Jennifer Granick, a criminal defence attorney based in San Francisco and considered by many as one of the US`s leading experts in cyber law issues, opened the second day of the 27th annual security conference in Chicago yesterday.
Her talk was titled "Hacking: Criminal law is not the answer".
"As a criminal defence attorney who defends hackers accused of illegal activities, you may consider me to be more lenient on crime than most people," said Granick. "However, we do have a common interest: the security of the network."
[...] the client mentioned that he had `cut and pasted` something. The judge interrupted and asked: `Did you use scissors?`
Jennifer Granick, criminal defence attorney, San Francisco
She listed two main methods of protecting information on the network. "Firstly we use technology. Here I mean firewalls and various computer programs.
"Secondly, we rely on the law. Law is the realm in which we as a society try to resolve our most difficult social problems. Courts are often the final arbitrators for sticky issues such as euthanasia. I have a problem with our heavy reliance on the law when it comes to computer security."
Granick said the law moves too slowly and technology changes so quickly that the law has no chance to keep up. Also judges often don`t understand the technology or the issues.
"I had a client recently who was accused of crashing a Web site. During the defence the client mentioned that he had `cut and pasted` something. The judge interrupted and asked: `Did you use scissors?` I had no idea how far behind us this specific judge was.
Clarity
"I believe legal solutions often do more to hurt security than to help it. At the moment there is no guidance about how to conform. The law lacks clarity.
"I believe there are three things that need to be present for the law to work: social consensus, it must be clearly written, and it must be evenly applied. Otherwise we will have detrimental consequences. With over-zealous prosecution, computer security development and research will suffer.
"I believe the solution is that the computer community has to get together and decide on the industry`s values. The people in the industry are the ones who know what works. Then take this to the legislators. The legal system can help computer security, but it is also the responsibility of the industry to help legislators."
Share
