Let's Honor Aaron Swartz by Fixing This Draconian Computer Crime Law

What's to come?
Jan. 14 2013 5:01 PM

How To Honor Aaron Swartz

In the wake of the brilliant technology activist's death, let's fix the draconian Computer Fraud and Abuse Act.

FT-130114-Swartz
Aaron Swartz in 2009 at the Boston Wiki Meetup.

Photograph by Sage Ross/Creative Commons License.

Outpourings of grief and calls for change continue to flood the Internet after the suicide of Aaron Swartz, only 26 years old.

Aaron was one of our community's best and brightest, and he achieved great heights in his short life. He was a coder, a political activist, an entrepreneur, a contributor to major technological developments (like RSS), and an all-around Internet freedom rock star. As Wired noted, the world will miss out on decades of magnificent things Aaron would have accomplished had his time not been cut short.

Over the past two years, Aaron was forced to devote much of his energy and resources to fighting a relentless and unjust felony prosecution brought by Justice Department attorneys in Massachusetts. His alleged crimes stemmed from using MIT's computer network to download millions of academic articles from the online archive JSTOR, allegedly without "authorization." For that, he faced 13 felony counts of hacking and wire fraud (PDF), which carried the possibility of decades in prison and crippling fines. His case would have gone to trial in April.

Advertisement

The government should never have thrown the book at Aaron for accessing MIT's network and downloading scholarly research. However, some extremely problematic elements of the law made it possible. We can trace some of those issues to the U.S. criminal justice system as an institution, and I suspect others will write about that in the coming days. But Aaron's tragedy also shines a spotlight on a couple of profound flaws of the Computer Fraud and Abuse Act in particular and gives us an opportunity to think about how to address them.

Problem 1: Hacking laws are too broad, and too vague
Among other things, the CFAA makes it illegal to gain access to protected computers "without authorization" or in a manner that "exceeds authorized access." Unfortunately, the law doesn't clearly explain what a lack of "authorization" actually means. Creative prosecutors have taken advantage of this confusion to craft criminal charges that aren't really about hacking a computer but instead target other behavior the prosecutors don't like.

An infamous example is United States v. Drew, a case in which a woman created a fake MySpace page to taunt a teenage girl. The girl became distraught and committed suicide. No crime made the bullying itself illegal, so prosecutors charged Drew under the CFAA, claiming her fake profile violated MySpace's terms of use, which made her access to the social networking site's computers "unauthorized."

An obvious problem with this argument is that it would mean anyone who runs afoul of a web site's fine print is a criminal—and many of us intentionally or unintentionally violate those agreements every day. Prosecutors wouldn't bother filing criminal charges against most of us, of course. But if they wanted to, they would have the leeway to do it under the government's theory.

The judge ultimately reached the right result, finding that Drew didn't violate the CFAA just because she breached MySpace's terms of use.

But other criminal defendants haven't been so lucky.

In November, a jury convicted Andrew Auernheimer after someone else wrote a script to collect thousands of iPad owners' email addresses—which AT&T had failed to secure. Auernheimer's involvement in the "hack" appears to have been primarily telling journalists about then vulnerability after the fact (PDF). He plans to appeal the conviction.

It's possible that Auernheimer's unsympathetic reputation as an Internet troll played a role in the government's decision to indict him. And the CFAA's vague and overbroad language gave the jury an excuse to punish someone who didn't carry out anything remotely resembling a serious computer intrusion, even though that's the concern that caused Congress to criminalize "unauthorized" access in the first place.

Let's be clear: Being an unsympathetic person is not a computer crime.

Most of the government's charges against Aaron alleged "unauthorized" access. We'll never know exactly how prosecutors planned to argue at trial that Aaron's access to JSTOR and the MIT network was "unauthorized." However, the allegations in the indictment suggest the case was based at least in part on the idea that Aaron violated JSTOR and MIT's network rules and user agreements. Under Drew and more recent precedent(PDF), that theory of criminal liability is dubious at best.

TODAY IN SLATE

Foreigners

More Than Scottish Pride

Scotland’s referendum isn’t about nationalism. It’s about a system that failed, and a new generation looking to take a chance on itself. 

iOS 8 Comes Out Today. Do Not Put It on Your iPhone 4S.

Why Greenland’s “Dark Snow” Should Worry You

Three Talented Actresses in Three Terrible New Shows

The Human Need to Find Connections in Everything

It’s the source of creativity and delusions. It can harm us more than it helps us.

Jurisprudence

Happy Constitution Day!

Too bad it’s almost certainly unconstitutional.

What Charles Barkley Gets Wrong About Corporal Punishment and Black Culture

My Father Was James Brown. I Watched Him Beat My Mother. Then I Married Someone Like Him.

  News & Politics
Weigel
Sept. 17 2014 12:02 PM Here It Is: The Flimsiest Campaign Attack Ad of 2014, Which Won’t Stop Running
  Business
Business Insider
Sept. 17 2014 1:36 PM Nate Silver Versus Princeton Professor: Who Has the Right Models?
  Life
The Vault
Sept. 17 2014 1:04 PM The War Department's WWII Advice Booklet for Soldiers Headed to Syria
  Double X
The XX Factor
Sept. 17 2014 1:26 PM Hey CBS, Rihanna Is Exactly Who I Want to See on My TV Before NFL Football Games
  Slate Plus
Slate Fare
Sept. 17 2014 9:37 AM Is Slate Too Liberal?  A members-only open thread.
  Arts
Brow Beat
Sept. 17 2014 1:01 PM A Rare, Very Unusual Interview With Michael Jackson, Animated
  Technology
Future Tense
Sept. 17 2014 12:35 PM IOS 8 Comes Out Today. Do Not Put It on Your iPhone 4S.
  Health & Science
Bad Astronomy
Sept. 17 2014 11:18 AM A Bridge Across the Sky
  Sports
Sports Nut
Sept. 15 2014 9:05 PM Giving Up on Goodell How the NFL lost the trust of its most loyal reporters.