Who are authorized to use the system but exceed that and also act as a website that exceeds the authorization the website owner has provided to them and so this is important in the employment context you have for example a Police Officer that is about and authorized to access sensitive databases about american citizens that exceeds the authorization because hes looking at the database to do something impermissible. We think that those up to be prosecuted offenses because the Computer Fraud and abuse as we read it would permit the prosecution of those things. However there have been criticisms of the statute because a classic example is the dating website you agree to the terms of service but you lie about your age and finally the term of service and are arguably now not authorized to use the site. Isnt there a perception the that thats what is going on . [laughter] even though the department of justice has absolutely zero interest in prosecuting people in that sort of term of service the reading is enough to include those and now we have two circuits who because of that concern has read the statute much more narrowly and in fact in such a way that would prevent us from the other case i mentioned the privacy violating Police Officer to the pitcher meant to protect privacy so what we would like to see is for the congress to address the situation. We would like to see a way of human and aiding those cases that we have no interest in and nobody wants us to be prosecuting but permitting us to bring the criminal violators but i think most people would like us to see are currently. There is a shadow on this whole theory across the country. Is there a way to deal with the trivial ones so that it would lead to some monetary damage . I dont have a particular legislative proposal to launch but ideas like that are the kind of things that could help restrict the statute to the things that matter although of course the Police Officers data have to be careful in the way that we constructed so that we keep the good stuff while eliminating things that really shouldnt be in there. If you have a statute that has these problems and if you are looking at this as entirely lawful. In terms of the idea weve seen that that government has done it in the case when logging into my space which is a horrible tragedy but i dont think that it is a crime but theyve made clear that it only counts if you are circumventing a technology meant to control access dot has the result of the security of the research for fear the researcher may be prosecuted or perhaps more likely being sued civilly by someone other than the government. The government at this point has any prosecution for a Service Violation into private actors certainly havent and so that is still always a threat when someone is attempting a way that doesnt circumvent any measure. That is one of the reasons why right now there is a petition to the white house to address this concern by the cybersecurity researchers its one of the reasons there was the introduction two years ago who committed suicide in the midst of the prosecution and was basically codify the president saying only if you are circumventing the measure to prevent a new violating the law and i think its important richard raises the issue of the thread where someone steals or misuses the data in a way that violates their Employment Contract or something else. I understand that is a problem and we want to find out ways to criminalize the data but if we are creating a new regime of the law grade data theft law we need to discuss that rather than put a square peg into a round hole and make this apply to the data that they are authorized to access. If i can just jump in for a second and get some perspective on this, while it would certainly have the effect of taking care of those cases it would have done nothing to save the case it would be clear we have to absolutely be clear about that so if you think that his life would have been saved its simply not so. If you are a prosecutor like myself and andrew when you are a prosecutor and you look at the cases that you have and people say this is terrible the reaction is are you kidding me look at the cases i have. And its not until you leave the prosecution that they get a glimpse of what it is. They are talking about the problems of controlling the Law Enforcement discretion. Of course we are not going to prosecute anybody for lying on a dating why emoney dating site but all of a sudden the warrior comes along and commits a terrible crime and there is an uproar about the crime she committed and the Law Enforcement officials are answerable to the public and they are screaming why didnt you do something about this woman that helped us grow killed herself into the have to take actions they can grasp so when you have a statute what happens is you have an important individual who might hack into the site to look around then it becomes how much damage did he do. Now you are on trial and now the judges for making the determination. What happens is the discretion of the lawenforcement expands and there is no rule that can keep you out of trouble and thats where people have some discomfort with this and thats where it needs to go. When you look at why the cases have come out they talk precisely about the question which it is about the discretion. It is a constitutional problem with the statute that ends up being able to analyze anything that is a violation and when you add to that whether or not they prosecute, they can still investigate. So all of the surveillance issues that we talked about our something that can be alleged and will justify the surveillance. Second, they have the liability and its one of those funny things about these dual statutes where the doj has a particular vision of how they want the statute to work and they will arrange in a way that doesnt want the case and the soulful Civil Servant you end up with interesting patterns that go in a different trajectory and they create much more chaos and when it is this openended it lends itself to abuse. Im going to have to stop you because i need to give you enough time. Questions. If you have any questions for the panelists and if you dont. My question goes to the issue that you were just discussing in terms of the Police Officer looking at the data that we shouldnt be looking at any given the general nature of todays discussions i understand why he picked that. I dont see that problem as often. What i see is i have to tell a lawyer who has an employee who on his way out the door store a whole lot of data. That may not be a trade secret and i have to tell them im sorry that there is nothing i can do for you. And then on kevins point we do need a statute that covers it and it shouldnt be whether the person is authorized or unauthorized but to focus on what is the state of mind because if they are accessing to do the deed that everybody thinks that is this is funny because they are accessing it to steal we all grew up learning that stealing was a bad. And it seems to me that it needs to be amended, not to focus on what they mean by the unauthorized exceeding which i agree is very vague and i agree with you if you need to focus on the frame of mind of the perpetrator. There is a good point the requirement is an important one that we understand in the analogies as we have. There is a difference between somebody that walks into a restaurant to take a look at the menu selection which they may not be allowed to do because they are not planning to eat their day just went to look at the menu and that is a trespass, isnt it . Theres a difference and there may be a difference in the cyber world as well and that is where congress should be and thats where it may put its efforts. I would say they would support that distinction differentiating what your intent is. If i can just respond very quickly, it sounds like we are in agreement that the Congress Needs to act to address the scope of the provision. So maybe we might have Different Solutions to the problem but its certainly one that should be brought up in the next congress. One of my questions would be why does this need to involve federal Law Enforcement if someone is stealing the property of the company that is a crime. They can be prosecuted and they could also be sued so why is that not adequate . The district attorneys in my area its in the Philadelphia Office anybody but to philadelphia knows that they dont just focus on that. But i have the resources and biscuits with the lawenforcement agencies to do the investigation and the alternative is that nobody gets prosecuted for stealing. If everyone agrees it should be criminal whether it should be federal and just state. It cant just be intent. The intent is to take something that somebody was making money on and it should be free to the public. The real issue should be the law so if a Building Block im not authorized by breaking in and i steal it and i commit a crime but that doesnt entitle me when they are open for business that i can walk into the store and walk out with everything and it shouldnt matter whether my intent is to be robin hood or to go sell it down the alley so i think that there needs to be more focused on however it happens because the loss of the victim or the company. The way that they damage those things are calculated and its a very strange sort of thing at all sorts of things that you do to mitigate end up figuring into the calculation. The other part is if you have a statute that ranges across a large number of different things, that the potential penalty even for something that is small and graduated can be highly disproportionate. I will add to that. I dont think that it would have prevented the prosecution i think that it would have reduced the number of years that they handled the charging under the csa and i think it would have impacted the case and perhaps saved his life. We should keep in mind when we are prosecuting these cases we should be factoring in what the intent of the person is and the damage thats being done. Like i said there is tremendous and if you see somebody because the press has an involvement in this or youre not really doing the right thing so the question is how much discretion to wake discretion do we give the lawenforcement to handle the issues that the same time it gives people the security and the comfort of knowing if they stray over by mistake they are not going to get hammered so badly that the line is going to be. So i think that they can actually make these changes. I agree a lot with other people than the panel have said. Thanks to the panelists. [applause] we will bring you live coverage starting at one 45 on cspan2 we sat and watched him and listened to a group of second graders and they came and interpreted the president and i was stunned. He whispered and nobody interrupts the president even in front of second graders. The president stood and said she had to go and he went into the room and then we heard that there were two planes down for two plane crashes in new york. They came out to the pool, the parking lot, im sorry can, and they said to stay right here. And i said no there are cameras in the cafeteria. The president has to speak their. But he did go into the cafeteria. We were pushed the board quickly to the door slammed and then the pentagon was hit. U. S. Attorney attorney for the Western District of pennsylvania talks about how Law Enforcement is pursuing criminals and prosecuting cyber crimes. His remarks or ten minutes. Thank you for that generous introduction. Im going to be very direct and to the point. We are going to get out of here very quickly. This has been a mixed ordinary conference and im very grateful for the invitation to be here and for the honor of closing the conference. We developed a bit of a signature and if youve been paying attention it was a watershed year. We brought the case against the members for economic espionage to the united steelworkers from oregon and then just two weeks later i was back in washington to announce the case that we talked about in detail today. He is max butler and he was prosecuted and pittsburgh that was the largest fraud in history and as alluded to earlier he was a criminal, cooperator and that reflects part of our challenge. You hear about the bombing case and i think its important to hear about this case and im going to try to give you the lens of a body of work as a Reference Point to try to tie together what you heard today because what we do in the and the practicality of handling these cases was addressed in various ways. But it happened right after we had a mass shooting at our principal Psychiatric Hospital in pittsburgh because of affiliated at the university of pittsburgh and we had over 100 bomb threats that were coming through anonymized or it of the various types through Media Outlets causing great terror in our flagship university. And i took the step at a time of activating the joint Terrorism Task force which was considered controversial. It also put us out on a limb in terms of whether we could solve what was the solve with was a cyber needle in the haystack problem. But i did so because in pittsburgh, and you may not notice we have some of the best resources in the country to deal with the cyber threat. You heard earlier about the agent on the iceman max butler case. Earlier today for a brief period of time, hes now he was formerly in western pennsylvania and he was the prosecutor. If you dont want to read the book you can can pull up the american creed and put in the iceman and for 55 minutes you can read all about this and that is kind of the beginning of the story in pennsylvania but with all of that talent and the oneofakind Publicprivate Partnership i still felt we were going out on a limb but we have no choice. We had a shooting with fatalities and less than a week later, a series of threats against the university and the chancellor was in the position of determining whether or not he evacuated on the cyberbased threats. These cyberbased threats. He also knew what he did each kind and there was pretty much no question but that is that that is exactly what they wanted him to do. This extreme had a tail to it which was to individuals from cincinnati who in another purpose they were threat of activists who use the anonymous to trigger writes the university and without going through all of the details, it involved International Cooperation with partners to ireland by me because we were to to him for him and make sure that the guard understood how important this was. We were able to identify the individual who has been charged and we were doing everything we could to extradite him to bring him to pittsburgh. He had since been convinced that he did this and i think that was a huge achievement and all of that was going on at the same time since i began at the u. S. Attorney attorney in 2010. We were working towards efforts in the case and the chinese espionage case. Why does this matter . It matters because and this is somewhat lost in the discussion today which is no criticism this far. We need to take as the First Principles the cyber intrusions and how they affect real people in real ways. Our entire approach in pittsburgh as a victim centric. So the comment about how microsoft does its business process needs with me. But in each of the cases that i tell you about, of course we have the whole spindle of cyber cases. We have one of the largest concentrations of that the exploitation of the childrens cases involving cybermedia. We have cases involving the effects. We announced one that is in the news today involving the Million Dollars of theft of a couple that were using the Social Security numbers at walmart, with the 900 victims. So, we are doing this every day and like most of the u. S. Attorneys office is a large part of what we are doing you never hear about. But it is victim focused and its also been done with attention to the fact that we embrace the challenge of having to deal with both the Security Issues in the at the privacy issues. That responsibility in western pennsylvania. Fullstop my shoulders and most u. S. Attorneys about the accept and relish the challenge. In all of the conversations about where the legislation into law will go will never take that response ability out of the u. S. Attorneys office ultimately. We could have both. Its a false choice that we have to give up one to the other. But i am heartened and take note that we cannot have privacy with security. We have to deal with the threat as it is. So, it is a borderless print. It is in insidious. It involves involves evaporating evidence. When we talk about how slow the government move is when we move in committee and one of my meetings at 9 00 every monday we had a dedicated National Security and cyber group that we operate the whole world depends on our work and listen to me as a firebreathing dragon saying we need to move faster. We cant just accept that we can do this in a linear fashion like we would do it in a historical crime case. This is a dynamic challenge. And as i said to the fbi directors times two and the leadership and the department of justice if this matters as much as we say that it does, we have to reject all conventions. We have to let the limits of our imagination be the guide to where we go to deal with this difficult problem. You see, because i believe that you have to understand my narrative about pittsburgh, which you think translated tutorial narratives about where you reside, to appreciate how significant this really is. Notwithstanding martins provocative john earlier today, pittsburgh is the center of the universe if you did not know that. We were the American Industrial revolution. Andrew carnegie started, John Rockefeller started oil. If you go back and read the book you can get a quick refresher on this. The polio vaccine was discovered in pittsburgh. Much of organ transplant technology happened with tom stars. We are evolving into a technical medical mecca. At mcdowell we have the three quarters of the technology in the company and i havent even begun to talk about the