Federal criminal law is an absolute travesty. Not only are the sentences typically very harsh (10+ years in prison is typical) but also many of the statutes are incredibly broad. The book “ Three Felonies a Day: How the Feds Target the Innocent” by Harvey Silverglate was a real eye opener for me. There are so many criminal statutes that prosecutors could lock away virtually any American, even if they’ve not really done anything that a reasonable person would think is wrong.
Except they are often intimidated from invoking things like jury nullification. Selection of juries is highly political and then the court decides whether information is relevant to be given to the jury. I don't see juries really providing much protection.
“Then Reagan got spooked by the movie Wargames – yes, the one with Matthew Broderick – and urged the dimbulbs in the Congress and Senate to send the CFAA to his desk. They obliged, he signed it, and CFAA became law in 1986.”
You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interests had nothing to do with it?
Have we seen mass prosecutions under the CFAA at the behest of corporate interests?
I don't think that's the case, tons of people are violating various policies all the time and they're not being prosecuted.
SCOTUS was right in narrowing the focus, but I'm not sure the CCFA really was some corporate conspiracy, if it was ... they didn't make much use of it outside of some terrible, but still isolated incidents.
Even things like the abuse of arbitration agreements I think more likely stem from creative lawyers using existing laws to their advantage, not as much direct legislating as is often claimed.
As a general rule, I think it's unwise to attribute to conspiracy that which can be sufficiently explained by incentive structures and existing rule frameworks.
It's nice to pretend someone's in charge of all the bad things that happen, but as They Might Be Giants reminds us, most of the world is described by individual actors doing what they can get away with in individual circumstances.
TMBG's "The Shadow Government" tells the story of a man going through life extremely paranoid that powerful forces are conspiring personally against him.
In the end, he is (likely) murdered and disappeared by the mayor of his small town for challenging the mayor's right to steal his property, because in reality there is no higher power checking his local government's authority. It's the lack of any massive conspiracy controlling events that kills him.
or maybe it was written for the benefit of Congressional virtue signaling. The utility of bolstering the reputation of Federal Prosecutors via selective prosecution is just an emergent property?
The term “Virtue Signaling” observes the practice of concealing one's true feelings or ignorance in order to publicly communicate an acceptable moral perspective, thus demonstrating good character to some audience. It is a scornful pejorative to label someone’s actions as “Virtue Signaling”, as it implies they may be disingenuous, deceitful, duplicitous, etc.
Thus very popular with elected officials seeking a positive reputation among the electorate or seeking campaign funding.
Still seems like a long way to get to 'i don't like it'.
I have trouble believing anyone pushing the CCFA somehow cared enough to be disingenuous about it... to me that require more than a randomly applied label.
The mass is the fact that every single person is subject to being abused, any time anyone else wants to.
They can't do it to everyone because of simple logistics, but they can do it to anyone.
If you didn't get thrown in prison today, it's not because the problem doesn't apply to you and you are safe. It's only because no one decided it would be super convenient for them if you went away.
Under that definition, there’s no mass prosecutions under any law, right. There aren’t a great number of prosecutions for federal laws. I can’t find any specific statistics for charges brought under CFAA.
I think the issue isn’t the total number but the potential total number. So if there’s mass violation and law enforcement picks and chooses who to prosecute that’s a problem. Although obviously it’s less a problem if they do that 1,000 times a year vs 1,000,000.
No, they didn't. Once Swartz turned over all the data he had collected and promised not to do it again, both MIT and JSTOR said they were satisfied and told the feds they did not want any further action taken. The feds chose to pursue Swartz anyway.
I don’t think that’s accurate. The MIT report [0] says “ The Institute made no public statements regarding the merits of the case against Swartz or whether it should proceed, nor did it attempt to influence the prosecutor’s decisions on the case, other than to tell the prosecutor that the government should not proceed on the assumption that MIT wanted Aaron Swartz to go to jail.”
But I think that’s pretty weasily as having a neutral position while the government is prosecuting means endorsing the status quo. “Not proceeding with the assumption that MIT wanted Aaron Swartz to go to jail” is so BS. How about a statement of “We do not want AS to go to jail.” Or “We do not believe a crime has been committed” or “As the operator of the network, we do not consider this a violation of CFAA” or the million other useful things MIT could have said and done.
Many urged MIT to advocate to not prosecute and MIT chose not to.
Also MIT brought the charges of breaking and entering that led to Swartz’s arrest. And that’s pretty lame given MIT’s mission and what Swartz was doing.
If I was a student and my guest was arrested for B&E that would be bad.
MIT isn’t legally culpable, but they acted poorly and all they needed to do was say “hey don’t do that” instead it led to a large scale prosecution and a suicide.
Spinning this like MIT wasn’t responsible or JSTOR wasn’t responsible is so mealymouthed.
Certainly. Not charging him for breaking and entering. Not charging him for cfaa charges. Not treating like a laptop plugged in is a felony.
Also I think had MIT asked the prosecutor not to prosecute then the case would have been dropped. Without MIT and JSTOR saying Swartz committed computer fraud, the prosecution would have no case. Etc etc.
> Not treating like a laptop plugged in is a felony.
MIT didn't do that either.
> I think had MIT asked the prosecutor not to prosecute then the case would have been dropped
I don't know what you're basing this on. Everything the prosecutor said at the time made it clear that they wanted to make an example of Swartz and would have done much the same thing no matter what MIT and JSTOR said.
> Without MIT and JSTOR saying Swartz committed computer fraud
Neither MIT nor JSTOR ever said that. Charging Swartz under the CFAA was the federal prosecutor's doing.
> The case existed because MIT wanted it to exist.
I think you are mistaken. I think the case existed because the federal prosecutor wanted it to exist. That's not to say MIT made no mistakes, but we should put the blame for the CFAA prosecution and the threat of decades in jail where it belongs.
> MIT brought the charges of breaking and entering that led to Swartz’s arrest
That's because they didn't know who it was that was doing it. Their main purpose in getting the police involved was to find out.
> Many urged MIT to advocate to not prosecute and MIT chose not to.
Yes, that's a fair point (and IIRC the Abelson report makes a similar point), and it was an overstatement on my part to say that MIT asked that no further action be taken. (I believe JSTOR did, though.)
However, that's still very different from saying that MIT (or JSTOR) "lobbied the feds to pursue Swartz", which is what the post I was originally responding to claimed. Neither MIT nor JSTOR did any such thing.
> Spinning this like MIT wasn’t responsible or JSTOR wasn’t responsible is so mealymouthed.
I don't think either MIT or JSTOR were responsible for "pursuing" Swartz. They certainly weren't responsible for threatening him with decades in jail. That was the federal prosecutor.
One could argue that MIT was "responsible" because they didn't work harder to persuade the feds not to pursue Swartz. But that could just as easily have been because they couldn't wrap their minds around the idea that a federal prosecutor would go so overboard until after it had actually happened, at which point it was too late.
> all they needed to do was say “hey don’t do that”
It's not at all clear to me that that would have made a difference, given the attitude of the federal prosecutor. That's not to say MIT shouldn't have done it (I think they should have), but it's also not an argument, IMO, for MIT being responsible for what happened to Swartz. Prosecutorial overreach is the responsibility of the prosecutor--and of the government that empowers the prosecutor, and ultimately of all of us citizens who empower the government.
> Have we seen mass prosecutions under the CFAA at the behest of corporate interests?
This is a case where a small number of people had a very profitable racket going, selling access to publicly funded scientific papers, and Swartz posed a threat to their racket.
I can understand that but I was responding to someone who claimed "You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interests".
Isn't protecting the interests of a wealthy few exactly what happened in this case?
Look at all the recent Federal activity aimed at shutting down Sci-Hub.
>A reminder that Elsevier made
$6 BILLION selling your academic journals and articles behind paywalls, and made more profit than Amazon, Google and Apple every year for YEARS...
And paid the academics who wrote the articles $0
And paid the reviewers of the articles $0
“I can understand that but I was responding to someone who claimed ''You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interest.''”
You left off the "had nothing to do with it?” part, which was a rhetorical assertion of equivalent hyperbole, but not a direct claim. If you want to interpret it that way you should to include the question mark in the consideration of your response....
Except both MIT and JSTOR did not press charges. It was an ambitious US Attorney, Carmen Ortiz, who wanted a notable scalp to boost her career. That career is now in tatters for completely independent reasons:
Prosecutorial malfeasance is a serious problem in the US, probably worse than police shootings in sheer number of lives broken, notably due to the abusive plea deal system where innocent people have a Hobson's choice to accept a plea just to avoid the risk of draconian penalties if they take the chance of a trial and whatever attorney will be assigned to them.
Congress bans things based on pop culture fiction movies all the time. They banned switchblade knives in 1958 because of gangster movies. Half the federal firearm regulations (such as the Undetectable Firearms Act) seem to be motivated by learning about guns from action movies.
Agreed, I an I think there is a dangerous precedent here for "selling" fear via movies. Entertainment as mass propaganda to enable the passing of unjust laws.
I would not be surprised if the recent upticks are directly correlated with privatized prisons.
There’s a corporate interest right there! Having some experience from within (healthcare industry, original DRG implementations and TEFRA), I can say that not everything you can get Congress to implement (at the behest of lobbyists) works out beneficially for your particular corporate or industry interest.
His personal grudge against Reagan detracts from the overall article. I mean, this law being "one of Ronald Reagan's many idiocies?" Like no one else involved in drafting and passing the law was an idiot? Or that, say, Clinton didn't pass several idiotic laws that have proven disastrous in retrospect? It's troubling to me that Congress always has single-digit approval numbers, and yet people who ought to know better continue to lay blame everywhere EXCEPT Congress.
Yeah, I'd like to see some documentation of that claim. Congress wrote the CFAA. The President probably had nothing to do with writing the CFAA -- he only signed it. We can't blame Presidents for all that they sign, especially when the convention is to veto very very few bills ever.
We lost a good one. I think, at times, back to Aaron and his grasp of both code and politics. That ability to empower people, cultivate discussion, and I would argue, solidarity on human basics, is rare.
There are a lot of grave injustices in this world and this was probably not even remotely close to the worst but I am still really bitter about what happened to Aaron after all these years. I remember how upset I was to hear of his suicide and the things that lead up to them. Maybe it was because he was one of "us" or maybe because his works have improved the lives of so many of us. People like him who make that kind of impact usually ends up becoming rich, etc. Instead he was persecuted until he committed suicide for wanting to make knowledge more accessible. The new SCOTUS ruling helps but I'm still quite sad over what happened.
I'm reminded of "The wheels of justice turn slowly, but grind exceedingly fine." Sometimes this is a feature; we probably don't want frequent, sweeping changes in the legal landscape, or snap decisions based on emotion. But it also means that injustices are righted slowly, and sometimes too late, after people's lives have been destroyed.
"Justice delayed is justice denied." While this SCOTUS decision may vindicate Swartz, he never got the justice he deserved. Now it's too late for that.
There's been a movement on to privatize law to limit rights. One of the sneaky ways they were doing this was taking the Computer Fraud and Abuse Act and making contract law violations into criminal law violations. You breach the contract, we can send you to jail, when it would normally would only be money damages or injunctive relief after the court had weighed in on the matter.
> Prosecutors Stephen Heymann and Carmen Ortiz didn't dispute that Aaron was allowed to access the articles he retrieved. Rather, they said that the WAY he accessed them (using a script instead of clicking on links) was a terms-of-service violation and hence a crime.
I'm sorry, but isn't that a major oversimplification of what he did?
That's what the article is about. Basically the federal hacking law defines computer crime as "exceeding your authorization" on a computer that didn't belong to you. Hence violating terms of service would be computer crime.
Essentially, the Computer Fraud and Abuse act was being interprated waaaaaaaaaay too broadly, because it could be. Here's the discussion on the supreme court win
Under Van Buren, merely saying in the ToS that [X] part of website is restricted access would not be enough to make it a crime under the CFAA.
In the Van Buren case, SCOTUS was very concerned with the potential for innocent actors to unwittingly run afoul of the CFAA. The website would likely have to take further steps to make the restrictions on access known to the user (such as a warning when trying to access [X], and probably also take actual steps to limit access to [X], such that one would only be able to access [X] deliberately knowing that they don't have authorized access to it.
I think that's true of some people, but it's important to remember that all he did was violate the terms of service of a corporation that was (IMO) already behaving unethically and being poor stewards of the data given to it. (I am fundamentally opposed to allowing the result of scientific research -- especially when much of that research benefited from public funding -- to be locked behind paywalls.)
Swartz did not deserve to be driven to suicide for this. He did not deserve jail time, or to be arrested. At worst he deserved to be the defendant in a fairly low-stakes civil suit, and maybe even lose. But that's it.
He’s certainly responsible for his actions, but they were not wrong, I think. And he was obviously unjustly persecuted for his actions.
I think it’s accurate for us to celebrate SCOTUS ruling that the way the feds prosecuted Swartz was wrong and recognize that it will help prevent future Swartz.
You could argue what you want about the legality of his right to have a local copy of the entirety of JSTOR, but he hid equipment in a wire ring closet that was left unlocked on MITs network to carry out his scraping and that’s definitely not something that is “not wrong”.
It doesn’t matter what the action of the equipment or the morality of it. It’s not like it would be bad for a student or professor to put up crypto miners, but then good if they donate them to charity.
And that is not to even mention the fact that his actions caused effectively a denial of service attack on jstor from MIT.
I suppose we can argue since sticking a laptop in a closet isn’t nefarious but just an efficient way to get on the network.
I’ve attended and visited quite a few universities and they all had liberal network access policies. So the idea of anyone caring about someone plugging a laptop into a lanport and downloading millions of text files is not remarkable and happens all the time, I expect.
There was no “denial of service” on jstor as it was still available during the whole time. And if jstor can’t handle a single laptop scraping every article, then that seems to be more of a problem with jstor.
Students scrape jstor and other journal sites frequently and seems like a pretty decent use case that I want to support at my university, if I had one.
Crypto miners are a different story as they consume resources and if Swartz had set up a hundred laptops or a bunch of gpus and used university resources, I’d have a different story.
But the idea that a single laptop running in a closet for a weekend had any material impact on MIT or jstor is so laughable that I don’t understand how anyone honestly presents it as an argument.
He was literally a saint. Sorry, but there aren't many people who were as consistently good as him and who also did so much to fight for justice. You're entitled to your opinion, but I disagree very strongly.
Swartz set up a laptop surreptitiously plugged directly into a networking switch in a controlled-access closet on the MIT campus to which he did not have authorized access.
Importantly, Swartz's prosecution would not have been blocked by the SCOTUS decision in Van Buren because they make a distinction between improper use of computer access and improper access of a computer: Swartz did not have authorized access to the networking switch.
However, if he had used Wifi, to connect to the MIT networking, the charges would have been unsustainable under the Van Buren decision because guests were permitted on the MIT wifi network (and he had a JSTOR account through his Harvard employee account), and his use of it would merely of been improper use at best (since he effectively DDOS'd JSTOR for other users and got MIT's IP range blocked) rather than improper access.
EDIT: Note: a friend pointed out that the DDOS'ing of JSTOR could technically constitute a crime under the CFAA, depending on intent. In Swartz' case, the DDOS was an unintentional side effect of trying to download too much data at once for archival purposes so malicious intent was missing, but someone doing the same thing for the purpose of preventing access to the system could still be guilty of a crime.
> However, if he had used Wifi, to connect to the MIT networking, the charges would have been unsustainable under the Van Buren decision because guests were permitted on the MIT wifi network.
That's not clear to me, because MIT tried several times to revoke his permission to use their guest network by repeatedly banning him by IP address, and then by MAC address. He kept changing those to evade the revocation of permission.
That seems like it would be enough to distinguish from the Van Buren case.
Sadly, that is true, but it might go some way to prevent another tragedy of "justice" being inflicted on someone else who might otherwise die from such persecution.
Yeah, I’d like to see Snowden exonerated, but the government hasn’t changed. They’re still vindictive about being embarrassed, even though it was clearly whistleblowing and, nearly everyone agrees, ethical.
> I'm sure in hindsight he absolutely make a different choice
This strikes me as disrespectful, unless you have some inside knowledge about the whole event. Respect a persons choice to end their life, as that was their final action.
> Most people want to end their pain not their lives
That might be true. But again, we don't know exactly how he felt, so why assume something? Many people end their lives with purpose as well, not every suicide is about ending pain.
The world would be a better place with Aaron Swartz still in it. Unfortunately I don't think we've lived up to the mantle he placed on us with his passing.
Fantastic article, thanks for sharing. Also, this little bit, "... I really wanted to talk about WarGames because it’s the one movie I can think of that’s had the most direct influence on any technology policy issue." made me think of another film, which I would argue had a great effect on technology policy. The film was Disney's "Victory Through Air Power" [1]. (See, specifically, the "impact" section [2] of the Wikipedia article.)
The film is an astonishing piece of animation (which in places resembles an almost manga style), education and propaganda. I cannot recommend it highly enough and it is available at the Internet Archive [3].
Law or not, it seems completely absurd that I should be able to go through any database I have a license to view and just scrape all the content, especially if my purpose is to release their content to vitally damage their business.
At the same time, I don’t see why we should consider it a crime if I ssh into an insecure server and steal a persons credit card information, but if someone at the bank has an old password and go into the same server to get the same information then suddenly it’s ok? I mean the crime in a breaking and entering isn’t that you manage to break the lock, it’s the entering that’s the problem.
While in theory a ruling 'fixing' CFAA is exactly what we've been waiting for I have two problems with it:
The first is a principled objection (and thus in some ways less important): the rulings below were probably correct applications of a terribly drafted law. The way to fix the law in a functioning government would be legislative.
But anyways I really want to share the second objection which is entirely pragmatic: if the only time we ever limit the scope of laws which are badly drafted like this is when we're trying to find some excuse to let bad cops get away with their behavior, then this will have two outcomes: first, bad cops will get away with their bad behavior more often; second, we will find that these precedents don't actually stick when it comes to protecting actual innocents. These are related problems because judges can always find some way to distinguish bad cop cases from innocent private citizen cases to ensure that precedents need not apply.
People talk about the first and second and fourth (... and fifth, sixth, tenth, etc.) Amendments to the US Constitution as being under attack, and the interstate commerce clause as being long dead. But like all stillbirths, no one likes to talk about the equal protection clause.
Whenever I see his name I think of our collective failure to change the rules around research publishing.
...adding, its not just that we failed. It seems like we didn't even try. At least, nowhere near the level that would seem commensurate with outrage years ago.
Just wait until you all start hearing about the punitive psychology being actively used by law enforcement against U.S. Citizens. Methods and procedures trained against Guantanamo detainees. Awful stuff to do to any human.
My opinion here is going to be unpopular, and honestly, I don't care for the way the legal (and political) system has handled any of these issues either. I also haven't thought enough about the Supreme Court decision to decide what I think about it.
But I think this particular article is garbage.
To begin, here's a small point that many engineering types fail to internalize: the legal system is built to deal with intentions. A piece of code or a device doesn't care what your intentions were when you built it, or what the user's intentions are when they use it. It just does what it does. On the contrary, intentions matter in the legal system. Hitting someone with your car is not automatically murder. It may not even be a crime. And stealing bread if you are starving is almost universally recognized as not a crime.
"Prosecutors Stephen Heymann and Carmen Ortiz didn't dispute that Aaron was allowed to access the articles he retrieved. Rather, they said that the WAY he accessed them (using a script instead of clicking on links) was a terms-of-service violation and hence a crime."
I'm a bit ambivalent about this part of Swartz's case, but it is certainly not mustache-twirling evil on the part of the prosecutors. I'm sure Doctrow, like the prosecutors, isn't going to dispute some of the facts in the case: Swartz intended to make those articles free. He was going to take those articles from the system that allowed him to access them and re-publish them in violation of their owner's wishes. Now, I don't like the information property system we have any more than anyone else, but it is the system we have and we get to live with it until we can change it. Swartz was not using a script to download the articles so he could read them later, he was using a script to make copies so he could redistribute them.
And the prosecutors weren't saying, "oh, ho, using a script is bad, you just can't do that." They were arguing that using the script was evidence of Swartz's intentions regarding the copies he was making. Doctrow is here violating one of Hacker News' guidelines, "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
"Security researchers who audit systems and warn their users about defects in them are silenced with CFAA threats, giving companies a veto over who can criticize them and how."
Yes, "security researchers" who have not bothered to clear their activities with their targets beforehand have faced legal problems. Some who have have also faced those, but the legal system is supposed to tell the difference and generally does a fair job. What would you prefer as the alternative?
"Nevertheless, prosecutors charged him under the CFAA, saying that while he was allowed to access the database, doing so for an improper purpose was a hacking crime, because he "exceeded his authorization."
"This may sound sensible – or just expedient – to you. But if the prosecutors were right – if accessing a computer you were authorized to use, but in an unauthorized way – is a felony, then almost everyone is a felon."
Yes, I would argue, that is a hacking crime. (Insider threats are one of the biggest problems with computer systems because they're impossible to secure against---can anyone explain to me the authorization logic that would allow Van Buren to do his job, which apparently includes looking up "personal information", while preventing him from doing anything illegal with that information?) What else do you think you can charge him with, illegally accepting a gift in the process of doing his job?
But mostly, this article is almost entirely scare mongering. "This correct interpretation (far narrower than the DoJ's) safeguards security researchers, competitors, and other researchers doing things like gathering data from a housing site to investigate racial bias in rental ads"---which would be protected, right? Remember, intentions matter.
I get it: Information wants to be free. Cops bad. Lawyers bad. Politicians and judges bad. Anarchy good. Unfortunately, I seem to live in a world where humans are gonna keep humaning so that doesn't work.
Federal criminal law is an absolute travesty. Not only are the sentences typically very harsh (10+ years in prison is typical) but also many of the statutes are incredibly broad. The book “ Three Felonies a Day: How the Feds Target the Innocent” by Harvey Silverglate was a real eye opener for me. There are so many criminal statutes that prosecutors could lock away virtually any American, even if they’ve not really done anything that a reasonable person would think is wrong.
Juries are supposed to protect against some of that, fortunately.
Except they are often intimidated from invoking things like jury nullification. Selection of juries is highly political and then the court decides whether information is relevant to be given to the jury. I don't see juries really providing much protection.
Yet the federal conviction rate is well above 99%. The book provides actual examples where people have gone to prison over nothing.
74% of sentences are < 5 years.
(https://www.ussc.gov/sites/default/files/pdf/research-and-pu...)
A Crime a Day on Twitter is fun to casually scroll through.
https://twitter.com/CrimeADay
“Then Reagan got spooked by the movie Wargames – yes, the one with Matthew Broderick – and urged the dimbulbs in the Congress and Senate to send the CFAA to his desk. They obliged, he signed it, and CFAA became law in 1986.”
You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interests had nothing to do with it?
Is that the case?
Have we seen mass prosecutions under the CFAA at the behest of corporate interests?
I don't think that's the case, tons of people are violating various policies all the time and they're not being prosecuted.
SCOTUS was right in narrowing the focus, but I'm not sure the CCFA really was some corporate conspiracy, if it was ... they didn't make much use of it outside of some terrible, but still isolated incidents.
Even things like the abuse of arbitration agreements I think more likely stem from creative lawyers using existing laws to their advantage, not as much direct legislating as is often claimed.
As a general rule, I think it's unwise to attribute to conspiracy that which can be sufficiently explained by incentive structures and existing rule frameworks.
It's nice to pretend someone's in charge of all the bad things that happen, but as They Might Be Giants reminds us, most of the world is described by individual actors doing what they can get away with in individual circumstances.
> as They Might Be Giants reminds us
Remind me where they remind us? This is the crucial content I'm here for.
TMBG's "The Shadow Government" tells the story of a man going through life extremely paranoid that powerful forces are conspiring personally against him.
In the end, he is (likely) murdered and disappeared by the mayor of his small town for challenging the mayor's right to steal his property, because in reality there is no higher power checking his local government's authority. It's the lack of any massive conspiracy controlling events that kills him.
or maybe it was written for the benefit of Congressional virtue signaling. The utility of bolstering the reputation of Federal Prosecutors via selective prosecution is just an emergent property?
I don't know what anyone means by virtue signaling these days beyond 'i don't like it'.
CCFA beyond the situation described to me still serves a purpose / can be used responsibly.
The term “Virtue Signaling” observes the practice of concealing one's true feelings or ignorance in order to publicly communicate an acceptable moral perspective, thus demonstrating good character to some audience. It is a scornful pejorative to label someone’s actions as “Virtue Signaling”, as it implies they may be disingenuous, deceitful, duplicitous, etc.
Thus very popular with elected officials seeking a positive reputation among the electorate or seeking campaign funding.
Still seems like a long way to get to 'i don't like it'.
I have trouble believing anyone pushing the CCFA somehow cared enough to be disingenuous about it... to me that require more than a randomly applied label.
> Have we seen mass prosecutions under the CFAA at the behest of corporate interests?
The article has Aaron Swartz in the title, so yes. MIT and JSTOR lobbied the feds to pursue Swartz and there are many more examples.
“Mass” is kind of an important word there. Swartz and the “many more examples” are still essentially rare and isolated incidents.
The mass is the fact that every single person is subject to being abused, any time anyone else wants to.
They can't do it to everyone because of simple logistics, but they can do it to anyone.
If you didn't get thrown in prison today, it's not because the problem doesn't apply to you and you are safe. It's only because no one decided it would be super convenient for them if you went away.
Under that definition, there’s no mass prosecutions under any law, right. There aren’t a great number of prosecutions for federal laws. I can’t find any specific statistics for charges brought under CFAA.
I think the issue isn’t the total number but the potential total number. So if there’s mass violation and law enforcement picks and chooses who to prosecute that’s a problem. Although obviously it’s less a problem if they do that 1,000 times a year vs 1,000,000.
> MIT and JSTOR lobbied the feds to pursue Swartz
No, they didn't. Once Swartz turned over all the data he had collected and promised not to do it again, both MIT and JSTOR said they were satisfied and told the feds they did not want any further action taken. The feds chose to pursue Swartz anyway.
I don’t think that’s accurate. The MIT report [0] says “ The Institute made no public statements regarding the merits of the case against Swartz or whether it should proceed, nor did it attempt to influence the prosecutor’s decisions on the case, other than to tell the prosecutor that the government should not proceed on the assumption that MIT wanted Aaron Swartz to go to jail.”
But I think that’s pretty weasily as having a neutral position while the government is prosecuting means endorsing the status quo. “Not proceeding with the assumption that MIT wanted Aaron Swartz to go to jail” is so BS. How about a statement of “We do not want AS to go to jail.” Or “We do not believe a crime has been committed” or “As the operator of the network, we do not consider this a violation of CFAA” or the million other useful things MIT could have said and done.
Many urged MIT to advocate to not prosecute and MIT chose not to.
Also MIT brought the charges of breaking and entering that led to Swartz’s arrest. And that’s pretty lame given MIT’s mission and what Swartz was doing.
If I was a student and my guest was arrested for B&E that would be bad.
MIT isn’t legally culpable, but they acted poorly and all they needed to do was say “hey don’t do that” instead it led to a large scale prosecution and a suicide.
Spinning this like MIT wasn’t responsible or JSTOR wasn’t responsible is so mealymouthed.
[0] https://news.mit.edu/2013/mit-releases-swartz-report-0730
Do you think MIT doing something would've made a difference?
Certainly. Not charging him for breaking and entering. Not charging him for cfaa charges. Not treating like a laptop plugged in is a felony.
Also I think had MIT asked the prosecutor not to prosecute then the case would have been dropped. Without MIT and JSTOR saying Swartz committed computer fraud, the prosecution would have no case. Etc etc.
The case existed because MIT wanted it to exist.
> Not charging him for breaking and entering.
Why not? He did that.
> Not charging him for cfaa charges.
MIT didn't do that. The federal prosecutor did.
> Not treating like a laptop plugged in is a felony.
MIT didn't do that either.
> I think had MIT asked the prosecutor not to prosecute then the case would have been dropped
I don't know what you're basing this on. Everything the prosecutor said at the time made it clear that they wanted to make an example of Swartz and would have done much the same thing no matter what MIT and JSTOR said.
> Without MIT and JSTOR saying Swartz committed computer fraud
Neither MIT nor JSTOR ever said that. Charging Swartz under the CFAA was the federal prosecutor's doing.
> The case existed because MIT wanted it to exist.
I think you are mistaken. I think the case existed because the federal prosecutor wanted it to exist. That's not to say MIT made no mistakes, but we should put the blame for the CFAA prosecution and the threat of decades in jail where it belongs.
> MIT brought the charges of breaking and entering that led to Swartz’s arrest
That's because they didn't know who it was that was doing it. Their main purpose in getting the police involved was to find out.
> Many urged MIT to advocate to not prosecute and MIT chose not to.
Yes, that's a fair point (and IIRC the Abelson report makes a similar point), and it was an overstatement on my part to say that MIT asked that no further action be taken. (I believe JSTOR did, though.)
However, that's still very different from saying that MIT (or JSTOR) "lobbied the feds to pursue Swartz", which is what the post I was originally responding to claimed. Neither MIT nor JSTOR did any such thing.
> Spinning this like MIT wasn’t responsible or JSTOR wasn’t responsible is so mealymouthed.
I don't think either MIT or JSTOR were responsible for "pursuing" Swartz. They certainly weren't responsible for threatening him with decades in jail. That was the federal prosecutor.
One could argue that MIT was "responsible" because they didn't work harder to persuade the feds not to pursue Swartz. But that could just as easily have been because they couldn't wrap their minds around the idea that a federal prosecutor would go so overboard until after it had actually happened, at which point it was too late.
> all they needed to do was say “hey don’t do that”
It's not at all clear to me that that would have made a difference, given the attitude of the federal prosecutor. That's not to say MIT shouldn't have done it (I think they should have), but it's also not an argument, IMO, for MIT being responsible for what happened to Swartz. Prosecutorial overreach is the responsibility of the prosecutor--and of the government that empowers the prosecutor, and ultimately of all of us citizens who empower the government.
> Have we seen mass prosecutions under the CFAA at the behest of corporate interests?
This is a case where a small number of people had a very profitable racket going, selling access to publicly funded scientific papers, and Swartz posed a threat to their racket.
My point being I think it is unlikely the law was created so long ago ... to account for that.
This is more of an explanation of why the law was misused in this particular case.
Swartz posed a threat to the ability to privately profit off of publicly funded science.
I can understand that but I was responding to someone who claimed "You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interests".
Isn't protecting the interests of a wealthy few exactly what happened in this case?
Look at all the recent Federal activity aimed at shutting down Sci-Hub.
>A reminder that Elsevier made $6 BILLION selling your academic journals and articles behind paywalls, and made more profit than Amazon, Google and Apple every year for YEARS...
And paid the academics who wrote the articles $0 And paid the reviewers of the articles $0
https://twitter.com/DrJessTaylor/status/1390798132632596488?...
“I can understand that but I was responding to someone who claimed ''You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interest.''”
You left off the "had nothing to do with it?” part, which was a rhetorical assertion of equivalent hyperbole, but not a direct claim. If you want to interpret it that way you should to include the question mark in the consideration of your response....
Except both MIT and JSTOR did not press charges. It was an ambitious US Attorney, Carmen Ortiz, who wanted a notable scalp to boost her career. That career is now in tatters for completely independent reasons:
https://theintercept.com/2021/02/15/marty-walsh-aaron-swartz...
Prosecutorial malfeasance is a serious problem in the US, probably worse than police shootings in sheer number of lives broken, notably due to the abusive plea deal system where innocent people have a Hobson's choice to accept a plea just to avoid the risk of draconian penalties if they take the chance of a trial and whatever attorney will be assigned to them.
Congress bans things based on pop culture fiction movies all the time. They banned switchblade knives in 1958 because of gangster movies. Half the federal firearm regulations (such as the Undetectable Firearms Act) seem to be motivated by learning about guns from action movies.
Agreed, I an I think there is a dangerous precedent here for "selling" fear via movies. Entertainment as mass propaganda to enable the passing of unjust laws.
I'm all about moving "lobbyocracies" back to democracies, but in this case it does seem to check out.
https://www.nytimes.com/2016/02/21/movies/wargames-and-cyber...
We certainly wouldn't want to blame the Obama DOJ for persecuting, I mean prosecuting, him.
Plenty of blame going around. This has been ongoing since Nixon, and has accelerated during Bush, and has continued during Obama.
I would not be surprised if the recent upticks are directly correlated with privatized prisons.
I would not be surprised if the recent upticks are directly correlated with privatized prisons.
There’s a corporate interest right there! Having some experience from within (healthcare industry, original DRG implementations and TEFRA), I can say that not everything you can get Congress to implement (at the behest of lobbyists) works out beneficially for your particular corporate or industry interest.
His personal grudge against Reagan detracts from the overall article. I mean, this law being "one of Ronald Reagan's many idiocies?" Like no one else involved in drafting and passing the law was an idiot? Or that, say, Clinton didn't pass several idiotic laws that have proven disastrous in retrospect? It's troubling to me that Congress always has single-digit approval numbers, and yet people who ought to know better continue to lay blame everywhere EXCEPT Congress.
Yeah, I'd like to see some documentation of that claim. Congress wrote the CFAA. The President probably had nothing to do with writing the CFAA -- he only signed it. We can't blame Presidents for all that they sign, especially when the convention is to veto very very few bills ever.
We lost a good one. I think, at times, back to Aaron and his grasp of both code and politics. That ability to empower people, cultivate discussion, and I would argue, solidarity on human basics, is rare.
Safe Travels Aaron, you are missed.
There are a lot of grave injustices in this world and this was probably not even remotely close to the worst but I am still really bitter about what happened to Aaron after all these years. I remember how upset I was to hear of his suicide and the things that lead up to them. Maybe it was because he was one of "us" or maybe because his works have improved the lives of so many of us. People like him who make that kind of impact usually ends up becoming rich, etc. Instead he was persecuted until he committed suicide for wanting to make knowledge more accessible. The new SCOTUS ruling helps but I'm still quite sad over what happened.
I am bitter too, and for similar reasons.
I'm reminded of "The wheels of justice turn slowly, but grind exceedingly fine." Sometimes this is a feature; we probably don't want frequent, sweeping changes in the legal landscape, or snap decisions based on emotion. But it also means that injustices are righted slowly, and sometimes too late, after people's lives have been destroyed.
"Justice delayed is justice denied." While this SCOTUS decision may vindicate Swartz, he never got the justice he deserved. Now it's too late for that.
Exactly. My exact thought when I read the title was "Whatever the article says, he's still dead and that, is not going to change.
You can only think of him as a soldier giving his life to defend everyone elses.
Well, a draftee, involuntarily having it taken for the good of everyone else. Damn that's no better.
I don't want to enjoy benefits that were aquired by theft and murder.
I tried. There is no good here and no way to make it ok.
You did! Cool.
Thanks.
He was one of us, just far, far more talented. It's an incredible loss to society, not just geekdom.
There's been a movement on to privatize law to limit rights. One of the sneaky ways they were doing this was taking the Computer Fraud and Abuse Act and making contract law violations into criminal law violations. You breach the contract, we can send you to jail, when it would normally would only be money damages or injunctive relief after the court had weighed in on the matter.
> Prosecutors Stephen Heymann and Carmen Ortiz didn't dispute that Aaron was allowed to access the articles he retrieved. Rather, they said that the WAY he accessed them (using a script instead of clicking on links) was a terms-of-service violation and hence a crime.
I'm sorry, but isn't that a major oversimplification of what he did?
Short answer: no it is not.
Why would a terms-of-service violation be a crime, exactly? Since when is it the job of state attorneys to enforce ToS?
That's what the article is about. Basically the federal hacking law defines computer crime as "exceeding your authorization" on a computer that didn't belong to you. Hence violating terms of service would be computer crime.
Essentially, the Computer Fraud and Abuse act was being interprated waaaaaaaaaay too broadly, because it could be. Here's the discussion on the supreme court win
https://news.ycombinator.com/item?id=27382752
Under Van Buren, merely saying in the ToS that [X] part of website is restricted access would not be enough to make it a crime under the CFAA.
In the Van Buren case, SCOTUS was very concerned with the potential for innocent actors to unwittingly run afoul of the CFAA. The website would likely have to take further steps to make the restrictions on access known to the user (such as a warning when trying to access [X], and probably also take actual steps to limit access to [X], such that one would only be able to access [X] deliberately knowing that they don't have authorized access to it.
It is. I feel that people are too ready to deify Aaron Swartz and act like he held no responsibility in what happened.
I think that's true of some people, but it's important to remember that all he did was violate the terms of service of a corporation that was (IMO) already behaving unethically and being poor stewards of the data given to it. (I am fundamentally opposed to allowing the result of scientific research -- especially when much of that research benefited from public funding -- to be locked behind paywalls.)
Swartz did not deserve to be driven to suicide for this. He did not deserve jail time, or to be arrested. At worst he deserved to be the defendant in a fairly low-stakes civil suit, and maybe even lose. But that's it.
I’m not sure how you think Swartz is diefied.
He’s certainly responsible for his actions, but they were not wrong, I think. And he was obviously unjustly persecuted for his actions.
I think it’s accurate for us to celebrate SCOTUS ruling that the way the feds prosecuted Swartz was wrong and recognize that it will help prevent future Swartz.
They were absolutely wrong actually.
You could argue what you want about the legality of his right to have a local copy of the entirety of JSTOR, but he hid equipment in a wire ring closet that was left unlocked on MITs network to carry out his scraping and that’s definitely not something that is “not wrong”.
It doesn’t matter what the action of the equipment or the morality of it. It’s not like it would be bad for a student or professor to put up crypto miners, but then good if they donate them to charity.
And that is not to even mention the fact that his actions caused effectively a denial of service attack on jstor from MIT.
I suppose we can argue since sticking a laptop in a closet isn’t nefarious but just an efficient way to get on the network.
I’ve attended and visited quite a few universities and they all had liberal network access policies. So the idea of anyone caring about someone plugging a laptop into a lanport and downloading millions of text files is not remarkable and happens all the time, I expect.
There was no “denial of service” on jstor as it was still available during the whole time. And if jstor can’t handle a single laptop scraping every article, then that seems to be more of a problem with jstor.
Students scrape jstor and other journal sites frequently and seems like a pretty decent use case that I want to support at my university, if I had one.
Crypto miners are a different story as they consume resources and if Swartz had set up a hundred laptops or a bunch of gpus and used university resources, I’d have a different story.
But the idea that a single laptop running in a closet for a weekend had any material impact on MIT or jstor is so laughable that I don’t understand how anyone honestly presents it as an argument.
He was literally a saint. Sorry, but there aren't many people who were as consistently good as him and who also did so much to fight for justice. You're entitled to your opinion, but I disagree very strongly.
Swartz set up a laptop surreptitiously plugged directly into a networking switch in a controlled-access closet on the MIT campus to which he did not have authorized access.
Importantly, Swartz's prosecution would not have been blocked by the SCOTUS decision in Van Buren because they make a distinction between improper use of computer access and improper access of a computer: Swartz did not have authorized access to the networking switch.
However, if he had used Wifi, to connect to the MIT networking, the charges would have been unsustainable under the Van Buren decision because guests were permitted on the MIT wifi network (and he had a JSTOR account through his Harvard employee account), and his use of it would merely of been improper use at best (since he effectively DDOS'd JSTOR for other users and got MIT's IP range blocked) rather than improper access.
EDIT: Note: a friend pointed out that the DDOS'ing of JSTOR could technically constitute a crime under the CFAA, depending on intent. In Swartz' case, the DDOS was an unintentional side effect of trying to download too much data at once for archival purposes so malicious intent was missing, but someone doing the same thing for the purpose of preventing access to the system could still be guilty of a crime.
100% agree. While the punishment didn't fit the crime it still was a crime.
> However, if he had used Wifi, to connect to the MIT networking, the charges would have been unsustainable under the Van Buren decision because guests were permitted on the MIT wifi network.
That's not clear to me, because MIT tried several times to revoke his permission to use their guest network by repeatedly banning him by IP address, and then by MAC address. He kept changing those to evade the revocation of permission.
That seems like it would be enough to distinguish from the Van Buren case.
Unfortunately that won't bring Aaron back to life.
Sadly, that is true, but it might go some way to prevent another tragedy of "justice" being inflicted on someone else who might otherwise die from such persecution.
Yeah, I’d like to see Snowden exonerated, but the government hasn’t changed. They’re still vindictive about being embarrassed, even though it was clearly whistleblowing and, nearly everyone agrees, ethical.
He also exposed crimes against the constitution that afaik no one has answered for, yet he himself is effectively banished to a dictatorship.
Poor Aaron -- he was in a difficult place. I'm sure in hindsight he absolutely make a different choice.
> I'm sure in hindsight he absolutely make a different choice
This strikes me as disrespectful, unless you have some inside knowledge about the whole event. Respect a persons choice to end their life, as that was their final action.
I think most suicides are very preventable. Most people want to end their pain not their lives.
"I think most suicides are very preventable."
In the same way, we can solve hunger and war. Theroretically yes, practically very hard.
> Most people want to end their pain not their lives
That might be true. But again, we don't know exactly how he felt, so why assume something? Many people end their lives with purpose as well, not every suicide is about ending pain.
The world would be a better place with Aaron Swartz still in it. Unfortunately I don't think we've lived up to the mantle he placed on us with his passing.
"Demand Progress" --Aaron
[Looks around]
I must agree with you.
The Wargames bit intrigued me, so if others are curious there's way more available about it than I figured.
https://melmagazine.com/en-us/story/wargames-ronald-reagan-c...
Fantastic article, thanks for sharing. Also, this little bit, "... I really wanted to talk about WarGames because it’s the one movie I can think of that’s had the most direct influence on any technology policy issue." made me think of another film, which I would argue had a great effect on technology policy. The film was Disney's "Victory Through Air Power" [1]. (See, specifically, the "impact" section [2] of the Wikipedia article.)
The film is an astonishing piece of animation (which in places resembles an almost manga style), education and propaganda. I cannot recommend it highly enough and it is available at the Internet Archive [3].
[1] https://en.wikipedia.org/wiki/Victory_Through_Air_Power_(fil...
[2] https://en.wikipedia.org/wiki/Victory_Through_Air_Power_(fil...
[3] https://archive.org/details/VictoryThroughAirPower
Awesome movie, tysm, really eye opener.
Law or not, it seems completely absurd that I should be able to go through any database I have a license to view and just scrape all the content, especially if my purpose is to release their content to vitally damage their business.
At the same time, I don’t see why we should consider it a crime if I ssh into an insecure server and steal a persons credit card information, but if someone at the bank has an old password and go into the same server to get the same information then suddenly it’s ok? I mean the crime in a breaking and entering isn’t that you manage to break the lock, it’s the entering that’s the problem.
Everything you are describing essentially amounts to "crime, but with a computer." Crime is still crime, we don't need the CFAA to fight it.
While in theory a ruling 'fixing' CFAA is exactly what we've been waiting for I have two problems with it:
The first is a principled objection (and thus in some ways less important): the rulings below were probably correct applications of a terribly drafted law. The way to fix the law in a functioning government would be legislative.
But anyways I really want to share the second objection which is entirely pragmatic: if the only time we ever limit the scope of laws which are badly drafted like this is when we're trying to find some excuse to let bad cops get away with their behavior, then this will have two outcomes: first, bad cops will get away with their bad behavior more often; second, we will find that these precedents don't actually stick when it comes to protecting actual innocents. These are related problems because judges can always find some way to distinguish bad cop cases from innocent private citizen cases to ensure that precedents need not apply.
People talk about the first and second and fourth (... and fifth, sixth, tenth, etc.) Amendments to the US Constitution as being under attack, and the interstate commerce clause as being long dead. But like all stillbirths, no one likes to talk about the equal protection clause.
Saw this law blog post this morning with the same conclusion (mentioned in passing): https://blog.simplejustice.us/2021/06/04/scotus-limits-reach...
Whenever I see his name I think of our collective failure to change the rules around research publishing.
...adding, its not just that we failed. It seems like we didn't even try. At least, nowhere near the level that would seem commensurate with outrage years ago.
Just wait until you all start hearing about the punitive psychology being actively used by law enforcement against U.S. Citizens. Methods and procedures trained against Guantanamo detainees. Awful stuff to do to any human.
Yes, indeed. And hopefully those actions stop, too.
My opinion here is going to be unpopular, and honestly, I don't care for the way the legal (and political) system has handled any of these issues either. I also haven't thought enough about the Supreme Court decision to decide what I think about it.
But I think this particular article is garbage.
To begin, here's a small point that many engineering types fail to internalize: the legal system is built to deal with intentions. A piece of code or a device doesn't care what your intentions were when you built it, or what the user's intentions are when they use it. It just does what it does. On the contrary, intentions matter in the legal system. Hitting someone with your car is not automatically murder. It may not even be a crime. And stealing bread if you are starving is almost universally recognized as not a crime.
"Prosecutors Stephen Heymann and Carmen Ortiz didn't dispute that Aaron was allowed to access the articles he retrieved. Rather, they said that the WAY he accessed them (using a script instead of clicking on links) was a terms-of-service violation and hence a crime."
I'm a bit ambivalent about this part of Swartz's case, but it is certainly not mustache-twirling evil on the part of the prosecutors. I'm sure Doctrow, like the prosecutors, isn't going to dispute some of the facts in the case: Swartz intended to make those articles free. He was going to take those articles from the system that allowed him to access them and re-publish them in violation of their owner's wishes. Now, I don't like the information property system we have any more than anyone else, but it is the system we have and we get to live with it until we can change it. Swartz was not using a script to download the articles so he could read them later, he was using a script to make copies so he could redistribute them.
And the prosecutors weren't saying, "oh, ho, using a script is bad, you just can't do that." They were arguing that using the script was evidence of Swartz's intentions regarding the copies he was making. Doctrow is here violating one of Hacker News' guidelines, "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
"Security researchers who audit systems and warn their users about defects in them are silenced with CFAA threats, giving companies a veto over who can criticize them and how."
Yes, "security researchers" who have not bothered to clear their activities with their targets beforehand have faced legal problems. Some who have have also faced those, but the legal system is supposed to tell the difference and generally does a fair job. What would you prefer as the alternative?
"Nevertheless, prosecutors charged him under the CFAA, saying that while he was allowed to access the database, doing so for an improper purpose was a hacking crime, because he "exceeded his authorization."
"This may sound sensible – or just expedient – to you. But if the prosecutors were right – if accessing a computer you were authorized to use, but in an unauthorized way – is a felony, then almost everyone is a felon."
Yes, I would argue, that is a hacking crime. (Insider threats are one of the biggest problems with computer systems because they're impossible to secure against---can anyone explain to me the authorization logic that would allow Van Buren to do his job, which apparently includes looking up "personal information", while preventing him from doing anything illegal with that information?) What else do you think you can charge him with, illegally accepting a gift in the process of doing his job?
But mostly, this article is almost entirely scare mongering. "This correct interpretation (far narrower than the DoJ's) safeguards security researchers, competitors, and other researchers doing things like gathering data from a housing site to investigate racial bias in rental ads"---which would be protected, right? Remember, intentions matter.
I get it: Information wants to be free. Cops bad. Lawyers bad. Politicians and judges bad. Anarchy good. Unfortunately, I seem to live in a world where humans are gonna keep humaning so that doesn't work.
you can continue what Aaron started. there is archiving effort to save scihub, google it