

The Criminal Charges Against Aaron Swartz (Part 1: The Law) - abtinf
http://www.volokh.com/2013/01/14/aaron-swartz-charges/

======
gyardley
Sure, but the appropriateness or inappropriateness of the particular charges
isn't the issue. Anyone who focuses on 'computer crime' or any of Aaron's pet
causes is missing the point. The issue is abuse of power, and why the federal
government has so much power in the first place.

Criminals should be a tiny group of antisocial people who deserve serious
consequences for their serious actions, with law enforcement enforcing a
limited set of laws (rape, murder, etc.) universally - going after every
criminal that comes to their attention. Fair and understandable.

Back in reality, most of us have probably innocuously violated some federal
law already (Silverstein's Three Felonies a Day has been mentioned a bunch -
it's a great book.) Even in cases like Swartz's where his violations were
arguably intentional rather than accidental, the penalties are completely
disproportionate to the action.

In this system, where we're practically all lawbreakers, the government has
the discretion to decide exactly whose lives they want to ruin. In the best
case they're enforcing the law selectively in line with their best moral
judgement - for example, Al Capone. He was generally suspected to be a bad
guy, but no one could _prove_ that he committed any sort of real crime - so
out of the millions of people that cheat on their taxes every year, the
government singled him out to prosecute for tax evasion, and then threw the
book at him. Maybe jailing him was a good result, but by selecting one man out
of a pool of millions of lawbreakers to go after, the government crossed the
line from the rule of law to the rule of man. And think of the result when the
government's initial instinct about a person's "good guy" vs. "bad guy" status
is wrong!

In this system, the nightmare is the malicious prosecutor, one that's not even
attempting to "do what's right" but instead is selecting cases to prosecute
for personal motivations - political advancement, personal causes, etc. People
who are initially targeted for federal prosecution but somehow 'escape' are
frequently recharged for something else - for example, the hapless fuel-cell
entrepreneur Krister Evertson. That's what it sounds like happened to Aaron
Swartz - thanks to the previous federal investigation into PACER, when he
popped up again the federal government was delighted to go after him with both
barrels, for reasons having nothing to do with MIT or JSTOR. Even if PACER
wasn't an influence, going after Swartz instead of modern Al Capones shows
that the arbitrary rule of man we've got in place of a real legal system is
working pretty damn poorly.

The way to solve this problem, ultimately, would be to dramatically shrink the
size of criminal federal law - ideally by limiting what can be declared
criminal in the constitution, since we certainly can't rely on the legislative
branch's sense of justice. This will never happen, at least not until this
system is torn down and another is constructed (yeah, you scoff, but
historically this does happen from time to time). In the meantime, we might as
well find legal ways to make being a prosecutor politically unrewarding, and
look for incremental reform where we can find it.

~~~
rayiner
The whole "we each innocuously violate several federal laws ever day!" angle
is a total red herring. This isn't an instance of someone being charged for
actions which nobody thinks should constitute a serious crime.

Go up to your mother and tell her a story that involves someone breaking into
restricted closet at MIT, plugging into their network, evading electronic
attempts to stop him, and downloading millions of scientific articles that
normally are sold for a fee. If your mother is anything like mine, she won't
be able to fathom why anyone would do something like this unless he were up to
no good.

Swartz did not innocuously do anything. He willfully violated laws designed to
proscribe exactly the conduct he was engaged in, conduct that to your average
person smacks of criminal activity. Legislators, who think more like my mother
than they think like you or me, intended to prohibit Swartz's exact conduct.
The prosecutor here was doing exactly what my mother or my Congressman would
consider the right course of action in such a situation.

At the end of the day you have to tackle the real problem, which is this: my
mother understands the difference between joy riding and grand theft auto.
That's within the wheel house of her experience. People interested in
"information freedom" or even just proportionate punishment in these
situations need to be able to make a case to my mom about why downloading
JSTOR articles on MIT's network isn't the same thing as hacking into Bank of
America's servers to steal credit card numbers.

~~~
gyardley
The 'several federal laws every day' angle is there to remind each and every
one of us that we could be treated like Aaron Swartz, whether we think we're
violating a law or not. The federal government prosecutes cases all the time
against defendants who had no criminal intent whatsoever.

After telling your mother that story about Swartz, tell her a bunch of other
stories about a bunch of other potential federal cases, and then tell her she
has the resources to prosecute just a subset of them. Prosecutors are always
complaining about not having enough resources, after all. See if she likes the
feeling of arbitrarily choosing which of a whole bunch of people get a taste
of federal justice, and which go free. Explore the rationale your mother uses
to make her decisions. Do political considerations ever come into it? Does
settling a grudge? The ability of the defendant to defend himself?

I don't get why you're bringing up 'information freedom' or other red
herrings. I'm not particularly interested in that or the rest of Aaron's
politics, which were rather far from my own. I'm not even trying to argue that
Aaron's actions were harmless (although it's true I don't see any significant
harm resulting from them). I'm just stating that the real problem is too many
laws on the books, prosecuted selectively by people who don't have to justify
why they pursue the cases they choose to pursue and ignore the cases they
choose to ignore. Arbitrary power. Rule by man, not by law. Something that
threatens every one of us, no matter what we think of Aaron's actions.

~~~
GHFigs
_The 'several federal laws every day' angle is there to remind each and every
one of us that we could be treated like Aaron Swartz, whether we think we're
violating a law or not._

You mean "convince", not "remind". You're trying to persuade people here, not
remind them of something they already believe. Bear this in mind when trying
to refer to what you think "the real problem" is, else you might say things
that only sound convincing to people that already share your views.

------
binarymax
The witch hunt was inevitable due to the sheer emotion we all felt during this
tragic event. It is correct to step back and not look at getting one or two
attorneys fired - but rather look at the law itself, and reflect on the
absolute absurdity of how it can be applied. If the law is the law, and the
law says that someone downloading academic papers carries the same punishment
as a murderer or rapist, then the law needs to be changed. A fundamental shift
needs to take place.

We can take a page from: "Dear Congress, It's No Longer OK To Not Know How The
Internet Works"

And follow with: "Dear Attorneys, It's No Longer OK To Not Know All Hacking
Isn't Terrorism"

~~~
SeanDav
I think the attorneys getting fired would be a great first step. After all
they hounded Aaron and people like him to send a "message". Let them get sent
a "message" in return.

~~~
nicpottier
Yes, after all, "an eye for an eye" is a great system of justice.

No, they shouldn't be fired for doing their job, regardless of the
consequences.

It is a tragedy that Aaron took his life, but nobody can argue that it was an
appropriate response to the challenges posed to him.

You can't blame a prosecutor because Aaron reacted violently to them doing his
job, just as you can't blame violent video games for Columbine or D&D for kids
hurting themselves in the forest with swords.

They are all contributing factors, but it is the core mental illness that is
at fault.

~~~
chris_wot
If the job of the prosecutor is to persecute someone, even after the "victim"
resolved their issue with the offender, then they have a shitty job and should
just up and quit.

There are better jobs out there: ones that don't destroy the lives of good
people.

~~~
watty
Even good people fuck up. Aaron committed crimes and got himself in trouble.
Aaron then killed himself. There are many people who could have done things
differently to prevent this from happening but why should we point fingers?

~~~
chris_wot
JSTOR, the offended party, sorted it all out with Aaron out of court. It was
an issue of copyright infringement, not theft, but Ortiz characterised it as
such. She decided to pursue it out of some misguided and rabid attempt at
sticking Aaron's head on a pike a a warning to others, and to make her CV look
good.

There are fingers to point, and they need to be pointed in the right
direction.

~~~
maxharris
Copyright infringement is theft. At root, all property _is_ intellectual
property.

[http://aynrandlexicon.com/lexicon/patents_and_copyrights.htm...](http://aynrandlexicon.com/lexicon/patents_and_copyrights.html)

~~~
chris_wot
Interesting take, but as with much of Ayn Rand's work, fundamentally flawed.
An idea can be had independently. The idea if a computer was independently
conceived upon in the UK and in Germany at around the same time. Intellectual
Property laws weren't needed to "protect" the idea.

All that I really being said is that the person who comes up with an idea
should be properly compensated. You don't need IP laws to do that. Many
businesses agree - they file patents for inventions for their employees, and
pay them a wage (and possibly a bonus).

------
ramanujan
One thing worthy of notice are the "combo" nature of these penalties. For
example, he says Computer Fraud is pretty much the same as Wire Fraud. Yet
that's a separate count, with more years/fines/numbers, which gives the
prosecution a larger Sword of Damocles to hold over someone's head. Why have a
separate crime if you are always going to charge both?

Kerr is probably right on the narrow point that if you decided to throw the
book at someone you'd hit them with a combo like this (and they later expanded
it into a 13-hit combo), and might even be right that this combo is "nothing
unusual". We should wait for part two, but the multiplication of an infinite
number of federal statutes in combination with prosecutorial discretion looks
like the real problem here. We need to trim the sails of these prosecutors in
a big way, or at least provide an external check.

For example: they're against jury trials? They want to deny people the right
to a jury by depleting their cash? Well, what about a virtual jury? Have a
site with all public court documents and filings, like the grand jury
indictment. Look at how many years they are pursuing and include bios/faces of
the accused, defense, and the prosecutors. Then have people vote up/down as to
whether or not they think the punishment fits the crime. Completely non-
binding of course, and conceptually separate from the question of
innocence/guilt. Include lots of analytics/stats on past convictions and the
like. Make money via Amazon affiliate links to books on crime, TV shows, etc.
And do SEO so that people found innocent are very clearly marked as such in
search result snippets.

Many crimes are salacious so with reasonable graphic design you'd have no
problem getting visitors (like the Smoking Gun). The resulting scrutiny of
prosecutorial decisions by thousands of people would indeed change the
profession, putting a second and more scalable check on them comparable to the
press.

~~~
cones688
Key point with regards to your opening paragraph is:

" But the ordinary practice is to charge all the possible offenses committed
in the indictment, even if they overlap, and then let the jury sort them out
at trial."

There is at least a passable amount of evidence for each of the charges, so
naturally the prosecution will maximise the number of possible charges. This
prevents the whole case falling through if of the one of the counts fails.

~~~
jrs235
So force the prosecution to pick the appropriate charge?

(Or are the prosecutors not versed well enough in the law to know which
law/crime is the correct one that was violated?)

What do you think about this: if the prosecutor thinks the big charge might
not stick because the evidence is questionable then charge the lesser crime?

Or perhaps (I know many don't like this, especially the government) a separate
trial for each charge. Yes, the cost to prosecute goes up (if all charges are
going to be charged) and that's why they combine multiple charges into one
trial. But psychologically, if the jury see that a person has been charged
with 13 crimes then he must be guilty of one or some of them right? If the
state had to try each charge separately and the big one didn't stick, then if
the state truly thought the next one would stick do that trial.

Our legal/justice system has a flaw and that flaw was to let a few guilty men
go free to safe guard and protect innocent men from going to prison.

~~~
fusiongyro
How is a separate trial for each charge different from double jeopardy? Part
of the point of having the prosecutor bundle together all the possible charges
is so there can be a single trial in which the truth comes out. How are you
going to "lock in" the possible set of charges early on in such a way to
prevent the prosecution from just digging up one more offense at the end of
every trial ensuring the defendant never gets to go on with his/her life?

This tragedy is really bringing out the propensity of us Americans to try and
find someone to blame for every bad thing that happens so we can prevent bad
things from happening again. Unfortunately, there's a certain level of tragedy
in this world that is just random and unavoidable. The hang-wringing isn't
doing Aaron or his causes any good, it's just creating new victims and wasting
a lot of time.

~~~
danielweber
_so there can be a single trial in which the truth comes out._

As a point of order, since trials are incredibly stressful and expensive for
the accused, society isn't supposed to use them for "the truth to come out" or
"to find out what happened."

The trial is where the state -- having decided internally that a person is
guilty and must be punished -- goes to prove its case to a jury of the
accused's peers, in an orderly courtroom where only pertinent evidence is
allowed.

This probably backs up your point even more -- having multiple trials for the
same thing is horrible for the accused.

------
roel_v
Highlight:

"This is going to be a long post, so here’s the summary of my conclusion on
the first question: I think the charges against Swartz were based on a fair
reading of the law. None of the charges involved aggressive readings of the
law or any apparent prosecutorial overreach. All of the charges were based on
established caselaw. Indeed, once the decision to charge the case had been
made, the charges brought here were pretty much what any good federal
prosecutor would have charged. This is different from what a lot of people are
hearing on the Internets, so I realize this post isn’t going to be popular."

(should have been in the title imo)

~~~
bane
Right, which points strongly to how disproportionate and broken the penalties
are in the legal system.

------
hobbyhacker
I've read the piece carefully and the thing that stands out for me most is the
bit about the data being 'property'.

It is argued that since JSTOR claims property rights with a tangential link to
another case where someone downloaded a chunk of software that was in wide
distribution and used that to their defense which was invalidated is reason
enough to establish that this data was the property of JSTOR and that any
unauthorized download is therefore a breach of the law.

This is interesting because as far as I can see the whole of Aaron's argument
revolved around this data being public property all along by virtue of the
research being publicly funded and the fact that many authors of these papers
can't legally distribute their own work.

If the law can't distinguish between unjust claims of property and a complete
lack of public interest on the one side and the good intentions of an
individual on the other then you can stick to the 'letter of the law' but that
means the law is no longer functional.

I also keep reading about 13 counts, and here there are only 4, is there any
reason for the discrepancy or is this commentary based on the pre-September
expansion of the charges?

------
antman
The professor says this is a first post is about the law, but it is an
assortment of opinions.

 _II. The Legal Charges Brought Against Swartz (a) Wire Fraud. The Wire Fraud
statute, 18 U.S.C. 1343, prohibits a scheme to gain “property” by false
pretenses. This strikes me as a pretty strong charge here. The false pretenses
are provided by the false identification and spoofing of Swartz’ IP address
and MAC address._

-> This is not false identification, IP or MAC is not tied to Aaron as person. MIT allows guest access and blocking an IP does not mean forbidding to a person access.

 _Swartz was trying to trick JSTOR into giving him access to their database
after they had specifically tried their best to ban him from doing so. And the
“property” was the contents of the JSTOR database itself._

-> The property is not the contents of the database since it was not produced by them they were handling it.

 _Some might argue that the contents of the JSTOR database should not be
considered “property.” But I think that’s a hard argument to make in light of
United States v. Seidlitz, (...) that OSI invested substantial sums to modify
the system to suit its peculiar needs, that OSI enjoyed a multi-million dollar
competitive advantage because of WYLBUR,(...)_

-> "OSI invested substantial sums to modify the system to suit its peculiar needs, that OSI enjoyed a multi-million dollar competitive advantage because of WYLBUR" ???????? This is the exact opposite of this case where specifically JSTOR cannot alter the content of the producer. It's mission statement says it is also a not for profit organization [1]

 _That reasoning seems to apply reasonably well to the JSTOR database, too.
See also Carpenter v. United States, 484 U.S. 19 (1987) (recognizing a
property right for purposes of federal fraud statutes for a business in
confidentiality and use of information to appear in a forthcoming
publication). It’s possible to argue that Seidlitz is distinguishable, but I
think it’s an uphill battle._

-> If it possible to argue, then it is possible for the prosecuter to show discretion

 _(b) Computer Fraud. The next charges were brought under the Computer Fraud
statute, 18 U.S.C. 1030(a)(4), which is a close cousin of the Wire Fraud
statute. The two are usually charged together in computer crime cases, and
there isn’t really all that much that separates them that we need to dwell on
here. So let’s move on to the next crime._

-> ... so if there isn't a wire fraud there is also no computer fraud?

 _(c) Unauthorized Access. The next charge was unauthorized access to a
computer to obtain information valued more than $5,000, in violation of 18
U.S.C. 1030(a)(2)(C) and 18 U.S.C. 1030(c)(2)(B)(iii). I think this charge was
a fair one. There are two notable legal issues here. First, was the
information valued at more than $5,000? The answer is clearly yes under the
leading case of United States v. Batti, (...)methodology when “information
obtained by a violation of § 1030(c)(2)(B)(iii) does not have a readily
ascertainable market value.” In such cases, the court held, “it is reasonable
to use the cost of production as a means to determine the value of the
information obtained.” Creating thousands of journals over many years
obviously costs more than $5,000, so that element is easily satisfied._

-> He did not steal any journals. The only thing he got was the content that for JSTOR it had a zero cost of production. At least they have not claimed it did since they dropped the case. The Batti case had as an example a video feed that the company had created, and the cost for its production. That does not seem releveant it is legal name dropping.

 _(...) They blocked his IP address; he changed it. They blocked his MAC
address; he spoofed it. They blocked access and he broke into a restricted
closet and connected directly to MIT’s network. This is not merely a case of
breaching a written policy. Rather, this is a case of circumventing code-based
restrictions (...)So I think unauthorized access is established here, too._

-> It is pretty clear that he has not exceed anything not explicitly stated. Was there a page saying "We forbid YOU the PERSON to ever access this server?". I guess there wasn't because it would have already become an internet sensation. He did not circumvent code restrictions since there weren't any for MIT guests. The professor does not see why this is different than stealing someone else's password. An interesting view for a law Professor, so help me god.

 _(d) Computer Damage. The final charge brought was exceeding authorized
access and thereby impairing the availability or integrity of information in
ways that cause more than $5,000 or loss or involve more than 10 computers, in
violation of 18 U.S.C. 1030(a)(5)(B) and 1030(c)(4)(A)(i)(I) & (VI). This is a
plausible charge, although we’d need to know more details about the case to
know if it is fully merited. I’ve already covered the elements of authorized
access, so we can adopt that analysis above here and move on to the other
elements._

-> We should thank the unbiased professor here also.

 _To get to $5,000 in a 1030(a)(5) case, the easiest and most widely-accepted
methodology in the caselaw is to focus on the time spent responding to the
unauthorized access. (...)_

-> JSTOR seems to have had an automated system that cut access so there is not a proof that anyboy worked on it. After the breach was established JSTOR and MIT should provide data of manhours that were used ouside the daily shift (was there overtime? a destruction of the system?). Merely adding restrictions that they previously had CHOSEN not to have as part of the system is definitely not a response cost. They were repairing a broken business model. Anyway good luck obtaining dollar figures from JSTOR or MIT for the prosecutor.

 _The impairment of availability or integrity element would probably be
satisfied, as well, (...) And more significantly, does access to a particular
service from some users really constitute an impairment of availability of the
JSTOR computer itself? I’m not sure, but I’m wary of that argument. So the
1030(a)(5) charges are plausible, but we would need to know more facts to know
for sure if they were justified._

->"The impairment of availability or integrity element would probably be satisfied" and "The indictment alleges that Swartz’s conduct impaired the working of the JSTOR database but doesn’t give us much detail, so it’s hard to be sure" are two opposing sentences. Either it is probably justified or it is hard to be sure. Ofcourse since the admins have taken down the system themselves they will have to prove that it would go down by itself. But neither JSTOR or MIT have provided such data.

 _III. Conclusion

My conclusion, at least based on what we know so far, is that the legal
charges against Swartz were pretty much legit. Three of them are pretty
strong; one is plausible but we would need to know more facts to be sure. Of
course, there may have been reasons not to charge Swartz even though he had
violated these statutes or to offer him a lenient plea. I’ll take on those
questions in my next post. But to the extent we’re focused on just what the
law is, I think that what Swartz was alleged to have done fits pretty well
with the charges that were brought._

->My Conclusion: This is a biased opinion but not necessarily wrong or willfully biased. It is legally biased. Truth or Mens Rea is irrelevant and things that are hard to be proven by the government alone are described as self explanatory, or obvious interpretation of facts.

[1] <http://about.jstor.org/about>

------
SagelyGuru
When the laws, applied fairly and legitimately, have the effect of silencing
an activist working for the public benefit, one has to start questioning those
laws and the motivations behind them.

~~~
aneth4
This activist was working to change laws, so that's a circular argument.

------
jmcgough
I'm looking forward to the second part of this (on prosecutorial discretion) -
this is a good analysis.

I feel torn about the trial, and I know I'll get flack for this but what Aaron
did was illegal, and I'm sure he knew while he was doing it that it was
illegal, or at least in a grey area. At the same time, they were way overly
aggressive in prosecuting him.

There's something wrong with the system when someone can have their life
destroyed and their resources drained by their choice to exercise civil
disobedience in protesting something that is morally wrong.

~~~
josephlord
Largely agree although I would insert the word 'probably' before illegal in
your second paragraph. It hadn't come to trial yet and we don't have ALL the
evidence (especially the defense evidence). I would say that I don't think
that the concept of prosecuting him was inherently or clearly wrong.

I'm also very interested to read the second part. I hope it covers the number
of counts of each charge brought. This seems to be something that racks up the
potential penalty very fast and the individual offences aren't necessarily
that distinct from each other

------
btilly
I read through this and got the opposite impression from most people who are
responding here.

This is explicitly not an analysis of right versus wrong. This is an analysis
of the cudgel that the prosecutors were about to use on Aaron. This is about
whether the charges were likely to stick in court.

The analysis says that the cudgel was very strong. Aaron had real cause to
fear. And his defense was going to face an uphill battle.

I look forward to part 2, which is explicitly supposed to be an analysis of
whether or not the cudgel should have been swung in the first place.

~~~
tptacek
I would be shocked if Part 2 says anything other than "the prosecution's
conduct was abusive", given that Swartz's violations were done without
commercial intent, caused little if any lasting damage, and were (mostly) not
malicious. The defendants in the Gonzalez carding ring got lower sentences
than Swartz was threatened with.

~~~
btilly
I suspect the same, else I wouldn't be looking forward to it.

But even though I expect the conclusion, I'll still be very interested to see
how a legal expert makes the case persuasively, and manages to support it with
objective examples.

However your comparison to the Gonzalez carding ring is highly unfair. We've
been repeatedly warned about the difference between statutory maximums and
actual penalties. Jail sentences are like college tuition, the actual amount
you pay is not the official sticker price you're given.

How much less? According to [http://www.boston.com/metrodesk/2013/01/14/mit-
hacking-case-...](http://www.boston.com/metrodesk/2013/01/14/mit-hacking-case-
lawyer-says-aaron-swartz-was-offered-plea-deal-six-months-behind-
bars/hQt8sQI64tnV6FAd7CLcTJ/story.html) the plea bargain that Aaron was
offered was that he had to plea guilty to all 13 counts, and spend 6 months in
jail. That's a lot less than what the defendants in the Gonzalez carding ring
got.

But that's a plea deal. If Aaron took it to trial and won some, lost the
others, his likely sentence would be something greater than the plea bargain
and significantly less than the maximum. The judge would have discretion, and
would likely take everything you say into account in determining the penalty.
So I'd still hope it would be less than what the defendants in the Gonzalez
carding ringt got.

That said, being declared to be a felon is no picnic, as many can attest.
Doubly so if, like Aaron, you have friends all over the world and would like
to travel to conferences in other countries. And yes, you can sometimes get
the felony officially expunged years later, but even that is imperfect. (As I
learned sharing beers with Randal Schwartz...)

~~~
tptacek
We know the prosecution felt a 6-7 year outcome was reasonable for the
offenses Swartz committed. We know that outcome is worse than that obtained by
members of a carding ring. I agree with you: the carders plead out, and the
prosecutors were offering a much more lenient sentence to Swartz for pleading
out.

The whole thing is a tragic game of chicken. Both players seem to have been
dysfunctional in different ways. But the prosecution wielded far more power.
If what we know about the case is the whole story, then any reasonable person
looking at this case should have been able to see that a 6 year sentence was
an unjust outcome. Unlike most HN'ers, I actually have no problem with plea
deals and stern prosecutions for people who go to trial; the system has to
work that way unless we fund it differently. But the stern prosecutions need
to be hemmed in by reason and fairness and logic. Here, it doesn't seem to
have been.

~~~
btilly
How do we know that the prosecution felt a 6-7 year outcome was reasonable?

Otherwise we're in violent agreement.

------
jasonzemos
The best refutation to this law professor's analysis is mostly within here:
[http://io9.com/5975592/aaron-swartz-died-innocent-++-here-
is...](http://io9.com/5975592/aaron-swartz-died-innocent-++-here-is-the-
evidence)

The application of these federal _penal statutes_ is wholly improper for this
case. This case is a _civil matter_.

~~~
bradleyjg
It may have been improper in some grand sense, but that's not what Professor
Kerr was addressing. He was addressing whether or not the conduct fit the laws
in question, as interpreted by the relevant case law.

Alex Stamos doesn't even really try to refute that. Instead he provides
context that suggests that it was an injustice to apply those laws to Aaron
Swartz. That's a separate question, and one that Kerr apparently intends to
address in a follow up post.

~~~
AnthonyMouse
The thing that's going to disappoint me is if Kerr strictly analyzes whether
the prosecutor choosing to bring the charges was unlawful, which I imagine it
probably wasn't -- it's standard operating procedure.

Which is its own problem. But the problem with what prosecutors did is that
prosecutors are _allowed not_ to bring the charges and did anyway,
notwithstanding the epic disproportionality of the charged penalties to the
acts.

In other words, the problem is that the law is defective, and prosecutors
could have had a conscience and not abused that fact to break this kid, but
they failed at being human, and for that they are culpable. Morally and
ethically if not legally.

~~~
bradleyjg
That's supposed to be the second blog post.

While we wait though, I wonder Aaron's lawyers ever explained to him that
thirty five years was an all but impossible outcome of this case, that seven
years was a longshot and some type of non-incarceration a distinct
possibility. If his lawyers for some reason didn't make that clear they did
him no favors.

Now whether pervasive overcharging to extract pleas is itself ethical is
another question ...

------
Vivtek
You know what Aaron's sin was? Greed.

If he'd set this _same thing_ up so that it would download JSTOR over the
course of, say, two years, nobody would ever have been the wiser, we'd
actually have that data today since it's actually _been_ two years, and he'd
still be alive.

But he had to have all the data NOW. I get it, I really do. He lost track of
the goal in the excitement of the pursuit.

~~~
rdl
His sin was being in the middle of the barbell. Act fully legally and under
your own name (or, only slightly illegally, and with the intention of being
arrested and prosecuted as civil disobedience), or, act entirely covertly,
unlinkable to your identity, and just get it accomplished.

Doing things multiple times with risk that someone would set up surveillance
is what exposed him. Buying a throwaway laptop for cash, wiping all prints,
and hiding it somewhere off-video, waiting a few days, and then starting a
slow-leech, uploading the content to some anonymous site, and then acting
shocked about how someone copied what he'd done with PACER in this way, would
have been a lot safer. $300 laptop is cost of doing business. ATM skimmers
crews know this.

~~~
ansible
I agree. After getting detected and stopped the first couple times, I would
have preferred him to be a bit more clever.

And certainly when it gets to the point you're worried about being identified
via video surveillance, it is time to take a radically different approach.

------
fijal
Ok, fine. Assuming this analysis is correct (and I really lack the legal
background to asses this), it does not really change that Aarons accusations
was in the mind of people who know what they're talking about utter nonsense.

Hence the logical conclusion is that prosecutors might be fine, but it does
not change the fact that the law is completely nonsensical and this is what we
should change. How about you guys fire some congresman instead?

~~~
AnthonyMouse
You can't really fire a Congressman, only vote them out at the next election.
But that comes after you push them to fix it and they falter. First we push
them to fix it. Hard.

------
lhnz
Unrelated to this, but does anybody else wonder whether the prosecutors would
have gone after him when others decided not to if it wasn't for his activism?
SOPA being stopped surely annoyed a few powerful people.

What better way to move up in the establishment than by taking out bright
activists...

------
belorn
On the legal theory used, I do find a few areas where further information
would be useful.

In the case of Wire Fraud, is it JSTOR or MIT's rights that was violated if
someone under false pretenses gains access to MIT's facilities and MIT's
licensed access for research articles? What is the legal precedence in regard
to rented or licensed property; is it the licensee's right that was violated
if a crime is made to the property whiles in the care of the licensee or is it
the licensers? By continuing giving MIT access after the breach of
contract/license agreement, does JSTOR still have a legal claim of Wire fraud?

In the case of Unauthorized Access, Orin Kerrthe refer to a methodology of
using the cost of production as a means to determine the value of the
information obtained. But are we talking about the cost of production that
JSTOR did in producing access to the information, or the production of the
information itself done by parties not JSTOR or MIT. If we talk about the
production efforts made by JSTOR, would the production cost be limited to the
licensing fee's that JSTOR is (or are they?) paying to get exclusive access to
the research journals?

~~~
jforman
_By continuing giving MIT access after the breach of contract/license
agreement, does JSTOR still have a legal claim of Wire fraud?_

You're thinking in terms of a civil suit, where an aggrieved party sues to
restore their property/rights/etc. This was a criminal suit where the process
is very different: the party suing is always the government in criminal cases,
and the only matter at hand is whether the defendant violated the letter of
the law. Aggrieved parties don't even have any authority to press or drop
charges in criminal cases: that authority rests solely with the government
(and the government will often continue cases when the parties involved just
want it to go away).

------
JohnsonB
How can spoofing IP/MAC addresses be considered "false pretenses" if these are
considered, by nature of how computer networks and management thereof have
evolved, to be transient or arbitrary in nature? Spoofing IP/MAC addresses
does't even involve "pretenses", because it is a fallacious assumption
(usually by the technically illiterate) that IP/MAC addresses correspond, or
are even supposed to correspond, to a unique person/computer/entity in the
first place. I can't say this is a good analysis by Kerr, given that he
ignores extremely basic weaknesses such as this in the charges brought against
Swartz.

~~~
danso
Isn't this like asking "How is wearing a fake mustache in public a false
pretense?" It isn't. But if I'm doing it with an obvious intent on deceiving
someone about my identity, don't you think that context matters? Even if the
fake-mustache seems ridiculous?

~~~
JohnsonB
That's the point, the spoofing of the IP/MAC addresses in themselves prove
nothing, and yet Kerr is assessing it as such. The guy with a fake mustache
could be a method actor preparing for his next role, and Swartz could have
thought "MIT/JSTOR doesn't give a damn if I scrape these articles, but I don't
care to ask for official resources to do it just to be told no."

~~~
andylei
> Swartz could have thought "MIT/JSTOR doesn't give a damn if I scrape these
> articles, but I don't care to ask for official resources to do it just to be
> told no."

except that

1\. his behavior was clearly against JSTOR's terms of service

2\. his computer was blocked MULTIPLE times

3\. when he retrieved his computer, he was using his helmet as a mask to avoid
being filmed

~~~
JohnsonB
1.) We're reading TOS now? Is that against the law?

2.) Irrelevant, could be a simple traffic reduction block.

3.) Too flimsy to rest the entire charge on.

~~~
andylei
> 1.) We're reading TOS now? Is that against the law?

so is your comment a joke reply, or do you have a serious argument? has this
ridiculous response indicates that you concede that it is against the terms of
service?

> 2.) Irrelevant, could be a simple traffic reduction block.

if he thought it was that, why did he need a mask to retrieve his computer?

> 3.) Too flimsy to rest the entire charge on.

agree. except there's all the stuff above.

~~~
jasonzemos
Violating a private entity's TOS is not a federal crime. He did not mask
anything: MIT has an open network, and apparently unlocked wiring closets
(trespassing was not charged). Rotating your IP address on an already open
network to circumvent said TOS does not constitute a statutory violation
either. You can sue him, that's about it.

~~~
pdonis
What about JSTOR's TOS?

------
chmike
What about 35 or more years prison sentence threat ? Whether law was breached,
is apparently not contested. What is weird is this sentence.

In France, murder gets you usually at most 20 years jail. The sentence seams
totally disproportionate to the harm. Will Mr Orin Kerr also discuss this
aspect ?

Another point is the harm done just by the trial. Going for trial is in itself
condemning someone to pay a huge amount of money. Even if if that someone is
finally proven innocent or the charges excessive and abusive.

~~~
tptacek
Clarity:

Swartz wasn't seriously threatened with 35 years. The prosecution told his
attorneys they'd seek ~7 years.

7 years is still ludicrous. 1 year would be ludicrous.

The prosecutors can't fairly escape the blame for the "35 years" publicity,
because they themselves bragged about it.

Swartz's own lawyer predicted that there'd be minimal chance of him serving
any time even if he'd been convicted. First time offender, no commercial
purpose, no malice, no lasting damage.

~~~
AnthonyMouse
I think the 35 years is still important because the law _allows_ the
prosecutor to charge that, which is thoroughly insane and needs to be fixed,
notwithstanding that the problem there is with the law rather than the
prosecutor.

Moreover, it allows prosecutors to threaten defendants with that and coerce
even the innocent into plea bargains, and coerce those guilty of minor
offenses into plea bargains for multi-year prison terms because the
alternative is to risk multi-decade prison terms, which _is_ a problem with
the conduct of prosecutors when they choose to do that.

~~~
tptacek
The point here is that the prosecution _didn't_ threaten Aaron with 35 years.
They were explicit about what they expected to get at trial. When they were
trying to scare him, they scared him with a 6-7 year figure.

It is, obviously, an extremely troubling fact that the prosecutors in this
particular case decided to try to scare the shit out of the defendant to get
him to cop to 13 felonies.

~~~
AnthonyMouse
>The point here is that the prosecution _didn't_ threaten Aaron with 35 years.

Are we sure of that? Putting 6-7 years instead of 35 in the indictment or a
public statement may be calculated by prosecutors to try to avoid outraging
the jury or the public with wildly absurd penalties. That doesn't preclude
their ability to use the maximum as leverage in plea negotiations prior to
that.

I'm willing to admit that I don't know either, but we can't assume what we
don't know one way or the other. My point is that prosecutors should be
precluded from being able to do that, and in general should be chastised for
doing it even if they are legally allowed to, regardless of what happened in
this specific case.

~~~
tptacek
His attorney said so directly, disclosing this weekend that:

* If Swartz plead out, he was being required to plea to all 13 counts.

* If he plead out the prosecution would seek some prison time.

* If he went to court, the prosecution would seek 6-7 years of prison time.

* His own attorney expected that even if he was found guilty, he would receive a suspended sentence.

No credible source suggests that the prosecution seriously entertained or
threatened 35 years. Though, again, the prosecution brought this
misunderstanding on themselves by bragging to the media about a 35 year
sentence.

------
rdl
We really need to change the laws as they relate to computer crime and
copyright.

~~~
tptacek
I do not agree. Beyond that, I worry that what geeks hope for is a situation
where the plain language of the law protects them from "overcharging". That's
never going to happen. A zealous prosecutor is going to be able to make your
life miserable no matter what. That's the problem we need to address.

Count me among those who think what Swartz did _could_ reasonably have been
charged as a felony, but _should never_ have been charged as multiple
felonies.

Swartz' attorneys tried to arrange a plea deal and were told that Swartz would
need to cop to all thirteen felonies, and would still serve prison time. If
all we know now is all there is to the story, that's a gross abuse on the part
of Stephen Heymann's office.

~~~
AnthonyMouse
>Beyond that, I worry that what geeks hope for is a situation where the plain
language of the law protects them from "overcharging". That's never going to
happen. A zealous prosecutor is going to be able to make your life miserable
no matter what. That's the problem we need to address.

I don't know if overcharging is an unsolvable problem. "Plain language" may
not be the right approach, but taking the excessive breadth and poor wording
out of existing legislation would go a long way toward removing the number of
felony counts a prosecutor can "legitimately" charge a typical bystander with.

Here are a couple of examples: A lot of these laws have threshold amounts of
property that have to be in question before someone can be guilty of the
crime. (And the amounts haven't been adjusted for inflation in several
decades, which we could easily fix too.) But the real trouble there is that we
take the amounts and then shovel a whole bunch of questionable nonsense into
what can qualify. If I'm reading Prof. Kerr's analysis correctly, if someone
breaks into your computer and you hire someone to clean it up, that goes in.
You're paying them, so just pay them enough to hit the threshold and you've
made a felon of the accused. It seems the value of intangible works goes in,
so you bring in the copyright mathematicians who say one copy of one work is
worth $150,000, which makes that element of the charge totally redundant in
virtually every single case involving a computer, because all computers do is
send data to one another, and virtually all data is copyrighted, so you copy
one work and it exceeds the threshold and you're guilty of a felony. So let's
take the ability to count all of that sort of thing out of that requirement
and only include actual cash money or tangible physical products with specific
market values, and if you want to have criminal copyright statutes or trade
secret misappropriation statutes with appropriate penalties then let them be
separate from statutes originally intended to deal with fraud and sabotage.

Then we can get rid of the vagueness. "Unauthorized access" is nonsense words.
If someone is guilty of fraud, charge them with fraud. If someone is guilty of
copyright infringement, sue them. If someone accesses a computer without
authorization and hasn't committed any other offense whatsoever, use
technological measures to prevent future access and don't charge them with
anything.

Furthermore, we can do something about the maximum penalties. 35 years is
_insane_. It's insane for actual hardened criminals -- bank robbers often go
to jail for five years. _Murder_ is on the order of 25 to life. We can make
the maximum penalty for any computer crime that isn't also a serious non-
computer crime something like 364 days.

Is that the sort of thing you mean to do to check over-zealous prosecutors, or
did you have something else in mind? Because I'm open to suggestions. And we
can do both.

~~~
tptacek
A problem with this analysis is that Swartz _was_ charged with fraud.

There is no question, at least none I can find anywhere, that Swartz was
overcharged, and that requiring prison time from a plea deal or a threat of
6-7 years in prison was unreasonable. The problem we face is that prosectors
aren't held accountable for failures to exercise discretion. In Chicago, a
local prosecutor pursued a felony charge against someone who recorded two
internal affairs officers. She was roundly castigated in the media for doing
so, but won reelection handily, because nobody pays any attention to what
prosecutors are doing.

It may very well be that the problem here is lack of funding for prosecutors
and the courts; that we should give them _more money_ , instead of playing a
futile game of whack-a-mole when problems like this happen, so that we can
make saner decisions about prosecuting people and not immediately push every
case into a tragic game of chicken.

~~~
AnthonyMouse
>A problem with this analysis is that Swartz _was_ charged with fraud.

That's what I'm saying. We should change the definition of "computer fraud"
and other felonies so that they no longer cover what Swartz is alleged to have
done.

Computer fraud should cover breaking into Amazon's order processing system and
modifying the database so that they ship you $50,000 worth of jewelry without
you paying for it. What Swartz allegedly did is more accurately characterized
as something like excessive use or (for entering the network closet) physical
trespass, for which the maximum penalty should be a modest fine along the
lines of a speeding ticket. There should exist no felony charge available for
prosecutors to use whose text can be legitimately said to cover his actions.
All felonies should require extremely serious harm, such as personal injury or
death, physical damage, or depriving others of extremely high value property
explicitly for the purpose of personal financial gain. In all other cases
there may be an offense but it should not be a felony, and we can work to have
the law changed to reflect that.

I understand that even if we do that, it may be possible for prosecutors to
file totally fictitious charges against their targets, but in those cases at
least in theory it should be trivial for the defendant's lawyer to win quickly
with a motion to dismiss, unless law enforcement is going so far as to
fabricate evidence and the like, which is a different class of problem.

>It may very well be that the problem here is lack of funding for prosecutors
and the courts; that we should give them _more money_ , instead of playing a
futile game of whack-a-mole when problems like this happen, so that we can
make saner decisions about prosecuting people and not immediately push every
case into a tragic game of chicken.

I agree with this as long as you concede that the only way it will be possible
is to drastically reduce the number of accused somehow. If we prosecuted
significantly fewer criminals (for example because we repealed many of the
unnecessary laws that they are now prosecuted under) then we can easily afford
to spend more resources on each case. I don't think the alternative will be
possible: Spending significantly more per case without significantly reducing
the number of cases would be prohibitively expensive, because there are
currently _so many_ people accused of serious crimes.

~~~
tptacek
He's not accused of overusing JSTOR's systems so much as he is accused of
intentionally copying their whole database so he could deliver them to file
sharing networks. That action would have seriously harmed JSTOR.

~~~
AnthonyMouse
>That action would have seriously harmed JSTOR.

I think we could reasonably argue about that; the entire database is freely
available to anyone who goes into a major university library, etc., and unless
posting the articles resulted in universities ceasing to subscribe to JSTOR
(which seems unlikely) then they lose no significant revenue. But this is
going off on a tangent.

Even if I concede that JSTOR would be financially harmed, it still shouldn't
be a _felony_. Let them sue him for copyright infringement.

------
Illychnosis
People like Orin Kerr are part of the problem. Anyone associated with the DoJ
can't see that the DoJ is the problem, not the Aaron Swartzes of the world.

"It is difficult to get a man to understand something, when his salary depends
upon his not understanding it."

-Upton Sinclair

~~~
zaidf
_Anyone associated with the DoJ can't see that the DoJ is the problem_

Why? He is precise in what his post is doing: simply making an evaluation of
whether the charges stack up with the law on the books. He neither promises
nor tries to evaluate the legitimacy of the laws. I think that is perfectly
fine and in fact I'd love if more qualified folks shared their specific
interpretation of the law with minimal bias in either direction.

~~~
monsterix
> "He neither promises nor tries to evaluate the legitimacy of the laws."

Which also implies that there is hardly any possibility for his analysis to be
'incorrect' because it is rooted to come out as correct within the provisions
of existing laws.

Isn't that so?

~~~
zaidf
His analysis can still be incorrect. For example, other legal experts may
disagree with his interpretation of blah law. This is why I think more, not
less, somewhat emotion-free evaluation would be helpful.

If we learn the laws are far overreaching, it requires a different set of
actions to attempt to change than if we find that the charges don't align with
the law.

------
hobbyhacker
The fact that it was 'perfectly legal' definitely does not make it right.

------
kandahar
Thanks for the adult, reasoned perspective Professor Kerr--it was much-needed.
I have been dismayed (but not surprised) by the ghoulish treatment of this
poor kid. He's a perfect martyr for movement-minded people. The only movement
he should inspire right now is a gut check by anyone who is "mentoring" a
minor or a troubled young person. Are you mentoring him/her for his/her
benefit, or for your own? I'm sure it's immensely flattering for the leading
lights of the various hacker and open source, open information movements to
have brilliant youngsters sitting at their feet, capering and reacting to
their social manifestos. Well, I hope Aaron's whole-hearted devotion was
gratifying to SOMEONE. I personally wish he had never been allowed to wander
at an impressionable age among the manifesto crowd, who in fact do incite
criminal actions by their followers. They have now shown that they will allow
themselves to address a child as though he is an adult, and let the chips fall
where they may. But of course we all know who the REAL villains are: those who
have and attempt to assert property rights. Just astounding. I think I will
have to avert my gaze from this crowd of ghouls--I don't want to see a dead
kid's face on tee shirts and posters, but that is where this is going.

------
yarrel
Stay classy, Orin Kerr.

------
eric_bullington
I think it's important to note here that Orin Kerr was a DoJ lawyer before he
became a law professor[0]. It is likely that he maintains ties and some degree
of loyalty to his former employer (many people do). Many bloggers would
include a disclaimer on a blog post defending a former employer in a
contentious matter, but Kerr did not.

0\. <http://en.wikipedia.org/wiki/Orin_Kerr>

~~~
slapshot
It's also worth noting that he literally wrote the book on the law of computer
crime [1], and served as a pro bono (free) defense attorney _against_ the DOJ
in the Lori Drew MySpace case [2], and he was extensively critical of the
government in that case [3], and he has testified before Congress to say that
the Computer Fraud and Abuse Act is too broad.[4]

He worked for the DOJ from 1998-2001. If he harbors sympathies for the
government, they're pretty well hidden at this point.

[1] [http://www.amazon.com/Computer-Crime-Law-American-
Casebook/d...](http://www.amazon.com/Computer-Crime-Law-American-
Casebook/dp/0314204547) [2]
<http://en.wikipedia.org/wiki/United_States_v._Lori_Drew> [3]
[http://www.volokh.com/archives/archive_2008_05_11-2008_05_17...](http://www.volokh.com/archives/archive_2008_05_11-2008_05_17.shtml#1210889188)
[4] [http://www.volokh.com/2011/11/14/my-congressional-
testimony-...](http://www.volokh.com/2011/11/14/my-congressional-testimony-on-
the-need-to-narrow-the-computer-fraud-and-abuse-act/)

~~~
DannyBee
Orin doesn't harbor sympathies for anyone. He has his own viewpoints, some of
which match up with the government, and some of which don't. I took classes on
computer crime from him when I was in law school :)

At this point, he seems more interested in the development of 4th amendment
jurisprudence as it relates to technology that he does the CFAA in particular.

At least on that front, he's been wildly wrong about future development of the
4th amendment so far. He was a strong opposer of the "mosaic theory" of the
4th amendment, and thought there was a 0% chance the supreme court would go
for it, and he was completely and utterly wrong.

So take what he says with a grain of salt. He's a brilliant commentator on the
CFAA, but a lot of what he says seems to be based on an idea that courts don't
really change law to suit justice or policy given sets of facts, which at
least, IMHO, is completely false.

