5 ms·

What's your point? Had he walked away with a paper copy of the data in question, more than half those charges would not exist. The issue here is that "involvi

What's your point? Had he walked away with a paper copy of the data in question, more than half those charges would not exist. The issue here is that "involving a computer" has become an excuse for harsher sentencing and greater power for police and prosecutors. Driving that is a law that is so broad that nearly anyone with computer access could be accused of violating it (in other words, the majority of Americans).

rayiner 14y ago
The point is that Wired's egregiously shitty journalism isn't doing anybody any favors when it comes to mustering up legitimate opposition to the CFAA. If I opposed the CFAA in its present incarnation (which I do), I'd be embarassed to be associated with Wired's coverage. If I were a friend of Aaron Swartz, I'd be offended at Wired's repeated attempts to compare guys with malicious intent like this guy and the Watts guy in an article earlier this week to Aaron.
- betterunix 14y ago
  First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime. Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In all three cases, the CFAA charges were used for no reason other than to pressure the defendant. You are doing a disservice to those who are trying to fix the problems with the CFAA by suggesting that there is any legitimacy to the application of that law in this case.
  - rayiner 14y ago
    > First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime. The jury concluded based on the evidence that he knew that his friend intended to use it to commit a crime. Knowledge and concious disregard for the fact that your work is being used to commit a crime is indeed malicious intent. > Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In two of the cases, the men were directly involved in the commission of a computer-related crime and acted maliciously. If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices.
    - AnthonyMouse 14y ago
      >If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices. So what do you do if you're trying to show that the law has excessive and disproportionate penalties?
      - mpyne 14y ago
        I'd find a better case, for starters. The trade secret charge has the harshest penalty, and is independent of computer use. The conspiracy charge has the same maximum as the unauthorized network access charge. Someone who is an expert at the Federal Sentencing Guidelines will have to chime in with what that means for an eventual sentence, but I suspect that even if the computer violation were considered extremely minor that it would have nearly the same marginal effect on the eventual sentence, once the trade secret and conspiracy sentences are thrown into the mix. Even if the prosecutors had never mentioned the term "computer" this guy would be in some deep shit...
        AnthonyMouse 14y ago
        >I'd find a better case, for starters. I was responding to the general point. But as for finding a better case, the problem is that you don't get to pick which cases get prosecuted. If the parties have decided to appeal then a precedent is going to be set here one way or the other. So let him go to jail for what he actually did -- there is no reason to allow the CFAA charge to be piled on top of that and set a terrible precedent for next time when the defendant is sympathetic but the question has already been settled.
        mpyne 14y ago
        Why is it OK to have a law against something as general as mail fraud, given that pretty much everyone has used the post at some time or another, but have no law at all regarding computer crimes? I would understand arguing that CFAA in particular is overbroad but it's hard to claim it's being used in this case in a way that's inconsistent with the rest of the U.S. Code. In fact even the CFAA is more narrowly-focused than the aforementioned mail fraud law. And that's what I mean by "finding a better case". This is simply not a suitable demonstration of stupendous overreach. Prosecutors pile charges on, that's what they do. They only get one trial to sort everything out and entire swaths of their case can be thrown out in one fell swoop so yes, they'll stick everything they feel they can prove on there. Even with some theoretical replacement for CFAA that is more fair I would think that at least the authorized access using a co-conspirator's credentials would end up being a chargeable offense, so the difference here is with the remaining accesses that were made. And even those are hard to claim would be "authorized" access with a straight face, as why would any company authorize access to their networks for the purpose of industrial espionage?
  - tptacek 14y ago
    I'm no expert in the Watt prosecution and know nothing about him, but from the reading I did: he wasn't accused of writing an innocuous tool and sharing it with a friend, or even writing a particularly useful network security testing tool. He's accused of writing a sniffer specifically designed to capture and record credit card transactions. Then he shared that tool with the ringleader of the largest credit card theft ring in the history of credit cards, who was a personal friend of his, with whom he partied during the ongoing criminal activities. At least one other longtime associate of Watt's was an active, remunerated contributor to the theft ring.
mpyne 14y ago
On the other hand, had he used a conspirator within the old company use the postal service to mail over a paper-based list he could easily have been charged with mail fraud, which occurs whenever the postal system is used in furtherance of a criminal act... any criminal act. Theft of trade secrets, even for purely corporate-interest reasons, has been a crime in the U.S. since 1996.
anigbrowl 14y ago
Yes, and a bunch of other charges would exist. Since you're so convinced of your rightness on this, be specific, tell u which charges he would have faced in the two different situations, and calculate the different penalties he'd be eligible for.
- betterunix 14y ago
  The "bunch of other charges" is actually two charges: conspiracy, and unauthorized receipt and possession of stolen trade secrets. That would have been plenty to charge this guy with, and would have meant a lengthy maximum sentence of fifteen years in prison. The CFAA charges have a maximum penalty of five years in prison per charge. So with all six charges, the maximum penalty was thirty five years. All charges carried a maximum $250000 fine. Again, the CFAA charges more than doubled the maximum penalty. Really though, what is your point in asking? This is laid out in rayiner's link, anyone can read it. Yes, the judge has leeway in deciding the penalty, but that is not really the issue; the issue is that a defendant facing 35 years faces a much harder choice than a defendant facing 15 years. The CFAA violations are an example of a typical prosecutor strategy of pressuring defendants into making a guilty plea, and of trying to reduce the likelihood of an acquittal.
  - anigbrowl 14y ago
    What about accessory charges? You don't get to have clean hands just because some else does the dirty work for you. Really though, what is your point in asking? Because you keep making these assertions about how awful the CFAA but handwaving away critiques of your argument and any charges you don't like. So, you say that conspiracy and trade secrets charges are plenty, but from the point of view of interest of the public, why should we abstain from charging the guy with everything we can pin on him? Because he's a white-collar criminal as opposed to some kid with a bunch of drugs or a gun? Or because the deterrent 'yield' on marginal charges diminishes? I get that you hate the CFAA, but you always spluttera bout how unfair it is and how much it's used for leverage against defendants. You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet, and you need to show why the breach of trust involved in compromising a private computer system doesn't or shouldn't matter. As it is, all your arguments seem to revolve around 'it's just a computer, it's not that bad.' I had the same problem with the Aaron Swatz case with people saying it was no big deal that he plugged his laptop into the wiring closet. Just because an act is trivially easy to commit doesn't mean that you have a right to do it. My neighbor tends to leave his window open, but I don't think it entitles me to enter his apartment even though I could do so very easily.
etvmueller 14y ago
This is a common pattern for objects that are force multipliers. For example, the use of firearms and/or automobiles in the commission of a crime leads to harsher sentencing. Anything that gives the everyman an outsize advantage, like a computer, is treated harshly if that advantage is used against society.

rayiner 14y ago

The point is that Wired's egregiously shitty journalism isn't doing anybody any favors when it comes to mustering up legitimate opposition to the CFAA. If I opposed the CFAA in its present incarnation (which I do), I'd be embarassed to be associated with Wired's coverage. If I were a friend of Aaron Swartz, I'd be offended at Wired's repeated attempts to compare guys with malicious intent like this guy and the Watts guy in an article earlier this week to Aaron.

betterunix 14y ago
First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime. Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In all three cases, the CFAA charges were used for no reason other than to pressure the defendant. You are doing a disservice to those who are trying to fix the problems with the CFAA by suggesting that there is any legitimacy to the application of that law in this case.
- rayiner 14y ago
  > First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime. The jury concluded based on the evidence that he knew that his friend intended to use it to commit a crime. Knowledge and concious disregard for the fact that your work is being used to commit a crime is indeed malicious intent. > Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In two of the cases, the men were directly involved in the commission of a computer-related crime and acted maliciously. If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices.
  - AnthonyMouse 14y ago
    >If you're trying to show the injustices of a law, it's generally a good idea to find sympathetic defendants rather than criminals or their accomplices. So what do you do if you're trying to show that the law has excessive and disproportionate penalties?
    - mpyne 14y ago
      I'd find a better case, for starters. The trade secret charge has the harshest penalty, and is independent of computer use. The conspiracy charge has the same maximum as the unauthorized network access charge. Someone who is an expert at the Federal Sentencing Guidelines will have to chime in with what that means for an eventual sentence, but I suspect that even if the computer violation were considered extremely minor that it would have nearly the same marginal effect on the eventual sentence, once the trade secret and conspiracy sentences are thrown into the mix. Even if the prosecutors had never mentioned the term "computer" this guy would be in some deep shit...
      - AnthonyMouse 14y ago
        >I'd find a better case, for starters. I was responding to the general point. But as for finding a better case, the problem is that you don't get to pick which cases get prosecuted. If the parties have decided to appeal then a precedent is going to be set here one way or the other. So let him go to jail for what he actually did -- there is no reason to allow the CFAA charge to be piled on top of that and set a terrible precedent for next time when the defendant is sympathetic but the question has already been settled.
        mpyne 14y ago
        Why is it OK to have a law against something as general as mail fraud, given that pretty much everyone has used the post at some time or another, but have no law at all regarding computer crimes? I would understand arguing that CFAA in particular is overbroad but it's hard to claim it's being used in this case in a way that's inconsistent with the rest of the U.S. Code. In fact even the CFAA is more narrowly-focused than the aforementioned mail fraud law. And that's what I mean by "finding a better case". This is simply not a suitable demonstration of stupendous overreach. Prosecutors pile charges on, that's what they do. They only get one trial to sort everything out and entire swaths of their case can be thrown out in one fell swoop so yes, they'll stick everything they feel they can prove on there. Even with some theoretical replacement for CFAA that is more fair I would think that at least the authorized access using a co-conspirator's credentials would end up being a chargeable offense, so the difference here is with the remaining accesses that were made. And even those are hard to claim would be "authorized" access with a straight face, as why would any company authorize access to their networks for the purpose of industrial espionage?
- tptacek 14y ago
  I'm no expert in the Watt prosecution and know nothing about him, but from the reading I did: he wasn't accused of writing an innocuous tool and sharing it with a friend, or even writing a particularly useful network security testing tool. He's accused of writing a sniffer specifically designed to capture and record credit card transactions. Then he shared that tool with the ringleader of the largest credit card theft ring in the history of credit cards, who was a personal friend of his, with whom he partied during the ongoing criminal activities. At least one other longtime associate of Watt's was an active, remunerated contributor to the theft ring.

mpyne 14y ago

On the other hand, had he used a conspirator within the old company use the postal service to mail over a paper-based list he could easily have been charged with mail fraud, which occurs whenever the postal system is used in furtherance of a criminal act... any criminal act. Theft of trade secrets, even for purely corporate-interest reasons, has been a crime in the U.S. since 1996.

anigbrowl 14y ago

Yes, and a bunch of other charges would exist. Since you're so convinced of your rightness on this, be specific, tell u which charges he would have faced in the two different situations, and calculate the different penalties he'd be eligible for.

betterunix 14y ago
The "bunch of other charges" is actually two charges: conspiracy, and unauthorized receipt and possession of stolen trade secrets. That would have been plenty to charge this guy with, and would have meant a lengthy maximum sentence of fifteen years in prison. The CFAA charges have a maximum penalty of five years in prison per charge. So with all six charges, the maximum penalty was thirty five years. All charges carried a maximum $250000 fine. Again, the CFAA charges more than doubled the maximum penalty. Really though, what is your point in asking? This is laid out in rayiner's link, anyone can read it. Yes, the judge has leeway in deciding the penalty, but that is not really the issue; the issue is that a defendant facing 35 years faces a much harder choice than a defendant facing 15 years. The CFAA violations are an example of a typical prosecutor strategy of pressuring defendants into making a guilty plea, and of trying to reduce the likelihood of an acquittal.
- anigbrowl 14y ago
  What about accessory charges? You don't get to have clean hands just because some else does the dirty work for you. Really though, what is your point in asking? Because you keep making these assertions about how awful the CFAA but handwaving away critiques of your argument and any charges you don't like. So, you say that conspiracy and trade secrets charges are plenty, but from the point of view of interest of the public, why should we abstain from charging the guy with everything we can pin on him? Because he's a white-collar criminal as opposed to some kid with a bunch of drugs or a gun? Or because the deterrent 'yield' on marginal charges diminishes? I get that you hate the CFAA, but you always spluttera bout how unfair it is and how much it's used for leverage against defendants. You need to show that prosecutors could not bring as many charges for an equivalent crime of stealing something from a safe or locked filing cabinet, and you need to show why the breach of trust involved in compromising a private computer system doesn't or shouldn't matter. As it is, all your arguments seem to revolve around 'it's just a computer, it's not that bad.' I had the same problem with the Aaron Swatz case with people saying it was no big deal that he plugged his laptop into the wiring closet. Just because an act is trivially easy to commit doesn't mean that you have a right to do it. My neighbor tends to leave his window open, but I don't think it entitles me to enter his apartment even though I could do so very easily.

etvmueller 14y ago

This is a common pattern for objects that are force multipliers. For example, the use of firearms and/or automobiles in the commission of a crime leads to harsher sentencing. Anything that gives the everyman an outsize advantage, like a computer, is treated harshly if that advantage is used against society.