidental to an otherwise valid seizure, and the government officer or employee- ''(A) was not aware that work product material was among the data seized; ''(B) upon actual discovery of the existence of work product materials, the government officer or employee took reasonable steps to protect the privacy interests recognized by this section, including- ''(i) using utility software to seek and identify electronically stored data that may be commingled or combined with non-work product material; and ''(ii) upon actual identification of such material, taking reasonable steps to protect the privacy of the material, including seeking a search warrant." Re: Clipper Chip -- The bill would make it a crime "to distribute computer software that encodes or encrypts electronic or digital communications to computer networks that the person distributing the software knows or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable." However, there is an exception: "It shall be an affirmative defense to prosecution under this section that the software at issue used a universal decoding device or program that was provided to the Department of Justice prior to the distribution." This is essentially an attempt to sneak the key "escrow" provisions of the Clipper scheme in through a legislative back door. Fortunately, the bill does not have a very promising future. The bill has no co-sponsors. It was immediately referred to the Committee on the Judiciary, where it currently sits. LEXIS's bill tracking report only gives it a 10% chance of passing out of the committee. I thought Senator Grassley's own statement when he introduced the bill is worth reading, so I'm attaching it here. My favorite line is "Elliott Ness needs to meet the Internet." This is especially ironic in light of recent comparisons of hysteria about "dangerous" material on the internet, and Prohibition. The bill itself follows. Shari ------------------------------------------------------------------------ Shari Steele, Director of Legal Services ssteele@eff.org Electronic Frontier Foundation 202/861-7700 (voice) 1667 K Street, N.W., Suite 801 202/861-1258 (fax) Washington, DC 20006-1605 202/861-1224 (BBS) ---------- Senator Grassley's Statement to the Senate ---------- Mr. President, I rise this evening to introduce the Anti-electronic Racketeering Act of 1995. This bill makes important changes to RICO and criminalizes deliberately using computer technology to engage in criminal activity. I believe this bill is a reasonable, measured and strong response to a growing problem. According to the computer emergency and response team at Carnegie-Mellon University, during 1994, about 40,000 computer users were attacked. Virus hacker, the FBI's national computer crime squad has investigated over 200 cases since 1991. So, computer crime is clearly on the rise. Mr. President, I suppose that some of this is just natural. Whenever man develops a new technology, that technology will be abused by some. And that is why I have introduced this bill. I believe we need to seriously reconsider the Federal Criminal Code with an eye toward modernizing existing statutes and creating new ones. In other words, Mr. President, Elliot Ness needs to meet the Internet. Mr. President, I sit on the Board of the Office of Technology Assessment. That Office has clearly indicated that organized crime has entered cyberspace in a big way. International drug cartels use computers to launder drug money and terrorists like the Oklahoma City bombers use computers to conspire to commit crimes. Computer fraud accounts for the loss of millions of dollars per year. And often times, there is little that can be done about this because the computer used to commit the crimes is located overseas. So, under my bill, overseas computer users who employ their computers to commit fraud in the United States would be fully subject to the Federal criminal laws. Also under my bill, Mr. President, the wire fraud statute which has been successfully used by prosecutors for many users, will be amended to make fraudulent schemes which use computers a crime. It is not enough to simply modernize the Criminal Code. We also have to reconsider many of the difficult procedural burdens that prosecutors must overcome. For instance, in the typical case, prosecutors must identify a location in order to get a wiretapping order. But in cyberspace, it is often impossible to determine the location. And so my bill corrects that so that if prosecutors cannot, with the exercise of effort, give the court a location, then those prosecutors can still get a wiretapping order. And for law enforcers-both State and Federal-who have seized a computer which contains both contraband or evidence and purely private material, I have created a good-faith standard so that law enforcers are not shackled by undue restrictions but will also be punished for bad faith. Mr. President, this brave new world of electronic communications and global computer networks holds much promise. But like almost anything, there is the potential for abuse and harm. That is why I urge my colleagues to support this bill and that is why I urge industry to support this bill. On a final note, I would say that we should not be too scared of technology. After all, we are still just people and right is still right and wrong is still wrong. Some things change and some things do not. All that my bill does is say you can't use computers to steal, to threaten others or conceal criminal conduct. Mr. President, I ask unanimous consent that the text of the bill be printed in the Record. There being no objection, the bill was ordered to be printed in the Record, as follows: S. 974 SECTION 1. SHORT TITLE. This Act may be cited as the ''Anti-Electronic Racketeering Act of 1995''. SEC. 2. PROHIBITED ACTIVITIES. (a) Definitions .-Section 1961(1) of title 18, United States Code, is amended- (1) by striking ''1343 (relating to wire fraud)'' and inserting ''1343 (relating to wire and computer fraud)''; (2) by striking ''that title'' and inserting ''this title''; (3) by striking ''or (E)'' and inserting ''(E)''; and (4) by inserting before the semicolon the following: ''or (F) any act that is indictable under section 1030, 1030A, or 1962(d)(2)''. (b) Use of Computer To Facilitate Racketeering Enterprise .-Section 1962 of title 18, United States Code, is amended- (1) by redesignating subsection (d) as subsection (e); and (2) by inserting after subsection (c) the following new subsection: ''(d) It shall be unlawful for any person- ''(1) to use any computer or computer network in furtherance of a racketeering activity (as defined in section 1961(1)); or ''(2) to damage or threaten to damage electronically or digitally stored data.''. (c) Criminal Penalties .-Section 1963(b) of title 18, United States Code, is amended- (1) by striking ''and'' at the end of paragraph (1); (2) by striking the period at the end of paragraph (2) and inserting ''; and''; and (3) by adding at the end the following new paragraph: ''(3) electronically or digitally stored data.''. (d) Civil Remedies .-Section 1964(c) of title 18, United States Code, is amended by striking ''his property or business''. [*S9181] (e) Use as Evidence of Intercepted Wire or Oral Communications .-Section 2515 of title 18, United States Code, is amended by inserting before the period at the end the following: '', unless the authority in possession of the intercepted communication attempted in good faith to comply with this chapter. If the United States or any State of the United States, or subdivision thereof, possesses a communication intercepted by a nongovernmental actor, without the knowledge of the United States, that State, or that subdivision, the communication may be introduced into evidence''. (f) Authorization for Interception of Wire, Oral, or Electronic Communications .-Section 2516(1) of title 18, United States Code, is amended- (1) by striking ''and'' at the end of paragraph (n); (2) by striking the period at the end of paragraph () and inserting ''; and''; and (3) by adding at the end the following new paragraph: ''(p) any violation of section 1962 of title 18.''. (g) Procedures for Interception .-Section 2518(4)(b) of title 18, United States Code, is amended by inserting before the semicolon the following: ''to the extent feasible''. (h) Computer Crimes .- (1) New prohibited activities .-Chapter 47 of title 18, United States Code, is amended by adding at the end the following new section: '' 1A1030A. Racketeering-related crimes involving computers ''(a) It shall be unlawful- ''(1) to use a computer or computer network to transfer unlicensed computer software, regardless of whether the transfer is performed for economic consideration; ''(2) to distribute computer software that encodes or encrypts electronic or digital communications to computer networks that the person distributing the software knows or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable; and ''(3) to use a computer or computer network to transmit a communication intended to conceal or hide the origin of money or other assets, tangible or intangible, that were derived from racketeering activity; and ''(4) to operate a computer or computer network primarily to facilitate racketeering activity or primarily to engage in conduct prohibited by Federal or State law. ''(b) For purposes of this section, each act of distributing software is considered a separate predicate act. Each instance in which nonexportable software is accessed by a foreign government, an agent of a foreign government, a foreign national, or an agent of a foreign national, shall be considered as a separate predicate act. ''(c) It shall be an affirmative defense to prosecution under this section that the software at issue used a universal decoding device or program that was provided to the Department of Justice prior to the distribution.''. (2) Clerical amendment .-The analysis at the beginning of chapter 47, United States Code, is amended by adding at the end the following new item: ''1030A. Racketeering-related crimes involving computers.''. (3) Jurisdiction and venue .-Section 1030 of title 18, United States Code, is amended by adding at the end the following new subsection: ''(g)(1)(A) Any act prohibited by this section that is committed using any computer, computer facility, or computer network that is physically located within the territorial jurisdiction of the United States shall be deemed to have been committed within the territorial jurisdiction of the United States. ''(B) Any action taken in furtherance of an act described in subparagraph (A) shall be deemed to have been committed in the territorial jurisdiction of the United States. ''(2) In any prosecution under this section involving acts deemed to be committed within the territorial jurisdiction of the United States under this subsection, venue shall be proper where the computer, computer facility, or computer network was physically situated at the time at least one of the wrongful acts was committed.''. (i) Wire and Computer Fraud .-Section 1343 of title 18, United States Code, is amended by striking ''or television communication'' and inserting ''television communication, or computer network or facility''. (j) Privacy Protection Act .-Section 101 of the Privacy Protection Act of 1980 (42 U.S.C. 2000aa) is amended- (1) in subsection (a)- (A) by striking ''or'' at the end of paragraph (1); (B) by striking the period at the end of paragraph (2) and inserting ''; or''; and (C) by adding at the end the following new paragraph: ''(3) there is reason to believe that the immediate seizure of such materials is necessary to prevent the destruction or altercation of such documents.''; and (2) in subsection (b)- (A) by striking ''or'' at the end of paragraph (3); (B) by striking the period at the end of paragraph (4) and inserting ''; or''; and (C) by adding at the end the following new paragraph: ''(5) in the case of electronically stored data, the seizure is incidental to an otherwise valid seizure, and the government officer or employee- ''(A) was not aware that work product material was among the data seized; ''(B) upon actual discovery of the existence of work product materials, the government officer or employee took reasonable steps to protect the privacy interests recognized by this section, including- ''(i) using utility software to seek and identify electronically stored data that may be commingled or combined with non-work product material; and ''(ii) upon actual identification of such material, taking reasonable steps to protect the privacy of the material, including seeking a search warrant.''.