There is great public concern now with vandalism and blackmail using
computers as a medium.  The obvious legal response is a law against
vandalism and blackmail, regardless of means.  After all, they are
just as bad if done without a computer.

So why, instead, do we get laws against `unauthorized computer use'?
Why do people gloss over the difference between `unauthorized' and
`harmful'?  And why do proposed laws emphatically condemn even
harmless unauthorized users?  That's irrelevant, if the purpose is to
punish harmful ones.

Perhaps it's because the impetus for computer crime laws comes from
computer owners.  The public has no reason to oppose harmless
unauthorized computer users, but computer owners hope to divert
public concern to their own ends.

Last summer someone threatened to turn off MIT's phone service by
sneaking into a computer system.  "And to show I can do it, I'll turn
off your own phone service this week," he told my colleague.  Sure
enough, my colleague's phone service was turned off--but not through
a computer.  The threatener simply mailed the phone company a
forged request to discontinue service.  As far as we know, he had
no way into the phone company computers at all.

It's a good thing we have a law against fraudulently interfering with
phone service.  If we were depending on a computer crime law, this
criminal would have found a loophole.  There's just no reason to
focus on unauthorized computer use among all the means of doing wrong.

Conversely, unauthorized computer use is not necessarily wrong.
`Unauthorized' just means `the boss doesn't see why you need to
do it'.  Maybe the boss is mistaken.  Maybe he doesn't deserve
public sympathy.

Computer security is used for enforcing rules--any rules the boss
wants to make.  Many rules are the the computer equivalent of "No
talking on the job!  Only one trip to the bathroom per shift!"
Breaking a rule is unauthorized use of the computer.  Typical
computer crime bills would make it a crime.  It would still be right
for the workers to break the rules, because laws do not decide
morality.  But we, the public, should not support a law that says
the boss is always right.

The boss may not even understand what's best for himself; he can make
rules that interfere with productivity.  A worker with high morale
breaks these rules to do a good job.  Creeping bureaucracy constantly
threatens to strangle us, and is only held in check by bold
individuals who trample it.  Administrators naturally do not like to
acknowledge how much damage they would do if people obeyed them; they
want computer crime laws so they can compel obedience.

Computers are fascinating.  Teenagers want to explore them and learn
all about them.  Wise computer owners view this as a source of
talent, but most are not wise and treat all strangers with knee-jerk
suspicion.  They condemn unauthorized users hatefully even when
no harm is done.  Receiving this hostility makes some teenagers
bitter and cynical; then they may become vandals.  For society's
sake, we should try to prevent the embitterment, not just the
vandalism.  This requires recognizing that the original desire to
explore is admirable.  If we prohibit vandalism, we should not lump
exploration in with it.

By all means prohibit people from cutting off my phone, but I'm more
worried about regimentation, bureaucracy and inhospitality.  They are
legal, and promoted by powerful institutions.  As a professional
hacker (`hacker' properly means `an avid computer buff' and says
nothing about authorization), I have considered it my duty to resist,
neutralize or scrap unjustified bureaucracy on the computers I work
with, and the security used to enforce it.  Often, I as system
developer have been expected to implement or enforce security.  I
have refused, in order to protect users from others' control.

In the same spirit, I ask everyone to oppose laws that would punish
unauthorized computer use per se, in the absence of any specific
harmful purpose.
