QBtfire of the @eneral 13 01 20530 September 11 2014 MEMORANDUM TO THE UNITED STATES ATTORNEYS AND ASSISTANT ATTORNEY GENERALS FOR THE CRIMINAL AND NATIONAL SECURITY DIVISIONS FROM TI IE ATTORNEY GENERAL SUBJECT Intake and Charging Policy for Computer Crime Matters Cyber-based crimes are one of the fastest growing threats our nation faces Although laws addressing the misuse of computers have not kept pace uniformly with developments in technology and criminal schemes the Computer Fraud and Abuse Act codi ed at Title 18 United States Code Section 1030 remains an important law for prosecutors to address cyber-based crimes As technology and criminal behavior continue to evolve however it also remains important that the CF AA be applied consistently by attorneys for the government and that the public better understand how the Department applies the law To accomplish these goals I recently asked the Criminal Division to work with the National Security Division the Executive Of ce of United States Attorneys and the Attorney General s Advisory Committee to develop a policy to guide attorneys for the government in the appropriate considerations for prosecutors contemplating charges under the CFAA The resulting policy is effective immediately A Policy In addition to the considerations set forth in USAM 9-27 230 which are incorporated herein by reference an attorney for the Department of Justice should consider the following additional factors in determining whether prosecution of a violation of the Computer Fraud and Abuse Act l8 U S C 1030 should be pursued because a substantial federal interest would be served by prosecution in a casein which the admissible evidence is expected to be suf cient to sustain a conviction It is recognized that the signi cance of any cyber event for a District can vary depending on facts and circumstances speci c to the District Factors to be considered include I The sensitivity of the affected computer system or the information transmitted by or stored on it and the likelihood and extent of harm associated with damage or unauthorized access to the computer system or related disclosure and use of information 2 The degree to which damage or access to the computer system or the information transmitted by or stored on it raises concerns pertaining to national security critical infrastructure public health and safety market integrity international relations or other considerations having a broad or signi cant impact on national or economic interests 3 The extent to which the activity was in furtherance of a larger criminal endeavor or posed a risk of bodily harm or a threat to national security 4 The impact of the crime and prosecution on the victim or other third parties 5 Whether the criminal conduct is based upon exceeding authorized access consistent with the policy set forth at page 4 below 6 The deterrent value of an investigation or prosecution including whether the need for deterrence is increased because the activity involves a new or expanding area of criminal activity a recidivist defendant use of a novel or sophisticated technique or abuse of a position of trust or otherwise sensitive level of access or because the conduct is particularly egregious or malicious 7 The nature of the impact that the criminal conduct has on a particular District or community and 3 Whether any other jurisdiction is likely to prosecute the criminal conduct effectively if the matter is declined for federal prosecution Comment This policy lists factors that may be relevant in determining whether prosecution of violations of the CFAA should be pursued because a substantial federal interest would be served by prosecution in a case in which the person is believed to have committed an offense under the Act and the admissible evidence is expected to be sufficient to sustain a conviction The list of relevant considerations and examples of criminal conduct illustrating those factors are not intended to be all-inclusive Not all of the factors will be applicable to every case and in any particular case one factor may deserve more weight than it might in another case The principles set forth here and internal office procedures adopted pursuant to this memorandum are intended solely for the guidance of attorneys for the government They are not intended to do not and may not be relied upon to create a right or benefit substantive or procedural enforceable at law by a party to litigation with the United States 1 Sensitivity of Affected Computer System or Information In determining whether to bring a charge for violation of 13 U S C 1030 in a case involving obtaining information from a protected computer consideration should be given to the sensitivity and value of the information involved and the potential for harm associated with its disclosure or use Examples of the types of information that should be given a high priority for federal prosecution when illegally accessed include sensitive personal information such as intimate photographs or correspondence medical educational or nancial records Social Security numbers biometric information and other personal identi cation information and passwords and access devices trade secrets valuable intellectual property and other con dential business information and classi ed or other sensitive government information To be clear federal prosecution may be warranted even where the offender did not actually obtain any such information in other words in certain aggravated circumstances more access to a computer system that stores these types of sensitive information may weigh in favor of prosecution Further federal prosecution may be warranted for conduct that involves accessing a computer system without authorization or in excess of authorization for the purpose of selling or traf cking in sensitive information or the public distribution of private information Conversely federal prosecution may not be warranted if the information obtained is otherwise publicly available or has little vaIUe Potential for Broad or Signi cant Impact on National or Economic Interests Many types of offenses under the CFAA can have an impact far beyond the particular computer that is directly affected by the actions of the offender Unauthorized access to a computer containing classified information for example can harm national security Shutting down a computer that controls a portion of the electrical grid can harm business activities and put public safety at risk Unauthorized access to stock market computers can undercut investors' faith in the fairness of the market And the actions of terrorist organizations and foreign governments can cause signi cant harms to the safety and prosperity of Americans Similarly many types of malicious software can affect thousands of computers or more across the country and have the potential to invade the privacy and harm the nancial security of those computers users Where criminal activity risks these broad harms or has a substantial effect in several parts of the country federal prosecution may be warranted In other circumstances if the effect of a violation is geographically focused and limited deference to state or local authorities may be warranted where they have the legal tools and resources to act Connection to Other Criminal Activity or Risk of Bodily Harm Offenses under the CFAA often occur in concert with and in furtherance of other criminal activity including that which poses a threat to national security Depending on the nature of the predicate criminal activity such circumstances may weigh in favor of federal prosecution Organized criminal enterprises for example access banking and nancial computers to steal information in furtherance of fraud and extortion schemes Individual hackers may gain access to the private information of others in order to stalk or harass to encourage others to harass or endanger public of cials and other victims or to pro t from its sale Disrupting a hospital computer can place patients lives in danger Impact of the Crime and Prosecution on Victim or Other Third-Parties An attorney for the government may consider whether investigation and prosecution might result in further negative impacts on victims or third-parties that cannot otherwise be avoided Thus prosecutors should take into account the impact of the crime on the victim as detailed in USAM 9-27 230 Exceeding Authorized Access Several portions of the CFAA prohibit obtaining information by accessing a protected computer either 1 without authorization or 2 in a manner that exceeds authorized access Some exceeds-authOrized-access violations may occur where the actor had authorization to access the computer for one purpose but accessed the computer for a prohibited purpose For example in several circuits violation of the statute under the exceeds-anthorized-access theory might occur where an employee accesses sensitive corporate information in violation of the company s access policy or where a law enforcement of cer accesses the National Crime lnforrnation Center computers to obtain information in order to stalk a former romantic partner which would violate access restrictions When prosecuting an exceeds-authorized-access violation the attorney for the government must be prepared to prove that the defendant knowingly violated restrictions on his authority to obtain or alter information stored on a computer and not merely that the defendant subsequently misused information or services that he was authorized to obtain from the computer at the time he obtained it As part of proving that the defendant acted knowingly or intentionally the attorney for the government must be prepared to prove that the defendant was aware of such access restrictions The extent ofthe federal interest in exceeds-authorized access prosecutions under section 1030 a 2 varies based upon both the nature of the conduct and the nature of the information obtained during the offense As with situations presenting an increased need for deterrence one factor that supports prosecutions under the exceeds-authorized-access provision is the abuse of a position of trust Examples would include situations in which a system administrator invaded the privacy of email accounts in violatiOn of company policy and for personal gain or in which a government official accessed information stored on government computers in contravention of clear rules prohibiting such access Likewise if the criminal conduct threatened national or economic interests was in furtherance of a larger criminal endeavor or posed a risk of bodily harm or threat to national security those factors would weigh in favor ofprosecution On the other hand if the defendant exceeded authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or website federal prosecution may not be warranted Increased Need for Deterrence As technology advances criminals discover novel ways to exploit it For example as mobile devices become increasingly powerful and flexible they have also increasingly become a target for computer criminals An individual may also abuse a trusted position to commit a computer crime or may exhibit particularly malicious motivation or egregious behavior These considerations may in combination with other factors weigh in favor of federal prosecution Extent of Harm to One District or Community In deciding whether to bring a CFAA prosecution in a particular District the attorney for the govemment should consider how much harm the criminal activity caused within the relevant District or community Where an offense causes particularly signi cant harm to a single District or community federal prosecution may be warranted Possibility of Effective Prosecution in Another Jurisdiction In determining whether prosecution should be pursued even though the person is subject to effective prosecution in anotherjurisdiction the attorney for the government should weigh the considerations discussed in USAM 9-27 240 C Consultation 1 Introduction Cases under the CFAA are often complex and analysis of whether a particular investigation or prosecution is warranted often requires a nuanced understanding of technology the sensitivity of information involved tools for lawful evidence gathering national and international coordination issues and victim concerns among other factors SAM 9-50 000 sets forth general requirements for cyber prosecutions including coordination with and noti cation of the Computer Crime and Intellectual Property Section of the Criminal Division in certain cases These provisions are still in effect Investigative Consultation In addition at important stages of an investigation because it is the best practice the attorney for the government should consult with a Computer Hacking and Intellectual Property Coordinator within the District in which the case would be brought Because electronic evidence is often subject to deletion after very short retention periods the need to preserve or obtain evidence critical to the investigation may require taking preliminary investigative steps before undertaking the consultation above In such cases the consultations as required should take place as soon as possible Charging Consultation With respect to charging decisions the attorney for the government shall consult with CCIPS which often has knowledge ol similar cases in other Districts or how the case may t into national priorities Attorneys for the government are encouraged to have a District CHIP participate in this consultation The consultation should be substantive in nature It is meant to both assist the prosecutor and promote consistency in the Department in a quickly evolving area of practice The depth of the consultation and degree of information required to accomplish these goals will vary according to the facts complexity and sensitivity of a particular investigation 0r matter These types of consultations are already a hallmark of the CHIP program and the strong working relationships are a key reason for the program s collaborative successes Consultation for Cases Involving National Security Issues For CFAA cases involving international terrorism or domestic terrorism or affecting involving or relating to the national security USAM 9-2 136 9-2 137 9-90 020 and or 9-90 800 set forth additional National Security Division noti cation consultation and approval requirements In such cases the attorney for the government can if he or she chooses satisfy the initial CCIPS and NSD noti cation requirements with one contact NSD or CCIPS will then be responsible for facilitating any additional required noti cations consultations or approvals including to the extent requested by the attorney for the government with the other component If there is any question about whether a matter involves international terrorism domestic terrorism or otherwise affects involves or relates to the national security the attorney for the government should consult with the National Security Cyber Specialist NSCS within his or her district for further guidance