united-states california hacking cfaa
Malicious actions by individual moderators
<p>This is a follow up on a <a href="https://law.stackexchange.com/questions/79729/suit-for-excessive-moderarion">previous question.</a></p>
<p>Using Stack Exchange as a example, moderators should be able to destroy the site within minutes by automated means. There is no meaningful terms of service.</p>
<p>I am not talking about the site intentionally deleting itself as a policy, as Stack Exchange has no policies or rules that would stand in a court room. Just saying if one of the moderators — there are hundreds of them — or not even a moderator, just a individual user who hacked the site — did this, there's nothing in the terms of service saying &quot;you're not allowed to destroy our site.&quot; Again, it doesn't have to be a moderator, it could be a individual user, or anyone. There is nothing in the terms of service saying you will go to federal jail for destroying Stack Exchange.</p>
<p>Does this make it illegal? Even if it is illegal, how many mods, or just one, can just run an automated script in Java AWT and destroy the site in seconds or minutes?</p>

<h2>Yes, it's illegal.</h2>
<p><a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">18 USC 1030 (a) (5) (A)</a></p>
<blockquote>
<p>[Whoever]  knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section].</p>
</blockquote>
<p>&quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;.  Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts.</p>
<p>Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe.  It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it.  To use a firewall analogy, it's &quot;default deny&quot;.</p>
<p>&quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce.  Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers.</p>
<p>So your proposed attack would include all the elements of a violation of this section.  Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would.  Greater penalties are possible in certain circumstances.  Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)).</p>
<blockquote>
<p>There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange.</p>
</blockquote>
<p>Irrelevant.  It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison.  Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.</p>

<p>The relevant US statute is The Computer Fraud and Abuse Act of 1986 (CFAA), which has been codified at <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">18 U.S. Code § 1030</a></p>
<p>Section 1030 prohibits unauthorized access to a &quot;protected computer&quot; under any of several conditions, and also prohibits unauthorized obtaining of information from a &quot;protected computer&quot;.</p>
<p>Section 1030 (e)(2) defines &quot;protected computer&quot; The relevant part, (e)(2)(B) defines this as meaning a computer</p>
<blockquote>
<p>(e) (2) (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States</p>
</blockquote>
<p>That would surely include the computers whch host Stack Exchange.</p>
<p>The offenses relevant to this question would be subsectons (a)(5)(A), (a)(5)(B), and (a)(5)(C) which make it a crime for anyone to:</p>
<blockquote>
<ul>
<li><p>[(a)(5)(A)] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, <strong>intentionally causes damage without authorization</strong>, to a protected computer;</p>
</li>
<li><p>[(a)(5)(B)] intentionally accesses a protected computer without authorization, and as a result of such conduct, <strong>recklessly causes damage</strong>;</p>
</li>
<li><p>[(a)(5)(C)] intentionally accesses a protected computer without authorization, and as a result of such conduct, <strong>causes damage and loss</strong>.</p>
</li>
</ul>
</blockquote>
<p>At least one of these subsections would apply to any of the scenarios suggested in the question, or any similar scenario. In all such cases the person or persons would be acting without authorization, or in excess of any authorization such persons had (as no one has authorization to destroy the site), and such actions would cause damage and loss.</p>
<p>Subsection (c) provides the relevant penalties:</p>
<blockquote>
<p>(c) The punishment for an offense under subsection (a) or (b) of this section is—</p>
<p>...</p>
<p>(3)(A) a fine under this title or imprisonment for not more than five years, or both, in the case of an offense under subsection (a)(4) or (a)(7) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and</p>
<p>(3)(B) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(4), or (a)(7) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph;</p>
</blockquote>
<p>So such conduct would be punishable by imprisonment for up to 5 years, or up to 10 years for a repeat offender, as well as by a fine.</p>
<p>State laws might impose additional criminal liability.</p>
<p>In addition to criminal prosecution, section 1030 provides a right of private action under subsection (g) which provides:</p>
<blockquote>
<p>(g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses [5] (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware.</p>
</blockquote>
<p>Note that nothing in 18 USC § 1030 depends upon any &quot;Terms of Service&quot; document. The code section does depend on &quot;authorization&quot;. Subsection (e)(6) provides that:</p>
<blockquote>
<p>(6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;</p>
</blockquote>
<p>Subsection (e)(8) defines &quot;damage&quot;, and (e)(11) defines &quot;loss&quot;:</p>
<blockquote>
<p>(8) the term “damage” means any impairment to the integrity or availability of data, a program, a system, or information;</p>
<p>...</p>
<p>(11) the term “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service;</p>
</blockquote>
<p>In addition, although I know nothing specific about the internal design of Stack Exchange, I would be astounded to learn that it does not include a robust backup system, so the idea that a rogue moderator or hacker could &quot;destroy the site&quot; so that it could not be put fully back online in a fairly short period of time is impluasible at best.</p>
<p>I suspect that the SE servers also include code that will detect and stop or pause widespread unauthorized deletion, but that is just a guess.</p>
<p>In an case, neither backups nor internal protections depend on any provision in any TOS document. Nor do the various criminal statutes.</p>
