Amid the debate in Washington last week, provisions of the bill tucked into a section about "cyber-security enhancements" received scant attention. The Senate prepared to vote on the entire legislation Tuesday.
Most of the provisions passed the House as part of separate legislation in an overwhelming 385-3 vote during the summer, but they were never considered in the Senate. Many are similar to changes made last year under the USA Patriot Act, which included new laws affecting Internet wiretaps and cracker investigations.
One new provision raises possible criminal penalties to life in prison for crackers caught during electronic attacks that cause or attempt to cause deaths. An attack aimed at causing "serious bodily injury" could result in 20 years behind bars.
The debate over appropriate penalties for serious electronic attacks has intensified since the Sept. 11 terror attacks. Experts have increasingly focused on Internet threats to important computer systems that control power grids, pipelines, water systems and chemical refineries.
"We must not ignore the growing threat of cyber attacks," said Rep. Lamar Smith, R-Texas, who first introduced the proposals as the Cyber Security Enhancement Act.
Just a few years ago, crackers vandalized popular commercial and government Web sites, including those for the Pentagon, White House and Senate. But compared with the threat of electronic shutdowns of critical services, those sorts of attacks look more like simple nuisances.
Supporters of the sentencing changes for crackers say they eliminate differences with possible penalties for other crimes that might also result in deaths. Critics noted that some prosecutors have been accused in past years of exaggerating the scope and financial damages from attacks.
The bill also provides greater legal protections for Internet providers, such as AOL or Microsoft Network, to turn over information about their subscribers to government officials during computer emergencies. If companies believe "in good faith" that there is risk of death or injury to any person, they can turn over details about customers -- even their e-mails -- without a warrant.
Civil-liberties groups, such as the Washington-based Electronic Privacy Information Center, have complained the bill's language allows Internet providers to turn over subscriber information to any government officials, not just investigators. U.S. companies have traditionally refused to act as agents for prosecutors without court-approved warrants, said Chris Hoofnagle, EPIC's legislative counsel.
The legislation requires any government officials who obtain such information to report details to Attorney General John Ashcroft within 90 days. It also requires Ashcroft to report results to Congress after one year.
Another part of the Homeland Security bill gives U.S. authorities new power to trace e-mails and other Internet traffic during electronic attacks without first obtaining even perfunctory court approval. That could only happen during "an immediate threat to national security," or during an attack against a "protected computer." Prosecutors would need to obtain a judge's approval within 48 hours.
Experts have noted that U.S. law considers as "protected" nearly any computer logged onto the Internet. In addition, civil-liberties groups have frequently complained that obtaining permission from a judge is too easy for this type of e-mail tracing; if an investigator merely attests that the information is relevant to an ongoing investigation, a judge can't deny the request.
Copyright 2002. Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.
