He who seeks to deceive will always find someone who will allow himself to be deceived.
~ Nicolo Machiavelli, The Prince, 1513

There's a Sucker Born Every Minute.
- Attributed to PT Barnum

Theft of Information

The Computer Fraud and Abuse Act also deals with crimes over the network where the hack is targeted to swipe information (note that a hack may involve both damage to the network and theft of information; violation of one provision does not preclude violation of another).

The following bad deeds may constitute violations of the Computer Fraud and Abuse Act:

Classified Information

Whoever

• Hacks a computer (“knowingly accessed a computer without authorization or exceeding authorized access”)
• Swipes classified information
• Believes that this information will harm the US or benefit “Charlie” (where “Charlie” is any country other than the US), and
• Transmits it to someone other than the Feds, or doesn’t transmit it.

18 U.S.C. § 1030(a)(1). [NIIP]

Government Information

Whoever

• Hacks a computer, and
• Swipes government information

18 U.S.C. § 1030(a)(2)(A).

Swiping Information from Protected Computers

Whoever

• Hacks a computer, and
• Swipes
• financial records or [S Report No 99-432 at 6]
• information. [This provisions is a reaction against “United States v Brown , 925 F2d 1301, 1308 (10th Cir. 1991), where the court held that purely intangible intellectual property, such as a computer program, cannot constitute goods, wares, merchandise, securities, or moneys which have been stolen converted, or taken."]

18 U.S.C. § 1030(a)(2)(A)&(C). See Identity Theft. [IMS] [Shurgard]

Fraud

"A claim under CFAA §1030(a)(4) has four elements:

1. defendant has accessed a "protected computer;"
2. has done so without authorization or by exceeding such authorization as was granted; [See Lockheed s III.B.]
3. has done so "knowingly" and with "intent to defraud"; and
4. as a result has "further[ed] the intended fraud and obtain[ed] anything of value.""

[Yonkers at (1)] Other than simply scamming computer services of less that $5000 a year. [S Report No 99-432 at 10 ] 18 U.S.C. § 1030(a)(4). [Czubinski] [Pacific at 1195]

Punishment

Violations of the CFAA are punishable pursuant to 18 U.S.C. § 1030(c).

Data Retention

While ISPs are not currently to retain data and records in general, they can be requested by a government entity to "take all necessary steps to preserve records and other evidence in its possession pending the issuance of a court order or other process." The retention period is 90 days which can be renewed. 18 U.S.C. § 1030(f)