Aaron Swartz, Vindicated
pluralistic.net
pluralistic.net
(https://www.ussc.gov/sites/default/files/pdf/research-and-pu...)
You mean corporate lobbyists wanting federal enforcement of contract terms and corporate interests had nothing to do with it?
Have we seen mass prosecutions under the CFAA at the behest of corporate interests?
I don't think that's the case, tons of people are violating various policies all the time and they're not being prosecuted.
SCOTUS was right in narrowing the focus, but I'm not sure the CCFA really was some corporate conspiracy, if it was ... they didn't make much use of it outside of some terrible, but still isolated incidents.
Even things like the abuse of arbitration agreements I think more likely stem from creative lawyers using existing laws to their advantage, not as much direct legislating as is often claimed.
It's nice to pretend someone's in charge of all the bad things that happen, but as They Might Be Giants reminds us, most of the world is described by individual actors doing what they can get away with in individual circumstances.
Remind me where they remind us? This is the crucial content I'm here for.
In the end, he is (likely) murdered and disappeared by the mayor of his small town for challenging the mayor's right to steal his property, because in reality there is no higher power checking his local government's authority. It's the lack of any massive conspiracy controlling events that kills him.
CCFA beyond the situation described to me still serves a purpose / can be used responsibly.
Thus very popular with elected officials seeking a positive reputation among the electorate or seeking campaign funding.
I have trouble believing anyone pushing the CCFA somehow cared enough to be disingenuous about it... to me that require more than a randomly applied label.
The article has Aaron Swartz in the title, so yes. MIT and JSTOR lobbied the feds to pursue Swartz and there are many more examples.
They can't do it to everyone because of simple logistics, but they can do it to anyone.
If you didn't get thrown in prison today, it's not because the problem doesn't apply to you and you are safe. It's only because no one decided it would be super convenient for them if you went away.
I think the issue isn’t the total number but the potential total number. So if there’s mass violation and law enforcement picks and chooses who to prosecute that’s a problem. Although obviously it’s less a problem if they do that 1,000 times a year vs 1,000,000.
No, they didn't. Once Swartz turned over all the data he had collected and promised not to do it again, both MIT and JSTOR said they were satisfied and told the feds they did not want any further action taken. The feds chose to pursue Swartz anyway.
But I think that’s pretty weasily as having a neutral position while the government is prosecuting means endorsing the status quo. “Not proceeding with the assumption that MIT wanted Aaron Swartz to go to jail” is so BS. How about a statement of “We do not want AS to go to jail.” Or “We do not believe a crime has been committed” or “As the operator of the network, we do not consider this a violation of CFAA” or the million other useful things MIT could have said and done.
Many urged MIT to advocate to not prosecute and MIT chose not to.
Also MIT brought the charges of breaking and entering that led to Swartz’s arrest. And that’s pretty lame given MIT’s mission and what Swartz was doing.
If I was a student and my guest was arrested for B&E that would be bad.
MIT isn’t legally culpable, but they acted poorly and all they needed to do was say “hey don’t do that” instead it led to a large scale prosecution and a suicide.
Spinning this like MIT wasn’t responsible or JSTOR wasn’t responsible is so mealymouthed.
[0] https://news.mit.edu/2013/mit-releases-swartz-report-0730
Also I think had MIT asked the prosecutor not to prosecute then the case would have been dropped. Without MIT and JSTOR saying Swartz committed computer fraud, the prosecution would have no case. Etc etc.
The case existed because MIT wanted it to exist.
Why not? He did that.
> Not charging him for cfaa charges.
MIT didn't do that. The federal prosecutor did.
> Not treating like a laptop plugged in is a felony.
MIT didn't do that either.
> I think had MIT asked the prosecutor not to prosecute then the case would have been dropped
I don't know what you're basing this on. Everything the prosecutor said at the time made it clear that they wanted to make an example of Swartz and would have done much the same thing no matter what MIT and JSTOR said.
> Without MIT and JSTOR saying Swartz committed computer fraud
Neither MIT nor JSTOR ever said that. Charging Swartz under the CFAA was the federal prosecutor's doing.
> The case existed because MIT wanted it to exist.
I think you are mistaken. I think the case existed because the federal prosecutor wanted it to exist. That's not to say MIT made no mistakes, but we should put the blame for the CFAA prosecution and the threat of decades in jail where it belongs.
That's because they didn't know who it was that was doing it. Their main purpose in getting the police involved was to find out.
> Many urged MIT to advocate to not prosecute and MIT chose not to.
Yes, that's a fair point (and IIRC the Abelson report makes a similar point), and it was an overstatement on my part to say that MIT asked that no further action be taken. (I believe JSTOR did, though.)
However, that's still very different from saying that MIT (or JSTOR) "lobbied the feds to pursue Swartz", which is what the post I was originally responding to claimed. Neither MIT nor JSTOR did any such thing.
> Spinning this like MIT wasn’t responsible or JSTOR wasn’t responsible is so mealymouthed.
I don't think either MIT or JSTOR were responsible for "pursuing" Swartz. They certainly weren't responsible for threatening him with decades in jail. That was the federal prosecutor.
One could argue that MIT was "responsible" because they didn't work harder to persuade the feds not to pursue Swartz. But that could just as easily have been because they couldn't wrap their minds around the idea that a federal prosecutor would go so overboard until after it had actually happened, at which point it was too late.
> all they needed to do was say “hey don’t do that”
It's not at all clear to me that that would have made a difference, given the attitude of the federal prosecutor. That's not to say MIT shouldn't have done it (I think they should have), but it's also not an argument, IMO, for MIT being responsible for what happened to Swartz. Prosecutorial overreach is the responsibility of the prosecutor--and of the government that empowers the prosecutor, and ultimately of all of us citizens who empower the government.
This is a case where a small number of people had a very profitable racket going, selling access to publicly funded scientific papers, and Swartz posed a threat to their racket.
Swartz posed a threat to the ability to privately profit off of publicly funded science.
Look at all the recent Federal activity aimed at shutting down Sci-Hub.
>A reminder that Elsevier made $6 BILLION selling your academic journals and articles behind paywalls, and made more profit than Amazon, Google and Apple every year for YEARS...
And paid the academics who wrote the articles $0 And paid the reviewers of the articles $0
https://twitter.com/DrJessTaylor/status/1390798132632596488?...
You left off the "had nothing to do with it?” part, which was a rhetorical assertion of equivalent hyperbole, but not a direct claim. If you want to interpret it that way you should to include the question mark in the consideration of your response....
https://theintercept.com/2021/02/15/marty-walsh-aaron-swartz...
Prosecutorial malfeasance is a serious problem in the US, probably worse than police shootings in sheer number of lives broken, notably due to the abusive plea deal system where innocent people have a Hobson's choice to accept a plea just to avoid the risk of draconian penalties if they take the chance of a trial and whatever attorney will be assigned to them.
https://www.nytimes.com/2016/02/21/movies/wargames-and-cyber...
I would not be surprised if the recent upticks are directly correlated with privatized prisons.
There’s a corporate interest right there! Having some experience from within (healthcare industry, original DRG implementations and TEFRA), I can say that not everything you can get Congress to implement (at the behest of lobbyists) works out beneficially for your particular corporate or industry interest.
Safe Travels Aaron, you are missed.
"Justice delayed is justice denied." While this SCOTUS decision may vindicate Swartz, he never got the justice he deserved. Now it's too late for that.
Well, a draftee, involuntarily having it taken for the good of everyone else. Damn that's no better.
I don't want to enjoy benefits that were aquired by theft and murder.
I tried. There is no good here and no way to make it ok.
Thanks.
I'm sorry, but isn't that a major oversimplification of what he did?
In the Van Buren case, SCOTUS was very concerned with the potential for innocent actors to unwittingly run afoul of the CFAA. The website would likely have to take further steps to make the restrictions on access known to the user (such as a warning when trying to access [X], and probably also take actual steps to limit access to [X], such that one would only be able to access [X] deliberately knowing that they don't have authorized access to it.
Swartz did not deserve to be driven to suicide for this. He did not deserve jail time, or to be arrested. At worst he deserved to be the defendant in a fairly low-stakes civil suit, and maybe even lose. But that's it.
He’s certainly responsible for his actions, but they were not wrong, I think. And he was obviously unjustly persecuted for his actions.
I think it’s accurate for us to celebrate SCOTUS ruling that the way the feds prosecuted Swartz was wrong and recognize that it will help prevent future Swartz.
It doesn’t matter what the action of the equipment or the morality of it. It’s not like it would be bad for a student or professor to put up crypto miners, but then good if they donate them to charity.
And that is not to even mention the fact that his actions caused effectively a denial of service attack on jstor from MIT.
I’ve attended and visited quite a few universities and they all had liberal network access policies. So the idea of anyone caring about someone plugging a laptop into a lanport and downloading millions of text files is not remarkable and happens all the time, I expect.
There was no “denial of service” on jstor as it was still available during the whole time. And if jstor can’t handle a single laptop scraping every article, then that seems to be more of a problem with jstor.
Students scrape jstor and other journal sites frequently and seems like a pretty decent use case that I want to support at my university, if I had one.
Crypto miners are a different story as they consume resources and if Swartz had set up a hundred laptops or a bunch of gpus and used university resources, I’d have a different story.
But the idea that a single laptop running in a closet for a weekend had any material impact on MIT or jstor is so laughable that I don’t understand how anyone honestly presents it as an argument.
Importantly, Swartz's prosecution would not have been blocked by the SCOTUS decision in Van Buren because they make a distinction between improper use of computer access and improper access of a computer: Swartz did not have authorized access to the networking switch.
However, if he had used Wifi, to connect to the MIT networking, the charges would have been unsustainable under the Van Buren decision because guests were permitted on the MIT wifi network (and he had a JSTOR account through his Harvard employee account), and his use of it would merely of been improper use at best (since he effectively DDOS'd JSTOR for other users and got MIT's IP range blocked) rather than improper access.
EDIT: Note: a friend pointed out that the DDOS'ing of JSTOR could technically constitute a crime under the CFAA, depending on intent. In Swartz' case, the DDOS was an unintentional side effect of trying to download too much data at once for archival purposes so malicious intent was missing, but someone doing the same thing for the purpose of preventing access to the system could still be guilty of a crime.
That's not clear to me, because MIT tried several times to revoke his permission to use their guest network by repeatedly banning him by IP address, and then by MAC address. He kept changing those to evade the revocation of permission.
That seems like it would be enough to distinguish from the Van Buren case.
This strikes me as disrespectful, unless you have some inside knowledge about the whole event. Respect a persons choice to end their life, as that was their final action.
In the same way, we can solve hunger and war. Theroretically yes, practically very hard.
That might be true. But again, we don't know exactly how he felt, so why assume something? Many people end their lives with purpose as well, not every suicide is about ending pain.
[Looks around]
I must agree with you.
https://melmagazine.com/en-us/story/wargames-ronald-reagan-c...
The film is an astonishing piece of animation (which in places resembles an almost manga style), education and propaganda. I cannot recommend it highly enough and it is available at the Internet Archive [3].
[1] https://en.wikipedia.org/wiki/Victory_Through_Air_Power_(fil...
[2] https://en.wikipedia.org/wiki/Victory_Through_Air_Power_(fil...
At the same time, I don’t see why we should consider it a crime if I ssh into an insecure server and steal a persons credit card information, but if someone at the bank has an old password and go into the same server to get the same information then suddenly it’s ok? I mean the crime in a breaking and entering isn’t that you manage to break the lock, it’s the entering that’s the problem.
The first is a principled objection (and thus in some ways less important): the rulings below were probably correct applications of a terribly drafted law. The way to fix the law in a functioning government would be legislative.
But anyways I really want to share the second objection which is entirely pragmatic: if the only time we ever limit the scope of laws which are badly drafted like this is when we're trying to find some excuse to let bad cops get away with their behavior, then this will have two outcomes: first, bad cops will get away with their bad behavior more often; second, we will find that these precedents don't actually stick when it comes to protecting actual innocents. These are related problems because judges can always find some way to distinguish bad cop cases from innocent private citizen cases to ensure that precedents need not apply.
People talk about the first and second and fourth (... and fifth, sixth, tenth, etc.) Amendments to the US Constitution as being under attack, and the interstate commerce clause as being long dead. But like all stillbirths, no one likes to talk about the equal protection clause.
...adding, its not just that we failed. It seems like we didn't even try. At least, nowhere near the level that would seem commensurate with outrage years ago.
But I think this particular article is garbage.
To begin, here's a small point that many engineering types fail to internalize: the legal system is built to deal with intentions. A piece of code or a device doesn't care what your intentions were when you built it, or what the user's intentions are when they use it. It just does what it does. On the contrary, intentions matter in the legal system. Hitting someone with your car is not automatically murder. It may not even be a crime. And stealing bread if you are starving is almost universally recognized as not a crime.
"Prosecutors Stephen Heymann and Carmen Ortiz didn't dispute that Aaron was allowed to access the articles he retrieved. Rather, they said that the WAY he accessed them (using a script instead of clicking on links) was a terms-of-service violation and hence a crime."
I'm a bit ambivalent about this part of Swartz's case, but it is certainly not mustache-twirling evil on the part of the prosecutors. I'm sure Doctrow, like the prosecutors, isn't going to dispute some of the facts in the case: Swartz intended to make those articles free. He was going to take those articles from the system that allowed him to access them and re-publish them in violation of their owner's wishes. Now, I don't like the information property system we have any more than anyone else, but it is the system we have and we get to live with it until we can change it. Swartz was not using a script to download the articles so he could read them later, he was using a script to make copies so he could redistribute them.
And the prosecutors weren't saying, "oh, ho, using a script is bad, you just can't do that." They were arguing that using the script was evidence of Swartz's intentions regarding the copies he was making. Doctrow is here violating one of Hacker News' guidelines, "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
"Security researchers who audit systems and warn their users about defects in them are silenced with CFAA threats, giving companies a veto over who can criticize them and how."
Yes, "security researchers" who have not bothered to clear their activities with their targets beforehand have faced legal problems. Some who have have also faced those, but the legal system is supposed to tell the difference and generally does a fair job. What would you prefer as the alternative?
"Nevertheless, prosecutors charged him under the CFAA, saying that while he was allowed to access the database, doing so for an improper purpose was a hacking crime, because he "exceeded his authorization."
"This may sound sensible – or just expedient – to you. But if the prosecutors were right – if accessing a computer you were authorized to use, but in an unauthorized way – is a felony, then almost everyone is a felon."
Yes, I would argue, that is a hacking crime. (Insider threats are one of the biggest problems with computer systems because they're impossible to secure against---can anyone explain to me the authorization logic that would allow Van Buren to do his job, which apparently includes looking up "personal information", while preventing him from doing anything illegal with that information?) What else do you think you can charge him with, illegally accepting a gift in the process of doing his job?
But mostly, this article is almost entirely scare mongering. "This correct interpretation (far narrower than the DoJ's) safeguards security researchers, competitors, and other researchers doing things like gathering data from a housing site to investigate racial bias in rental ads"---which would be protected, right? Remember, intentions matter.
I get it: Information wants to be free. Cops bad. Lawyers bad. Politicians and judges bad. Anarchy good. Unfortunately, I seem to live in a world where humans are gonna keep humaning so that doesn't work.