LOPPSI 2, Partie Remise

LOPSSI 2 ne sera finalement pas présenté au Parlement avant le premier semestre 2010.

Le projet de loi « Sécurité intérieure : loi d'orientation et de programmation pour la performance » ajouterait un nouvel article 222-16-1 au Code pénal visant à réprimer l’usurpation d’identité, qui serait définie comme suit :- « Le fait d’utiliser, de manière réitérée, sur un réseau de communication électronique l’identité d’un tiers ou des données qui lui sont personnelles, en vue de troubler la tranquillité de cette personne ou d’autrui ».- « Le fait d’utiliser, sur un réseau de communication électronique, l’identité d’un tiers ou des données qui lui sont personnelles, en vue de porter atteinte à son honneur ou à sa considération. » Ces comportements sont sanctionnés, selon le projet de loi, sur le modèle des appels téléphoniques malveillants (un an d’emprisonnement et 15 000 € d’amende).

Ce projet de loi est à suivre de près. Si le droit français peut sans doute s’accommoder de l’incrimination spéciale de l’usurpation d’identité numérique, le projet de loi comporte des éléments plus inquiétants pour les libertés publiques.

L’article 23 du projet de loi insérerait dans le chapitre II du titre XXV du livre IV du code de procédure pénale une section 6 bis , « De la captation des données informatiques » , permettant l’installation d’un « keylogging » sur un ordinateur, si autorisé par un juge d’instruction.:

« Art. 706-102-1. – Lorsque les nécessités de l’information concernant un crime ou un délit entrant dans le champ d’application de l’article 706-73 l’exigent, le juge d’instruction peut, après avis du procureur de la République, autoriser par ordonnance motivée les officiers et agents de police judiciaire commis sur commission rogatoire à mettre en place un dispositif technique ayant pour objet, sans le consentement des intéressés, d’accéder, en tous lieux, à des données informatiques, de les enregistrer, les conserver et les transmettre, telles qu’elles s’affichent sur un écran pour l’utilisateur d’un système de traitement automatisé de données ou telles qu’il les y introduit par saisie de caractères. Ces opérations sont effectuées sous l’autorité et le contrôle du juge d’instruction."

Le droit à l’image français pourrait également être remis en cause : le projet de loi modifierait le régime juridique de la vidéo protection et autoriserait les particuliers à installer des systèmes de vidéo protection afin de filmer les abords de leurs bâtiments pour des raisons sécuritaires, dans des lieux particulièrement exposés à des risques d’agression ou de vol. Les images pourraient être conservées un mois.

The Elements of Style, by SCOTUS

I will knowingly eat a sandwich with cheese today, to honor the SCOTUS, who ruled unanimously on Monday that workers using a mean of identification of another person must know that the means of identification they used belongs to another person.

Pursuant to 18 USC 1028 A(a)(1),which prohibits aggravated identity theft crimes, "Whoever, during and in relation to any felony violation enumerated in subsection (c), knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person shall, in addition to the punishment provided for such felony, be sentenced to a term of imprisonment of 2 years." The question the Supreme Court had to answer was whether the statute required the government to show that the defendant knew that the "means of identification " he had unlawfully transferred, possessed, or used, belonged to "another person". The Supreme Court held that he does.


I found this case particularly interesting for two reasons. First, I have been studying identity theft in the US, and in Europe, for many years, and found it a fascinating topic, because it opened my mind to the more vast topic, of "What exactly is identity"?

Also, the SCOTUS reminded all lawyers, and law students alike, that "It's the law, stupid!". Sometimes, when we are looking for the answer of the legal issue that the senior partner just asked us, we sometimes tends to rush to find a well written article on the subject, which will provide us with all kind of neat little references, and handy quotes to be peppered throughout the memo. However, nothing beats a thorough examination of the law, and its analysis. In order to decipher the meaning, one has sometimes to refer to Congressional debates. But most of the time, printed the text, and read it carefully will allow us to find our arguments.

The Supreme Court offered us in Flores-Figueroa v. United States a lesson in both grammar and lawyering skills. Part II of the Supreme Court opinion analyzes and explain why the word "knowingly" in 18 USC 1028 A(a)(1), must be interpreted as applying to all the subsequent listed elements of the crime. The government was arguing that the word "knowingly" applies to all but the statute's last three words, i.e., "of another person". The Supreme Court reminded us that " in ordinary English, where a transitive verb has an object, listeners in most contexts assume that an adverb (such as knowingly) that modifies the transitive verb tells the listener how the subject performed the entire action, including the object as set forth in the sentence, " and adds further that "if we say that someone knowingly ate a sandwich with cheese, we normally assume that the person knew both that he was eating a sandwich and that it contained cheese."

The government tried to scorn using grammar instead of law in order to analyze a case : "The Government correctly points out that in these cases more was at issue than proper use of the English language. But if more is at issue here, what is it? " I will reflect on that today munching on my cheese sandwich.

Cyber-Extorsion

Section 6 of Senate bill S. 2168, the Identity Theft Enforcement and Restitution Act of 2007, would create the crime of Cyber-Extorsion:

Section 1030(a)(7) of title 18, United States Code, is amended to read as follows:
`(7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any--
`(A) threat to cause damage to a protected computer;
`(B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or
`(C) demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion;'.

Don't forget to vote on the issue on Fantasy Congress....

Illinois Right of Privacy in the Workplace Act

The U.S. filed a lawsuit on September 24 against the State of Illinois, seeking to invalidate Illinois Public Act 095-0138, The Right to Privacy in the Workplace Act.

The Illinois law, which will be effective on January 1st, 2008, prohibits employers to enrol in an Employment Eligibility Verification System, i.e. , a database allowing them to check the immigration status of new hires, as they are authorized to do so by federal law, 8 U.S.C. 1324(a). Such verification system includes E-Verify, an online database system operated by the Department of Homeland Security.

Illinois legislators were concerned that the systems currently available to employers are not accurate enough. The law would remain in effect until the Social Security Administration (SSA) and Department of Homeland Security (DHS) databases can determine that their databases are 99% accurate.

The law also requires that employers must safeguard the information provided by the workers, by using passwords and "other privacy protections", to prevent its use by unauthorized person, and to protect their confidentiality. This law may thus prevent, incidentally, the use of such information by unscrupulous employees, allowing them to steal the identities of the candidates. Once again, it shows that all compagnies have a responsability in establishing, and enforcing, clear privacy procedures. Whether it should be a legal obligation, or only a choice, is a question that is still open. As an European, I favor the legal solution, and approve the Illinois legislature. However, the law does not make any provisions for fining the companies that would not put such a policy in place.

NY Credit Freeze Law Takes Effect

The New York credit freeze law takes effect today. NY consumers may as of today choose to place a notice on their credit reports that would prohibit credit reporting agency from releasing the report, or even the credit score. This law was voted as a measure to fight identity theft. After one person's identity has been stolen, the thief typically tries to obtain credit using the victim's name. That law would prevent the thief to obtain credit.

However, since a victim of identity theft is not always immediately aware that she is a victim, thief may still have enough time between their crime and the discovery of the crime to gain credit using the victim's name.