Cyber Crime in Outer Space: Houston, Do We Have a Problem?
On August 23, the New York Times published a story about “what may be the first allegation of criminal wrongdoing in space.” The allegation involved a claim of identity theft that occurred when a NASA astronaut on the International Space Station (ISS) used a NASA computer network to access, without permission, a spouse’s bank account in the United States. The astronaut rejected the allegation, asserting that “she was merely doing what she had always done,” with permission, “to make sure the family’s finances were in order.”
Although not mentioned in the story, the alleged wrongdoing implicates the Computer Fraud and Abuse Act (CFAA), which, among other things, criminalizes intentionally accessing a computer without authorization, or in excess of authorized access, and thereby obtaining information contained in a record of a financial institution. The claims and counterclaims of the spouse and the astronaut touch on familiar CFAA issues, such as problems with defining what “without authorization” and “in excess of authorized access” mean in cases not involving hackers or disgruntled insiders as suspects.
More interesting is that someone orbiting Earth used interconnected space and terrestrial computer systems in a manner that possibly constituted a crime. This context is not familiar territory for the CFAA, and it raises legal questions, including whether the United States has criminal jurisdiction over the astronaut in question and what criminal law applies to U.S. nationals in space.
These questions connect with the New York Times reporter’s observation that the “complaint involving bank access from the space station is just one of a number of complex legal issues that have emerged in the age of routine space travel, issues that are expected to grow with the onset of space tourism.” The new age of space activities involves the increasing interdependence of cyberspace and outer space. This interdependence makes the nature of the allegations against the NASA astronaut important to assess at the start of what many believe will be a transformational era for human activities in space.
International law answers the question whether the United States has criminal jurisdiction over a U.S. astronaut on the ISS or Americans on U.S. space craft. Under the Intergovernmental Agreement Concerning Cooperation on the International Space Station, the United States has criminal jurisdiction over its nationals on the station. Beyond the ISS, the Outer Space Treaty provides that a state party launching an object into outer space retains “jurisdiction and control over such object, and over any personnel thereof, while in outer space or on a celestial body.” Thus, the CFAA’s application to U.S. nationals on the ISS or space craft over which the United States retains jurisdiction and control under the Outer Space Treaty would not violate international law.
But, under domestic law, can the U.S. government apply the CFAA to the actions of U.S. nationals in outer space? The federal government can enforce the CFAA against actions taken outside U.S. territory by Americans or foreign nationals. However, to date, the government has only exercised the CFAA’s extraterritorial jurisdiction in cases of a terrestrial nature.
Congress provided for the application of U.S. criminal law to space activities by including space vehicles listed on the U.S. registry of objects launched into space within the “special maritime and territorial jurisdiction of the United States.” However, government and scholarly analyses have questioned whether this provision for jurisdiction over U.S. space vehicles applies to multinational space stations. More broadly, special maritime and territorial jurisdiction includes any place outside any nation’s jurisdiction with respect to a federal criminal offense committed by or against a U.S. national.
The Department of Justice’s manual for Prosecuting Computer Crimes states that special maritime and territorial jurisdiction might provide a source of extraterritorial jurisdiction for the CFAA. However, unlike other criminal offenses, such as murder and false pretenses, that federal law expressly subjects to this special jurisdiction, the CFAA contains no provision that brings its offenses under such jurisdiction. A Congressional Research Service report from 2016 did not list the CFAA as one of the criminal laws that fall under the special maritime and territorial jurisdiction of the United States.
These observations suggest that how the CFAA applies to U.S. nationals engaged in government, commercial, or non-governmental space activities might require clarification. In this new age of space activities, the need for clarity about domestic law arises frequently. Questions have emerged, for example, about how U.S. law applies to post-launch space activities of interest to U.S. companies, such as asteroid mining, lunar operations, and missions to Mars that implicate planetary protection obligations under the Outer Space Treaty.
The allegations against the NASA astronaut will likely be resolved without criminal prosecution. The case’s notoriety might prompt changes in NASA policies and deter astronauts from engaging in online activities from space unrelated to their missions. In addition, the anticipated increase of humans in orbit, on the lunar surface, or on missions to Mars remains, for the moment, well over the horizon. In the meantime, the most serious cybercrime threats for space activities will continue to emanate from the usual, terrestrial suspects.