According to SecurityFocus, the new PATRIOT Act, section 814, expands the US definition of computer crime to include any act the US considers criminal where Internet packets pass through US computers, even if none of the attacker, the attacked, or the computers are under US jurisdiction. It also gives the US Justice Department carte blanche to decide if such "crimes" should be prosecuted in the US. So, like Dimitry Sklyarov, you could be in another country and do something that's perfectly legal in that country, but still be prosecuted by Ashcroft & Co. if your legal activity involves packets sent through the US.

Under the Department of Justice's interpretation of this legislation, a computer hacker in Frankfurt Germany who hacks into a computer in Cologne Germany could be prosecuted in the Eastern District of Virginia in Alexandria if the packet of related to the attack traveled through America Online's computers. Moreover, the United States would reserve the right to demand that the extradition of the hacker even if the conduct would not have violated German law, or to, as it has in other kinds of cases, simply remove the offender forcibly for trial.

What is perhaps the most troubling about this legislation, in addition to the lack of any debate or focus on it, is the fact that the Department of Justice manual simply says that this unprecedented power will be used in "appropriate cases." The Department of Justice provides no guidance to prosecutors or citizens of the world what kinds of cases it will deem to be "appropriate" for the expanded jurisdiction.

In other words, Ashcroft now says US laws on computer crime trump all other international laws -- if we say it's illegal, it is, whether the country it happens in says it's legal or not. The article lists justification about providing reciprocal coverage for international computer crimes and getting US law enforcement involved faster in international crimes, but the one does not justify the other. (found at Politech)