Fixing the worst law in technology
newyorker.com
newyorker.com
The damage was trivial, yet he is threatened with two hundred and fifty thousand dollars in damages and up to twenty-five years in prison.
Really? The prosecutor is seeking the maximum statutory penalty for this? Somehow I doubt that.
All the Administration needs to do is to rely on the ancient common-law principle called the “rule of lenity.” This states that ambiguous criminal laws should be construed in favor of a defendant.
BY A COURT. The rule of lenity is something that is supposed to guide the behavior of judges.
This is lousy journalism, which misleads the audience in an attempt to pander to their sensibilities. There is no way the author of this piece ran it past a lawyer.
> Really? The prosecutor is seeking the maximum statutory penalty for this? Somehow I doubt that.
The penalties listed are what's defined in the statutes. Keep in mind that the case at hand was just revealed. The prosecutors won't be saying what penalties they seek until the bargaining and sentencing phase.
> 2. BY A COURT. The rule of lenity is something that is supposed to guide the behavior of judges.
You're correct that this is a guideline for judges. But the OP is apparently referring to "the rule of lenity" in how 13 federal judges so far have rejected the DOJ's interpretation of the CFAA. To the OP, this is proof that the law is so vague that it needs to be changed, or else "the rule of lenity" will constantly be invoked.
By that standard I could say 'X has been arrested for littering - he could face the death penalty!!' Well, it's possible - until X has been charged with something specific, who am I to say he won't get hit with a capital murder charge or somesuch?
I don't agree with you about the how the OP is using the rule of lenity. He specifically says the executive needs to change its enforcement on that basis, whereas changing the law is something that would be done by Congress. If he can't say what he means then he has no business reporting on legal topics.
If may be misleading, but strictly speaking it's factually accurate. That is the maximum penalty -- and as long as it is, people who don't like it are going to report it.
If you want them to stop, amend the law so that minor offenses don't fall under the same section as major offenses. For a law to carry felony penalties, it should require something in the nature of profit motive and nontrivial actual harm. Then some fool who vandalizes a website for fun can be convicted of a misdemeanor and pay a fine or go to jail for a couple months while we still get to throw the book at people who make fraudulent credit card charges or engage in industrial espionage, and you won't see any more stories about how the former class of people could be jailed until death for the computer equivalent of disregarding a sign that says "don't walk on the grass."
As a matter of fact, the mean sentence under the CFAA (as of 2008 EDIT: typo. This is as of 2000.) is only 6.8 months. Minor offenders tend to get probation, and the heaviest sentences fall on those who interfere with the administration of justice or commit industrial espionage - and they face an average sentence of 17.3 months.[1]
1. http://proc.isecon.org/2000/128/ISECON.2000.Nwokoma.pdf
It's a bit pointless demanding reform of the law without any context for how it is actually working in the real world.
Listing only the maximum is a good thing because phrasing the range of penalties as you suggest is a variant of the "Door in the Face" technique. In absolute terms, 5 years may seem incomprehensibly ridiculous for what amounts to digital graffiti, but when readers are skimming through an article they'll see "5 out of 25" and think, "How generous of the prosecutors to knock off 80% of the sentence!" This is not the desired outcome.
I imagine people convicted of manslaughter also don't typically serve anything like the statutory maximum. But we calibrate our expectations and sense of proportionality based on the maximum because that's the number that gets published and compared to penalties for other offenses, and actual sentences are often set in proportion to the maximum, so changing the maximum has the practical consequence of changing the result in typical cases.
>As a matter of fact, the mean sentence under the CFAA (as of 2008) is only 6.8 months.
If you get convicted of a felony and sentenced to probation, you still get a felony record. I don't think we should be making felons out of people who have done something that deserves to be punished only with probation. The maximum penalty is extremely relevant because that's what makes it a felony, even if it bears little resemblance to what happens in the typical case.
>It's a bit pointless demanding reform of the law without any context for how it is actually working in the real world.
By the real world you mean the court system, but what about the real real world? The maximum is what you read in the statute when you're trying to decide whether to break an unclear law for a good reason. It probably has more influence on the behavior of people in the real world than the unpublicized actual outcomes do.
Well, this is the problem - it's often the only number that gets published, because it makes for a better story than qualifying that sensational number with the rather less exciting reality of sentences administered.
You can't go complaining about the length of the maximum sentence and then waving aside the much lower sentences that are actually handed out as if they didn't matter.
I don't think we should be making felons out of people who have done something that deserves to be punished only with probation.
We're not, generally. Not every offense prosecuted under CFAA is a felony; in many cases defendants are charged with a misdemeanor instead. This was mentioned int he link I gave you earlier, and it's treated in much more detail here: http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf
This is why I'm grumbling about the inaccuracy in reporting. You see the big maximum sentence as if it were the only thing that mattered, and you develop a really inaccurate idea of the law as a result.
I think it's more of an issue that the truth is complicated and a journalist can't cover a story in the detail you might like without losing too many readers to "TL;DR" or spending more hours to research it than the editor has assigned for the story. The typical sentences handed down are by far not the only important thing left out of articles like this. The things missing from these articles could span volumes of books. And each one of them needs to be put into context. If you discuss the typical sentences handed down then they ought to be compared to the sentences handed down for other similar offenses, or to the offenses that have similar typical sentences, and a thorough treatment would go down the rabbit hole into plea bargaining and sentencing guidelines and the whole works. But given limited resources and limited column inches, instead we end up with heuristics like using the maximum penalty as a proxy for the severity with which the law treats the behavior.
Whenever there is a popular push to change the law, most people aren't going to understand all the details. People don't have time to learn everything about everything. At some point the layman will have to defer to someone trustworthy (like the EFF or the ACLU) to do the legwork and then adopt their position on the strength of their reputation. They need to get down into the weeds and make sure they understand what's going on, but they aren't the ones getting their information from popular media, they're the ones reading the statutes and the case law and engaging in discussions with scholars and legislators etc. Articles in The New Yorker aren't meant for those people, they're meant for the man in the street who needs to be made aware that something is going on and the people who have done their homework are saying it's a problem and we should do something about it. That way a critical mass of people willing to support doing something about it can be achieved, even if it isn't possible for all of those people to each be individually aware of every nuance of the issue. If someone wants to know more then the information is available. Anyone so inclined can look it up. But most people won't; I don't see any obvious way around that. And an article that skims over some of the details for the sake of brevity and approachability is a lot more likely to be read by those people, so that at least they know that something is happening and maybe some subset of the currently-oblivious can be inspired to learn more.
>Not every offense prosecuted under CFAA is a felony; in many cases defendants are charged with a misdemeanor instead.
I'm not sure how that changes anything. That some cases are prosecuted as misdemeanors or in an otherwise unproblematic fashion doesn't mean we can't do better in the cases that aren't. And if many of the cases prosecuted as misdemeanors could under the law have been prosecuted as felonies but for the grace of the prosecutor, that still points to a problem in the law.
Is it not factually accurate? Could local law enforcement not arrest you for doing it and subject you to a trial or try to coerce you into a plea bargain, if they didn't mind the response from the public or the courts?
Moreover, would you not oppose an effort to remove such a law from the books? How do you imagine anyone would lobby for that to happen without discussing it?
In Minnesota, oral sex is punishable by up to a year in jail and a $3,000 fine.
Factually accurate:
In Minnesota, by law, oral sex is punishable by up to a year in jail and a $3,000 fine. However, that law is never enforced and your chances of getting prosecuted are 0.
Factually accurate does not mean you can cherry pick your facts and pretend you are telling the whole truth just because each individual fact is accurate.
Before the charges came down, I would've thought the realistic number was 30 days of probation or maybe 20 hours of community service. Of course, that number would have said more about me than about reality. I prefer my reporters to deliver the facts first, and their interpretations and guesses second.
As I pointed out in another message in this thread, your estimate would be the realistic number, because most petty offenders under the CFAA do get probation.
Second, you're imposing an unrealistic burden upon reporters. The OP in this case is simply stating the facts: that the charges that Keys faces have a sky-high penalty -- which is not the case for littering, to use our example. For the OP to also say, "but most likely, Keys won't face the full penalty and he may even get a slap on the wrist," the OP has to predict the future or have foreknowledge of these factors:
* How guilty Keys actually is
* The current and near-future caseload of the prosecutor
* How strong the case is
* How likely it is that Keys will be the type to plea bargain
* Whether or not there's the possibility that Keys will turn state's evidence, which would essentially nullify any punishment.
Such a thorough exploration would make for an interesting article, maybe, but that was never the OP's intention. The OP is merely pointing out what a sloppy statue the CFAA is. What happens as a matter of judicial procedure is only a tangent.
By contrast, look at the NYT's report on the story: http://www.nytimes.com/2013/03/18/technology/outcry-over-com... This raises all the same issues, but in much greater detail and with meaningful context.
It is, however, frequently used to intimidate people into giving up their rights. There is a reason that more people go to prison each year than could possibly be sentenced by a jury of their peers, and the maximum penalties allowed by the law is one of them. Let's put it this way: the four men in Norfolk who pled guilty to a rape and murder they were entirely innocent of did not do so because they were insane; they were simply terrified of the possibility that they might be executed (and the exhaustion of many hours of berating by the police did not help).
The tactic works because of human psychology. Being in an interrogation room is terrifying, and people have a natural instinct to try to get out as soon as possible. The police interrogators are trained to extract confessions and play on those instincts and the general fear their subjects experience. The problem is not the press, it is the interrogation and plea bargaining process itself.
My whole point is that such data are missing from this article, despite their relevance.
The tactic works because of human psychology. Being in an interrogation room is terrifying, and people have a natural instinct to try to get out as soon as possible.
I've been in one. I found it annoying rather than terrifying, but that's obviously not the case for many other people. For all its flaws, sitting people down and asking them uncomfortable questions is one of the better techniques we have for solving crimes, and I find it vastly preferable to the use of things like truth serums or lie detectors.
Does a law professor at Columbia count as a lawyer? Because that's what the author of the piece is =)
Professor Wu's suggestion that the Administration rely on the rule of lenity is not as off-base as you suggest. Although it's true that it is a rule for construing criminal statutes applied by courts, the administration needs to construe statutes, too, before they can decide whether to enforce them in specific situations.
Professor Wu is suggesting, I think, that the Administration should use the rule of construction that ambiguous criminal law should be read in favor of the defendant to say that it's too ambiguous to be enforced in Swartz-like cases in any principled way.
Put yourself in the shoes of the injured party, and ask yourself how you'd feel if people investigating your case told you not to worry about it, even though you had spend a lot of money on hardening your servers and even though losing control of your servers to the extent that people could post fake stories on your website kind of damages your standing as a major newspaper.
After reading the indictment, with Keys' encouragement to his co-conspirator to 'go fuck some shit up' I don't see how a prosecutor could do other than indict him. That does not mean the prosecution is trying to put him in jail for 25 years, and Wu knows that full well. 'Sharpie,' the anonymous member he corresponded with over IRC, did limit him(?) self to just joking around, posting the fake news story about 'Chippy 1337,' and I suspect that if caught he would receive only a misdemeanor charge. But for all Keys knew, he might have engaged in far more destructive acts.
In reality, though, either strategy misses the grander problem, which is not about the letter of the law, but about selective prosecution that dehumanizes arbitrary victims for the purposes of career advancement, personal grudges, and maintaining bureaucratic budgets.
An unnamed politician was wrongly linked to a paedophile sex scandal. Twitter users named that man, and called him a paedophile. (He isn't!) Many thousands of people repeated this slander.
Lord McAlpine was potentially going to sue 10,000 people.
(http://blogs.wsj.com/tech-europe/2012/11/22/mcalpine-forces-...)
The reason this sort of scheme never works is called prosecutorial discretion. If your purpose is to show how the law is an absurdity then prosecutors who see through you can choose not to prosecute in that case because they don't want to enable you to change a law they want to stay the way it is.
Overtly breaking the law doesn't get the law changed, it just makes the law unenforceable in most cases. Look at what happened with all the people printing DeCSS on t-shirts -- I'm not aware of any of them actually being convicted of violating the DMCA. The fact that the code was so widely distributed meant that it could never be suppressed and anyone (i.e. any pirate) who lives outside the law has ready access to it, but the law is still sitting there on the books screwing over the people who won't risk prosecution, who then can't make innovative products that would otherwise have to interact with DRM.
Having the law stay on the books but never be enforced (or never enforced against "good" actions) is a totally unreasonable outcome. Because plenty of people will be deterred from doing "good" things as a result of the possibility of being prosecuted, even if it doesn't happen in practice. The law actually has to be changed, either in Congress or in the courts.
Don't try to repair it. Rip it out and establish clear, concise, use-case specific laws, when necessary.
It's possible however that this makes Keys a "better" defendant, in that the law is clearly unjust even in his case.
Um what?
If you read court decisions where a law is criticized by a judge or justice as unjust or unfair (but not necessarily unconstitutional), they never say that prosecutors should stop bringing such cases to court; they say that changing the law will require Congress to act.
To take a current example of the dichotomy, the Obama administration has filed a brief with the Supreme Court asking it to overturn DOMA (Defense of Marriage Act), as it's the administration's belief that the law is unconstitutional - but in the meantime, the administration is still implementing DOMA as written, because until the SC rules against it (if they do) it remains the law of the land. If two married gay people file a joint tax return, the IRS will send it back with an apologetic letter and tell them they have to file separately and so on.
http://www.politifact.com/florida/statements/2012/apr/09/ver...
In practice, though, the executive can pick and choose enforcement priorities. Case in point: the DEA ramped up the effort against medical marijuana in California after the Obama administration made a deal with the pharmaceutical lobby, to win support for the Affordable Care Act. Within two years, the Obama administration's DEA had raided more medical marijuana dispensaries than the previous administration had in all eight years.
Virginia recently overturned its law that forbade unmarried opposite-sex couples from living together. Nobody had been prosecuted under that law in many years (at least not as far as anyone knows), and only one person had been threatened with prosecution. The police in Virginia certainly know that unmarried couples are living together and having sex with each other; they just have other laws they are busy enforcing.
The idea that the law must be enforced without any exceptions or leniency is the sort of far-right, law-and-order thinking that has turned America into the world leader in imprisonment.
Your misrepresenting my position on law enforcement; I pointed out a critical logical flaw in the OP, which is the idea that the rule of lenity applies to law enforcement. It is a specifically judicial concept.
Is the combination of the administration's dealings with the pharmaceutical industry's lobbying group, PhRMA, and the fact that during the same period of time that those deals were being made the administration became more aggressive on marijuana raids, count?
https://www.nytimes.com/2012/06/09/us/politics/e-mails-revea...
http://reason.com/archives/2011/09/12/bummer/singlepage
Unfortunately, the extent of the administration's deal-making with the pharmaceutical lobby remains undisclosed. Why the public has not been given access to their emails is anyone's guess (I suspect most people would guess the same thing). Maybe in a few decades, when the full details of this administration's activities become public knowledge (assuming such things even happen), we can figure out if the simplest answer -- that the administration attacked marijuana in a quid-pro-quo with PhRMA -- is indeed the correct answer.
"Also, your claim implicitly assumes that the number of dispensaries was static, when it was anything but."
Are you actually claiming that nearly overnight, the number of medical marijuana dispensaries increased by more than a factor of four? That somehow, the number of suppliers in California simple increased by pure coincidence in 2009?
This administration has been one of the most aggressively anti-drug-law-reform administrations in the history of the war on drugs. The President has publicly (and falsely) stated that it is up to Congress to legalize marijuana. He falsely claimed that he would suspend raids once he ejected Bush administration holdovers from top DEA positions, only to appoint Bush administration holdovers to those positions and increase the number of raids.
And yes, the number of dispensaries did shoot up in a relatively short period. Los Angeles in particular turned into a free-for-all, with estimates of up to 1000 operating in LA county at one point, much to the chagrin of the NorCal MMJ community that has been pushing for legalization. Indeed, all the legal and industry advisers at Oakland's Oaksterdam University (of which I am a graduate) predicted in advance that the LA dispensary gold rush was on a collision course with the LA county authorities, which is exactly what happened. And while the feds conducted investigations up here in Norther California, it's worth bearing in mind that they didn't actually shut anything down - Oaksterdam university is still taking students, major dispensaries like Harborside remain open and so on. If you look at the record of small dispensaries shut down in Northern California (where I live and pay more attention) you'll see that in almost every case it involved weapons charges or non-payment of taxes.
This administration has been one of the most aggressively anti-drug-law-reform administrations in the history of the war on drugs.
Yeah, just look at the abolition of the crack sentencing disparity.
The President has publicly (and falsely) stated that it is up to Congress to legalize marijuana.
This is correct. The President can direct the surgeon general to reconsider a drug's scheduling, but a great many substances (including marijuana) are explicitly proscribed in federal legislation.
Clearly you have an axe to grind, but I suggest you grind it a little more carefully.