How has the Business Community Help Judges Best Crack Down on Identity Theft?
Tagged as: crime, cyber crime, government, identify theft, penalties, sentencing, small business
Cybercrime is posing a rising threat to the private sector, particularly to small- and medium-size businesses, which are attractive targets because they tend to have fewer information security measures in place compared with larger enterprises. The U.S. Sentencing Commission (Commission) has tried to crack down on identity theft and cybercrimes by increasing the penalties. The Commission issued a final rule significantly enhancing the severity of punishment in the hopes of deterring potential cyber-criminals of computer and identity theft crimes.
Background
As everyone knows, identity theft and cybercrimes are growing in size and sophistication. As businesses, large and small, become increasingly dependent on computer networks to store sensitive information, they are also increasing their risk for theft and loss. In response to this trend, Congress passed a law strengthening prosecutors’ tools for penalizing identity theft and cyber criminals and expanding the possible avenues for victim restitution and looked to businesses and the Commission for guidance on these matters. Business and the Commission recommended increasing penalties for five kinds of identity theft and computer crimes:
Fraud and Related Activity in Connection with Identification Documents, Authentication Features, and Information;
Aggravated Identity Theft;
Fraud and Related Activity in Connection With Computers;
Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited; and
Unlawful Access to Stored Communications.
Just a little background on what the sentencing guidelines do. They are supposed to serve as a reference for federal judges when determining the level of penalties to impose for federal crimes. The guidelines outline a range of 1 to 43 possible base offense levels that are assigned to various crimes. The more serious the crime, the higher the offense level. For each offense level, the Commission provides a range of months for which an offender can be imprisoned for committing a crime at that offense level. And within each offense level, the range of imprisonment can also vary, depending on the person’s criminal history, which is rated from I to VI.
For example assigning the Range of Imprisonment at Each Offense Level.
A first-time offender (Criminal History Category I) whose crime is at a base offense level of 5 can be subject to anywhere from 0 to 6 months of imprisonment. A more experienced offender, in Criminal History Category IV, who commits a crime at the same offense level can be subject to 4 to 10 months of imprisonment.
Versus Increasing the Base Offense Level
When determining the base offense level of a crime, judges can increase or decrease the level based on various characteristics of the crime. Theft, for example, often starts at a base offense level of 7 but can increase depending on the amount of monetary loss involved.
Criteria for Amending Penalties for Cyber and ID Theft Crimes
Business and the government identified 13 key factors including how sophisticated the crime is, whether the crime was intended to disrupt a critical infrastructure, whether the crime involved a computer associated with national security, among others. These factors must be considered when increasing or decreasing the offense levels assigned to the five identity theft and cybercrimes. The 13 criteria are as follows:
1. The level of sophistication and planning involved in the offense.
2. Whether the offense was committed for commercial advantage or private financial benefit.
3. The potential and actual loss resulting from the offense including a) the value of information obtained from a protected computer, regardless of whether the owner was deprived of use of the information; and b) where the information obtained constitutes a trade secret or other proprietary information, the cost to the victim incurred developing or compiling the information.
4. Whether the defendant acted with intent to cause either physical or property harm in committing the offense.
5. The extent to which the offense violated the privacy rights of individuals.
6. The effect of the offense upon the operations of a U.S. government agency or that of a state or local government.
7. Whether the offense involved a computer used by the U.S. government, state or local government in furtherance of national defense, national security or the administration of justice.
8. Whether the offense was intended to, or had the effect of, significantly interfering with or disrupting a critical infrastructure.
9. Whether the offense was intended to, or had the effect of, creating a threat to public health or safety, causing injury to any person, or causing death.
10. Whether the defendant purposefully involved a juvenile in the commission of the offense.
11. Whether the defendant’s intent to cause damage or intent to obtain personal information should be disaggregated and considered separately from the other factors set forth.
12. Whether the term “victim” should include individuals whose privacy was violated because of the offense in addition to those who suffered monetary harm as a result of the offense.
13. Whether the defendant disclosed personal information obtained during the commission of the offense.
As you can see many of the offenses are related to commercial activity or individual privacy.
The U.S. judiciary looked to the private sector for input on how to strengthen penalties for committing identity theft crimes and other computer related acts. Small businesses, in particular, are becoming frequent targets for hackers and cyber criminals because they lack the information security defenses in which large enterprises have invested significant time and resources. According to a Verizon study, 33 percent of all data breaches in 2008 were directed at businesses with 100 employees or less. By comparison, large businesses with more than 10,000 employees sustained fewer data breaches in 2008, totaling 25 percent. Furthermore, industry leaders conclude that almost 20 percent of small businesses do not even use antivirus software, more than half do not use encryption and two-thirds do not even have information security plans in place.
The U.S. Sentencing Commission’s request for input on sentencing guidelines provided an opportunity for businesses to review current penalties for such crimes and suggest increasing the severity of fines or prison sentences. Whether or not greater penalties result in greater deterrence of identity theft and other computer crimes is yet to be seen. However, the changes to the guidelines represented a significant opportunity for businesses to have their voices heard in an area typically dominated by the federal government.