Exam 1 Sample

Midterm Exam 1 will be given in class. Anything we’ve covered since the first day of class will be fair game.

Some questions may be simple factual questions. For example:

• State the “Katz test”, and explain what it determines.
• Broadly, what actions create criminal liability under the CFAA?
• What are the differences between a misdemeanor and a felony?
• Whose actions does the 4A control?
• What are the specific requirements of a warrant application, as defined by the 4A?
• What is the typical remedy for a violation of a warrant requirement?

There will be several longer questions, that might you to apply your knowledge of legal reasoning and precedents to hypothetical situations. These are not opinion questions. To receive credit, you must back up your answer with citations of law, policy, precedent, rigorous logic, careful analogy, or the like. Statements like “I feel [element X] should be legal” or “[element Y] seems like it is illegal” will be worth little or no credit.

For example:

• Imagine the following hypothetical: A student at UMass realizes that by sending specially-formed HTTP requests to the Moodle server, he can manipulate stored data on that server without using his web browser. He endeavors to discover if this technique can be used to change grades. Once successful, the student changes several grades stored in the electronic gradebook for his Computer Security class.

  Several days later, the student’s actions are discovered and referred to the relevant U.S. District Attorney’s Office. The student is charged with one violation of 18 U.S.C. §1030(a)(5)(A). The student’s attorney moves to dismiss the charge, noting that §1030(a)(5)(A) prohibits only “accessing a computer without authorization.” In this instance, the attorney argues, the student exceeded authorized access (by using his special technique), but did not access without authorization (as he was permitted to log in normally to Moodle with his username and password).

  As a judge, would you grant this motion (dismissing the case) or deny it (allowing the case to go forward)? Justify your answer.

• Image the following hypothetical: Power Ventures (“Power”) had creates a service that aggregates social media information for Internet users. Users who subscribe to the service authorize Power to access their social media accounts and to make these accounts available and accessible at power.com. Facebook objects to the use of Power’s service by Facebook account holders, noting that their terms of service forbid the delegation of authorization to third parties.

  • Is the user violating Facebook’s terms of service? If so, are they committing a violation under the CFAA?
  • Is Power violating Facebook’s terms of service? If so, are they committing a violation under the CFAA?

  Now suppose Facebook sends Power a cease-and-desist ltter, explaing to Power that their access to Facebook’s website violates their terms of service.

  • Is the user violating Facebook’s terms of service? If so, are they committing a violation under the CFAA?
  • Is Power violating Facebook’s terms of service? If so, are they committing a violation under the CFAA?

• Imagine the following hypothetical: A police officer enters a coffee shop and orders a large quadruple espresso. While sipping her beverage, she notices the man at the table in front of her is viewing what appears to be child pornography. She uses her cell phone to take a picture of his laptop screen. Has the officer searched and/or seized information, under the 4A? Why or why not? Does her action violate the 4A? Why or why not?