Towards Learning from Losing Aaron Swartz: Part 2 | Center for Internet and Society

The CFAA is incredibly broad and covers swaths of online conduct that should not merit prison time.  To point out that under the CFAA, Aaron's defense was hard is not to say that I believe Aaron was guilty.  Aaron was authorized to access JSTOR as a result of being on MIT's campus.  The CFAA may protect the box from unauthorized access, but it does not regulate the means or the speed of access.  If you are allowed to download, and Aaron was, then it is not a crime to download really, really fast.  Even if the server owner would prefer you took your time.

Exactly because the CFAA arguably applies to Aaron's alleged actions,it should be amended.  It's also why prosecutors must be extremely careful and measured when bringing these cases.  Unfortunately, from Drew, to Nosal, to McDanel, to Aurenheimer to Swartz, they are not.  When so many thoughtful people, including former prosecutors, disagree with United States Attorney's conduct in these cases, we need to stop. 
 
----
ORDINARY PROSECUTORIAL TACTICS BECOME EXTRAORDINARY MISTAKES WHEN THE CASE IS BOGUS OR OVERCHARGED

Many people feel that Aaron's prosecution was disproportionate to the offense, if any, committed.  The government filed multiple, duplicative charges, hung 35 years, then 50, over Aaron's head and insisted that Aaron plead to multiple felonies and be incarcerated.  

Certainly, most federal cases I defended went much the same way: The government overcharges the case.  There are so many ways to lose and only one way, total acquittal, to win. The maximum potential sentence is terrifying.  While any first time defendant is unlikely to get the maximum, because defendants are sentenced based not just on the conduct proven at trial, but also on unproven "related conduct", the actual sentence can be quite high.  In this atmosphere of terror, the prosecutor offers a deal, usually before dispositive motions are heard, or before trial.  If my client waives her right to trial and appeal and admits felonious conduct, the government will suggest to the court a greatly reduced sentence.  If she refuses to do so, the prosecutor will return to the grand jury and add more charges to the case, thereby racheting up the opportunities to lose and the maximum lawful sentence.

This reality is discomfiting enough when your client has been caught red-handed with a car full of cocaine.  But when the facts are unclear, or the case arises under a vague and overbroad law, it becomes terrifying. I want to both acknowledge that regular defendants unjustly face the same tactics used against Aaron every day, and also identify ways in which those tactics are especially likely to produce unjust results in the computer crime context. 

OVERCHARGING

Voluminous, overlapping charges may be typical, but they can give unfair advantage to the prosecution.  At trial, each charge is a chance for the prosecution to win.  Convict on one count, and you can likely punish the defendant for all of his conduct, because related conduct, even aquitted conduct, is part of the sentencing calculation.  In contrast, the defendant has only one way to win: He must be acquitted on all counts.  The more counts, the more chances for the government to win. Furthermore, having a lot of counts bolsters the government's case in front of a lay jury.  Jurors tend to infer that the defendant must have done something very wrong if the indictment is substantial and voluminous. When just disposition of the case requires jurors to understand technology, politics, economics, philosophy and physics likely outside of common experience, this tactic is all the more coercive. 

SENTENCING

Aaron was in danger of doing real time behind bars, and that is terrifying. To really understand the pressure that federal defendants face, you have to understand something about the way that federal sentencing works.  

In federal court, sentences are almost entirely determined by the federal sentencing guidelines.  The guidelines were initially adopted to constrain judges' arbitrary sentencing practices, so similarly situated convicts would be sentenced similarly.  In practice, the guidelines set draconian sentences that would always rachet upwards, but almost never downwards.  Because one of the only ways to lower your sentence was to plead guilty and testify against someone else, the federal court system is replete with prosecutions based on snitches and liars.  When I was practicing, judges had to sentence according to the guidelines. Today, the guidelines are highly influential but technically discretionary, giving us the worst of both worlds -- arbitrary sentences informed by a strict and draconian regime.  

To calculate the sentence, you look at the defendant's past record and at the offense characteristics.  The factors are plotted along the X- and Y-axis on a sentencing table.  Cross-referencing these factors on the table gives the judge a range of months she should impose.  Along the X-axis, Aaron was criminal history category I, he had no prior convictions.  

Along the Y-axis, you look at the sentencing guideline for the particular case.  CFAA sentences are governed by §2B1.1, which providers for a base offense level of 6, and adds to that for loss and other characteristics of the offense. 

Sentencing under the CFAA is both harsher and less predictable than sentencing even in other fraud cases. Loss, and not the statutory maximum, determines the sentence in computer crime cases.  But, as I wrote in 2006 (pdf), in computer crime cases, the sentence is almost wholly dependent on a "reasonable estimate" of loss and the loss calculation is extremely malleable. The CFAA defines loss as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."

Nor do the guidelines limit loss in computer crime cases to foreseeable damages. While the definition of loss for other white collar fraud crimes punished under the same guideline includes only reasonably foreseeable monetary harm, a special rule for computer crime cases requires the court to include any reasonable cost to any victim, “including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other damages incurred because of interruption of service”, regardless of whether the harm was reasonably foreseeable or not. Also, the guidelines establish a lower burden of proof for loss calculations in sentencing. Generally, sentencing is by a preponderance of the evidence. However, the guidelines only require the judge to make a “reasonable estimate” of the loss. In other words, the government only needs to show by a preponderance of the evidence that the sentencing court made a reasonable estimate of loss, and that estimate is a factual finding entitled to great deference on appeal.

I don't know what the government claimed was the loss in Aaron's case. Allegedly, he downloaded 4.8 million articles and the cost to download each individual article was $19.  At that rate, Aaron arguably caused $91M in loss to JSTOR.  The government's opposition to the suppression motion alleged the information was "valued in the tens of thousands of dollars at the time." Another, or additional, claim of loss could be based on the amount of time MIT and JSTOR spent trying to stop Aaron from downloading. Given the low burden of proof, and the fact that such damage need not be foreseeable, loss numbers are very much in the control of the alleged victims. 

For Aaron, with such a fungible numbers in hand and such a low burden of proof, the government could have argued for almost any sentence it wanted.  Using just the base level of 6 and $70K in loss, Aaron would not be eligible to serve any of his sentence in a halfway house or on home confinement. He would be looking at 15 to 21 months of incarceration.  That number could get higher quickly.  Section 2B1.1 increases the base offense level to 12 if the conduct involved use of an "authentication feature" or "unauthorized access device". Alternatively, upwards adjustments may be warranted if the defendant used a special skill, abused a position of trust, or tried to obstruct justice. True, 35 years wasn't in the cards, despite the fact that's the sentence the government publicly waived over Aaron's head.  Neither was a maximum of 50 years, which was what the government arrived at after its perplexing choice to get a superceding indictment.  But Aaron could easily have come out to over a year in his guideline calculation.   

PLEA BARGAINING

Reportedly, prosecutors offered Aaron three options: He could plead guilty to all 13 felony charges and the government would argue for a six-month prison term while Swartz’s lawyers argued for less time; he could plead guilty to all 13 felonies and accept a sentence of four months; or Aaron could go to trial and if he lost, the government would argue for seven years. 

Some have blithely said Aaron should just have taken a deal. This is callous. There was great practical risk to Aaron from pleading to any felony. Felons have trouble getting jobs, aren't allowed to vote (though that right may be restored) and cannot own firearms (though Aaron wasn't the type for that, anyway). More particularly, the court is not constrained to sentence as the government suggests.  Rather, the probation department drafts an advisory sentencing report recommending a sentence based on the guidelines.  The judge tends to rely heavily on that "neutral" report in sentencing.  If Aaron pleaded to a misdemeanor, his potential sentence would be capped at one year, regardless of his guidelines calculation.  However, if he plead guilty to a felony, he could have been sentenced to as many as 5 years, despite the government's agreement not to argue for more.  Each additional conviction would increase the cap by 5 years, though the guidelines calculation would remain the same.  No wonder he didn't want to plead to 13 felonies.  Also, Aaron would have had to swear under oath that he committed a crime, something he did not actually believe.

There's a more systemic problem here.  Plea bargaining in the face of potentially heavy sentences incentivizes guilty pleas even (or especially) where the case is weak, or the defendant is factually innocent. People plead guilty all the time to things they did not do, because they couldn't afford the right lawyer, because they are scared, because they think no one will believe them, because they are simply playing the odds. Especially when you have a case involving network policies, academic culture, technological infrastructure, and information of questionable economic value, asking a jury to decide what's "authorized" at the risk of prison is scary.

Lest we mistake plea bargaining for justice, ask yourself, why is a seven-year sentence just for a person who goes to trial, while one who pleads guilty should only be incarcerated for six months? Why should Aaron have received two additional months of incarceration in order to argue to the judge that his sentence should be lower?  This is not justice, this is horse trading.  It is typical, it happens every day, but it is also wrong.
 
The criminal process is byzantine and treacherous.  We rely on knowlegable lawyers to shepherd our loved ones safely through the system, even though we know that the system is broken.  We ourselves are afraid to be called as witnesses, to be inculpated.  We have no clear avenue through which we can say "Stop!"  Perhaps now is an opportunity.  

THOUGHTS ON CURRENT ACTIVISM:

I've seen two petitions to the White House circulating, one for reforming the CFAA and one for removing the prosecutors from office.  

Real reform of the CFAA requires two steps: (1) a comprehensive rethinking of the statute, esp. since solving the Lori Drew problem would not have saved Aaron and (2) engaging not with the White House, but with Senators Leahy and Franken, the policy makers most likely to understand and support these efforts. Nevertheless, I'm going to sign this petition. The White House can know what I think.  

As for removing the prosecutors, yes, I am angry. But, I am the kind of person who tends to blame the system rather than the individual, and I believe systematic change is more likely to make a difference than a campaign against these particular officials. I want to know how and why the decision to charge was made in Aaron's case. I want to know why they were pushing for felonies and incarceration.  I want to know what JSTOR and MIT's role was. I want to better understand funding, incentives, evaluation metrics, bonuses and other perks prosecutors receive, for cybercrime and for other cases.  I want to insulate future prosecutors from the incentives to build their careers on conviction rates rather than crime prevention, to train them so that they don't get myopic, so that in their bones they know that behind their conviction rates are the hearts, minds and bodies of real people and their families. I want to change the conditions so that a newly-minted bully won't just take these prosecutors' places.

It is also true that in my criminal law career, I found the U.S. Attorney's office in the District of Massachusetts particularly immoral.  In one case, I was told that if my client failed to enter a plea that day, the prosecutor would obtain a superseding indictment and add embarrassing pornography charges to my client's computer crime case based on materials allegedly found on his hard drive but never disclosed to me in discovery.  Similarly, that office sought to imprison a man for collecting user emails to compile a list of best-selling books, despite the fact that the email collection would have uncontrovertably have been lawful had it occurred a nanosecond later. (U.S. v Councilman). 

I may sign that petition, but I need more time to think about that.  

TOWARDS LEARNING

I admire this community's anger and energy. We are not alone. There are great organizations out there fighting to improve the criminal justice system in specific ways that would have helped Aaron.  Every day there are people getting chewed up by the criminal justice system, rightly or wrongly, and these people tend to be poor, people of color, non-English speakers, the mentally ill, the addicted. The pressure the government regularly brings to bear on the least powerful of us, when combined with vague laws like the CFAA, can wreak devastation on innocent people from all walks of life.  My hope is that this community will productively cross-pollinate with criminal justice advocates and that together we are strong enough not only to change the CFAA but also the normalization of disproportionately harsh prosecutorial tactics.  

In the next few days, I'll post a short reading list and seek out compatriots at the ACLU, NACDL, and Federal Defender bar and talk to friends and colleagues about what's next.  

To Aaron's friends and family: I'm sorry.  In the aftermath of this great loss, all I know how to do is make a To Do list.  I am going to try to make changes that will reduce the chances that something like this happens again.  It will not bring our Aaron back.