March 12, 2003
The Honorable George E. Pataki
State Capitol
Albany, NY 12224

Dear Governor Pataki:

The Center for Democracy and Technology (CDT) and the Electronic Frontier Foundation (EFF), public interest organizations that seeks to promote civil liberties in the information age, write to express grave concerns about S. 1627, a bill that recently passed the New York Senate. In our view, S. 1627 so broadly defines the crime of "cyberterrorism" that even the most low-level, non-violent computer crime would become a serious felony if the bill were enacted into law. While we commend the State of New York for attempting to address the threat of cyberterrorism, we urge that this provision not be enacted as drafted, and that careful consideration be given to any future cyberterrorism legislation to ensure that political protesters are not treated as terrorists.

As drafted, S. 1627 would severely penalize petty crimes of a political nature, including online civil disobedience. S. 1627 makes any computer crime or "denial of service attack" a "cyberterrorism" crime (and therefore a serious felony) if committed "with the intent to .!.!. influence the policy of a unit of government by intimidation or coercion, or affect the conduct of a unit of government." If the goal of the legislation is to penalize more harshly the most serious computer attacks that cause physical harm or damage critical infrastructures, the provision is too broadly drafted to further that goal. As written, the legislation sweeps within the definition of "cyberterrorism" minor, politically motivated computer crimes. While prosecution of these petty crimes under current law is justified, there is no reason to treat the perpetrators of these non-violent crimes as terrorists.

For example, S. 1627 would treat as terrorist acts many "web defacements," where a website is entered without authorization and content is added, removed or replaced (but no permanent damage is done to the site). Web defacement, while justly illegal, is a non-violent civil disobedience tactic that often is intended precisely to "affect the conduct of a unit of government" - and would therefore become a terrorist felony if S. 1627 were enacted. (Under current law, the crime of web defacement is a class A misdemeanor.) In this respect, S. 1627 also raises serious constitutional concerns, as it would more severely punish politically motivated web defacements than those done for non-political reasons.

S. 1627 also would define as cyberterrorism a politically motivated "denial of service attack," which is currently not a state crime at all. A denial of service attack occurs when a network server is inundated with too much information for it to handle - either by email traffic or website hits - so that legitimate users cannot access the server. Like web defacements, denial of service attacks are commonly used as a form of civil disobedience - a kind of cyber "sit-in." Even a campaign that encourages citizens to send email to their elected officials could be characterized as a denial of service attack if it results in a large volume of email. It is nonsensical and likely unconstitutional to punish these attacks when made with an intent to "affect the conduct of a unit of government," yet not punish them at all when done for non-political reasons.

This bill is not effective cyberterrorism legislation. It does not distinguish between those engaging in petty crimes, and those whose aims are to seriously damage a computer network in order to cause physical harm to civilians, severe economic hardship, or the crippling of critical infrastructures. CDT and EFF believe that these complex issues deserve careful review and public hearings before legislation is enacted. We encourage the State of New York to combat cyberterrorism, but not to brand as "terrorists" those who commit minor illegal acts in cyberspace, just as those who commit civil disobedience offline are not punished as terrorists.

Sincerely,

Center for Democracy and Technology
1634 I Street NW, Suite 1100
Washington, DC 20006
www.cdt.org

Electronic Frontier Foundation
454 Shotwell Street
San Francisco, CA 94110
www.eff.org

cc: Senate Majority Leader Joseph L. Bruno
Assembly Speaker Sheldon Silver