Although Mitnick claims he hacked with "ethics" - that he never stole, caused damage or profited from his practices- not all hackers adhere to these principles. And as computers become more and more common, so are incidents of hacking and other computer-related crimes. Computer crime, also known as cybercrime, includes such activities as hacking, virus creation and distribution, forgery, theft and denial of access. Computes have essentially unlocked the gates to a new era in lawbreaking. Due to technological advances, crimes are committed today that could not have existed a decade ago and the traditional crimes are being made easier. Michael A. Vatis, Director of the National Information Infrastructure Protection Center, notes: "Whether we like it or not, cybercrime presents the most fundamental challenge for law enforcement in the 21st Century. By its very nature, the cyber environment is border-less, affords easy anonymity and methods of concealment to bad actors, and provides new tools to engage in criminal activity". The unique nature of computer crime has caused a debate among law enforcement experts. Some believe that cybercrime is just a conventional crime committed with high-tech devices. Others argue, however, that cybercrime is a totally new phenomenon that, in order to be dealt with effectively, requires new law enforcement techniques and new legislation.

• To knowingly access a computer without authorization, or in excess of authorization, in order to obtain classified United States defense or foreign relations information with the intent to harm the United States or benefit a foreign nation.
• To obtain information, via unauthorized access, from the financial records of a financial institution or from any protected computer if the conduct involves interstate or foreign communication.
• To access a computer to use, destroy, modify, or disclose information found in a "federal interest" computer system, as well as to prevent authorized use of any computer used for government business if the usage interferes with government activities.
• To knowingly and with the intent to defraud participate in the trafficking of passwords or similar information through which computers can be accessed without authorization.

The history of the Computer Fraud and Abuse Act illustrates the complexity of cybercrime legislation. The first person charged with violating the Computer Fraud and Abuse Act was Robert T. Morris Jr., author of the first computer virus. Morris was charged with releasing a "worm" that, according to Morris, unintentionally caused harm to many government and university computers. The legal language applied in the case was to someone who:

The District Court in the Morris case interpreted the law as only requiring the intent to access a computer, not the intent to cause actual damage, and thus Morris was convicted. Morris' lawyer, Thomas Guidoboni, described the Computer Fraud and Abuse Act of 1986 as "perilously vague" because it treated well-intended intruders just as harshly as it treated ill-intended intruders.

As a result of this and other gaps in the legislation, the Computer Fraud and Abuse Act has since been amended. The most notable amendments occurred in October of 1996 with the enactment of the National Information Infrastructure Protection Act. Listed below are some of the changes made to the legal code:

• The phrase"[I]ntentionally accesses a Federal interest computer" has been substituted by the clause "through means of a computer used in interstate commerce or communications, knowingly causes the transmission of a program, information, code, or command to a computer or computer system…"
• In order to broaden coverage of the law, "Federal interest computer" has been replaced with the term "protected computer".
• The intentional accessing of a protected computer that recklessly causes damage has been added as an offense. This applies to people like Robert Morris who intentionally let a virus loose, though not necessarily with malicious intent.

The Computer Fraud and Abuse Act has become a landmark in the fight against cybercrime. The Act provided a single piece of code that specifically addressed computer-related offenses, thus eliminating the need to rely on legislation written for other crimes which often proved inadequate when applied to computer activity. For example, the statute pertains to interstate transportation of stolen property, 18 U.S.C. § 2314, applies to "goods, wares and merchandise," and thus has been held by several courts not to apply to intangible property such as stolen data. The existence of the Computer Fraud and Abuse Act also means that when new computer technology is introduced, instead of having to scan through the entire United States Code amending every statute potentially affected, law makers can focus on essential amendments to only this legislation.

Computer Viruses and the Law   [Top]
A computer virus crime usually involves the intent to cause damage through the creation and/or distribution of a destructive computer program. The legislation most applicable to computer viruses is just general cybercrime legislation. In the United States, the distribution of a virus that affects computers used by government or by financial institutions is a federal crime under the Computer Fraud and Abuse Act. In addition to the Morris computer worm case, there have been other successes. In December of 1999, David L. Smith pleaded guilty to creating and distributing the "Melissa" virus that caused more than $80 million in damage. Smith faces a maximum sentence of five years in prison and a $250,000 fine. The "Melissa" virus was so devastating and widespread that it affected both computers belonging to individuals and those belonging to the government. This is not always the case. Thus, since federal legislation is primarily concerned with "federal interest" computers, local statutes tend to be stricter when dealing with personal computers.

As evident, the legal implications of computer viruses are not well defined. The laws pertaining to computer viruses change from state to state and from country to country. In many countries the writing of viruses is not an offence in itself. In others even the sharing of virus code between anti-virus researchers could potentially be considered an offense. To make matters more complicated, once a virus is released it is free to cross state lines and national borders, making the author or distributor of the virus accountable for his or her action under a very different legal system. For a list of the anti-virus and cybercrime laws available in US states and other countries see http://vx.netlux.org/texts/laws/laws.htm.

The newsgroup alt.comp.virus provides the following list of the grounds on which virus creation or distribution may be found to be illegal: