The CFAA and RICO – Proposed Legislation
By Sean O’Brien on Thursday, October 6, 2011
Last month the Senate held hearings on a piece of legislation designed to extend the reach of the CFAA. The “Personal Data Protection and Breach Accountability Act of 2011″ is the latest product of the Government’s efforts to strengthen the nation’s cyber security. See White House’s May 2011 Cybersecurity Legislative Proposal at http://www.whitehouse.gov/omb/legislative_letters; and Senator Leahy’s June 2011 introduction of the “Personal Data Protection and Breach Accountability Act of 2011″ at 2011 S. 1151. These latest efforts include proposed amendments to a number of statutes, many of which were aimed at hackers and other more traditional threats to computer systems.
The September 2011 effort by the Legislative Branch, however, contains an extremely significant feature: It proposes to make felony violations of CFAA a predicate act of the RICO statute. See 2011 S. 1535 (Section 2, Title I, Sec. 101 (“Section 1961(1) of title 18, United States Code, is amended by inserting ‘section 1030 (relating to fraud and related activity in connection with computers) if the act is a felony,’ before ‘section 1084′.”).). Thus, the CFAA, a statute that has already expanded to apply to a broad swath of employer-employee related disputes and other routine business litigation, may now be combined with one of the most powerful statutes on the books. The RICO statute, of course, has long been used by civil practitioners in a wide range of commercial disputes. In addition to permitting a plaintiff to string together seemingly disparate or unconnected wrongdoing into a pattern of racketeering (see 18 U.S.C. § 1961 (1), (5) (definitions of and “racketeering activity” and “pattern of racketeering activity”); U.S. v. Bergrin, 2001 U.S. App. LEXIS 7457, at *19 (3d Cir. April 12, 2011) (“Because § 1961(1) casts such a wide net, RICO’s reach can be exceptionally broad”)), the RICO statute also provides for drastic remedies: Conviction for a violation of RICO carries severe criminal penalties and forfeiture of illegal proceeds, and a person found in a private civil action to have violated RICO is liable for treble damages, costs and attorney’s fees. See H.J. Inc. v. Northwestern Bell Telephone Co., 492 U.S. 229, 233 (1988).
Accordingly, if this proposed amendment is makes its way into the statute, the CFA