Could You Indict a Computer? I would have thought this would've been asked already, but I searched this site and the Internet, and I couldn't find anything. Apologies if this is a duplicate. As computers become increasingly autonomous, there have already been a handful of incidents where computers have done things that would be criminal for a person to do. For example, a self-driving car killed a pedestrian, and a Twitter bot made a death threat. Moreover, both of these computers were essentially operating under their own decision-making processes and were not directly controlled by any human. Could it be possible for prosecutors to file criminal charges against a computer? Is there some standard of sentience that the computer would have to achieve in order to indict it? (United States)
First, I will make a distinction of terminology. A computer is hardware, like, a calculator. Hardware doesn't make choices or decisions. Its response to any input or occurrence is dictated by the code it is running (barring misfunction). It's behavior to a given input is generally static or in set in a pre-specified pattern (e.g. press a button, show 1+the last number shown). However, it often responds to an input by giving inputs to a program, and then following its instructions (like a car, responding to a driver's input of pressing the accelerator peddle by speeding up). A program is software. Software and its behavior can be edited, and can even alter its own behavior (see the topics of &quot;machine learning&quot; and &quot;artificial intelligence&quot;, and note that in real life they are actually quite different from how they are commonly portrayed in fiction, much like law). With regards to a computer, technically it could be targeted directly by legal action today under the rule &quot;civil asset forfeiture&quot;. However, in general a computer is a merely a location where programs are stored and run, and so are unlikely to be indictable in the traditional sense, in the same way that one would usually not be able to indict a field or building. Potentially, a program could be indicted, if a law was passed indicating that programs or classes of programs are legally considered persons. Note that either this only apply to programs that can pass some series of thresholds or would have massive additional effects because programs would then be full persons, under the law; so you wouldn't be able to buy, sell or license property (due to slavery laws), nor shut down computers (because doing so would &quot;kill&quot; the programs that are stored there (in the same way one can't burn down a building where people are living), nor alter programs without their consent (analogous to medical procedures).
Surely such a well meaning albeit naive driver wouldn't stand a chance in court if they said that it's because they've a section 230-like protection. Because Section 230 of the Communications Decency Act explicitly protects computer service providers from such charges. A driver is not a computer service provider, and the US legislature has never voted to offer similar protection to drivers picking up hitchhikers. You say that an email can easily be classified as fraudulent, but that's not true. Spam detection has gotten pretty sophisticated, but they still get plenty of false positives. They were a lot less sophisticated back in 1996 when the Communications Decency Act was passed.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
What exactly would a prosecutor charge? State? Federal? It depends on whether it is a state or federal prosecutor. It appears that the president has at least flirted with violating both federal and state law, in which case he may be charged by both the federal and state prosecutors, each one laying charges under the relevant body of law. Would Trump be vulnerable to Federal prosecution of the phone call after he leaves office? Yes, if the facts support such a prosecution. It's not clear to me that the conversation constituted an unambiguous violation of the federal statute, but I have no knowledge of any precedent that might inform such a determination.
If the victim is unable to prove who the culprit was, then it will be impossible to prosecute that person criminally or sue them for civil damages. Incidents like these are rarely enough to cause a police department to throw sufficient investigative resources at it to crack the case without some reason to believe that it is part of something bigger. An unfortunate fact of life is that most perpetrators of crimes and torts get away with it and are not caught. And, if the only available witness is willing to lie to cover up the name of the guilty party (probably out of a desire to not have the dog put down), it is that much harder. A private investigator might be able to solve the case, but the cost of hiring a PI would probably exceed the benefit that could be obtained if the PI was successful.
It's naive to assume a college age hacker (or a hacker who bases his/her attacks from an academic institution) is treated differently than a "real" hacker, whatever a real hacker might be. The sentence any convicted hacker receives depends on many factors: the prosecutor, the evidence, veracity of witnesses, jurisdiction (academic or not), previous criminal records, the actual laws the person is being charged under, the judge, the jury, the lawyers, plea bargains, media coverage, etc. There are so many factors that the outcomes of the prosecutions of "hacking" crimes can be very different, re: your examples. Read about each case and you'll find many differences. Academic fraud or any form of fraud are completely different crimes. Hackers can commit fraud, but not all fraud involves hacking. Being convicted of fraud can sometimes happen if the evidence for a hacking charge is weak, or other factors. Again, that involves the specific case, the prosecutor, laws, the evidence, etc.
Yes a company can be sued (since anyone can sue anyone). But in order to win a lawsuit, you have to have damages as a result of some action, AND you must prove that the action was done with intent to harm or was otherwise negligent. So following your website example, a lot of things would have to happen: The website would have to be hacked. If the passwords are encrypted instead of hashed (which still qualifies as "plain-text" once they email it to you), the hacker would have to figure out how to decrypt the passwords. (Which a good hacker could probably do.) The hacker would have to take those passwords and do something with them that causes damage to their owners. Even if all of those things happened, you would still also have to prove negligence on their part which would be pretty difficult to do because the flaw that was hacked would be the focus of negligence discussions moreso than what was stolen. That being said, if your goal is simply to get them to fix the problem, rather than receive monetary damages, then you could still sue for an action to be taken. You'd have to pay by the hour for the attorney since they wouldn't have a chance of winning monetary damages. But in all likelihood the website owner, upon seeing the lawsuit, would fix the problem before it gets to court, so I could see that having the desired effect. That is if you think it's worth the cost of filing the lawsuit in the first place. Perhaps you could save yourself the cost of an attorney and just threaten to sue if they don't fix the problem.
I interpret the sentence &quot;intruder enters your home using the internet&quot; in the question as not as physically entering the home but as virtually entering the home, in other words hacking into the victim's home network remotely. When that interpretation is incorrect, please comment. Note that an action can only be considered self-defense when the self-defense prevents a crime currently in progress from being completed. When A hacked into B's computer and then B punches A in the face later, that's not self-defense, that's illegal vigilante justice. The self-defense argument would only work if it actually prevents the completion of the crime. For example, if A and B were in the same room, A sees B hacking into A's computer right now and uses physical force to prevent B from completing the hack (like yanking the keyboard out of B's hands). Also keep in mind that the intensity of self-defense must be appropriate for the severity of the crime. What is and is not appropriate is for a court to decide in each individual case, and the guidelines that are to be applied vary from jurisdiction to jurisdiction. But causing bodily harm to people when the crime they are committing does not cause bodily harm is often not considered within the limits of self-defense. For further information about what is and is not allowed in self-defense, I recommend the series about self-defense by Law Comic.