When hackers broke into online storage accounts and posted nude photos online of over half a dozen women celebrities — including Jennifer Lawrence — they didn’t just commit a gross invasion of privacy; they also broke federal anti-hacking laws. The perpetrators, if caught, should be prosecuted. But the case is also an occasion to revisit laws that are broad enough to cover a plethora of computer-related infractions but don’t specifically address the violation of privacy that Lawrence and other celebrities suffered. Just as some states treat peeping Toms differently from other trespassers, voyeuristic hacking targeting individuals may warrant a different punishment than other computer crimes.
Currently, many hackers who steal an individual’s personal files are subject to the same federal laws — most notably, the Computer Fraud and Abuse Act — that prohibit attacks on government agencies and other institutions. The breadth of these laws gives vast discretion, and little guidance, to federal prosecutors and judges. Christopher Chaney, who distributed nude photos of Scarlett Johansson and others, was sentenced to 10 years in jail. That was four more years than prosecutors sought, but less than the 60 years he might have faced. (Internet activist Aaron Swartz was accused of a vastly different offense — stealing academic papers from the JSTOR database — but was charged under the Computer Fraud and Abuse Act as well.)
The punishment for stealing nude selfies should reflect the sense of violation that victims feel. It should also be fair and consistent. Congress needs to refine the computer fraud act and better tailor the possible punishments to the circumstances of specific crimes.