Under the Sarbanes-Oxley Act, people are being prosecuted for deleting files or clearing their browser histories, and the harsh penalties associated with these actions can mean up to 20 years in prison.

The 13-year-old act was written into law in 2002 following the Enron scandal. The aim of the federal legislation was primarily to prohibit corporations under federal investigation from shredding or destroying incriminating documents. But since the law doesn’t require suspects to know they’re under investigation, Sarbanes-Oxley has cast a much wider net than it was seemingly intended.

One recent case was that of Khairullozhon Matanov, 24, a friend of Boston Marathon bombers Tamerlan and Dhzokhar Tsarnaev, who had dinner with the brothers on the evening of the bombing. When Matanov saw his friends’ faces plastered on CNN four days later, he went to the local police to inform them that he knew the suspects and had eaten dinner with them the week of the attack.

Matanov, for whatever reason, lied about several aspects of his relationship with the brothers and details that he knew, such as when he and Tamerlan had last prayed together. After speaking to the authorities however, the former cab driver went home and cleared his browser history.

For a year, Matanov went on with his life as the FBI tracked him with a “drone-like” surveillance plane. He was ultimately arrested and indicted in May 2014, despite never conceding that he knew of the brothers’ plan or had any involvement. Three of his four charges were for lies he told during police interrogation, and the other, under Sarbanes-Oxley, was for deleting videos on his computer and clearing his browser history.

Now, the man who has not been accused of any involvement with the fatal attack is working out a plea deal with prosecutors to serve 30 months behind bars, simply for deleting files and clearing his search history. His sentencing is scheduled for June.

Others who have been charged under the act include David Kernell, who was prosecuted under the far-reaching law in 2010 after he used publicly available information to gain access to Sarah Palin’s Gmail account. After downloading content and posting her new password online, Kernell cleared his browser history and deleted all evidence that he had been responsible for the intrusion.

He was charged with unlawfully obtaining information from a protected computer (a misdemeanor,) and felony destruction of records, thanks to Sarbanes-Oxley. The logic is baffling, but it seems as though covering his tracks was significantly more criminal than the tracks he was attempting to cover.

Other befuddling cases of the use of Sarbanes-Oxley include the prosecution of a woman in Illinois who deleted her boyfriend’s child pornography, the Nation reported.

“The idea that you have to create a record of where you’ve gone or open all your cupboards all the time and leave your front door unlocked and available for law enforcement inspection at any time is not the country we have established for ourselves more than 200 years ago,” Hanni Fakhoury, a senior staff attorney at the Electronic Frontier Foundation, told the Nation.