Hacker News Reader

Comment by polemic | Hacker News Reader

There should also be a push for better use of discretion and 'common sense' from the US judiciary. Most (all?) laws are, by their nature, crude sticks that have to be wielded carefully.

I'm not sure that in this case, the law is 'wrong'. As has been outlined elsewhere, by a reasonable reading of the applicable law Aaron's actions were criminal and (in my opinion) the law itself, in spirit, is not unreasonable.

What is unreasonable in this case, appears to be the application of the law, and more generally, the cost in time and money that is required to mount an adequate defence.

It should never take two years and millions of dollars to have a case like this settled, one way or the other. It seems a basic violation of human rights that it could happen. This is the general problem that needs to be solved in the US.

To end with a favourite quote that feels timely:

"The fall of Empire, gentlemen, is a massive thing, however, and not easily fought. It is dictated by a rising bureaucracy, a receding initiative, a freezing of caste, a damming of curiosity - a hundred other factors. It has been going on, as I have said, for centuries, and it is too majestic and massive a movement to stop"

-- Isaac Asimov, Foundation, 1951.

Let's hope that's not entirely true.

View on HN

>What is unreasonable in this case, appears to be the application of the law

I don't think you can let the law off the hook for allowing unreasonable applications of itself. The idea of criminalizing "computer fraud" (i.e. breaking into Amazon's servers to have it mail you expensive products without paying or to steal credit card numbers) is not objectionable. But the breadth and vagueness of the existing law, and the obscene penalties, most certainly are objectionable and should be fixed.

I completely agree that something must also be done about the excessive cost of criminal defense as well.

The idea of criminalizing "computer fraud" (i.e. breaking into Amazon's servers to have it mail you expensive products without paying or to steal credit card numbers) is not objectionable.

What I don't understand is why we need a separate law against "computer fraud", when we already have laws against, well, fraud. In the scenario you describe, in a sane legal system, the person who broke into Amazon's servers would be prosecuted for fraud, period. The fact that the fraud was committed using computers would merely be one of the facts of the case, not a reason for an additional charge.

I agree with you. You kind of have to understand the history: The Computer Fraud and Abuse Act was passed in 1986. I don't know if you remember 1986 (I know I don't), but from what I understand from the history books, computers communicated at around 300 baud and even if you exclude the mandatory freon compressor, the amount of energy required to run a computer with processor power equivalent to the phone in your pocket would still have been measured in tons of coal per fortnight.

So in 1986 they passed a law because "computers are huge corporate things used primarily by banks and governments that cost big money and don't concern common people, so fraud on a computer should have really high penalties." That's why we have a special law for it.

As to whether we still need it to be a separate law from ordinary fraud... no, I don't think so.

I don't know if you remember 1986 (I know I don't), but from what I understand from the history books, computers communicated at around 300 baud and even if you exclude the mandatory freon compressor, the amount of energy required to run a computer with processor power equivalent to the phone in your pocket would still have been measured in tons of coal per fortnight.

I do remember 1986--I was in college then--and it wasn't that bad. (Though your description was very entertaining.) PCs with modems existed in the late 1970's--a friend's father had a Commodore PET at that time. Certainly by the mid-1980s, with the IBM PC and clones going strong and Apple having released several different lines including the original Macs, computers were no longer just "huge corporate things".

But those were simply hobbyist things like the Arduino or Raspberry Pi are today. I find it very hard to believe that anyone in congress reponsible for drafting the CFAA were considering anything other than corporate use of computers, just like it would be hard to imagine congress taking interest in the Arduino or Raspberry Pi today and passing legislation that impacts those and other hobbyist devices and platforms.

Huh? The IBM-PC and clones, and the Apple II, Lisa, and Mac, were certainly not "hobbyist" computers. They were used by businesses to do spreadsheets and accounting, by artists to do graphics, and by all kinds of people to do the same sorts of basic tasks we use computers for today. (I did so myself; I had a PC clone, and my college roommate had an Apple II, and they certainly weren't "hobbyist" computers; we used them for serious work.) Even if Congress was only considering "corporate use" of computers in 1986, which is arguable, PCs and Macs were already part of "corporate use".

If you want to say that Congress was too technically ignorant in 1986 to recognize that PCs and Macs counted as "real computers", that I would agree with. :-)

Maybe in 1956 computers were "huge corporate things," but by 1986 there was a global computer network for PCs that remains popular in some parts of the world to this very day:

https://en.wikipedia.org/wiki/Fidonet

In 1986 large computers were still "huge corporate things" which is almost certainly what Congress was targeting with the law rather than Fidonet (hence the trouble).

What I don't understand is why we need a separate law against "computer fraud", when we already have laws against, well, fraud.

Because when that law was written it wasn't obvious how to distinguish in law between authorized and unauthorized access. You might as well ask why there's a bunch of law specifically regarding real estate when we already have laws about property, or why the laws about murder are so complex when the basic idea is 'thou shalt not kill.'

As an analogy, consider the standard definition of burglary: 'Entry into a building illegally with intent to commit a crime.' Now legally, that means 4 or arguably 5 elements - entry, a building, illegality, intent, and a contemplated crime. These might seem like hair-splitting points, but they're important - not just for the immediate situation of whether someone is guilty or not guilty, but whether or not that makes them liable under a three-strikes law, perhaps years later, or deportable, or how it might affect their sentencing for a completely unrelated crime a decade later, or....

...I mean, have you looked laws on fraud? they're complicated! It's not obvious in many real-world situations, and it's even less obvious where computers are concerned. If I am operating a computer system, how much information do I have to give you as a user about what you are or are not allowed to do on my system? Where does my responsibility end and yours begin? I mean, many people can't even understand the distinction between copyright infringement and theft, and fraud is a lot more complicated than simple theft - and theft itself is more complex than most people realize. Lots and lots of legal situations arise because people have different opinions about what sort of behavior is acceptable.

I don't know if you remember a pre-internet work environment, but when I was going about in the early 90s promoting the use of email and FTP to skeptical corporate buyers, one of the most frequent questions I used to hear was 'who owns the internet?' It was quite difficult for the typical business person to conceive of how network traffic could be separated from ownership of the network infrastructure, or how any participant in a network like some kid with a modem could possibly stand on the same legal footing as the phone company or the post office.

> when that law was written it wasn't obvious how to distinguish in law between authorized and unauthorized access.

I think you have it backwards. Passing the special computer fraud law was what created the problem of not knowing how to distinguish between authorized and unauthorized access, because it made that illegal regardless of whether the "unauthorized access" (whatever that means) was actually in furtherance of any particular malicious act.

It really is a profoundly stupid law. Nobody seems to be able to tell specifically what it means, and any of the plausible readings make a felony out of plenty of things that ought not to be a felony. And even the cases where unauthorized access is in furtherance of something legitimately felonious, the actually malicious thing we want to prohibit will still have to be illegal on its own, since otherwise someone with authorized access could do it and we wouldn't be able to prosecute them.

Laws are complicated because you have to handle the edge cases. And there are (rarely) edge cases in some laws where adding "on a computer" can make a difference, but the way to deal with that is not to have a special computer law with disjoint elements and penalties, it's to make a minor adjustment to the existing non-computer law to take that into account.

Your utility function as a consumer is wholly different from someone else's utility function as a provider. You might as well ask why we have laws about wire fraud or mail fraud when 'it's all fraud.' I'm sorry, but you're assuming your conclusion as one of your premises and then making a circular argument.

>You might as well ask why we have laws about wire fraud or mail fraud when 'it's all fraud.'

It is all fraud. Wire fraud and mail fraud are different primarily because they occur at a distance and are often interstate, which invokes the need for federal involvement in what would otherwise be a state matter. But that's a federal vs. state thing, not a different kinds of fraud thing. A single federal statute against interstate fraud that had specific provisions for any relevant characteristics of different communications media would still be preferable to separate legislation for wire, mail and computer fraud which is either overlapping and therefore redundant or disjoint and therefore inconsistent.

All we're talking about is how to organize the body of legislation. You can have separate provisions that take into account necessary differences in different subcategories of specific crimes, but similar crimes should be grouped together under the same heading and treated similarly unless there are sound reasons for them to be treated differently.

In other words, DRY.

That's what the Model Penal Code attempts to do, as the Uniform Commercial Code attempts to do for commercial relations. But different people have different ideas about what the model template should be, and the 57 varieties of US law reflect the different concerns of different people at the time those laws were made - in the case of the CFAA, owners of large expensive computer infrastructure.

It is all fraud.

I envy your certitude.

I understand why we have different laws in different jurisdictions. That is something different, and it doesn't mean we should have overlapping, duplicative, inconsistent legislation within a single jurisdiction, e.g. at the federal level.

>in the case of the CFAA, owners of large expensive computer infrastructure.

Which is the problem. That was a long time ago, those were different people than we are today and things have changed. It is time to reconsider.

Yes, things have changed. But the responsibility for updating the law lies with the legislative branch, not so much the executive.

I thought this was a discussion about "In the Wake of Aaron Swartz's Death, Let's Fix Draconian Computer Crime Law"? I would certainly agree that to do that we should be appealing to the legislators rather than the prosecutors, but I'm not sure what all that has to do with what we were most recently discussing.

You think the issues are simple and that these specific laws about fraud are duplicative; my view is that they're not that simple and that factors like non-locality demand greater specificity. Although I don't think the CFAA is a very good piece of legislation, I completely disagree with your suggestion that's it's unnecessary.

I can think of umpteen ways to get out of a fraud charge by playing definitional games once computers are introduced. For example: 'sure, it said on the screen that pressing enter I was promising X to be true, and I hit Enter knowing X to be false. But you haven't shown that any human ever reviewed the transaction, and a computer system isn't a person; so it's meaningless to say that I deceived the computer, therefore no fraud took place.' bullshit, of course, but new legislation is often introduced precisely because defendants are acquitted thanks to such technicalities.

I'm glad you agree that the CFAA is problematic. I think we may to some extent be talking past each other.

What I am objecting to is legislation in the style of the CFAA. Notwithstanding the name, it is barely addressed to fraud at all. It concerns itself primarily with unauthorized access, arguably a component of certain types of fraud, but which is a completely ridiculous thing to legislate against. Because while it is probably safe to assume that unauthorized access is generally bad, the question of how bad is determined entirely by the specific facts of the case. If you access a computer (e.g. your family member's work laptop) "without authorization" in order to check your own email, that is on an entirely different planet from doing so in order to obtain military secrets in preparation for a terrorist attack. The entire world of possible criminal penalties lives between those extremes. So prohibiting what is quite plausibly the precursor to an entire legal code worth of different crimes is totally absurd because there is no sane way to assign proportional penalties to it -- if you assign penalties greater than those of the most trivial of offenses then you create a disproportional penalty for such offenses just because a computer was involved and even trivial offenses are, as a rule, unauthorized. In theory one might argue that unauthorized access should still be an offense with the lowest of maximum penalties, e.g. a $100 fine, but with penalties that low it just seems like a waste of effort to even bother with it. And it sounds like you may agree with some of that, though I'm not sure what possible value you think can be salvaged from it.

What you're talking about with electronic forms perhaps not matching up with 20th century fraud legislation is a completely different animal. I think as a general rule that is the sort of thing that judges are able to see through, but in specific cases where this has failed to occur it naturally makes sense for the legislature to update the statute.

I'm just still not clear why you believe it should be a separate statute rather than merely a collection of relatively minor updates to long-standing law. I don't see how setting up a fake physical storefront and then collecting layaway deposits before skipping town to the next state should require a distinct piece of legislation from doing the exact same thing with a website. Perhaps the language will have to be adjusted to make sure the new offenders fall into scope, but why should the penalties be different? Or (in broad strokes) the elements of the crime? Or the intent requirement? Why reinvent the wheel? If you reinvent the wheel you get untested catastrophes like "unauthorized access to a computer."

Because when that law was written it wasn't obvious how to distinguish in law between authorized and unauthorized access.

But that's not what the laws do. They make committing fraud with a computer a worse crime than committing fraud some other way; that's a completely separate issue from defining what constitutes unauthorized access.

> But the breadth and vagueness of the existing law...

My point is this: of necessity, most laws are broad and vague, and it relies on judges to build the necessary case law to interpret it.

The current law absolutely needs to be addressed, but 'computer law' will always be 10 steps behind the technology. The much bigger issue is the fundamentally flawed, inhumane and insanely expensive US justice system.

>My point is this: of necessity, most laws are broad and vague, and it relies on judges to build the necessary case law to interpret it.

I don't think that is a necessity at all. What it is is a trade off. Compare tax law with antitrust law. There is relatively little vagueness in tax law, which is why the statutes are so verbose (or vice versa). Antitrust is technically "statutory" in that Congress passed the Sherman and Clayton antitrust acts etc., but the statutes are very short and very broad and their meaning has been defined almost entirely by the courts.

Each has advantages and disadvantages, but going too far in either direction is disastrous. (Which is why both tax and antitrust are a huge mess.) And that's where we are with the CFAA. The statute doesn't designate any particular harm you have to be aiming to cause, it just says "access without authorization -> felony conviction" regardless of whether you stole anything or hurt anyone or intended anything malicious, etc. It encourages courts and juries to think in terms of whether you violated the letter of the statute rather than whether you did anything specifically objectionable, and assume that any such violation must be a terrible crime worthy of that level of penalty without requiring any evidence that the circumstances of the specific case justify that outcome.

I honestly think we could repeal it entirely without any negative consequences following, because the actually objectionable things that people can do after they access a computer without authorization would still be separately illegal.

>'computer law' will always be 10 steps behind the technology.

I'm not at all sure that this is true. Most "computer law" is redundant garbage: There are laws against fraud, espionage, copyright infringement, etc. Those laws don't inherently become obsolete just because you add "on a computer" to it. Perhaps they need to be adjusted in certain ways -- often as a result of economic changes brought about by technology -- but that is no excuse for having a duplicate set of expansive, poorly drafted laws with extraordinary penalties that aim to serve substantially the same purposes as those that have been time tested over hundreds of years.

> My point is this: of necessity, most laws are broad and vague, and it relies on judges to build the necessary case law to interpret it.

Not if you're living in Continental Europe, where case law doesn't exist, precedence rarely matters, and all law is statutory law.

German law had to be amended for certain cases of computer criminality, e.g. illegally obtaining access to data which was impossible before without breaking into a building and stealing physical documents, so it was usually covered by theft before; or destroying data, which was just destroying physical things before. There were also problems around faking access tokens which is a bit like faking a document (think passport), but really not the same thing.

But there is no special case for something like computer fraud, that's just covered by regular fraud.

Edit: I stand corrected, there's actually a law about computer fraud: http://dejure.org/gesetze/StGB/263a.html, though it's essentially a reference to the law about regular fraud. The difference is apparently that fraud is defined as tricking _somebody_, and computer fraud happens without tricking a human person (but rather a program).

Agreed, this is part of why we have judges! Besides, if you think law is a tortured convoluted process today- just wait until we try to write it to explicitly handle every possible corner case.

The reason our laws have held up fairly well thus far is because they are vague. For example, the "reasonable person" clauses. What is considered reasonable changes with time. Do you really want to have to re-write all the laws centered around "reasonable person" every couple decades?

Remember, the legal system is not a computer. It doesn't necessarily make sense to approach it like one. Many of us here are programmers, and sometimes it shows.

"Do you really want to have to re-write all the laws centered around "reasonable person" every couple decades?"

Yes, and in fact, I would like every law to expire no more than 10 years after it is passed. We have too many laws and too many ways to become a criminal; force politicians to spend their days renewing necessary laws and we'll curb our out-of-control legal system. Keep the legal system straightforward, so that nobody is confused about whether or not they are committing a crime. Eliminate plea bargaining. Reduce the power of prosecutors, and reduce the power of the police (let's start by reducing the power of their firearms -- we really don't need soldiers serving search-and-arrest warrants).

If this was such a great way of doing things, why don't we programmers (who of course have everything all figured out) already do this in our code? Have a harvester that regularly walks your VCS and deletes any function older than 1 year. Sound like fun?

Keep the legal system straightforward

Being explicit is not the way to achieve that. Explicit handling of corner cases is always confusing when there are many, even more so when you are speaking in legaleese. "Reasonable Person" codified explicitly would take pages and pages and pages. You think that would be more understandable to the layman than, "What a Reasonable Person would do"?

If Real Life and People could be so easily codified, heuristics would be a completely useless field.

Eliminate plea bargaining. Reduce the power of prosecutors, and reduce the power of the police

What does that have to do with this line of discussion?

"Have a harvester that regularly walks your VCS and deletes any function older than 1 year. Sound like fun?"

Periodically reviewing code to ensure it still does what it needs to do is not exactly unheard of, and neither is replacing old code with new code. It is how we keep our software up-to-date.

How about the flip side: how would you like to have no code ever erased -- how would you like to spend your time supporting code written 50 years ago side-by-side with code written yesterday? That is what our legal system is like right now: laws that made sense decades ago, laws that made no sense decades ago, laws that were passed this year, etc., all relevant and applicable today. The government cannot even count the number of laws on the books at this point.

"Explicit handling of corner cases"

How about not bothering with corner cases? Let people whose actions seem criminal but which do not meet the definition of any crime go free. Do we really need to prosecute every single person who does something we do not like?

Our justice system is supposed to favor innocence, not guilt. Yet we see the exact opposite happen with the "let's make sure we never have corner cases by being as broad as we can be" approach to law.

The point is for laws to have a clear boundary between innocence and guilty. Nobody should be unsure about whether or not they are breaking the law and we should not be relying on a handful of judges to make such determinations.

""Reasonable Person" codified explicitly would take pages and pages and pages."

Sounds like the real problem here is that we have laws based on what "reasonable people" do, which is a pretty conservative approach to law. Why should the law be concerned with "reasonable people" -- why shouldn't the law just clearly state which actions are illegal and which are not?

We seem to be pretty straightforward sometimes. We define BAC limits for DUI laws. Why not be straightforward about computer crime too? Why not be straightforward about all laws? You are right, most people cannot understand pages and pages of laws -- so what are we supposed to do with the current legal system? You walk down the street at the mercy of the policy, because in reality you have no idea which laws you might have broken or which laws you were expected to follow.

What would a reasonable person do? A reasonable person would get a job, climb the social ladder, and never complain about it. Reasonable people in the 19th century would not have complained about women not having the right to vote. Reasonable people in the 18th century would not have complained about the triangle trade or slavery in general. Reasonable people would not have rebelled against British rule, nor written the Magna Carta. Laws should not be based on what reasonable people would or would not do; laws should be based on ensuring that people can continue to enjoy their freedom.

"What does that have to do with this line of discussion?"

I suppose that last comment was only tangentially related. The combination of broad laws, powerful prosecutors, and plea bargaining are the reason America is the world leader in imprisonment. Most of our prisoners never received a trial, because they odds were so severely stacked against them that they just accepted the plea bargain on the advice of their lawyers (often overworked public defenders). This is not a theoretical problem, it is the reality of our justice system and of our society.

I think our disagreement boils down to one thing. You believe our legal system could be fairly and justly encapsulated in a document perhaps the size of a dime novel, if only people had the forethought to make laws the way programmers (that godly race) write programs.

Yes, I'm being a little bit snarky. I can't help it. Besides the part where the real world is infinitely more intricate than a computer, software projects routinely fall into exactly the sort of chaos you are saying a pragmatic "boolean" approach to law would avoid.

There's an effect whose name I cannot remember that people in tech fields are particularly prone to fall victim to, wherein an individual wildly underestimates the amount of difficulty and effort required to tackle fields which are not his own. I believe you are falling victim to this effect.

Instead let's apply another software development concept to the law: regression tests. The current legal process is like deploying untested code to production (We aren't even sure if it will compile, but heck, ship it anyway! Got a campaign to run!).

Is approaching our body of laws like a programmer necessarily a bad thing?

I'm being a bit tongue in cheek here, but to use your example - if only our body of laws were properly DRY, changing that precisely-defined 'reasonable person' would only require one tweak.

"of necessity, most laws are broad and vague"

What necessity drives us to such laws? Perhaps the prison operator industry considers such laws to be a necessity, or maybe the police officers' unions, but in what way does our society need laws that are so broad that nobody knows whether or not they are actually following them?

How about we make laws as narrow as possible, just enough to cover heinous crimes, and let people live their lives? Nobody should be confused about whether or not they are following the law. Laws should be clear, and should not require years of education and decades of experience to understand. What would be wrong with that?

Are you worried that creepy people you do not like will not be arrested because they found a path through the law that allowed them to be creepy without being criminal? Why should that be worrisome? Such people are common in the financial world, and the rate of clinical psychopathy is higher amongst corporate executives than among the general population -- why do you think corporate bosses have teams of lawyers helping to guide them through business decisions? Why shouldn't ordinary people be able to say with certainty, "This action will not get me arrested?"

The problem with having laws as broad as we have now is that anyone who is different becomes a victim. The government does not just go around selecting random people to prosecute, despite having the legal power to do so. Instead, the government has a weapon that can be used to keep the population in line. Dare to speak up, dare to take a stand against those in power, and you become a target. It happens over and over again: whenever someone uses their skills in a way that does not fit the neat model of "get a job or start a business" they become a target, and the moment they try to take on the system or fix the problems we have, the hammer strikes and strikes hard.

There should also be a push for better use of discretion and 'common sense' from the US judiciary.

As a general matter (IOW I haven't analyzed the CFAA in this light) the judicary only has as much discretion as the legislature grants it. Populist legislators do not like the idea of an independent judiciary and frequently attempt to exclude legislative clauses from judicial review - which attempts often fail, but at considerably increased political cost to the judiciary. I'm personally biased, but it's worth considering that there are a lot more constitutional constraints on the executive and legislative branches than upon the judicial. 'Judicial activism' is the buffer on which many a judicial career has been halted, no matter how well-founded the decision it is applied to.

I'm not sure, at least in Swartz's case, you can fault the judiciary for not exercising it's ultimate discretion over punishment when no judge ever got to make that call.

And yet it had already cost him 2 years of his life and millions of dollars.

I should amend the comment to read "justice system", but judges are ultimately responsible for the fair and equitable operation of their courts.

That is clearly not happening.

The prosecutor brought a case within the letter and spirit of the law. What was the judge supposed to do at that stage, exactly?

>It should never take two years and millions of dollars to have a case like this settled, one way or the other. It seems a basic violation of human rights that it could happen. This is the general problem that needs to be solved in the US.

>There should also be a push for better use of discretion and 'common sense' from the US judiciary.

I cannot agree with your comments more. When people can't afford justice, justice may as well not exist. And there needs to be a better mechanism in place to thwart over zealous prosecutors from bullying defendants who are, almost by definition, weaker than the prosecution (as they are either less informed about the rules of the game, or have to pay through the nose for the services of someone who does.)

The idea of "law as program" vs "law as guideline" is certainly a dangerous one, and has become far too common lately. However, I don't think that we should rely on discretion too heavily. It should be the exception not the rule. Today it is the rule, and that means that for all intents and purposes it is de facto "the law", regardless of what's on the books. Which means takes away a lot of the checks and balances we have in place to keep the law reasonable and to ensure it works toward advancing liberty rather than fighting against it.

If there is a law that can possibly be unreasonably used to frighten someone, it needs to be clarified and explained and quantified and whatever else so that this kind of thing doesn't happen again. Needs to be given more thought before someone can use it in this manner at the very least

Can we start with shaming the prosecutors? Just pull public records, say with PACER.

PACER is free if you use less than $10.00 per year. If everyone used RECAP, there would be no need to access any document more than once.

I wasn't aware of RECAP. Having searched for it I came across a page on the pacer site[1] where Pacer say if you use if for free you aren't allowed to use RECAP. I'd be interested to know whether it's legal for them to have a fee exemption for limited purposes that allows them to make prohibition on transfer of information that is (as I understand it) public domain.

Edit: I've looked on www.recapthelaw.org and couldn't find any clarification on this.

[1] http://www.pacer.gov/announcements/general/exemptnotice.html it's the third result when searching for [pacer recap]

Reply on news.ycombinator.com