It could carry up to a 20-year sentence
Since then, the Sarbanes-Oxley Act has subtly provided the legal groundwork for prosecuting people for something as simple as deleting their browser history. One such case is that of Khairullozhon Matanov, a 24-year-old former cab driver who ate dinner with Tamerlan and Dhzokhar Tsarnaev the night of the Boston Marathon bombings. Federal prosecutors have charged Matanov under Sarbanes-Oxley for destroying evidence, The Nation reports.
According to The Nation, Matanov learned that the Tsarnaevs were suspects in the bombing a few days after the dinner, and went to talk to local police in Quincy, Massachusetts. He reportedly told a few lies to the police, including when he and Tamerlan had last prayed together. And then he wiped his internet browser history and deleted videos from his computer. In May 2014, after being tracked by the FBI for more than a year, Matanov was charged with four counts of obstruction of justice, with one count for “destroying any record, document, or tangible object with intent to obstruct a federal investigation,” which carries a possible sentence of up to 20 years in prison, The Nation reports.
The Sarbanes-Oxley Act is largely related to corporate financial reporting, but one section, Section 802, imposes severe penalties for “destroying, mutilating, concealing, falsifying records, documents, or tangible objects” with intent to impede or stall a federal investigation. Its vague and far-reaching rhetoric allows it to be applied to even non-tangible, personal information like stored records of online activity.
There is a precedent for this kind of prosecution. In 2010, University of Tennessee student David Kernell was convicted under Sarbanes-Oxley for deleting certain information from his computer and clearing his web browser’s cache after hacking into Sarah Palin’s Yahoo email account, according to The Nation.
Intent is difficult to prove
Such broad interpretation of a law that was originally meant to apply to large corporations highlights already simmering questions of what the federal government’s access to citizens’ data should actually look like. Because intent is difficult to prove, the current interpretation of Section 802 could make it possible for the feds to charge citizens for deleting data at any point in time, were it to end up becoming potential evidence at a later date.