FindLaw Forum: We don't need a secret new 'cyber court' for hackers By Anita Ramasastry FindLaw Columnist Special to CNN.com

	FINDLAW
Legal commentary from FindLaw's Writ Web Guide Consumer Center Select a topic Bankruptcy Discrimination Divorce Estate Planning Landlord-Tenant Personal Injury Taxes Law Dictionary
FINDLAW Column Archive

(FindLaw) -- Imagine this headline: "Cyber Court: Coming to a town near you." Does it sounds like a science fiction novel? A television series -- perhaps a "Dark Angel" spin-off? Or maybe a new Arnold Schwarzenegger film?

Unfortunately, the cyber court, far from being fiction, may become reality -- and quite soon. Earlier in October, a government anti-terrorism commission recommended the establishment of a new "cyber court" to prosecute hackers. The recommendation was, in part, a response to the September 11 terrorist attacks.

Gov. James Gilmore (R-Virginia), the commission's chairman, asserted that the reason a new court must be created is that currently judges are not moving fast enough to provide law enforcement with warrants in investigations of online crime.

However, rather than proposing that federal and state judges receive more training or resources to speed the issuance of warrants, Gilmore has recommended the creation of a new "cyber court," which will be vested with special powers of search and surveillance and which will likely conduct its proceedings in secret.

We do not need a new cyber court, and we especially do not need such a court to conduct its proceedings under the cloak of secrecy.

Protecting cyberspace -- but not with a secret 'star chamber'

In a press release issued by the House Science Committee, Gilmore argued: "Whether the threat manifests itself in the form of a physical attack against computer hardware and real property that houses critical portions of the nation's Internet backbone, or in the form of a cyber attack against computer software and the Internet controls, America's cyberspace needs protection."

Cyberspace may need protection -- now more than ever -- but it should not be in the form of a secret star chamber. The Gilmore Commission has proffered few details on the so-called cyber court, but we do know that the court would be styled after the Foreign Intelligence Surveillance Act (FISA) court -- a secret court made up of a rotating membership of U.S. federal district court judges.

The FISA court has long been criticized by civil liberties groups for being a secret court that meets behind closed doors. It was set up to deal with government surveillance for counterintelligence purposes. The FISA court does not observe traditional Fourth Amendment protections.

FISA judges review the Justice Department's requests for electronic surveillance, or for physical searches, of persons who are allegedly threats to national security. To date, save for a couple of cases, the court has always approved the Justice Department's requests.

Because the court conducts its proceedings in secret, the defendant may never even know that the government has searched his home or tapped his phone. The surveillance orders granted, and the reasons why they were granted, are classified and kept secret from the defendant unless he or she succeeds in getting the trial judge to release them. This is a rare and, indeed, almost unheard of event.

Even more surprising is the fact that the evidence collected as a result of FISA court authorization can be used in a later criminal prosecution. Indeed, the party whose privacy was compromised is never informed that surveillance or a search at the FISA court's behest even occurred unless and until there is a later criminal prosecution.

In such prosecutions, the target of FISA surveillance cannot obtain discovery of the FISA court order application because it is secret, and therefore cannot effectively challenge a search or wiretap conducted illegally.

FISA court procedures should not be imported into the cyber court. These procedures have been oppressive enough in the limited context to which they have so far been confined. And FISA court procedures will likely get worse before they get better: Anti-terrorism legislation currently before Congress may erode some of the few protections included in the FISA itself.

Specialized courts are not always necessary

We should also ask whether we truly need a separate "cyber court" in the first place. Although we criticize judges for not being specialists or experts in any number of fields, the law and courts have endured.

Courts have grappled with technological change for centuries - from the creation of railroads, to the advent of modern telecommunications, and now the rise of the Internet. Judges are able to apply existing legal rules to new technological developments. The Fourth Amendment is resilient and judges have been able to apply it in cases involving devices as varied as global positioning satellite devices and infrared heat sensors.

Specialized courts should not be the solution for many of our problems. While arson is a serious crime and arson investigations are difficult and complex, we have not created a special court for arson crimes. Nor have we created a special court to prosecute militia groups, money launderers or terrorists.

Most cyber crime can be investigated under normal procedures

Gov. Gilmore states that "[a] court dedicated to criminal cyber conduct can develop the needed expertise to act appropriately on investigative activities while ensuring the protection of civil rights and liberties." But if the FISA court is the model, as the legislation suggests, that simply will not be true; civil liberties will not be protected.

The differences between typical federal and state court procedures, as opposed to FISA court procedures, are very significant. When a federal or state court, rather than the FISA court, issues a warrant, civil liberties are respected to a far greater degree.

Under typical court procedure, for example, a defendant whose home is searched or conversations "seized" (through wiretapping or taping) under the government's normal criminal investigative authority can obtain a copy of the warrant or application for a court order. He or she can also challenge the search if there are defects - such as Fourth Amendment violations. As discussed above, FISA court procedures are very different.

The ordinary procedural model should be sufficient for many types of cyber crime. For example, to the extent that a court will be approving government search and surveillance for the sole purpose of criminal prosecution - rather than deterrence or the protection of public safety - it seems sensible to require that the government have probable cause before obtaining permission to monitor the computer activity of a suspect.

Hackers as cyber-terrorists?

But what about cases that implicate national security, including cases that implicate possible acts of terrorism? The FISA court already exists to address such matters. Thus, September 11's tragedy should not continue to be used as a justification for the creation of a secret cyber court. Rather, the existing FISA court can address the type of issues raised by September 11.

While hacking is a serious crime, not all hacking is "cyber terrorism." Rather, there is a broad range of criminal trespass activity that falls under the label "hacking," Web site defacement by so-called script kiddies is a far cry from a wide scale denial of service attack masterminded by a rogue nation with an intent to destabilize our government.

State and federal courts according to normal procedures can address the former; the FISA court can address the latter. Again, there is no need for a new, secret court that deals with all cyber crime issues.

Some drafts of the anti-terrorism legislation that have been making their way through Congress have included life prison sentences for hackers. Those life sentences should, at a minimum, be confined to the more serious varieties of hacking - those that are truly tantamount to terrorism.

Under certain circumstances, the penetration and destruction of computer networks and infrastructure may constitute a virtual act of terrorism akin to some of the physical sabotage that occurred on September 11. It is important, however, to carefully discuss and debate what types of computer offenses are deserving of more serious punishment and of the "virtual terrorism" or "cyber terrorism" labels.

Gov. Gilmore is right when he calls for greater attention to be paid to computer security in the United States, and warns us of the potential threat of cyber terrorism. But before we create another court, we need to first define the scope of the problem and then work to see if existing institutions can be utilized to remedy the situation.

Anita Ramasastry is an assistant professor of law at the University of Washington School of Law in Seattle, Washington, and the associate director of the Shidler Center for Law, Commerce & Technology.

---

Copyright © 1994-2001 FindLaw. Printed with permission from FindLaw