Law Lets U.S. Prosecute Foreign Hackers

The Justice Department, using the recently approved anti-terrorism law, can now prosecute foreign hackers when they attack computers in their own or other countries outside the United States.

Critics said Wednesday that the change could make the United States the world’s Internet policeman and set a precedent that would apply American values to the worldwide network.

Prosecutions can occur if any part of a crime takes place within U.S. borders. A large part of the Internet’s communications traffic goes through the United States, even in messages that travel from one foreign country to another.

The new prosecutorial powers, which have no parallel in other nations, troubled one former Justice Department computer crime prosecutor.

“It’s a massive expansion of U.S. sovereignty,” said Mark Rasch, now with the computer security firm Predictive Systems.

The change was highlighted last month by the Justice Department in its field guidance to federal prosecutors.

“Individuals in foreign countries frequently route communications through the United States, even as they hack from one foreign country to another,” the recommendations said. “The amendment creates the option, where appropriate, of prosecuting such criminals in the United States.”

The FBI referred questions to the Justice Department. A Justice Department spokeswoman did not return calls for comment.

The Internet’s message traffic is largely dependent on American hubs in Virginia and California.

Jessica Marantz of the Internet statistics firm Telegeography said more than 80% of Internet access points in Asia, Africa and South America are connected through U.S. cities. Therefore, an e-mail sent between two cities in China probably will travel through the United States, putting its contents under American jurisdiction.

The Justice Department pushed for the legislation as a way to fight terrorism, and U.S. interests overseas could be protected by the change.

But the change in law creates a precedent that could be used to prosecute any computer crime, Rasch said, from basic data theft to sending pornographic pictures. Current law allows pornography prosecutions in any jurisdiction the pictures pass through, but this has not been applied internationally to Internet transmissions.

For example, an owner of a pornography Web site in Sweden might be prosecuted for sending a racy picture to a friend in Norway if the message happened to travel through a computer in Fairfax, Va. In that case, a U.S. prosecutor could try to extradite the sender and prosecute him for breaking Virginia law, using the state’s standards for obscenity.

FBI agents complain about the difficulty of computer crime investigations that almost always venture overseas, requiring time-consuming search warrants at every step and the cooperation of foreign governments.

Prosecutors in the Philippines last year had to dismiss charges against a college student suspected of creating the “Love Letter” virus, which caused billions of dollars in damage worldwide, because they had no applicable law. Under the American anti-terror statute, the suspect could have been tried in the United States.