The Feds have dropped a proposal to classify the use of proxy servers as a sign of sophistication when determining the proper sentence for those convicted of a crime. For the time being, anyway.
The idea is likely to resurface once refinements are made to protect innocent uses of proxy servers that aren't related to the crime underlying the sentence.Proxy servers are computers that act as "middlemen" between a client
requesting resources and the servers where the resources reside. One
of the main uses of proxy servers is to mask internet traffic. Using a proxy server makes it difficult to determine what sites a particular computer has visited, and where requests to a server are coming from.
Criminal investigations can become very difficult when suspects use proxy servers since many servers reside in foreign jurisdictions that don't want to assist with US investigations. Even when the proxies are located within the US, tracing activity through a proxy server can involve subpoenaing uncooperative ISPs, which takes up valuable time and effort.
The proposal would have added use of proxy servers as an indicator of sophistication, which would enhance sentences for convicted criminals. Civil liberties groups and technology advocates objected to the plan, however, since they felt the language of the proposal was too broad, and could lead to enhancements for use of proxies that was not directly connected to the crime underlying the conviction.
The US Sentencing Commission seemed to agree, although it declined comment on the matter until it presented its official stance on the issue to Congress.
The discussion has come up because of a law passed by Congress last year that stated that skill and sophistication should be a factor in sentences for online crimes. This proposal made up part of the process of determining exactly what "skill and sophistication" means in the context of online crime.
The language that the Department of Justice proposed went like this: "using any technology or software to conceal the identity or geographic
location of the perpetrator ordinarily indicates sophisticated means." This broad description could include a number of innocent uses of proxy servers that many criminals might not even be aware of.
If someone made a threat to someone online while using their employer's VPN, for example, it's possible that they would employ a proxy server without even knowing it. This could lead to an enhancement even though the perpetrator never actually intended to cover up his location through the use of a proxy.
Several of the people who appeared before the Commission made this very point, and argued that the simple use of a technology can't be a . . . well . . . proxy for intent. Instead, judges must examine the full scope of a defendant's actions when determining the level of skill and sophistication they employed in their online crime.
Or at least until the Department of Justice proposes some better language that everyone can agree on.
See Also: Online proxy users won't get stiffer sentences after all (Ars Technica) Gov't won't classify proxies as 'sophisticated' (Siliconvalley.com)