Aaron’s Law Takes Shape
techcrunch.com
techcrunch.com
Very interesting take on things. I'm not sure if it would create a huge legal mess when a federal prosecutor is doing his or her job at prosecuting someone who's probably innocent.
In Aaron´s case it wasn't even the affected part putting the pressure, but a whole industry that feels threatened by what 'hackers' can do with easy-to-access information. They don't feel threatened by google because if it infringes a law they know they can sue and settle for several millions, but they know they can't stop hackers sitting in a computer in their homes or a public library, so they need to scare them away with preemptive strikes.
It Aaron's dead results in a change of this policies, not only lives but innovation will be saved and at least his dead won't been in vain. Hopefully.
I think if anything it's a disservice to Aaron's cause to mix him up with hackers who access information just "because they can" not to make some more meaningful point.
| this is about a government agency trying to set
| an example clearly pressured by businesses.
More likely that Aaron was: 1) a feather in the prosecutor's cap 2) a way to show the public that she is/was 'tough on crime', and/or 3) another attempt to stretch the Federal statutes on 'hacking' (setting precedent).
People are demonizing JSTOR and making excuses for MIT in this situation, but their perception of who is the big faceless establishment entity here is wholly mistaken.
When I talked about "businesses" I was referring to the constant pressure they apply for regulators to punish these kind of practices, as the case of Andrew Auernheimer shows, he was also prosecuted for access publicly available information perhaps with the same severity they did with Aaron. Both cases demonstrate a common practice that initiated by the necessity of businesses of cover their backs against these "intrusions", and in both cases also the prosecutors went out of their ways to set an example.
It's hard to hold Google up as a paragon of "doing the right thing" IP infringment when they'll auto-remove videos from YouTube based just on their similarity to other videos that have been flagged inappropriately for copyright violation.
One's an easy target to be made an example of, one isn't.
So aside from the fact that it's completely different, you're right, it's exactly the same.
2. He changed his MAC address because they blocked his old one.
I don't think that this alone should be enough for a conviction though. For instance, he wasn't privy to the reason that his network connection wasn't working anymore (so far as the MAC address was concerned). The prosecutors wanted to argue that changing the MAC address was a purposeful attempt to thwart restrictions, but from the outside he couldn't have known why the old MAC was no longer working.
3. Instead of using Harvard's network and signing up with his own name, he used MIT's network (which is open to the public) and signed up for access with a fake name. The prosecutors would have argued that this was his way of hiding his identity because he knew what he was doing was wrong.
4. The US Department of Justice has had a hard-on to expand the hacking statutes to cover "any crime with a computer." See the case about the MySpace/Facebook mother that drove her daughter's classmate to suicide. They tried to go after her for 'hacking' into the website because she signed up with a fake name which is against the Terms of Service (i.e. "unauthorized access" to the website).
You're conflating two networks. He had every right to access the public wifi network at MIT, which has numerous security and bandwidth-control mechanisms in effect.
He did not have every right to connect directly to MIT's core network infrastructure, which bypasses most of the above.
If an MIT professor left his laptop plugged into one of the public ports downloading a linux tarball unattended over night, is he liable under CFAA? What the professor left it in the unlocked closet instead, to minimize the risk of getting his laptop stolen?
He could have covered his face after his experience with PACER where he was legally in the right, but still got hounded by the FBI.
To indict someone, you don't have to prove your interpretation of the facts. You have to present evidence that supports your interpretation of the facts. The fact that he hid is face is perfectly reasonable evidence to suggest he knew he was accessing MIT resources he should not have, sufficient to support an indictment.
Now, maybe he could have argued that he nonetheless didn't know it wasn't meant for public access. I doubt the prosecutor would have believed that claim, or a jury. I don't believe it, and I honestly don't think you believe it either. So why drag us both down this ridiculous hypothetical?
The miscarriage of justice here is that they dropped the trespassing charge because the CFAA charge was so much more lucrative. There is no reason a minor network intrusion should carry a firmer penalty than an equivalent physical trespass. I wholeheartedly agree on that point. But to make the stronger argument that Aaron did nothing wrong, you have to put aside common sense to the point where you're arguing that a grown man didn't know he wasn't supposed to be doing something when even a child could have parsed the situation correctly.
The general public does not have a right to access MIT's network. MIT generously ALLOWS the general public some access to their network.
Source?