This is the second in a series of posts on the Aaron Swartz prosecution. In my first post, I analyzed whether the charges that were brought against Swartz were justified as a matter of law. In this post, I consider whether the prosecutors in the case properly exercised their discretion. As some readers may know, prosecutors generally have the discretion to decline to prosecute a case; once they charge a case, they have the discretion to offer or not offer a plea deal; and once they offer the plea deal, they have some discretion to set the terms of the offer that they will accept. This post considers whether the prosecutors abused that discretion.
To provide some attempted answers, I’m going to break down the question into four different issues: First, was any criminal punishment appropriate in the case? Second, if so, how much criminal punishment was appropriate? Third, who is to blame if the punishment was excessive and the government’s tactics were overzealous? And fourth, does the Swartz case show the need to amend the Computer Fraud and Abuse Act, and if so, how?
This is a very long post, so here’s a summary of where I come out on these four questions.
On the first question, I think that some kind of criminal punishment was appropriate in this case. Swartz had announced his commitment to violating the law as a moral imperative in order to effectively nullify existing federal laws on access to information. When someone engages in civil disobedience and intentionally violates a criminal law to achieve such an anti-democratic policy goal through unlawful means — and when there are indications in both words and deeds that he will continue to do so — it is proper for the criminal law to impose a punishment under the law that the individual intentionally violated. (Indeed, usually that is the point of civil disobedience: The entire point is to be punished to draw attention to the law that is deemed unjust.) As that appears to be the case here, I think some punishment was appropriate.
On the second question, I think the proper level of punishment in this case would be based primarily on the principle of what lawyers call “special deterrence.” In plain English, here’s the key question: What punishment was the minimum necessary to deter Swartz from continuing to try to use unlawful means to achieve his reform goals? I don’t think I know the answer to that question, but that’s the question I would answer to determine the proper level of punishment. The prosecution’s plea offer of 6 months in jail and a felony conviction may have been much more than was needed to persuade Swartz not to engage in unlawful and anti-demoratic means to pursue his policy goals in the future. If so, then I think it was too severe. But it depends on how much punishment was necessary to deter Swartz from using unlawful means to pursue his policy goals. In my view, that’s the question that we need to answer in order to say what punishment was appropriate in Swartz’s case.
On the third question, the issue of who was to blame if the prosecution was too severe, I think it’s important to realize that what happened in the Swartz case happens it lots and lots of federal criminal cases. Yes, the prosecutors tried to force a plea deal by scaring the defendant with arguments that he would be locked away for a long time if he was convicted at trial. Yes, the prosecutors filed a superseding indictment designed to scare Swartz evem more in to pleading guilty (it actually had no effect on the likely sentence, but it’s a powerful scare tactic). Yes, the prosecutors insisted on jail time and a felony conviction as part of a plea. But it is not particularly surprising for federal prosecutors to use those tactics. What’s unusual about the Swartz case is that it involved a highly charismatic defendant with very powerful friends in a position to object to these common practices. That’s not to excuse what happened, but rather to direct the energy that is angry about what happened. If you want to end these tactics, don’t just complain about the Swartz case. Don’t just complain when the defendant happens to be a brilliant guy who went to Stanford and hangs out with Larry Lessig. Instead, complain that this is business as usual in federal criminal cases around the country — mostly with defendants who no one has ever heard of and who get locked up for years without anyone else much caring.
On the fourth issue, yes, the Swartz case does point to a serious problem with the Computer Fraud and Abuse Act. But that problem is not the definition of “unauthorized access,” as some people seem to believe. (That definition is a problem, but with the Nosal case from the Ninth Circuit and likely Supreme Court review in the next year or so, I think the Courts are likely to take care of it.) Rather, the problem raised by the Swartz case is one I’ve been fighting for years: Felony liability under the statute is triggered much too easily. The law needs to draw a distinction between low-level crimes and more serious crimes, and current law does so poorly. I would recommend two changes. First, the felony enhancements for 1030(a)(2) are much too broad. I would significantly narrow them. Second, I would repeal 1030(a)(4), which is redundant as it only a combination of 1030(a)(2) and the wire fraud statute, 18 U.S.C. 1343. It therefore only leads to extra and redundant charges to confuse juries, and is better off repealed.
So that’s my overall take. Let’s take it issue by issue.
II. Was Any Criminal Punishment Proper in the Swartz Case?
Let’s start question of whether any criminal charges at all were appropriate in this case. In order to answer that, we need to focus on what Swartz planned to do. Swartz was arrested in the middle of his planned course of conduct, so we need to make an educated guess about what his plan was. Granted, some have argued that the fact that Swartz was caught mid-way means that there was no harm in the Swartz case and he should not be punished. But I think that approach is mistaken. When the police catch someone in the course of criminal conduct and intervene mid-way, the punishment is properly based on what the person was in the course of doing rather than how much he succeeded before he was caught.
So what was Swartz’s plan? From what I can tell, Swartz was a remarkable and unusually focused person, and there are substantial reasons to think he acted with a pretty specific plan in mind. Although he never went to law school, Swartz was a serious legal nerd. He hung out with lots of lawyers, and he was passionately involved in debates on legal topics. He went to the Supreme Court argument in Eldred v. Reno as Larry Lessig’s personal guest when he was only 15 years old. More recently, he was deeply involved in the recent debate over SOPA. He was quite informed about the law and interested in it. I know from an e-mail he once sent me that he was a “big fan” of my work — his words — which suggests he was pretty deep in the details of laws like the Computer Fraud and Abuse Act, under which he was ultimately charged.
In figuring out what Swartz was doing, we have an unusual source: Swartz’s own words. In 2008, Swartz published an essay that he labeled the Guerilla Open Access Manifesto. In the essay, Swartz argues that there is a moral imperative to engage in civil disobedience and break laws that limits access to academic articles and to make those articles available wherever they are restricted. Engaging in civil disobedience can nullify the law by making it impossible to enforce, Swartz suggests. Here’s the essay, which is worth reading in full:
Information is power. But like all power, there are those who want to keep it for themselves. The world’s entire scientific and cultural heritage, published over centuries in books and journals, is increasingly being digitized and locked up by a handful of private corporations. Want to read the papers featuring the most famous results of the sciences? You’ll need to send enormous amounts to publishers like Reed Elsevier. There are those struggling to change this. The Open Access Movement has fought valiantly to ensure that scientists do not sign their copyrights away but instead ensure their work is published on the Internet, under terms that allow anyone to access it. But even under the best scenarios, their work will only apply to things published in the future. Everything up until now will have been lost. That is too high a price to pay. Forcing academics to pay money to read the work of their colleagues? Scanning entire libraries but only allowing the folks at Google to read them? Providing scientific articles to those at elite universities in the First World, but not to children in the Global South? It’s outrageous and unacceptable. “I agree,” many say, “but what can we do? The companies hold the copyrights, they make enormous amounts of money by charging for access, and it’s perfectly legal — there’s nothing we can do to stop them.” But there is something we can, something that’s already being done: we can fight back. Those with access to these resources — students, librarians, scientists — you have been given a privilege. You get to feed at this banquet of knowledge while the rest of the world is locked out. But you need not — indeed, morally, you cannot — keep this privilege for yourselves. You have a duty to share it with the world. And you have: trading passwords with colleagues, filling download requests for friends. Meanwhile, those who have been locked out are not standing idly by. You have been sneaking through holes and climbing over fences, liberating the information locked up by the publishers and sharing them with your friends. But all of this action goes on in the dark, hidden underground. It’s called stealing or piracy, as if sharing a wealth of knowledge were the moral equivalent of plundering a ship and murdering its crew. But sharing isn’t immoral — it’s a moral imperative. Only those blinded by greed would refuse to let a friend make a copy. Large corporations, of course, are blinded by greed. The laws under which they operate require it — their shareholders would revolt at anything less. And the politicians they have bought off back them, passing laws giving them the exclusive power to decide who can make copies. There is no justice in following unjust laws. It’s time to come into the light and, in the grand tradition of civil disobedience, declare our opposition to this private theft of public culture. We need to take information, wherever it is stored, make our copies and share them with the world. We need to take stuff that’s out of copyright and add it to the archive. We need to buy secret databases and put them on the Web. We need to download scientific journals and upload them to file sharing networks. We need to fight for Guerilla Open Access. With enough of us, around the world, we’ll not just send a strong message opposing the privatization of knowledge — we’ll make it a thing of the past. Will you join us?As far as I can tell, this “manifesto” was not just a casual remark or random thought. Rather, it seems to have been a set of principles Swartz believed in quite passionately. And his conduct appears to reflect that commitment. In the same year Swartz published the manifesto, he participated in the effort to download the entire contents of PACER. That led to an FBI investigation but no charges. And then the MIT/JSTOR incident followed soon after, in 2010, which led to the criminal charges in this case.
If I’m right about what Swartz was trying to do, then I think some kind of criminal prosecution is appropriate in this case. The evidence suggests to me that this was not a one-time mistake or an impulsive decision. Rather, Swartz was acting very deliberately with a quite far-reaching goal: he was intentionally breaking the law in the short run to achieve a long-run goal of nullifying the protections of a set of democratically-enacted laws that he opposed.
And Swartz knew that the means he used to obtain the JSTOR database was unauthorized. He was playing a long-term cat-and-mouse game with MIT and JSTOR in which they repeatedly tried to get him off the network and he repeatedly figured out ways to get back on and get the files he wanted. He didn’t break into the closet because he liked closets; he was trying to find a way to do what MIT and JSTOR were trying to block. He wasn’t hiding his face from the video camera in the MIT closet out of shyness; he knew that he was doing something illegal and he was trying not to get caught. And when the police spotted him, he wasn’t surprised that they wanted to talk to him: According to the police report, he jumped off his bike and tried to outrun the police on foot. Further, Swartz’s conduct had real costs to others, ranging from costs to MIT in dealing with responding to his conduct to lost access to JSTOR for a few days for the entire campus.
In these circumstances, it seems to me that at least *some* criminal responsibility is appropriate. We can debate what the proper punishment should be — more on that in a minute — but I don’t think it would have been right to just let Swartz go ahead with his plan to intentionally violate the law, releasing millions of articles onto file-sharing networks, without the law responding at least in some way. The great tradition of civil disobedience is to intentionally violate the law and proudly bear the consequences in order to change public opinion and eventually change the law, not to violate the law in secret and try to render the law you oppose unenforceable while avoiding punishment. So I think some kind of criminal punishment is appropriate.
Some have argued that criminal prosecution was inappropriate because JSTOR did not favor prosecution. The problem with this view, in my opinion, is that JSTOR is not the only party with rights at stake here. MIT is also a party with rights at stake: Swartz imposed costs and inconvenience on MIT’s network and its users, and we know MIT called the police and helped the Secret Service catch Swartz. The copyright owners of the copyrighted articles that Swartz was trying to release on file-sharing networks were also parties with rights at stake: Democratically-enacted laws gave them control over that articles that Swartz was trying to defeat. And I would argue that the public also had a broad interest. To the extent Swartz’s goal was to nullify the effect of a democratically-enacted law that he opposed — which seems to be the gist of the manifesto — he was trying to eliminate options that the the public otherwise had in dealing with access to new technologies based on the public’s beliefs about optimal social policy. The reaction of JSTOR doesn’t consider or reflect any of these additional interests, so I don’t think it should strongly influence the government’s decision of whether to prosecute.
III. What Was the Appropriate Punishment in the Aaron Swartz Case?
Now let’s turn to what may be the next question. What punishment was proper? Did prosecutors go too far? To answer that, we need a benchmark of how much punishment was enough. And to answer that, we need to look at the social harms involved in the conduct. Swartz was caught before he executed his plan, so there were relatively minimal harms from the plan that was stopped before it succeeded. But as I’ve explained above, it seems like Aaron was committed to a long-term plan to continue to engage in such conduct, including through unlawful means. In his view, this was not a one-off, or an impulsive decision. Rather, he felt that there was a moral imperative to violate laws that he saw as unjust. And critically, he didn’t want to violate those laws in a symbolic way just to bring attention to laws he saw as unjust. Swartz was not acting in the grand tradition of civil disobedience in which one willingly draws punishment to bring attention to the unjustness of the law. In his own words, he didn’t want to “just send a strong message opposing the privatization of knowledge.” Rather, he wanted to change the facts on the ground to make his preferred world a fait accompli. That is, he wanted to make the laws unenforceable, winning the debate unilaterally outside of Congress. In his words, he wanted to act so that the democratically-enacted laws that allowed privatization of knowledge would become “a thing of the past.”
Given that commitment, I think one appropriate benchmark for the proper punishment is based on what legal scholars call “special deterrence.” In plain English, the question is this: What is the minimum punishment that was needed to persuade Swartz not to do this sort of thing in the future? To my mind, the answer to that question provides a reasonable benchmark to determine the proper punishment. By all accounts, Swartz was a tremendously brilliant guy with an incredibly bright future. His death is a tremendous tragedy. But had he lived, we would all have been better off with a future in which Swartz directed his incredible talents to pursuing his ideas through lawful means rather than unlawful means. Many people — and many readers of this post in particular — share Swartz’s sense of good social policy. But we live in a democracy. We might not like all the rules in a democracy, but the way to change those rules is through democratic change. Swartz could have tried to be punished under the law to bring attention to the law in the hope of changing it through the democratic process. But instead he had something anti-democratic in mind. I think it’s pretty clear that in a democratic system, that kind of anti-democratic cause is something that we should disfavor. You can break the law to draw punishment, but the ultimate goal of traditional civil disobedience is achieving change through the legal means of democracy. Swartz had something else in mind, it seems; changing the law de facto by his unilateral action. Given the importance of the difference, a punishment that was the minimum sufficient to persuade Swartz to follow the law in the future seems appropriate.
This brings up the difficulty that we don’t know exactly what penalty would have persuaded Swartz to follow the law in the future. So I’ll ask those who knew Swartz best: What do you think would have been sufficient to persuade Swartz to abandon the moral imperative of civil disobedience and instead agree to pursue change through only legal means? I’ll defer here to the people who knew Swartz best, with whatever they think the right answer is. Would probation have been enough? A month of home confinement? Jail time? I really don’t know. It may be that the answer was unknowable.
To my mind, this is one of the puzzles about Swartz. On one hand, he was deeply committed to civil disobedience and to the moral imperative of breaking unjust laws. On the other hand, he seems to have had his soul crushed by the prospect that he would spend time in jail. This is an unusual combination. Usually the decision to engage in civil disobedience comes along with a willingness to take the punishment that the law imposes. But despite Swartz’s apparent interest in legal questions, he seems to have made his decision with a blind spot to the penalties that would actually follow. It’s a strange situation: Swartz was really interested in the law, and he knew he was violating the law. He knew a lot of lawyers who would have told him that this would likely happen if he went ahead with his plan. But there was some apparent blind spot that led him to act anyway.
I think a lot of people will respond that whatever punishment was needed to deter Swartz in the future, surely the 35, 40, or even 50 years Swartz was facing was way too much time to achieve that goal. And I think it’s absolutely right that decades in jail would have been extreme overkill. But it’s important to realize that such a sentence was never a realistic possibility. To understand why, and to understand how much time Swartz was facing, we need to take a quick detour through federal sentencing law.
When Congress passes a criminal law, it specifies a maximum possible lawful punishment for a violation of that crime. If the maximum possible punishment is more than a year in jail, then the crime is called a felony; if the maximum possible punishment is a year or less, then the crime is called a misdemeanor. See 18 U.S.C. 3559. But it’s important to realize that the actual punishments that are imposed for violations usually have nothing to do with these maximum punishments. The actual punishments are calculated under a complex scheme enacted by a law called the Federal Sentencing Guidelines, which then offer a recommended sentence that a judge can then impose or modify to suit the circumstances.
Guidelines sentences are normally much lower than maximum sentences — roughly an order-of-magnitude lower. Further, Guidelines sentences group similar crimes. Congress often enacts criminal laws that largely overlap, and the government can then charge several different criminal violations for one particular act; even if the jury convicts on all of the overlapping crimes charged, the actual punishment imposed by the Guidelines ordinarily will be just the punishment from one of those crimes. As a result, you will often hear that a defendant was charged with 10 crimes and faces up to 50 years in jail, when actually the defendant was alleged to have committed only one wrongful act and would probably be punished by a year or so in prison if convicted.
Why are you hearing that Swartz faced 35 or 50 years if it was not true? First, government press releases like to trumpet the maximum theoretical numbers. Authors of the press releases will just count up the crimes and the add up the theoretical maximum punishments while largely or completely ignoring the reality of the likely much lower sentence. The practice is generally justified by its possible general deterrent value: perhaps word of the high punishment faced in theory will get to others who might commit the crime and will scare them away. And unfortunately, uninformed reporters who are new to the crime beat sometimes pick up that number and report it as truth. A lot of people repeat it, as they figure it must be right if it was in the news. And some people who know better but want you to have a particular view of the case repeat it, too. But don’t be fooled. Actual sentences are usually way way off of the cumulative maximum punishments.
That brings up the important question of how much time Swartz was actually facing. We need to consider two different questions: First, the likely sentence if Swartz went to trial and was convicted; and second, the likely sentence if Swartz had agreed to a plea deal and pled guilty.
To calculate how much time Swartz might have faced if he went to trial and was cvonvicted, we neeed to consider the relevant provision of the U.S. Sentencing Guidelines, Section 2B1.1. Under that provision, the actual sentence that would have been imposed in Swartz’s case would depend largely on how you measure the pecuniary harm — that is, the loss in dollar amounts — caused or intended to be caused by Swartz’s conduct. This is tricky in the Swartz case, as it probably requires trying to calculate how much cost and future income loss MIT and JSTOR suffered or would have suffered if Swartz had succeeded in his apparent plan. We don’t really know how a judge would have tried to answer that. According to Swartz’s defense attorneys, prosecutors claimed that they thought the judge might impose a Guidelines sentence as much as 7 years if Swartz went to trial and was convicted. That’s consistent with a loss valuation in the range of millions of dollars. In contrast, Swartz’s lawyers thought that Swartz might get just probation, which is consistent with a loss calculation at or less than $10,000.
And even then, a judge would have discretion to set the ultimate punishment. Consider a recent computer hacking case involving a financial fraud to make money. At sentencing, the judge cut in half the sentence that had been calculated under the Guidelines because the defendant was an immigrant who had money problems and a gambling disorder. See United States v. Dinh, 2011 WL 1197666 (S.D.N.Y. 2011) (reducing the sentence from 5-6 years to 3 years on that basis). Given the possibility of such exercises of judicial discretion, we just don’t know exactly how much punishment Swartz would have faced if he had been convicted. Swartz could have faced anything from probation to a few years in jail depending on the valuation question and what punishment the judge thought was appropriate.
The alternative sentence to consider is what Swartz would have received if he had agreed to plead guilty. According to Swartz’s lawyers, the prosecutors in the case offered two different pleas. First, they would agree to a sentence of four months if Swartz agreed to plead guilty to the felonies. And second, they could agree to a deal in which Swartz agreed to plead guilty, the government would argue for a 6 month sentence, and Swartz could argue for a lesser sentence (presumably including probation). In all likelihood, the judge would have then sentenced Swartz to 4 months under the 1st plea and whatever the judge thought appropriate, up to 6 months, under the second plea.
So, realistically, Swartz was facing anything from probation to a few years in jail if he went to trial — depending largely on how you value the loss he caused — and either a 4 months in jail or 0-6 months in jail if he pled guilty.
III. Who is to Blame for the Aggressive Tactics?
A lot of people have objected to the aggressive tactics used by the prosecution. The prosecution took several steps that have drawn a lot of criticism. First, they took several steps to pressure Swartz to plead guilty. They said that if Swartz went to trial and was convicted, they would argue at sentencing for a 7-year punishment. They filed a superseding indictment that added charges — which actually wouldn’t change the punishment at trial if the jury convicted, but instead created a risk that the jury would falsely think that they were “splitting the difference” if they convicted on some counts but not others. Second, they wouldn’t agree to a guilty plea without jail time and wouldn’t drop the felony charges. Swartz was in a bind: He could take the 4 month sentence and have a felony conviction through a plea, or he could go to trial and risk getting a more serious sentence. A lot of people think these tactics were out of line, and they want the prosecutors to be punished for their apparent overreaching. There’s no question that the prosecutors had created a difficult and intimidating picture for Swartz as he faced trial.
If these tactics are out of line, though, I don’t think it’s appropriate to blame the two prosecutors who happened to bring this case. What the prosecutors did here was what federal prosecutors often do. Congress has given the DOJ very broad powers. The law is vast and punitive — in my view, here too punitive (more on that in a minute). Federal criminal law gives prosecutors a lot of tools to pressure defendants to plead guilty, and prosecutors often exercise those tools. Once investigators put a lot of time into investigating a case necessary to make the arrest and gather the evidence, they’re going to want the charges to be serious; prosecutors may be reluctant to spend all that time only to get a misdemeanor plea out of all that effort. As a result, they’re likely to insist on felony liability instead of misdemeanor liability. In some ways, it could be worse. And at least here, the facts were not much in dispute; the charges were based on a fair reading of the law; and there wasn’t a serious suppression issue (a motion to suppress was filed, but it was plainly meritless on multiple independent grounds). In a lot of cases, prosecutors place these kinds of pressure on defendants when those circumstances aren’t the case.
But the broader point is that if we think agressive prosecution tactics such as this are improper, we shouldn’t be focused just on the Aaron Swartz case. Rather, we should be shining a light on the federal criminal system in its entirety. These sorts of tactics have been going on for years, without many people paying attention. If we don’t want a world in which prosecutors have these powers, we shouldn’t just object when the defendant in the crosshairs is a genius who went to Stanford, hangs out with Larry Lessig, and is represented by the extremely expensive lawyers at Keker & Van Nest. We should object just as much — or even more — when the defendant is poor, unknown, and unconnected to the powerful. To do otherwise sends an extremely troubling message to prosecutors that they need to be extra sensitive when considering charges against defendants with connections. We have too much of a two-tiered justice system already, I think. So blame the system and aim to reform the system; don’t think that this was just two or three prosecutors that were doing something unusual. It wasn’t.
Finally, I think the instinct to blame the prosecutors in this case should be checked because it is fueled in significant part by a human but improper motive: Making sense of Swartz’s suicide. When a young person commits suicide, there is a natural instinct to restore a sense of order to the world by finding someone to blame. We deal with the sense of shocking and unimaginable and senseless loss by pinning the blame on someone to create a tidy narrative of wrongful actor and wrongful act. I saw this upclose in the Lori Drew case. Drew was charged with violating the Computer Fraud and Abuse Act for aiding and abetting the violation of MySpace’s terms of service. But we all knew the case wasn’t really about that. The case was really about blaming someone for Meier’s suicide. Drew hadn’t actually had much to do with the MySpace profile: It wasn’t her idea, and she didn’t create it. She merely had helped others to create it and went along. But Drew had made callous comments about Meier’s death after it had occurred, and those comments were so out of place that it made her The Most Hated Woman in America. So prosecutors stretched the law to find a theory — any theory — to punish her for the suicide, and the suicide was always there during the case. When I was arguing the motion to dismiss, for example, even Judge Wu kept returning to the fact that a young girl had died. I think we’re seeing that same kind of rage directed at the prosecutors in the Swartz case. In a bizarre juxtaposition, the anger that was directed at the defendant in one Computer Fraud and Abuse Act case is now being directed at the prosecutors in another. But it’s not really about the Computer Fraud and Abuse Act; it’s about the human need to find someone to blame for a senseless and tragic suicide. As human as that instinct is to want to combine them, I think we need to separate out the suicide from our criticisms of the prosecutors’ behavior.
IV. How to Amend the Computer Fraud and Abuse Act in Response to the Swartz Case
A lot of people have wondered how to amend the computer crime laws in response to the Swartz tragedy. So far I have seen a lot of interest in this, but not a lot of sensible proposals. Already, Rep. Lofgren stepped forward with “Aaron’s Law,” , text here, which would amend the statutory definition of “exceeds authorized access.” This isn’t new text: It’s just the definition of “exceeds authorized access” that was passed by the Senate Judiciary Committee last year to try to stop Lori Drew-like prosecutions. This amendment is well meaning, no doubt, but I think it is a bad idea for two reasons. First, it is weirdly disconnected from the Swartz case. Swartz would still have faced exactly the same criminal liability under “Aaron’s Law” that he did without it.
Second, after the en banc Nosal case in the Ninth Circuit, I think the smart move for those of us who want a narrow reading of the CFAA is probably to wait for the Supreme Court to resolve the circuit split. Kozinski’s opinion in Nosal is terrific, and it went far beyond the approach taken by “Aaron’s Law” in limiting the CFAA; instead, it adopted the interpretation I recommended in my 2003 article that the CFAA should be limited to breaching code-based restrictions. Given the prospect that the Supreme Court would agree with that reading when it resolves the split, I think it would be better to wait for the Court to solve this one than have Congress enact the amended language for “exceeds authorized access” which was originally drafted as a small step forward back before the Nosal en banc decision came out. And at the very least, if you want to amend the definition of “exceeds authorized access” at this stage of the game, push for the Kozinski/Kerr interpretation that “exceeds authorized access” is same as “access without authorization” except that it applies when a person has some legitimate access rights to the computer. As it stands now, with the chance of a full victory at the Supreme Court, “Aaron’s Law” would probably be an overall step backward rather than a step forward. Let me put it this way: In the courts we might get a whole loaf; “Aaron’s Law” is just a few crumbs. I’d rather stick with the former rather than have latter.
The real statutory attention should somewhere else, I think: The felony provisions. Felony liability under 18 U.S.C. 1030 has a trigger that is too low. The most important offending section is 18 U.S.C. 1030(c)(2)(B). Under that statute, a mere misdmeanor act of unauthorized access becomes a serious felony crime when any one of the following three circumstances are met:
(i) the offense was committed for purposes of commercial advantage or private financial gain; (ii) the offense was committed in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State; or (iii) the value of the information obtained exceeds $5,000.I think most people would find the first provision sensible: If you’re doing it to make a buck, that’s more culpable and deserves greater punishment. But notice how incredibly broad the second and third provisions are. Under the second provision, unauthorized access in furtherance of any conduct that is any crime or tort under the state or federal system makes the low-level offense a felony. And DOJ always has creative theories that lets them find another tort or crime. In the Lori Drew case, their theory was that Drew was assisting in the creation of the MySpace profile in furtherance of the inentional infliction of emotional distress under California state tort law. And in other cases, DOJ has used the fact of overlapping federal and state crimes to try to bootstrap all 1030(a)(2) misdmeanors into felonies. In one case, United States v. Cioni, DOJ argued that an unauthorized access into an e-mail account was a felony because there are two overlapping misdemeanor crimes that it violated; this made the act a violation of one crime in furtherance of the other, magically creating a felony under 1030(c)(2)(B)(ii). And although the Fourth Circuit blocked that theory, DOJ remains aggressive on this issue: In the United States v. Auernheimer case, soon to be on appeal in the Third Circuit (and which I expect to help on pro bono), DOJ is arguing that 1030(c)(2)(B)(ii) makes every unauthorized access a felony when there is an overlapping state statute. As in Cioni, DOJ argues that the 1030 offense is in furtherance of the other crime, even though they’re just the same crime. I think this provision is far too broad; it’s like an overgrown computer version of the felony murder statute but without any limitations — and it applies not just in the course of felonies, but in the course of any crime or even any tort. If there is a justificatin for it, it should be strictly limited.
The third provision, 1030(c)(2)(B)(ii), also is problematic. It only considers the value of the information in the abstract: if a person obtains information worth more than $5,000, then the crime becomes a felony. This is a case of a concept that makes sense in the physical world being blindly applied to the virtual world without thinking through how differently it applies. In the physical world, it makes perfect sense for theft statutes to become more serious when the stolen property passes a threshold value of $5,000. In the case of physical property, obtaining $5,000 worth of property means gaining $5,000 in value and depriving the owner of $5,000. But with digital copying, that is no longer the case. In United States v. Batti, for example, it was happenstance that the defendant happened to obtain a file that turned out to be very expensive to make, and thus was valued at a lot of money. The dollar value of the property is detached from the gain to the defendant or loss to the victim. As a result, it no longer makes much sense to use that as a dividing line between misdemeanors and felonies.
Another change I would make would be to repeal 18 U.S.C. 1030(a)(4), the Computer Fraud statute. That statute shouldn’t exist because it is almost entirely redundant: It is just a blend of 1030(a)(2) and the Wire Fraud statute, Section 1343. It is almost never charged alone. Instead, 1030(a)(2), 1030(a)(4), and 1343 are usually charged together to cover the same basic conduct. Once you get to the sentencing stage, the fact of convictions under many crimes ends up making no difference; the Guidelines treat them as the same as a conviction under just one of those offenses. But the multiple overlapping crimes gives prosecutors an unfair advantage at trial that in turn pressures defendants unfairly to take a guilty plea. That’s the case because the jury is easily misled. When the jury sees a multi-count indictment involving many different crimes, the jurors have two natural reactions. First, they think they can “split the difference” and convict on some but not all. This is just wrong, as it turns out; at sentencing, a conviction as to only one crime is treated just as severely as a conviction as to all crimes. But the jury doesn’t know that, giving the prosecution an advantage. And relatedly, the jury likely thinks that the defendant’s conduct is extra serious if it is charged under lots of criminal offenses instead of one. The existence of multiple overlapping crimes therefore gives the prosecutors an unfair advantage; the answer is to narrow that advantage by eliminating entirely duplicative crimes like 18 U.S.C. 1030(a)(4).
These two changes, and other like them, would be truly in the spirit of an “Aaron’s Law.” They would limit the computer crime laws by more carefully limiting what constitutes a felony — making sure that only truly serious crimes have the felony label that both draws prosecutorial interest and was so offensive to Aaron Swartz.