Attorneys for Barrett Brown want case on linking to hacked material dismissed
theguardian.com
theguardian.com
This is a federal case, and the Federal Sentencing Guidelines (while now discretionary, see Booker) simply don't work that way. 100 years is the potential maximum he would get if the sentences were served consecutively, but at the federal level, there must be special circumstances to justify imposing consecutive sentences. Consequently, consecutive sentencing is the exception, not the rule, and is almost exclusively reserved for the most heinous crimes, i.e., rapes, murders, or high-level drug offenses. (Note that certain factors can also result in consecutive sentences, such as gun "enhancements" which can add 5-25 years to a base sentence.)
Edit: The above assumes the case even proceeds to the sentencing stage. Several US courts have already ruled that merely hyperlinking is not enough; there must be an additional circumstance to make the hyperlinking illegal. For example, if the information hyperlinked was clearly intended to be protected or private (i.e., Schwartz and the AT&T subscriber data), then dissemination of links could fall within the meaning of one or more statutes for unauthorized access.
A physical analogy to explain why this matters: a URL isn't simply an address; it is a path, and this makes all the difference. A p.o. address, for example, may tell you how to get to someone's apartment but it wouldn't tell you how to get up there if the front door is locked. A URL is more akin to giving someone an address and telling them how to get inside. (And for you nitpickers, in this example also assume that you don't know the person at this address; you simply know the URL.)
Maybe there should be a limit on the span between maximum threat and minimum sentence, so that 100-year threats can't be thrown around unless the minimum plea is at least 5-10 years. That would make a prosecutor hesitate to employ such a powerful weapon, because the defendant would be more willing go to trial in that scenario, which reduces their chances of landing that conviction.
Of all of the activities undertaken by the state, an increasingly high percentage fall firmly under this definition.
This is also a legal ethics issue, since a prosecutor who fraudulently claims a higher maximum penalty during plea bargaining can be suspended or disbarred. Cops can lie to you--prosecutor's can't. They have sworn an oath (to the bar) to be honest in their legal representations. Prosecutors have been sanctioned, suspended, and even disbarred for being dishonest about sentencing because such dishonesty indicates moral turpitude that likely extends into other facets of their legal work.
It's the media that throws around the 100-year numbers by adding together all of the potential individual sentences. It turns out that journalists aren't very good at understanding technology, science, or the law.
My comments on this thread only discuss the Stratfor case, which is the second indictment of the 3 discussed by the DMLP article ageisp0lis linked.
EDIT: I see you've run the numbers in your other comment, sorry:
1028 imposes a maximum sentence of 15 years for the gravest crime listed in the statute. Assuming he is found (or pleads guilty) this yields a likely maximum sentence of 17 years, or a potential maximum sentence of no more than 33 years.
Does this seem excessive?
Is it true to say "no one really knows precisely how much of a threat he's facing"? The justice system is usually precise, so it seems odd that a precise maximum can't readily be found in this case. Do you think the maximum is probably more than 10 years?
Yes, if he is found guilty. No, if he pleads. However, I heartily disagree that the justice system is precise. It's very messy, and two defendants with the exact same facts can get widely disparate sentences. A recent study from 2012 or 2013 revealed that judges were more likely to give harsh sentences after lunch than before lunch (controlling for race, criminal history, and other factors).
1028 imposes a maximum sentence of 15 years for the gravest crime listed in the statute. Assuming he is found (or pleads guilty) this yields a likely maximum sentence of 17 years, or a potential maximum sentence of no more than 33 years.
Does this seem excessive?
Yes since the crime is relatively non-serious compared to something like drug dealing or aggravated assault, and especially since our financial system already protects credit card holders. Hell, even violent robbery with a first-time gun enhancement can have a lower maximum potential sentence than 33 years.
1028 does not mandate consecutive sentences. Note that 1028 is also the "base" offense, i.e., the actual felony. That means the first 3 charges yield a potential maximum sentence of 45 years, but more likely 3 simultaneous sentences of 15 years.
1028A is the "enhancement" charge, which is why it must be served consecutively to the base offense on which they are levied. However, the enhancements themselves can be served concurrently. This means the potential enhancement sentence is anywhere from 2 years to 18 years.
This may be too complicated to explain in a brief HN comment, but an enhancement to one charge can be served consecutively to another charge because the concurrency prohibition is specific to the underlying offense. (I.e., if he gets 10 years for Count 1, but 8 years concurrently plus a 2 year enhancement for Count 2, he can serve both 10 year terms concurrently because the enhancement doesn't extend the sentence for count 1).
http://www.justice.gov/usao/txn/PressRelease/2012/DEC2012/de...
"Upon conviction, however, the trafficking count carries a maximum penalty of 15 years in prison and the access device fraud count carries a maximum penalty of 10 years in prison. Each of the aggravated identity theft counts, upon conviction, carries a mandatory two-year sentence in addition to any sentence imposed on the trafficking count."
Hackers seem to be getting longer sentences then career criminals these days.
"When it comes to computers we must punish severely because it's magical and we don't understand it." is the view all non IT literate politicians and lawyers seem to have.
I can't be bothered to search for other similar articles I'm sure you can find them.
Now that quote is the internal monolog I imagine given the actions these people take. It may not be completely accurate or even real but it certainly fits.
If you can come up with a better explanation why the sentences for computer related crimes are so absurdly high I would gladly listen.
I don't really care much for the legal issues the law is just so complex that you can pull off a lot of horrendous shit while perfectly justifying it legally.
If you're a judge that just goes by the letter of the law without applying common sense and morality you have failed.
- "my opinion..."
- "can't be bothered to search..."
- "I don't really care much for the legal issues, the law is just so complex..."
You know (by your own admittance) nothing of the underlying issues, yet you have a (somewhat) strong opinion on them based on your "feelings" and what your read left and right, and you have a completely warped view of reality on the facts in these issues. What does it take to convince you otherwise, without me having to spend hours compiling numbers or writing pages and pages of text? Is it enough to mention three-strike laws, which put people away for other offenses for decades for relatively minor property crimes? Or the explanations brought up elsewhere in this thread on the actual sentence in this case? I mean basically you're asking me to argue the 'why' for things that are plain not true.
When you can charge anybody with a crime regardless of what they are doing something is wrong.
The fact that this "exception" and many others like it are allowed to progress this far is quite problematic regardless since not all "exceptions" get reported on by the press this extensively and it takes only one precedent to ruin it for everybody.
"By all indication anything relating to computers, hacking or security research is considered one of the "worst" crimes in the USA. Hackers seem to be getting longer sentences then career criminals these days."
The mere fact that there are just two such cases, and that everybody recites the same two cases when making such gross exaggerations as the one above, reinforces my point about living in an echo chamber.
Echo chamber or not, the sentences either discussed or awarded in the cases above are disproportionate and unjust.
Because the media has been doing it for 20+ years. The news is more "interesting" when big numbers like that are thrown around.
When someone is convicted of a federal crime, its the Department of Corrections that will put together a presentence report with a computation of the sentence under the guidelines. To get above that, the prosecutor has to argue to the judge that this case is special and requires a sentence above the guideline range. This is very difficult.
18 USC § 1028A, etc.
"no term of imprisonment imposed on a person under this section shall run concurrently with any other term of imprisonment imposed on the person under any other provision of law..."
Only one of the statutes in question mandates consecutive sentences, 1028A. The maximum sentence for these counts is 2 years for the crime charged. (He was not charged with a terrorism offense under 1028A, so the 5 year sentence is not applicable.) The way this statute is written, this 2 year sentence may not be concurrent to any other sentence for any other crime but multiple counts of the same crime can be served simultaneously. (Note that 1028A is an "enhancement" charge, similar to the gun enhancements I mentioned earlier. They are add-ons to other crimes, and cannot be charged separately. Basically, enhancement charges are used when additional circumstances covered by the enhancement make the underlying crime "worse" than a normal instance of that crime.)
1028 imposes a maximum sentence of 15 years for the gravest crime listed in the statute. Assuming he is found (or pleads guilty) this yields a likely maximum sentence of 17 years, or a potential maximum sentence of no more than 33 years.
A URL may tell you how to get to someone's file, but it wouldn't tell you how to download it if the server required authentication. A URL might be more comparable to driving directions than a mere address, but it does not grant access to a resource with even the most rudimentary access control.
As a side note, it's amazing how the war on drugs advanced in the propaganda front. Selling drugs in bulk is not only a serious crime, it's high up there with rape and murder.
I'm as pro-legalisation as they come, but any reasonable person would have to admit that the damages caused by the actions of the leaders of big drug cartels are, in the aggregate, causing at least as much suffering as, let's say, a single rape. I know I'm threading on thin ice here because this might make it seem like I'm trivializing rape, which I'm decidedly not, but regardless of what side of the debate one is one, it's wholly unreasonable to assert that drug dealers do not cause any suffering and that they are in no way responsible for that suffering (i.e. the 'users make their own choices' and 'if I didn't sell it, somebody else would have' arguments).
Drug laws would lock up for good the guy in apartment 4c as well, and large segments of society do not see him as "quite different" than the cartels.
And all of that is separate still from the murders drug cartels commit as part of their business operations, I realize that. Apart from all that, there are still harmful effects from their acts. (hence my wording 'in no way responsible' - they are not fully responsible, but are at least contributing, and their contributions to many cases make for a lot of aggregate negative effects).
I'm not sure how you came to the conclusion that a URL is a path. A path implies a route from A to B. When I share a URL with you, I imply no path.
> A p.o. address, for example, may tell you how to get to someone's apartment but it wouldn't tell you how to get up there if the front door is locked.
You began your comment with the words FUD, so I'd like to add two of my own - Red Herring!
If you must use analogies, the physical equivalent of a URL is an address, not a P.O. box. But I suspect you still chose the P.O. box analogy because it allows you to create the false construct of a locked front door.
The availability of digital resources at a public URL is equivalent to the availability of physical resources at an address. The "locked front door" is irrelevant in both these (limiting) examples.
I don't like that interpretation, because i feel it's important that linking remains legal in most crcumstances, if not all, but that doesn't change the fact that if you reason by analogy to the physical world most url's are indeed paths. And this is where the danger is: reasoning by analogy. It doesn't produce good results to reason about dgital resources by analogy to physical resources.
I wouldn't mind being proven wrong though, preferably with an example.
Uniform Resource Identifiers (URIs, aka URLs) are short strings that identify resources in the web: documents, images, downloadable files, services, electronic mailboxes, and other resources. They make resources available under a variety of naming schemes and access methods such as HTTP, FTP, and Internet mail addressable in the same simple way. They reduce the tedium of "log in to this server, then issue this magic command ..." down to a single click.
Since Google is posting these publicly (using many fancy techniques to improve their relevance no less) how many billion years of Sentencing will Brin & Page face under these extremely well worded/just/sane Federal Laws?
What gives? Can't have it both ways.
There may (or may not) be specific laws that deal with explicit referrals to illegal activities.
> Google doesn't do any filtering (except the filtering that it does do)
> Google doesn't give directions to somebody's house and tell you how to get in, it gives directions to everybody's houses and tells you how to get in.
What is this, a formal debate with research and fact-checking and carefully proofread dissertations? We're just a few guys writing stream-of-consciousness paragraphs between code compiles. I maintain that anybody who doesn't recognize the difference between somebody posting a link to a bunch of credit card numbers and Google showing links in their search results is being deliberately obtuse or autistic, or both. There is obviously a continuum between them (in the sense that they both revolve about 'links'), and one can argue about cases on this continuum (although I have no interest in doing so), but the argument 'a link is a link' without any consideration for context, intent, etc is prima facie stupid to any reasonable person.
No, you're right. Let's keep this emotional, fact-free, and useless.
>the argument 'a link is a link' without any consideration for context, intent, etc is prima facie stupid to any reasonable person.
No, you're making a false dichotomy of this. The fact is that a link is a link is a link. Tying this in with intent and context is a different matter altogether. The nature of a link doesn't (or at least shouldn't) change between applications of the term, whereas intent and context can. However, if the crux of the matter with regards to intent and context is that a link "posted" by a link aggregator points to something it shouldn't, the effect of that action can't be split out differently simply because a different actor was involved.
By analogy, it doesn't matter that I was swinging a chain saw around my head on a rope with the intention of evenly cutting my hedges, the fact of the matter is that my neighbours are approximately one head-length shorter than they were when they stumbled upon me. Whether or not I'm a gardener or a dedicated chainsaw murderer doesn't affect the outcome here.
head explodes
If you're trolling, congratulations, you got me.
If not, it doesn't make any sense to continue this. I don't see a way to convince anyone who doesn't see the difference between somebody posting a specific link to stolen data and a link aggregator. It's not about the link, it's about posting the link, and the intent and context of that action. I honestly don't see how to go deeper on that.
The 'analogies' game is quite tiring, I'm not even going there.
Explain that one, Mister Ideological Predisposition.
[0] http://nypost.com/2013/01/12/no-charges-for-nbc-host-david-g...
"Influencing our judgment in this case, among other things, is our recognition that the intent of the temporary possession and short display of the magazine was to promote the First Amendment purpose of informing an ongoing public debate about firearms policy in the United States, especially while this subject was foremost in the minds of the public"
Edit: Another question gets downvoted. Hacker News really hates when people ask questions. You can go through my recent comment history and see where other questions[1] I ask get downvoted too. Whatever you do, don't ask people on Hacker News about whatever comments they make.
I think at this point pg would be doing everyone a favor if he just rebooted this site or just closed it down completely given what it the community has turned into.
Don't think those of us in "flyover country" aren't paying attention to this political corruption in the nation's capitol.
And yes, equality is something that governments attempt to achieve through laws. Equal application of the law is one of the founding tenets of the US government. In my opinion, yes, equality is a more worthy goal to pursue than blanket enforcement of every law that happens to have gotten onto the books.
And the fact is they uniformly enforce these laws, albeit with quite a few jury nullifications, except when people like David Gregory and institutions like NBC commit these crimes. Knowingly in NBC's case.
I wish more people would admit we have a severe problem with having effectively having two sets of laws, one for our nomenklatura and another for the rest of us.
Certain individuals who are part of the DC government believe those things. Some other individuals don't. We count up the ones on each side and then democracy happens. We have the courts to make sure the majority hasn't gone completely crazy.
DC went through a long time where they were leading the US in murders. When people are getting shot around you left and right, it's pretty reasonable to think that maybe you could stop that if you could stop people from having guns. The purpose of the laws was to stop people from getting shot. It's pretty clear that David Gregory was not going to shoot anyone, so putting him in jail was not going to serve the purpose of the law.
Are they willing to be as rational if the person isn't famous? I don't know. I'm not aware of any other cases where a non-famous citizen has gotten ahold of an illegal ammo clip to use as a prop in an argument about gun control.
"We have the courts to make sure the majority hasn't gone completely crazy."
Yes, that's what Heller was all about, but that hasn't stopped D.C. from engaging in Massive Resistance.
Getting back to the other case, Irvin Nathan had one defective shotgun shell in his home. Is putting him in jail going to serve the purported purpose of the law?
There are plenty of analogous examples to David Gregory with "illegal guns" being used a props by politicians and the like. Of course, they too are members of the nomenklatura that people like you are so willing to excuse.
Now you have two people in jail instead of one. We should be trying to have zero people in jail who should not be there. We shouldn't say "Well, we put one person there for a bad reason, so we should put everyone else there for the same bad reason too". This is what you seem to be proposing. I get David Gregory doesn't share your politics, and maybe you just don't like him. That doesn't mean we should put him in jail just so you can feel better about some other person getting screwed. I doubt Irvin Nathan would feel any better about being in jail if David Gregory were there along with him. I'm sure he'd much rather just not be there.
Side note: You can look at actual data here - http://www.disastercenter.com/crime/dccrime.htm
The murder rate in DC was rising steadily since 1960 until the gun control laws were passed in 1976. It went down briefly, then exploded with the crack epidemic in the late 80s, early 90s. Obviously, there are many, many factors contributing to the murder rate and you can't control it by modifying only one input. I'm not trying to imply otherwise.
This clear inequality appears to bother the parent poster more than the given example of heavy handed punishment.
Whereas the establishment of a shameless nomenklatura in the US is an existential threat to the Republic. Which could, I might add, have even nastier personal consequences.
Invidious gun grabber laws are as old as Reconstruction, but we've been fantastically successful at beating them back starting in 1986. Our fight with our ruling class ... not so much.
"We need to enforce the law because it's the law so we need to enforce it" is shitty, circular reasoning. This is the exact reason we have judges and juries in the first place: to interpret laws so they don't get blindly applied in places where they don't benefit us.
Its not like he was out there trying to sell credit card numbers. He was trying do disseminate information for the public good and some illegal information was swept up. Prosecutoral discretion, indeed.
The guy was steamrolled. They found a scapegoat for a problem they were embarassed they couldn't do much about (Anonymous). Luckily he was engaged in questionable personal activities like drug use so they knew they had an easy road to discredit his work and drag him through the mud. Then they found a reason to provoke and prosecute and did it.
"Goggle doesn't do any filtering"
"..doesn't willingly lead people to certain material"
Are you sure we are taking about the same Google?
I wonder what Daniel Elsberg[1] or Woodward and Bernstein would face today, if they tried to do today what they did then?
We're not living in the first world, and I fear we're not in the second anymore, either.
Barret Brown is not Aaron Schwartz. Schwartz at least had a colorable claim that what he was doing should not have been a crime. If the allegations are true, Barret Brown is definitely one of the bad apples and does not deserve our sympathy.
He flipped out and lost his cool over constant government-sanctioned harassment. He's not perfect by any means—admitted substance abuse problems and a big naïve/foolish/arrogant streak—but still deserves sympathy.
I don't think he would have known there was a law on the books making it illegal to dox feds. Doxing abusive cops on the other hand is legal and happens all the time between Anonymous/Occupy and even journalists do it sometimes.
In order to convict on threats there needs to be a "true threat" of physical harm, a non-conditional statement made to a specific person. All he said was "if they come" he wouldn't be able to tell FBI from Zetas so he'd exercise self-defense. And he explicitly clarified when he said he was going to ruin the guy's life, he meant to expose him, not as a physical threat.
One can disseminate a link without knowing whats in it. Brown is on the record in many places as being opposed to spreading credit cards. He was against that kind of stuff.
How can reporters verify sources or security researchers examine data dumps without fear of being prosecuted now?
This is a chilling attack on digital rights and needs to be stopped. I hope the judge listens. Stratfor was sued because they failed to sufficiently protect their systems and rightfully so. The actual hacker Jeremy Hammond got less time than this guy faces.
Large sentence are the norm in the US, not the exception. Petty thief in California and elsewhere[1] are sentenced to 25 years minimum if they are repeat offender, it's completely crazy.
In that regard, it seem unlikely Brown would get a light sentence.
http://www.popehat.com/2013/02/05/crime-whale-sushi-sentence...
(1) The circumstances under which hyperlinking to material posted and hosted by others is, or should be, a crime.
(2) If it is a crime, whether the proposed sentence is proportional to the alleged offense.
(3) Whether the prosecutor is trying to exert pressure for a plea bargain. E.g., if they offer him 100 days in jail if he pleads guilty, or 100 years in jail if he's convicted, it would make sense to plead guilty from a pure risk management perspective, even if he has an enormously strong case.
(4) If this length of sentence for this behavior is authorized by statute, whether the statute falls foul of the Constitution's prohibition of cruel and unusual punishment.
(5) Whether the First Amendment protects hyperlinks to unprotected speech.
I'm not so sure about that. Imagine the terrible precedent you'd set. EDIT: Risk aversion is sometimes toxic to society.
I don't think I would be that idealistic or generous.
Same with cops asking for anything else at gunpoint etc.
I disagree, mainly because this case is an asymmetric risk scenario - his gains from pleading not guilty are extremely miniscule when compared to his losses(compared to the 100 days he'd have to spend in jail, if he were to plead guilty).
If it's hazy about whether what they did was a crime, that's a different matter though. And it's a little frustrating to see prosecutors trump up charges to get an easy plea bargain. Maybe there should be some limit between the max sentence and the min plea sentence, so that they can't throw 50-year threats around without at least a 5-year plea bargain.
I don't see why being a white male hacker makes Barret Brown a special case. If anything, it's a good sign that a white male is being subjected to the same overhanded treatment that minorities have to deal with, because it makes people aware of the problem and creates pressure to fix the system.
If you're talking about piling on charges to make a plea deal look attractive, I'm pretty sure that's been done before.
Maybe I'm making a generality of a few fringe cases but since 9/11, and the rise of TSA and several horror stories of Police abuse I abandoned my project to one day visit this great country.
I believe the likelihood of having a serious run-in with the law in the U.S. as similar to having an accident when doing an "extreme" sport - you have to be aware of the possibility when doing it and accept them, but they're not so bad.
The most likely scenario, from what people who visited experienced: you will be treated a bit roughly at customs/inmigration (fingerprints, questioning your motives) and then you'll be free to have a nice time.
Do your homework and have your visa and papers and travel schedule and hotels in advance, and you'll be fine. It's still one of the least friendly countries to enter (and that's validated by people I know that have visited 100+ countries, I've visited 50+ myself), but I think it's worth it and I'll visit someday.
Bill Clinton once said "There is nothing wrong with America that cannot be cured by what is right with America", and at the time I agreed with that. It has been a while since I do not believe this anymore.
What I find concerning is his lawyer's argument, "Brown did not 'transfer' the stolen information as he arguably would have done had he embedded the link on his web page" ... does this mean for us webmasters, linking to a webpage (even as Google or Bing may do) would mean incrimination. I understanding hosting....but linking!!! WTF!
Sarah R. Saldaña is the U.S. Attorney for the Northern District of Texas... But who is the lead Assistant U.S. Attorney (AUSA) on this case?
A guidance system.
Banning the pool hall is not going to deter the crime. And banning links in chatrooms by making it illegal will not do anything either.
The problem is not the criminal, it's the guy trying to classify the criminal. Just because the baby is in the bath water has a little dirty water on him, doesn't mean we bag up the baby and throw it out.
I am pretty sure they meant "documents" not "link" here
although something about playing with fire and being burned comes to mind..
Does the right to free speech protect in this way:
<a href="[not_protected]">[protected]</a>
? <a href="[not_protected]">[not_protected]</a>
That said: blah blah blah .... blah blah
Now if a crawler scans that, puts it into an aggregate feed and cites me as the source, and there's a hyperlink in there... That means trouble for everyone.But really, if I give you some text and you copy-paste a substring of it into a search engine and get a Stratfor document, what's that mean?
Is it the function of a hyperlink + intent, or is it just the speech itself? Doesn't "speech" imply intentionality which itself is what is examined by law?