Cyber Security Planning

Cyber Security Sophistication and Planning

Note: This information about Cyber Security Sophistication and Planning is based on an United States Sentencing Commission report to the Congress on penalties for cyber security offenses. In this case, the content of this section deals with the implementation of the Homeland Security Act Directive in relation to Cyber Security Sophistication and Planning. The factor of sophistication and planning is addressed in the guidelines. Section 2B1. 1 includes a two level enhancement, with a minimum offense level of 12, for use of “sophisticated means” at §2B1. 1(b)(8)(C). This enhancement applies to “especially complex or especially intricate offense conduct pertaining to the execution or concealment of an offense. ” USSG §2B1. 1 comment. (n. 6(B)) (to be redesignated n. 7(B)). The majority of section 1030 cases are sentenced under §2B1. 1 and accordingly would be potentially eligible for this enhancement. Section 2B3. 2, the guideline applicable to violations of section 1030(a)(7) involving extortionate demands to damage protected computers, also addresses sophistication and planning. In that guideline, there is a three level enhancement at §2B3. 2(b)(3) for offenses that involved preparation to carry out, or a demonstrated ability to carry out, certain serious types of threats, including threats of death, serious bodily injury, kidnapping or product tampering. The proposed amendment has expanded the scope of this enhancement so that it will also apply to offenses that involved preparation to carry out, or a demonstrated ability to carry out, an extortionate threat to damage a computer system used to maintain or operate a critical infrastructure or used by or for a government entity in furtherance of the administration of justice, national defense, or national security. With respect to cases sentenced under §2M3. 2, involving unauthorized access to and dissemination of national defense and restricted information, the high base offense levels in that guideline – level 35 if the offense involved top secret information and level 30 otherwise – take into account the sophistication and planning inherent in such offenses and punish such offenses at or near the statutory maximum. The United States Sentencing Commission's data analysis suggests that many 18 U. S. C. §1030 offenses are relatively unsophisticated. Of the 116 cases reviewed, only 7 (6%) involved sophisticated means.