4 ms·

I went down a small rabbit hole after reading this, curious if it would have saved Aaron Swartz's life. It seems the lynchpin of the prosecution of Aaron Swart

I went down a small rabbit hole after reading this, curious if it would have saved Aaron Swartz's life. It seems the lynchpin of the prosecution of Aaron Swartz was that the CFAA criminalizes the breaking of a Terms of Service agreement (ie. it is a felony to break a terms of service). They've attempted to address this with "Aaron's law" but it is stalled in committee - people have blamed Oracle for lobbying it to be blocked. So.. this is a nice move from the DoJ, but not enough. Patching up a bad law with a policy to protect good faith security researchers is good, but it's still a bad law.

oversocialized 4y ago
tzs 4y ago
It wouldn't have made a difference. People tend to forget just how much effort Swartz put into repeatedly evading MIT's attempts to kick him off their network. That's not the kind of situation this policy change is trying to address. Heck, from the description of "Aaron's law" on Senator Wyden's site I'm not sure that would have made a difference either. It probably would have at most reduced some of the redundant charging, but since the redundant charging doesn't actually add to the sentence if convicted it would not really have affected the ultimate outcome much. There's a good summary of the long cat and mouse game to try to kick him off the network, and an analysis of the various charges against him and how likely they were to stick here [1]. [1] https://volokh.com/2013/01/14/aaron-swartz-charges/ https://volokh.com/2013/01/14/aaron-swartz-charges/
tptacek 4y ago
Swartz wasn't doing security research, and was charged with wire fraud, not just unauthorized use under CFAA. This wouldn't have helped him. He'd also likely have been undone by the provisos attached to "exceeding unauthorized access"; the red line the new policy draws is that once DOJ can demonstrate that someone knowingly exceeded their access, they're fair game, even if the conditions they violated were spelled out only in a contract or terms of use.
- gnfargbl 4y ago
  > even if the conditions they violated were spelled out only in a contract or terms of use. Is that correct? In https://www.justice.gov/opa/press-release/file/1507126/download https://www.justice.gov/opa/press-release/file/1507126/downl..., I see: > that division is established in a computational sense, that is, through computer code or configuration, rather than through contracts, terms of service agreements, or employee policies and later > A CFAA prosecution may not be brought on the theory that a defendant exceeds authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or web service available to the general public and > the Department will not take the position that a mere contractual violation caused the user’s previous authorization to be automatically withdrawn However, any previous authorization is withdrawn if you receive something that you should understand as a C&D. It seems to me that this new policy says that to reach the threshold for CFAA prosecution you must now do more than "just" violate the terms of service. Am I misreading?
- chrisfinazzo 4y ago
  IANAL, but I question whether the wire fraud charge would hold up. The layman’s definition doesn’t seem to apply. Of course, my memory my be failing me as to details that would make it relevant in his case. https://en.wikipedia.org/wiki/Mail_and_wire_fraud#Wire_fraud https://en.wikipedia.org/wiki/Mail_and_wire_fraud#Wire_fraud
  - tptacek 4y ago
    The layman's definition doesn't matter in the least. What matters are the jury instructions, which you can look up. The court system does not in fact leave it up to whatever definitions of a crime happen to be bouncing around in the jury's heads; the conditions required to find someone guilty of a crime tend to be spelled out in great detail.
    - chrisfinazzo 4y ago
      Jury instructions which are sure to include a version of "the wire fraud statute is defined as x, for those of you who are not attorneys, think of this as {{ Insert layman's definition here }}." Rephrasing would help the jury understand how to evaluate Aaron's actions and determine whether or not they meet the standard. I may be missing something about what transpired that causes me to think that it does not apply, but you can be sure that the jury will have heard evidence from the prosecution which lays out why they believe it is relevant in this particular case.
ARandomerDude 4y ago
> curious if it would have Hypotheticals like this are difficult to answer seriously. Still, if I had to guess, I suspect he would have been prosecuted nonetheless because he wasn't a good faith security researcher.
mc4ndr3 4y ago
Require publicly funded research to publish results publicly, instead of hiding it in paid gardens.
shadowgovt 4y ago
Better mental healthcare might have saved Swartz's life, not different laws.
- jedberg 4y ago
  One the one hand, you're absolutely right. Anyone who kills themselves clearly had some sort of mental health issue. But on the other hand, he grew up in a wealthy family and briefly attended Stanford -- he had access to some of the best health care in the world already. So I'm not sure better mental healthcare would have helped. Probably more along the lines of destigmatizing mental healthcare might have helped, which is a much harder problem to solve, but also something that thankfully Millennials/Gen Z are doing on their own. It's no longer taboo to mention that you're in therapy.

oversocialized 4y ago

tzs 4y ago

It wouldn't have made a difference. People tend to forget just how much effort Swartz put into repeatedly evading MIT's attempts to kick him off their network. That's not the kind of situation this policy change is trying to address. Heck, from the description of "Aaron's law" on Senator Wyden's site I'm not sure that would have made a difference either. It probably would have at most reduced some of the redundant charging, but since the redundant charging doesn't actually add to the sentence if convicted it would not really have affected the ultimate outcome much. There's a good summary of the long cat and mouse game to try to kick him off the network, and an analysis of the various charges against him and how likely they were to stick here [1]. [1] https://volokh.com/2013/01/14/aaron-swartz-charges/ https://volokh.com/2013/01/14/aaron-swartz-charges/

tptacek 4y ago

Swartz wasn't doing security research, and was charged with wire fraud, not just unauthorized use under CFAA. This wouldn't have helped him. He'd also likely have been undone by the provisos attached to "exceeding unauthorized access"; the red line the new policy draws is that once DOJ can demonstrate that someone knowingly exceeded their access, they're fair game, even if the conditions they violated were spelled out only in a contract or terms of use.

gnfargbl 4y ago
> even if the conditions they violated were spelled out only in a contract or terms of use. Is that correct? In https://www.justice.gov/opa/press-release/file/1507126/download https://www.justice.gov/opa/press-release/file/1507126/downl..., I see: > that division is established in a computational sense, that is, through computer code or configuration, rather than through contracts, terms of service agreements, or employee policies and later > A CFAA prosecution may not be brought on the theory that a defendant exceeds authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or web service available to the general public and > the Department will not take the position that a mere contractual violation caused the user’s previous authorization to be automatically withdrawn However, any previous authorization is withdrawn if you receive something that you should understand as a C&D. It seems to me that this new policy says that to reach the threshold for CFAA prosecution you must now do more than "just" violate the terms of service. Am I misreading?
chrisfinazzo 4y ago
IANAL, but I question whether the wire fraud charge would hold up. The layman’s definition doesn’t seem to apply. Of course, my memory my be failing me as to details that would make it relevant in his case. https://en.wikipedia.org/wiki/Mail_and_wire_fraud#Wire_fraud https://en.wikipedia.org/wiki/Mail_and_wire_fraud#Wire_fraud
- tptacek 4y ago
  The layman's definition doesn't matter in the least. What matters are the jury instructions, which you can look up. The court system does not in fact leave it up to whatever definitions of a crime happen to be bouncing around in the jury's heads; the conditions required to find someone guilty of a crime tend to be spelled out in great detail.
  - chrisfinazzo 4y ago
    Jury instructions which are sure to include a version of "the wire fraud statute is defined as x, for those of you who are not attorneys, think of this as {{ Insert layman's definition here }}." Rephrasing would help the jury understand how to evaluate Aaron's actions and determine whether or not they meet the standard. I may be missing something about what transpired that causes me to think that it does not apply, but you can be sure that the jury will have heard evidence from the prosecution which lays out why they believe it is relevant in this particular case.

ARandomerDude 4y ago

> curious if it would have Hypotheticals like this are difficult to answer seriously. Still, if I had to guess, I suspect he would have been prosecuted nonetheless because he wasn't a good faith security researcher.

mc4ndr3 4y ago

Require publicly funded research to publish results publicly, instead of hiding it in paid gardens.

shadowgovt 4y ago

Better mental healthcare might have saved Swartz's life, not different laws.

jedberg 4y ago
One the one hand, you're absolutely right. Anyone who kills themselves clearly had some sort of mental health issue. But on the other hand, he grew up in a wealthy family and briefly attended Stanford -- he had access to some of the best health care in the world already. So I'm not sure better mental healthcare would have helped. Probably more along the lines of destigmatizing mental healthcare might have helped, which is a much harder problem to solve, but also something that thankfully Millennials/Gen Z are doing on their own. It's no longer taboo to mention that you're in therapy.