Carmen Ortiz's Husband Criticizes Swartz Family For Suggesting Prosecution Of Their Son Contributed To His Suicide

from the foot-in-mouth-disease dept

As we've stated over and over again, it's a bit simplistic to place the "blame" for Aaron Swartz's suicide on the federal prosecutors, led by US Attorney Carmen Ortiz and her assistant Stephen Heymann. It is still quite reasonable to question their activities, but suicide is a complex thing and going all the way there may be going too far. Still, you can understand why Swartz's family did, in fact, directly call out the US Attorneys given their hardline position on the case, and the stress that created for Swartz. Lots of reporters have been contacting Ortiz and Heymann and the US Attorneys' offices and have consistently been getting back a big fat "no comment." Some reporters are even upset that no one put President Obama on the spot concerning the Swartz suicide at Obama's recent press conference. But, the stance of the government has been to avoid all such questions.

However, some noticed that Ortiz's husband -- an IBM exec named Tom Dolan -- apparently felt no such restriction. He took to Twitter... to complain about the statement from the Swartz family and to further scold anyone who claimed that Swartz faced 35-years in prison. Amazingly, he chose to do this by taking on some "big names" in the tech and media world: Mitch Kapor, Dan Gillmor and the blog ThinkProgress:



Dolan has since deleted his entire account after he either came to his senses or someone suggested strongly that he think better of it. While you can understand his desire to defend his wife's efforts, the tweets aren't just somewhat offensive following Aaron's suicide, but misleading as well. To argue that the prosecution was fair because they offered him a 6 month plea deal is complete and utter hogwash. As many have pointed out, it doesn't appear that Aaron should have been facing any federal charges at all. The 35 years is completely relevant, because that's part of the hammer that his wife was using to pressure him into taking the 6 month plea deal so that she and her assistant could get a big headline about another "guilty" plea. To act like the 6 month offer is some sort of "leniency" is insane when you know the details of the case and everything else that came with it.

Dolan also -- conveniently -- ignores that the government supposedly told Aaron's lawyers that if he didn't take the deal, the next one they'd come back with would be worse, and that if the case actually got to court, they'd try to get the judge (notorious for strict sentences) to throw the book at Swartz.

The one thing that Dolan got right is that "35 years" probably wasn't accurate. But he had it in the wrong direction. The original four charges had a maximum possibility of 35 years. After Dolan's wife upped the charge count to 13, it was looking like the total could possibly be upwards of 50 years -- for a situation where Swartz didn't think he'd done anything wrong. In that scenario, the plea bargain is an insult, but the entire situation must be incredibly difficult. Dolan's response isn't just insensitive, but it's downright misleading.

Filed Under: aaron swartz, carmen ortiz, plea bargains, tom dolan

Rep. Zoe Lofgren Plans To Introduce 'Aaron's Law' To Stop Bogus Prosecutions Under The CFAA

from the one-step dept

There's been talk for years about fixing the Computer Fraud and Abuse Act (CFAA), which has been widely abused by law enforcement/prosecutors to claim that basically any use of a computer that did not fall under the explicitly allowed uses was a form of "computer hacking" -- and potentially a felony. This allowed for law enforcement to go after all sorts of people -- including anyone who did anything on a computer that their employer didn't like. Or anyone whosent spam. Or anyone who reported on a data vulnerability. Or anyone who just senta too many emails. These and many more cases mostly revolved around a stretched interpretation of the (outdated) CFAA, which suggested that simply violating a terms of service was the equivalent of "unauthorized access," and thus a "hacking" violation. Courts have so far been somewhat split on this interpretation, with some buying it and others not buying it at all.

The abuse of the CFAA has been seen in some high profile cases, including the one against Lori Drew, after a young girl, who was a friend of Drew's daughter, killed herself following a "dispute" with a fake profile of a boy that was really set up by Drew and some others. The court eventually tossed that out (though a jury convicted her). But it seems tragically ironic that a law that prosecutors once used (they claimed) to go after someone for bullying someone to commit suicide, is now itself being blamed for prosecutors' own bullying tactics, which many (including his parents) now insist led to the suicide of Aaron Swartz.

Congress has approved fixes for the CFAA in the past, but they've never made it all the way into law. The unfortunate, untimely and tragic death of Aaron Swartz may have brought back politicians' interest in making such a fix. Rep. Zoe Lofgren announced on Reddit her plans to introduce "Aaron's Law" to fix one glaring weakness in the CFAA: the idea that any terms of service violation is akin to hacking and fraud under the law. The draft bill rejects such an interpretation explicitly:

Section 1343 of title 18, United States Code, is amended by inserting after the first sentence the following: ‘‘A violation of an agreement or contractual obligation regarding Internet or computer use, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or employer is not in itself a violation of this section.’’

Hopefully, this new Congress can look at the unfortunate situation with Aaron (and many others) and how prosecutors are using the CFAA as a weapon to browbeat people they don't like into guilty pleas on garbage charges, and finally pass this much needed fix to the CFAA.

Filed Under: aaron swartz, cfaa, computer fraud and abuse act, zoe lofgren

'Under American Law, Anyone Interesting Is A Felon' - Tim Wu On The Prosecution Of Aaron Swartz

from the destroyed-to-protect-imaginary-property dept

The reactions to Aaron Swartz's suicide continue to pour in and the recurring theme is one of disbelief at the government's hard nosed prosecutorial stance towards Swartz's actions. The Secret Service, for unknown reasons, took over the case and the prosecutor insisted on a guilty plea across the board as well as pretty much guaranteeing jail time for the hacker.

Tim Wu's excellent editorial details how the justice system made a mockery of that first word by relentlessly applying pressure to a young man whose "crime" was truly victimless.

The act was harmless—not in the sense of hypothetical damages or the circular logic of deterrence theory (that’s lawyerly logic), but in John Stuart Mill’s sense, meaning that there was no actual physical harm, nor actual economic harm. The leak was found and plugged; JSTOR suffered no actual economic loss. It did not press charges. Like a pie in the face, Swartz’s act was annoying to its victim, but of no lasting consequence.

This fact cannot be overstated. JSTOR itself declined to press charges against Swartz once its "property" was recovered. But this wasn't good enough for the federal prosecutor who took an outdated law and applied the interpretation that would do the most damage.

In our age, armed with laws passed in the nineteen-eighties and meant for serious criminals, the federal prosecutor Carmen Ortiz approved a felony indictment that originally demanded up to thirty-five years in prison. Worse still, her legal authority to take down Swartz was shaky. Just last year, the Ninth Circuit Court of Appeals threw out a similar prosecution. Chief Judge Alex Kozinski, a prominent conservative, refused to read the law in a way that would make a criminal of “everyone who uses a computer in violation of computer use restrictions—which may well include everyone who uses a computer.” Ortiz and her lawyers relied on that reading to target one of our best and brightest.

Wu says this targeting cut down a genius in his prime -- a curious and impulsive young man whose actions were actually less illegal than those of two computing pioneers, Steve Jobs and Steve Wozniak, who hacked AT&T's system for free long distance calls and sold "blue boxes" so others could do the same. They were never prosecuted for their actions and went on to found Apple -- something a prosecutor like Ortiz could have made impossible.

"We can rightly judge a society by how it treats its eccentrics and deviant geniuses—and by that measure, we have utterly failed," Wu says. And why? Because an adversarial, zealous prosecutor put in charge of the right case can wreak an incredible amount of havoc in pursuit of "justice."

Yes, most of the time prosecutors do chase actual wrongdoers, but today our criminal laws are so expansive that most people of any vigor and spirit can be found to violate them in some way. Basically, under American law, anyone interesting is a felon. The prosecutors, not the law, decide who deserves punishment.

Between the system of IP laws that awards fees for imaginary damages and a government that views any information leaks as criminal activity, Swartz never had a chance -- and sadly, unless there are major changes in the system, neither will his successors.

In an age when our frontiers are digital, the criminal system threatens something intangible but incredibly valuable. It threatens youthful vigor, difference in outlook, the freedom to break some rules and not be condemned or ruined for the rest of your life. Swartz was a passionate eccentric who could have been one of the great innovators and creators of our future. Now we will never know.

An effort to increase public knowledge, with no profit motive, as misguided and rash as it may have been, was rewarded with an intense crackdown, even after the "victim" had stated it was satisfied with the outcome. No matter your view on intellectual property, it should never have come to this. Swartz brazenly exploited loopholes to liberate documents he felt should have been public domain in the first place, much as he legally exploited free usage of the PACER system earlier.

It's very tempting to couch this discussion in language that pays its due to "rights holders." Swartz somehow needed to be punished for his deeds, even with some sort of slap on the wrist, because it was legally or morally wrong. MIT was abused. JSTOR was abused. The IP system -- the status quo -- was abused by Swartz's actions. That's the way we're programmed to feel. That no matter the overreaction, we need to give some quarter to the reacting parties. But when it comes to this situation, it feels completely wrong.

Wu's take shows just how dangerous this form of dues-paying is -- grant the system a little token respect before heading off into the "but" section of the argument and you've already justified a reaction. If the reaction seems too harsh, it's too late. You've already implicitly granted the system the right to punish perceived wrongs, something it often handles with ineptness or vindictiveness, and in worst case scenarios, large quantities of both.

The system has little use for rebels, innovators, and the internet-native element that threatens cherished IP institutions. It wasn't pleased with Swartz and the best way to discourage more Swartzes from leaping into action was to lock up the original, or bleed him dry with an extended legal battle. It ended up with nothing. Or rather, it ended up creating a martyr and rekindling a movement -- "nothing" would have been better. There will be more like him and, if the system remains unchanged, they will have their futures extinguished as soon as their actions put them in the firing line. The protected works are quantifiable. The extinguished possibilities verge on endless. 

Filed Under: aaron swartz, felonies, prosecutions

Aaron Swartz Could Have Killed Someone, Robbed A Bank & Sold Child Porn & Faced Less Time In Prison

from the the-system,-she-is-broken dept

Among the many injustices in the Justice Department's pursuit of Aaron Swartz was the disproportionate punishment he was facing. Remember that he used an open network connection at MIT, which explicitly allowed free guest access, to download academic research papers that were available for free for any user on that particular network. And yet, due to the US Attorney's Office led by Carmen Ortiz and Steve Heymann piling on additional charges, Swartz was potentially facing 50 years in prison.

Yes, reports claimed that Heymann offered to plea bargain things down to a mere 7 years in prison, but that's still an insane length, and by rejecting such a plea offer, Swartz guaranteed that Heymann was likely to throw the book at him and seek the maximum. That's how they work.

Over at ThinkProgress, Ian Millhiser, looks at the maximum jail terms for other crimes, and wonders how it's possible that Swartz had the potential to spend even more years in jail. It's quite a list, and you should go check out the full thing, but here are a few of the more interesting ones:

• Manslaughter: Federal law provides that someone who kills another human being “[u]pon a sudden quarrel or heat of passion” faces a maximum of 10 years in prison if subject to federal jurisdiction. The lesser crime of involuntary manslaughter carries a maximum sentence of only six years.
• Bank Robbery: A person who “by force and violence, or by intimidation” robs a bank faces a maximum prison sentence of 20 years. If the criminal “assaults any person, or puts in jeopardy the life of any person by the use of a dangerous weapon or device,” this sentence is upped to a maximum of 25 years.
• Selling Child Pornography: The maximum prison sentence for a first-time offender who “knowingly sells or possesses with intent to sell” child pornography in interstate commerce is 20 years. Significantly, the only way to produce child porn is to sexually molest a child, which means that such a criminal is literally profiting off of child rape or sexual abuse.
• Knowingly Spreading AIDS: A person who “after testing positive for the Human Immunodeficiency Virus (HIV) and receiving actual notice of that fact, knowingly donates or sells, or knowingly attempts to donate or sell, blood, semen, tissues, organs, or other bodily fluids for use by another, except as determined necessary for medical research or testing” faces a maximum of 10 years in prison.
• Selling Slaves: Under federal law, a person who willfully sells another person “into any condition of involuntary servitude” faces a maximum prison sentence of 20 years, although the penalty can be much higher if the slaver’s actions involve kidnapping, sexual abuse or an attempt to kill.
• Helping al-Qaeda Develop A Nuclear Weapon: A person who “willfully participates in or knowingly provides material support or resources . . . to a nuclear weapons program or other weapons of mass destruction program of a foreign terrorist power, or attempts or conspires to do so, shall be imprisoned for not more than 20 years.”
• Violence At International Airports: Someone who uses a weapon to “perform[] an act of violence against a person at an airport serving international civil aviation that causes or is likely to cause serious bodily injury” faces a maximum prison sentence of 20 years if their actions do not result in a death.

And Aaron faced more than any of those for accessing freely available knowledge. Something seems very, very, very wrong about that.

Filed Under: aaron swartz, sentencing

A Fitting Tribute For Aaron Swartz: Researchers Post Free PDFs Of Their Research Online

from the it's-a-start dept

As we noted earlier, one thing that Aaron Swartz would have almost certainly wanted, as a memorial for his own accomplishments, would be for others to continue that work and to do much more with it. It's a small thing, but it's been inspiring to watch one aspect of that come to life: some academic researchers suggested a bit of simple civil disobedience in asking other researchers to post their own research publicly for others to download, and use the tag: #pdftribute. Many researchers quickly jumped at the chance, leading some to set up a website, appropriately called PDFtribute.net to collect all the tweets and the links to all of that research.

It's unclear how much of that research is technically "allowed" to be published like this. If you're not familiar with the dirty sausage making of academic research, many journals claim all copyrights on research (despite not paying a dime for it -- and, in some cases, even requiring the researchers or their institutions to pay to submit the papers in the first place). Many then have policies that bar the original researcher from further distributing the work, so it's likely that some of the released research is in violation of those agreements. That said, over the past few years, more and more journals (often due to significant pushback from academics) have recognized how ridiculous this is, and many have started to allow -- either officially or with a nod and a wink -- academics the right to post free copies of their own research on their own website. A few, much more enlightened journals even encourage researchers to post the work.

Either way, if one of the legacies of Aaron Swartz's all-too-short life is to get more people interested in open access to research, and to drive that movement forward, that's a good thing.

Filed Under: aaron swartz, civil disobedience, knowledge, open access, pdftribute, sharing

Why Did The Secret Service Take Over Aaron Swartz's Case Two Days Before He Was Arrested

from the makes-no-sense dept

Many have noted that the US Attorneys had made a new filing on the day that Aaron Swartz committed suicide. While the filing may look like just a standard procedural filing, some are pointing out that it highlights some highly unusual activity in the case. It had to do with Swartz's motion to get some of the evidence blocked from being used in the case, over questions concerning how it was collected. But one of the key things that come out is that, for unexplained reasons, the Secret Service took over the case just two days before Aaron was arrested:

MIT and JSTOR conferred regarding methods to prevent excessive downloading. Timeline at 3-4. On December 26, 2010, there was another episode of excessive downloading, which MIT personnel did not learn of until on or about January 3, 2011. On the morning of January 4, 2011, at approximately 8:00 am, MIT personnel located the netbook being used for the downloads and decided to leave it in place and institute a packet capture of the network traffic to and from the netbook. Timeline at 6. This was accomplished using the laptop of Dave Newman, MIT Senior Network Engineer, which was connected to the netbook and intercepted the communications coming to and from it. Id. Later that day, beginning at 11:00 am, the Secret Service assumed control of the investigation.

As Emptywheel points out, it doesn't make any sense for the Secret Service to be involved in such an issue:

According to the Secret Service, they get involved in investigations with:

• Significant economic or community impact
• Participation of organized criminal groups involving multiple districts or transnational organizations
• Use of schemes involving new technology

Downloading scholarly articles is none of those things.

The same filing shows that MIT allowed all of this to happen despite no warrant, court order, or subpoena -- just handing over all sorts of info.

The disclosure took place only after the MIT General Counsel’s Office approved the disclosure of the information to law enforcement authorities even in the absence of a warrant or court order or subpoena – and at a time when MIT personnel were acting as government agents – and in contravention of MIT policy that such information, which exceeded that found in bank records or telephone toll records, would be disclosed only upon the receipt of lawful court orders or subpoenas, i.e., process complying with the Stored Communications Act, 18 U.S.C. §2701 et seq. See Section IV, infra. In a separate email from Halsall to S/A Picket on January 8, 2011, Halsall told Pickett that he “hop[ed] to have the pcap/flows/videos/logs all in by to me Monday, possibly sooner – if you don’t already have a copy of the video or pcap [packet capture], I’ll make sure you get one.” Exhibit 2. No warrant or court order has been provided to counsel which would evidence the government’s having, even post-interception, acquired the contents of the warrantless interceptions by seeking judicial authorization as required.

As more and more people are looking at the details of what went down in arresting and pressuring Aaron, the case just looks worse and worse.

Filed Under: aaron swartz, mit, secret service

The Case Against Aaron Swartz Was Complete Garbage

from the whether-or-not-it-had-an-impact dept

As I stated in my initial post about Aaron Swartz's death, I don't think it's fair to "blame" the DOJ or others on Aaron's suicide -- just as I don't think it's fair to blame anyone's suicide on a third party, no matter how horrible their actions. That said, the DOJ's actions in this case were quite clearly horrible, and since the case will now never go forward, it seems imperative to highlight just how badly the DOJ acted in this case.

Larry Lessig's post made some clear points suggesting that the feds and MIT were out of line in pursuing this case, which seems like an understatement:

Here is where we need a better sense of justice, and shame. For the outrageousness in this story is not just Aaron. It is also the absurdity of the prosecutor’s behavior. From the beginning, the government worked as hard as it could to characterize what Aaron did in the most extreme and absurd way. The “property” Aaron had “stolen,” we were told, was worth “millions of dollars” — with the hint, and then the suggestion, that his aim must have been to profit from his crime. But anyone who says that there is money to be made in a stash of ACADEMIC ARTICLES is either an idiot or a liar. It was clear what this was not, yet our government continued to push as if it had caught the 9/11 terrorists red-handed.

Aaron had literally done nothing in his life “to make money.” He was fortunate Reddit turned out as it did, but from his work building the RSS standard, to his work architecting Creative Commons, to his work liberating public records, to his work building a free public library, to his work supporting Change Congress/FixCongressFirst/Rootstrikers, and then Demand Progress, Aaron was always and only working for (at least his conception of) the public good. He was brilliant, and funny. A kid genius. A soul, a conscience, the source of a question I have asked myself a million times: What would Aaron think? That person is gone today, driven to the edge by what a decent society would only call bullying. I get wrong. But I also get proportionality. And if you don’t get both, you don’t deserve to have the power of the United States government behind you.

Lessig made it clear that the feds sought to get Aaron to agree to a plea deal, in which he'd plead guilty to some aspect of the charges against him, in exchange for letting him off on the more serious charges. Aaron did an amazing thing and refused, believing that he had not done anything wrong:

In that world, the question this government needs to answer is why it was so necessary that Aaron Swartz be labeled a “felon.” For in the 18 months of negotiations, that was what he was not willing to accept, and so that was the reason he was facing a million dollar trial in April — his wealth bled dry, yet unable to appeal openly to us for the financial help he needed to fund his defense, at least without risking the ire of a district court judge. And so as wrong and misguided and fucking sad as this is, I get how the prospect of this fight, defenseless, made it make sense to this brilliant but troubled boy to end it.

And, for those who don't think that pushing back against the feds is an amazing thing, you have no clue how much pressure the federal government can put on you when it wants you to plead guilty. Two years ago I wrote about a documentary called Better This World, which is about an entirely different subject, but really opened my eyes to the way the feds handle some of these cases. It's not about what's right. It is entirely about them winning, getting the press coverage and "making examples" of people. And they'll go to amazing lengths, and create pressure that you and I can only have nightmares about, to get people to accept bogus "plea" deals, just so they can notch up another "win." It's scary, scary stuff. Fighting back may have been the right thing to do, but must have created a level of stress unimaginable to most people.

The WSJ has provided more details about the hard line that federal prosecutors had taken with Aaron, including last week's demand that he plead guilty to all counts and spend time in jail:

Mr. Swartz's lawyer, Elliot Peters, first discussed a possible plea bargain with Assistant U.S. Attorney Stephen Heymann last fall. In an interview Sunday, he said he was told at the time that Mr. Swartz would need to plead guilty to every count, and the government would insist on prison time.

Mr. Peters said he spoke to Mr. Heymann again last Wednesday in another attempt to find a compromise. The prosecutor, he said, didn't budge

In exchange for pleading guilty across the board, Heymann apparently promised that they would ask for a shorter sentence, though that's never a guarantee:

The government indicated it might only seek seven years at trial, and was willing to bargain that down to six to eight months in exchange for a guilty plea, a person familiar with the matter said. But Mr. Swartz didn't want to do jail time.

"I think Aaron was frightened and bewildered that they'd taken this incredibly hard line against him," said Mr. Peters, his lawyer. "He didn't want to go to jail. He didn't want to be a felon."

The report also notes that his girlfriend was unaware of any depressive episodes until right after Wednesday's decision by Heymann to refuse to budge on jailtime and a guilty plea on all counts.

As for the details of the case itself, they were absurd -- and it is no wonder that Swartz refused to plead guilty. Back in September, we delved into the ridiculous details of the final indictment -- which upped the felony count, all of which was based on the idea that he had done some sort of massive computer hacking for the sake of some criminal conspiracy. And yet... that was clearly never the case. As Tim Lee detailed, at worst, it appeared that Swartz might possibly be guilty of trespassing. Yes, he went into a computer closet at MIT, but he got access to a network which was open for all, and he downloaded documents that were made available freely to all on that network.

Many people have reasonably pointed to a blog post from Alex Stamos, the CTO of Artemis Internet, who had been brought on as an expert witness on Aaron's behalf. After demonstrating that his reports have been used on behalf of prosecutors in attacks, and pointing out that he's no friend of hackers, Stamos highlights in detail just how completely bogus the charges against Swartz were:

I know a criminal hack when I see it, and Aaron’s downloading of journal articles from an unlocked closet is not an offense worth 35 years in jail.

The facts:

• MIT operates an extraordinarily open network. Very few campus networks offer you a routable public IP address via unauthenticated DHCP and then lack even basic controls to prevent abuse. Very few captured portals on wired networks allow registration by any vistor, nor can they be easily bypassed by just assigning yourself an IP address. In fact, in my 12 years of professional security work I have never seen a network this open.
• In the spirit of the MIT ethos, the Institute runs this open, unmonitored and unrestricted network on purpose. Their head of network security admitted as much in an interview Aaron’s attorneys and I conducted in December. MIT is aware of the controls they could put in place to prevent what they consider abuse, such as downloading too many PDFs from one website or utilizing too much bandwidth, but they choose not to.
• MIT also chooses not to prompt users of their wireless network with terms of use or a definition of abusive practices.
• At the time of Aaron’s actions, the JSTOR website allowed an unlimited number of downloads by anybody on MIT’s 18.x Class-A network. The JSTOR application lacked even the most basic controls to prevent what they might consider abusive behavior, such as CAPTCHAs triggered on multiple downloads, requiring accounts for bulk downloads, or even the ability to pop a box and warn a repeat downloader.
• Aaron did not “hack” the JSTOR website for all reasonable definitions of “hack”. Aaron wrote a handful of basic python scripts that first discovered the URLs of journal articles and then used curl to request them. Aaron did not use parameter tampering, break a CAPTCHA, or do anything more complicated than call a basic command line tool that downloads a file in the same manner as right-clicking and choosing “Save As” from your favorite browser.
• Aaron did nothing to cover his tracks or hide his activity, as evidenced by his very verbose .bash_history, his uncleared browser history and lack of any encryption of the laptop he used to download these files. Changing one’s MAC address (which the government inaccurately identified as equivalent to a car’s VIN number) or putting a mailinator email address into a captured portal are not crimes. If they were, you could arrest half of the people who have ever used airport wifi.
• The government provided no evidence that these downloads caused a negative effect on JSTOR or MIT, except due to silly overreactions such as turning off all of MIT’s JSTOR access due to downloads from a pretty easily identified user agent.
• I cannot speak as to the criminal implications of accessing an unlocked closet on an open campus, one which was also used to store personal effects by a homeless man. I would note that trespassing charges were dropped against Aaron and were not part of the Federal case.

In short, Aaron Swartz was not the super hacker breathlessly described in the Government’s indictment and forensic reports, and his actions did not pose a real danger to JSTOR, MIT or the public. He was an intelligent young man who found a loophole that would allow him to download a lot of documents quickly. This loophole was created intentionally by MIT and JSTOR, and was codified contractually in the piles of paperwork turned over during discovery.

That's from someone who clearly had detailed knowledge about the situation. Other legal experts had come to similar conclusions after the original indictment came out. Way back when, we had pointed to an article by Max Kennerly in which he looked closely at the indictment and was left confused as to how it got as far as it did. Kennerly has since updated his post (both after the new indictment and again over the weekend, in which he notes that Stamos' post suggest that his own original analysis didn't even go far enough after discovering the details). Kennerly looked at how the case really revolved around whether or not Swartz's activities violated the terms of service, but given the details of the case, combined with Stamos' comments and the fact that (since Swartz was charged) multiple courts have ruled that a mere terms of service violation is not a violation of the Computer Fraud and Abuse Act (CFAA), this case seemed to have absolutely nothing legitimate.

Given the disclosures by Swartz's expert, Alex Stamos, which are linked at the beginning of this post, it seems that Swartz had a strong argument that he did indeed have "authorization." As Stamos says, at the time of Swartz's downloads, "the JSTOR website allowed an unlimited number of downloads by anybody on MIT’s 18.x Class-A network" and "Aaron did not use parameter tampering, break a CAPTCHA, or do anything more complicated than call a basic command line tool that downloads a file in the same manner as right-clicking and choosing 'Save As' from your favorite browser."

Thus, all Swartz did was write a script to find and download the files. As a factual matter, that may have been "authorization," rendering it lawful everywhere. Even if the script was "exceeding authorization," if the First Circuit had adopted the same rule as the Fourth Circuit and the Ninth Circuit, then Swartz would likely have been not guilty as a matter of law. All of which further shows why this prosecution should not have been brought in the first place; the prosecutor is supposed to exercise their judgment to do justice.

Separately, it has been pointed out numerous times that the only real party who had any reasonable claim to "harm" was JSTOR, and it had said from early on that it had settled its issue with Swartz when he agreed to turn over his hard drive with everything he'd downloaded. Now, a bit more has come out, as apparently JSTOR itself asked federal prosecutors to drop the case:

Elliot Peters, Swartz's California-based defense attorney and a former federal prosecutor in Manhattan, told The Associated Press on Sunday that the case "was horribly overblown" because Swartz had "the right" to download from JSTOR, a subscription service used by MIT that offers digitized copies of articles from more than 1,000 academic journals.

Peters said even the company took the stand that the computer crimes section of the U.S. Attorney's Office in Boston had overreached in seeking prison time for Swartz and insisting , two days before his suicide , that he plead guilty to all 13 felony counts. Peters said JSTOR's attorney, Mary Jo White , the former top federal prosecutor in Manhattan , had called Stephen Heymann, the lead Boston prosecutor in the case.

"She asked that they not pursue the case," Peters said.

So even the supposedly "harmed" party didn't want the case to go forward. And yet, Stephen Heymann kept pushing.

The case is now gone, so we'll never see how a judge rules on it. We can hope that, given everything above, a judge would have clearly seen what a joke the case was, and dismissed it. But, you never know how judges will rule, and especially when they're not very technically savvy, they'll give a ridiculous amount of deference to federal prosecutors, merely because of their position. But the ridiculousness of the case should be pointed out over and over again to remind everyone of the problems we get when the federal government gets too powerful, and knows that it can use that power against someone it doesn't like.

Whether or not the impending trial contributed to Swartz's death, one thing is undeniable: the case itself was a complete farce, and that should not be forgotten. One hopes that, among other things, one of the legacies of Swartz's death may be to fix broken laws that allowed this prosecution to move forward, and to figure out a way to dial back the aggressiveness with which federal prosecutors take on cases these days.

Filed Under: aaron swartz, cfaa, copyright, doj, hacking, legal issues, pressure, stephen heymann, us attorneys

In Response To Aaron's Death: Don't Take Down, Build Up; Don't Attack, But Share

from the it's-what-he-would-have-wanted dept

I've already written some basic thoughts on the death of Aaron Swartz, and I know that more will be forthcoming, but within the justifiable anger out in the world over this turn of events, there are some reports suggesting that DDoS attacks took down MIT's website and possibly other sites (though, reports of the Justice Department's website being taken down were wrong). This happened soon after MIT put out a statement about Swartz, following the statement from Swartz's family that pointed a finger directly at MIT.

The family had said:

“Aaron’s death is not simply a personal tragedy. It is the product of a criminal justice system rife with intimidation and prosecutorial overreach. Decisions made by officials in the Massachusetts U.S. Attorney’s office and at MIT contributed to his death.”

In response, MIT's statement, by president L. Rafael Reif, was actually somewhat self-reflective, admitting that the university needed to look closely at its own role in the situation, and appointing professor Hal Abelson -- someone quite knowledgeable and active in many of the same causes as Aaron -- to lead the investigation.

To the members of the MIT community:

Yesterday we received the shocking and terrible news that on Friday in New York, Aaron Swartz, a gifted young man well known and admired by many in the MIT community, took his own life. With this tragedy, his family and his friends suffered an inexpressible loss, and we offer our most profound condolences. Even for those of us who did not know Aaron, the trail of his brief life shines with his brilliant creativity and idealism.

Although Aaron had no formal affiliation with MIT, I am writing to you now because he was beloved by many members of our community and because MIT played a role in the legal struggles that began for him in 2011.

I want to express very clearly that I and all of us at MIT are extremely saddened by the death of this promising young man who touched the lives of so many. It pains me to think that MIT played any role in a series of events that have ended in tragedy.

I will not attempt to summarize here the complex events of the past two years. Now is a time for everyone involved to reflect on their actions, and that includes all of us at MIT. I have asked Professor Hal Abelson to lead a thorough analysis of MIT's involvement from the time that we first perceived unusual activity on our network in fall 2010 up to the present. I have asked that this analysis describe the options MIT had and the decisions MIT made, in order to understand and to learn from the actions MIT took. I will share the report with the MIT community when I receive it.

I hope we will all reach out to those members of our community we know who may have been affected by Aaron's death. As always, MIT Medical is available to provide expert counseling, but there is no substitute for personal understanding and support. With sorrow and deep sympathy,

L. Rafael Reif

I am sure that many will continue to criticize MIT for its actions in this mess -- and some criticism may be well deserved. That said, MIT's response here is a step forward -- and hopefully it creates real change in how MIT handles such things in the future. I think that there are many, many, many reasons to be furious about the Justice Department's actions in the Swartz case (and I felt that long before Swartz's death). However, a DDoS attack on MIT or the DOJ or anyone else is exactly the wrong message to send concerning Aaron. Yes, I was just defending the use of DDoS as a form of expression and protest, but this is not the kind of protest that serves Aaron's memory well.

Aaron -- more than almost anyone else -- did stuff. He built stuff and he created change. Not by taking things down, but by building them up. Not by attacking, but by sharing and informing and educating.

Aaron's memory needs to be preserved, and his death will hopefully be a catalyst for many changes -- to the way the government prosecutes people, to the way computer hacking laws are used today, to the way copyright laws are used and much, much more. But the way to do that is to do something proactive and positive. The organization Aaron founded is called Demand Progress, and that's what we should be doing now.

We should be looking for ways to continue Aaron's work, to build, to share, to create and to create change through sheer will of knowing what's right.

So, don't participate in attacks or takedowns. Look for ways to build something up. Create efforts to change problematic laws like the CFAA or copyright law. Look for ways to share knowledge and expand our ability to learn and to educate each other. Create ways for people to speak out and to enable everyone to do more.

That is the legacy that I believe Aaron would have wanted. It will always be impossible to fill the void that Aaron's death has left in its wake -- but if it inspires each of us to do a little more, to create some positive change, to truly demand progress in the face of ridiculous odds, then that will be the testament to all that Aaron did for the world.

Filed Under: aaron swartz, activism, attacks, ddos, hacks

Some Thoughts On Aaron Swartz

from the a-loss dept

This past weekend has, tragically, been way too much about death for me. On Friday evening I found out that a close relative had just passed away, and had just spent some time talking to other family members, crying, figuring out how I was going to fly across the country for a funeral, etc. I'd finally had enough and was about to shut down and go to sleep, when an email popped up from a friend telling me that Aaron Swartz had killed himself. And, suddenly, there was more death to think about in a very different way. The past few days I've been thinking a lot about both my relative and Aaron -- two very different people who probably only share the end date of their lives. I'm mourning them both, but since Aaron was a public figure and relevant to what we write about here, I wanted to write something about him, even as the mourning sector of my brain tries to figure out how you grieve for multiple people at the same time.

I did not know Aaron all that well, but I did know him. I've been reading many of the stories from those who did know him quite well, and it's amazingly touching. But I wanted to share my short story, because it's what keeps running through my mind. In my head, there are a few key moments that I keep thinking about concerning Aaron. One is the first time I met him. I can't place the exact time, but I think it was a decade ago at a conference in Santa Clara (I remember the hotel well). He was sitting at a table, and wow, did he look young. Very much like the kid in this photo by Richard Gibson, that Aaron posted to his own website, showing himself talking to Larry Lessig back in 2002 -- at the age of 15. I knew back then that he'd been one of the creators of one version of RSS (and that he and Dave Winer didn't get along because of some disputes over that). And I'd remembered hearing that he was young. But seeing that little kid sitting there was still really surprising. I talked to him very briefly at that event, and was immediately struck by how sharp he was. I also remember him helping to "launch" Creative Commons -- and I thought that, at nearly twice his age, I'd done so little.

I started reading his blog soon after that, which was an interesting mix of content from technical to political to philosophical to personal. When he started college, at Stanford, something about his blog posts were both captivating and horrifying at the same time -- describing in vivid details the kinds of thoughts many of us have when we go to college for the first time and are trying to figure out how and where we fit into the world. What struck me as so odd was that because of everything else he had done, my mind just defaulted to assuming that he was completely mature in all aspects of his life. But he was still just a kid.

The blog post I most remember came maybe a month or so after he had gotten to Stanford, and it involved him telling the story -- again, in both captivating and horrifying detail -- about him hooking up with a girl. My memory is fuzzy at this point -- and a very cursory spin through his blog doesn't turn up the post -- but I remember her joking about him being famous, which lead to the usual sort of awkwardness that comes with early makeout sessions, but all described in detail. I also vaguely remember some sort of followup, indicating that the girl was mortified about the public reporting on their rendezvous.

It was Aaron, sorting out his life in public. That may be more common these days, but it was certainly relatively new back then, and it was so disjointed from the "profesional" Aaron, who had already accomplished so much. I kept thinking... "that's right, he's just a kid."

But the kid grew up. He left Stanford, he joined the first YCombinator class, he did a startup that didn't go far, but which eventually led him to joining the early Reddit team. Here and there, he kept popping up, always doing something interesting. The next time I came across him was in 2009, when the FBI investigated him for daring to download a ton of public domain court documents from PACER. While PACER tries to charge $0.10/page (at the time it was $0.08) the documents are still public domain. Many people find this annoying -- and Aaron was a true crusader for the right to information. So when he found out that some libraries were experimenting with free PACER access as a trial, he went to one, set up a perl script and had it cycle through tons of documents, downloading them for him to collect. Eventually, the FBI realized it had no case: freely offered access to public domain material is legal to use.

Obviously, that foreshadowed his more recent legal troubles.

Over the last couple years, Aaron and I emailed occasionally. He and I were two of the only people (along with Senator Wyden) who seemed really concerned about the predecessor to SOPA/PIPA called COICA, and he had talked to me about helping get more people aware of the problems of the bill. And then, when SOPA/PIPA came along, we were in touch over the efforts against that (along with many others as well). But I also remember the last two times I heard from Aaron. Last summer, out of the blue, he emailed me to say that he'd run across a minor (but annoying) technical error on Techdirt, and suggested how to fix it. And then, in October, when he finally got his FOIA request returned concerning ICE's domain seizures, he emailed to let me know. I never communicated with him directly about his own ongoing case, but I remember being both surprised and impressed (and then less surprised once I thought about it) that he'd continued to push forward on his activist causes, even while facing trial for one of them.

The only time I ever met Aaron in person was that one time, a decade ago. I probably emailed with him less than 100 times -- with most of those coming over the past couple of years. I always knew he was complex -- wise way beyond his years in some things, and still figuring out other things at the same time. But the news of his suicide definitely took me by surprise, though others have pointed out that he's hinted at such things in the past.

I will also say that I know there's been a rush to "blame" the lawsuit against him on this. In fact, our September post detailing the new charges against him got a tremendous amount of traffic over the weekend. Aaron's own family has stated:

“Aaron’s death is not simply a personal tragedy. It is the product of a criminal justice system rife with intimidation and prosecutorial overreach. Decisions made by officials in the Massachusetts U.S. Attorney’s office and at MIT contributed to his death.”

Just as I was hesitant to blame Lori Drew or Dharun Ravi for actions that were connected to later suicides of people they had taunted, it still feels wrong to say that the case itself led to his suicide, without more details. That said, as Tim Lee noted, knowing Aaron, he would be the first in line to suggest the value of using the circumstances of his own death to get reform of the massively broken Computer Fraud and Abuse Act (CFAA), which he was charged under.

Again, as detailed in our earlier post, as well as an earlier analysis, the case against him was a joke: it involved massive charges for downloading information that was made freely available to the campus network he was on. At best, we could have seen a trespassing citation -- but instead he was facing decades in jail and seven figure fines. For accessing information. It really showed a case where the feds seemed to be going after Aaron because they didn't like him -- and, as we've seen, when the feds don't like you, they can make your life hell. JSTOR -- the supposedly "harmed" party -- wanted nothing to do with the case. The feds just seemed to want to make an example out of Aaron... for the "crime" of wanting access to knowledge. It would be great to see an Aaron Swartz Act to reform the worst parts of the CFAA. It might not be his biggest legacy, but it would be a good one to add to a long list.

Larry Lessig -- who knows more about both Aaron and the case against him than most people -- has a tremendously powerful post calling out the federal government (and MIT) for their actions in the case against Aaron, suggesting that the feds offered up a plea deal, but Aaron would not take anything that would have him described as a felon. More is going to come out on what happened, I'm sure, and the government is not going to look good.

If you want to read more thoughts on Aaron from people who knew him much better than I, I suggest you read the posts by Cory Doctorow and Danny O'Brien. Also, Mathew Ingram has been curating a list of some of the more interesting remembrances -- and a tumblr for Remember Aaron Swartz is filling up with wonderful remembrances.

There are so many sad things about this story, but the biggest is the most obvious: knowing just how much Aaron had accomplished already in his short life, combined with his drive and determination, we'll now never know how much more he would have accomplished down the road -- and every single one of us will lead less fulfilling lives because of that loss. He was still just a kid... a kid who had already accomplished amazing things.

Filed Under: aaron swartz

ICE Reluctantly Releases A Small Number Of Heavily Redacted Domain Seizure Docs, Holds The Rest Hostage

from the but-of-course dept

Back in December of 2010, Aaron Swartz filed a Freedom of Information Act request regarding the Immigrations and Customs Enforcement (ICE) efforts to seize, without any notification or adversarial hearings, domain names which ICE claimed were facilitating copyright and/or trademark infringement. After nearly two years of back and forth (including ICE apparently losing an updated request and closing the request because of it), ICE has finally delivered 100 pages worth of heavily redacted material which are close to useless. They are also claiming that there are another 16,137 records out there, but they want him to pay over $1,000 to get the rest. They told him if he didn't cough up the money within a few days, they would consider the request closed. Aaron, with the help of the Muckrock site (which helps people file FOIAs), is appealing this decision.

In the meantime, however, we have 100 mostly useless documents that appear to just show the warrants that US Magistrate Judge Alan Kay approved on the morning of November 23rd, 2011. Of course, these are completely redacted, so you don't even know what domains they're referring to. In going through the documents, the only thing of interest that I spotted was that the judge time stamped each warrant signature, and many of them are mere minutes from one another -- at least raising some questions concerning how carefully the judge reviewed each individual case before granting the warrant that allowed the feds to then seize and shut down those sites. Considering that we already have two known cases -- Dajaz1 and Rojadirecta -- in which it later came out that the government did not have the necessary evidence, and where the feds were embarrassingly forced to hand back the domains and drop legal proceedings, it seems that a judge should be expected to at least spend some time understanding why it is he's signing off on an order to take down speech.

Either way, it really does seem like these documents being the first 100 released was, perhaps, done on purpose, to make sure the released documents don't actually get at what Swartz actually requested, which was:

• Any guidelines or protocols for ICE agents about the procedures for seizing domains
• Any communications between ICE and other government agencies with regard to the seized domains
• Any communications between ICE and intellectual property owners requesting domains be seized or discussing seized domains
• Any court filings requesting authorization to seize domains
• Any internal emails mentioning the seized sites
• Any legal memos mentioning the seized sites

Instead, he gets 100 pages of heavily redacted warrants? What a joke. And, is it that difficult to expect that a judge will take more than a minute or two to understand the issues at hand when signing off on a warrant to completely shut down a website with no adversarial hearing with the site owner?

Filed Under: aaron swartz, domain seizures, foia, ice, redacted