After Threatening Hacker with 440 Years, Prosecutors Settle for a Misdemeanor
wired.com
wired.com
http://www.popehat.com/2013/02/05/crime-whale-sushi-sentence...
Most importantly: when you are charged with many counts of the same crime, the DOJ likes to write press releases suggesting your sentence is the product of the maximum sentence of each count. But that is not how sentencing works in reality. Reality works more like this: the judge uses sentencing guidelines to figure out a sentence for the "worst" single count you're charged with, and that's how much time you serve.
The prosecutors get to decide what if any counts you are charged with. They have the most control over sentencing, judges very little. The little Judges do have is often constrained by mandatory minimums some of which require consecutive termss.
That judges are able to use their discretion and work within "guidelines" is a myth.
* Drug trafficking or manufacture
* Firearms used in the commission of felonies
* Identity theft, but only in the context of the specific list of crimes in 18 U.S. Code § 1028A (c) (purchase of firearms, immigration, passports, terrorism, bank fraud, &c)
* Trafficking in illegal immigrants
* Sex offenses against children
* Hijacking, kidnapping, violent terrorism, and hostage-taking
* Murder
* Racketeering
* Piracy, of the yo-ho-ho variety
The "consecutive sentence" issue here is also tricky, because some of these minimums are added as sentence accelerators; for instance, the gun crime minimums add years to the sentence you'd get for the underlying felony, and those extra years are served consecutively --- but that doesn't make all the charges for the felonies necessarily "stacking".
Mandatory minimum sentences are a terrible idea, and the minimums for drug crimes are particularly stupid, but they're not a factor in this story.
"if you are found to violate the CFAA as part of an activity that involves a variety of other crimes, you can now also be charged with racketeering. More specifically, if you look at that long list of related statutes in the definition to 18 USC 1961 (1), it will also include: "‘section 1030 (relating to fraud and related activity in connection with computers)."
https://hn.algolia.com/?q=author%3Atzs+techdirt#!/comment/fo...
Second, not all racketeering crimes are subject to federal mandatory minimums --- racketeering charges with minimums all involve forms of money laundering. The court has to find that you were laundering money regardless of how you use computers to do it.
Third, Techdirt takes the bill radically out of context; by Techdirt's logic, 18 USC 1961 also makes any misuse of a passport, any bribery, any counterfeiting, any obstruction of justice, and any violation of money transmitting statutes "racketeering". Of course, that's not how the law works. CFAA offenses were merely being suggested as one of the huge list of offenses that could, in the context of a racketeering case, be construed as part of the racketeering. The state still needs to make a racketeering case on the merits.
Fourth, in context, that one section of the bill actually makes sense. Racketeering is the crime of running a "racket"; the best-known example of this is a protection racket. It actually doesn't make sense for computer crimes to be exempt from the list of things you can shake businesses down for. As luck would have it, this is an issue being discussed on the front page of HN today:
https://news.ycombinator.com/item?id=8661245
Fifth, the bill was a House draft that apparently never made it out of committee.
If you want to learn more about the elements of the crime of racketeering and RICO in general, a good place to start is model jury instructions.
I'm less charitable towards Techdirt than other smart people seem to be. Popehat, for instance, which I more or less revere, routinely links to them. I find their coverage misleading at best, and often --- as in this case, where the author tries to convince their readers that the House wants to make all CFAA crimes chargeable as "racketeering" --- overtly dishonest.
In any case: no, nobody has proposed mandatory minimums for CFAA crimes.
False.
http://volokh.com/2011/05/24/congress-considers-increasing-p...
* 2011.
* Failed bill.
* Proposed making hacking that takes down the power grid subject to 3-year mandatory minimum.
* Raised a concern for Kerr in 2011 that was ameliorated by Nosal later.
You're right. I should say, "nobody IS proposing".
Perpetuating these myths does a disservice to anyone who believes them. If you want to take away prosecutors power to threaten, stop giving it to them.
(We've disagreed about this before. Instead of rehashing everything we've already written about the guidelines, I'll just direct people to this previous discussion -- unless, that is, you have anything you'd like to add. https://news.ycombinator.com/item?id=7999002)
[Is what I wrote before you pointed out your earlier comment, which is fantastic and I have nothing to add to it. Sorry, I should respond to comments assuming people know what they're talking about, and in criminal law threads I have a bad habit of doing the opposite.]
The "Introduction to Federal Sentencing" here:
http://nj.fd.org/Introduction%20to%20Federal%20Sentencing%20...
...states outright that grouping is mandatory. I'm guessing you're right: that if a judge can articulate a reason to override the sentencing rules, they can do that. I'm trying to find a case where such a thing happened and was then challenged on appeal.
The state has virtually unlimited resources and a legal monopoly on the use of force to compel obedience. That's far more terrifying than the ability of some lawyers to spin events in a favorable light.
It would be like me writing a business-critical app in INTERCAL or Brainfuck simply out of job security by obscurity, except instead of just me, imagine this was a commonly accepted practice for programmers, and you had to go to a very expensive school to become a programmer in this hypothetical world.
[1] It's really interesting to watch 80's dramas like "Star Chamber" to see these concerns aired out.
And let's not even get started with the mathematicians.
We all know that when stuff gets down to the details, things get complicated, edge cases multiply, and language turns into jargon. Law is no different.
Programmers have made computers significantly easier to use, for more purposes, including programming them, over time.
Lawyers have done the reverse. This comparison is not favorable to them.
I'm pretty sure they hate them after they need them too.
Just like how people hate their captors until they want to know where the keys are.
I know you're not saying anything more than "This isn't actually what it would have turned out to be," but what would it have turned out to be if these charges had stuck? I'm curious how long a felony count of computer fraud or cyberstalking will land you in prison for.
How long could your sentence be? With no criminal history and for offenses deemed non-money-making, your sentence could be so low that you fall below the threshold for probation. On the other hand, if your crime is deemed serious or you have any history, 3-4 years might be more realistic. If you ran the world's largest credit card ring --- really, if you did anything with credit cards --- think more along the lines of 10-20 years.
Interestingly, that last point has been a truism in the "computer underground" since I was a teenager. Break into phone switches. Own up Unix boxes. Release viruses. Just don't fuck with credit cards. It remains truish today.
A competent lawyer is not cheap, and does all the legal things you would expect -- but, if you are lucky, does a lot to help with the psychological/emotional trauma you are going through.
Maybe you meant the sum and not the "product"? Or does the legal system have its own version of arithmetic?
This is an important point because I've seen a lot comments on HN along the lines of "prosecutors single out computer crimes for crazy sentences."
As a result you have prosecutors doing what they do best, throwing everything at the wall and seeing what sticks. The problem with throwing everything at the wall is that defendants are more inclined to accept a reasonable plea rather than face the unknown.
For example, is it reasonable to charge someone with a count under CFAA for each instance they try to access a system without permission? You can try to adapt existing case law in unrelated crimes - such as attempted murder, should someone be charged for a new count of attempted murder for each bullet that was shot at a given victim or just a single count notwithstanding the number of shots fired, or how about if there are 2 potential victims the defendant wanted dead but only shot 1 bullet near both of them? Is it reasonable to charge a count under CFAA for running vulnerability software on a website? Is it reasonable to charge someone for breaking and entering if the defendant simply checks to see if doors or windows are unlocked, should we file an additional count for each door/window that was checked or a new count for each time a door knob was turned?
These are all issues that are ripe for the courts to decide, but it will take a very long time before you have a defendant willing to take the risk. What is really troublesome is that in the meantime there are cases such as this where 44 felony counts can be reduced to a single misdemeanor in exchange for a change of plea. The fact that a prosecutor was willing to offer a deal like this means the original charges were improper even in the eyes of the prosecutor.
Expect things to only get worse in terms of prosecutorial discretion vis-a-vis charges under CFAA in the foreseeable future.
There is a huge problem with CFAA sentencing: the sentence accelerator for damages. The iterator count in someone's "for()" loop can make the difference between probation and 3 years in prison.
Incidentally: you probably can be charged with breaking and entering for checking your neighbors window locks.
This is a bit counter-intuitive. In any type of sentencing hearing, if there is any discretion whatsoever, the number or counts/charges is always used an aggravating/mitigating factor. Actually the same goes for negotiating a plea deal, that is why I say 44 felony counts negotiated down to a single misdemeanor is an acknowledgement by the prosecutor something is wrong with the case.
>Incidentally: you probably can be charged with breaking and entering for checking your neighbors window locks.
Yes, but this would generally result in a single count, notwithstanding how many times the defendant "checked" doors/windows. However, in this case the Defendant was charged with an additional count for each time he tried to "unlawfully access" a given system - which was sometimes multiple times in the course of a minute (the proverbial "door/window check"). The point is the CFAA law is undeveloped and as a result the prosecutors are taking a mile with the inch they are given.
http://www.ussc.gov/guidelines-manual/2012/2012-3d11
In any case, this "440 year" nonsense comes from taking the product of the maximum sentence for all counts, which is simply not how sentencing works, or anything like it.
http://www.ussc.gov/sites/default/files/pdf/research/working...
Excerpt: "The Commission created the multiple count rules upon recognizing two important things. First, the Commission acknowledged that an offender who commits five offenses, for example, deserves more punishment than if he commits one, but not necessarily five times the otherwise applicable penalty. Consequently, the guidelines had to provide a mechanism for calculating incremental increases in punishment for multiple offenses. Second, if the guidelines based punishment on the number of offenses of which an offender was convicted, the Commission realized that formal charging decisions could have a tremendous impact on the resulting sentence. Consequently, the Commission had to create guidelines to limit the significance of formal charging decisions to ensure that similar defendants who engage in similar offense behavior will receive similar sentences."
In short, it supports both our positions, that multiple counts are taken into consideration for purposes of sentencing, but that the sentencing is stepped so that enhancement is not a 1 to 1 multiple. That said I did not mean to imply multiple counts enhance sentences, but that where there is discretion, multiple counts would be used as a aggravating factor.
Physical proximity matters. A remote person who seeks out and looks at the photos is probably at least an inconsiderate jerk. A person who trespasses onto your property and peeps into your windows is not merely an inconsiderate jerk, but represents a potential threat to one's physical safety.
Definitely not. Doing so is to much of a slippery slope when extended to drugs/alcohol or anything else that has the effect of lowering inhibitions or increasing the likeliness of committing a crime where one might otherwise not.
That said I agree with your point there is a blurring of the line. Whereas in your example, one would have to actively go to someones private property and peep through a window until they caught what they were looking for, versus the internet where a picture practically comes to you, your only act is clicking (tptacek touched on this...maybe could be termed "lowering the barrier to criminal behavior"). So while the victim impact is the same as you say (I might even argue online is worse because there is greater/continued victimization), the acts are different in nature. Blurring the line further is that culturally the internet pictures are normalized in the sense that they are practically marketed via traditional news, social media and late night comedians as things to see rather than condemned as acts of victimization.
[1] And that's the value of analogies--not just to help us understand things that are novel in terms of the familiar, but to help us think about how things are similar or different, which helps us cut to the heart of why we think about a thing in a particular way.
Pictures do not passively "leak" online. Someone goes to the trouble of posting them. If that person didn't have permission to do so, they are the guilty party, not some random person who happens to see the picture, not even knowing who that picture is of.
This is the same as if the peeping tom snapped photos, and then shared them. You're not automatically a wrongdoer just because you see such a thing.
Pictures leaked before we had the Internet. Hello? We had scandals revolving around leaked photographs of famous people decades prior. Paparazzi also existed long before the Internet.
This is a symptom of a much greater problem in our society: plea bargaining and the legislation built to take advantage of it. Plea bargaining is routinely used to extract guilty pleas from those too intimidated or otherwise unable to adequately defend themselves. It is profoundly unjust at its core. Its proponents tout it as a way to save money and reduce the burden on our courts. Since when has saving money been a fundamental pillar of justice?
If you ask me, we should do away with pleas altogether. All defendants would automatically be tried as if not guilty. Prosecution would likewise be compulsory. We would then have to rewrite most of our laws to reduce the ridiculous number of prosecutions that would result from the above changes. This would empower judges to do what they have been trained to do: discover the factual record and independently assess the case against the defendant.
This is obscene... There seems to be an utter lack of understanding by the prosecutors handling these cases.
Not at all. They know exactly what they are doing.
It isn't about them not understanding the intent of the law. It is about them understanding how to use the blunt tool of that law's language to satisfy their own objectives.
A lot of prosecutors harbor a desire to one day become the District Attorney or Attorney General and they do whatever they can get away with to pad their stats.
That is, there may be a motivation for pleading guilty even when you are not.
[1]: http://blogs.law.harvard.edu/philg/2013/01/15/plea-bargainin...
An interview with Aaron Swartz‘s defense attorney reveals that, though the government was threatening Aaron with between 30 and 50 years in prison if he went to trial and was convicted.
Not only was Swartz not threatened with 30 years, but the prosecutors themselves threatened him with (an itself implausible) single-digit-year sentence. Swartz's own attorney thought it likely that even were he convicted, he wouldn't end up serving a custodial sentence.
It sucks when this case gets brought up, because the only way to get to the truth of it requires people to sound like they're defending Steve Heymann, the prosecutor in the case. There was a great deal wrong with the case. It's just that a 30-year sentence wasn't part of it.
"If convicted on these charges, SWARTZ faces up to 35 years in prison, to be followed by three years of supervised release, restitution, forfeiture and a fine of up to $1 million." (http://www.justice.gov/usao/ma/news/2011/July/SwartzAaronPR....)
Not pleading out would mean that the offer of a lower sentence is off the table, and the prosecutor would push for the threatened maximum sentence.
The sad thing is, this only truly affects the non-career criminals in our society. Career criminals, that these tactics are supposed to be for, will laugh in a prosecutor's face for suggesting such stupidity. It's how you give non-career criminals a new career option so they can laugh later.
I'm pretty sure the three strikes law in California was enough to scare any career criminal into co-operating with prosecutors. At least until recently when changes have been proposed.
http://ivn.us/2012/11/09/changes-in-three-strikes-law-reform...
"California’s controversial three-strikes law mandated that anyone with two convictions on their record could be sentenced to life upon committing their third felony of any type. This includes theft, robbery, or burglary and up until 2011, could be applied legally to shoplifting. Passed in 1994 in response to the kidnapping of Polly Klaas by a repeat offender, California’s three-strikes law was the most unforgiving interpretation of the law in the country. Up until Tuesday, California was the only state to demand life-sentencing upon a third felony, regardless of whether or not that crime was violent."
Most cases of piling on charges for a non-career criminal would be for posturing purposes.
Most cases of threatening third strike on career criminals would be for investigation purposes. Or simply, to get a career criminal off the streets.
I was lucky enough to participate in a plea bargaining strike organized by the public defender and criminal defense attorneys bar in response to the DA refusing to negotiate for low-level (non-dealing) drug offenses. As part of the strike, our defendants also refused to waive their rights to speedy trials. Almost 100 additional cases were scheduled for trial during a 1 week period, with many more queued up in the weeks beyond. Despite utilizing every DA and intern at its disposal, and opening up shuttered courtrooms, the DA was wholly unable to staff the sheer volume of cases. On the 3rd day it became clear that fewer than 25 cases would make it to trial by the deadline, and the DA capitulated.
http://www.newyorker.com/magazine/2014/10/06/law-3
And a huge flood of criminal trials would certainly not make individual criminal trials any more rigorous, or juries any more likely to carefully weigh evidence.
Finally: people on HN royally fucking hate hearing this, but it's true: most criminal defendants are guilty. We hear about newsworthy cases where there's enough of an interesting narrative to write an interesting lede graf. But for every one of those, there are 100 where the details are completely uninteresting: the defendant was found in his living room with bloody knuckles standing next to his unconscious spouse.
A plurality of Cook County inmates are in for domestic violence; the majority are incarcerated for violent crime. So the idea that we'd have a fairer system by ensuring that fewer defendants actually faced charges is... suspect.
The injustices in our criminal law system need to be fixed at their source: the law needs to be changed to ratchet down sentences. This is an uncontroversial point. There is broad agreement that sentences were escalated to untenable levels during the nationwide freak-out over crime from the late 1960s through the mid 1990s. That problem needs to be fixed; no cosmetic change will improve our system until it is.
http://www.nybooks.com/articles/archives/2014/nov/20/why-inn...
a) Submitting garbage text via a Contact Us form up to (and including) 18 times, or
b) Threatening someone with 180 years in jail for those messages and then settling for a $10,000 fine?
Answers via my Contact Us form please!
This is what incentivizes the prosecutors to a large extent. It's a political office (even in the case of US attorneys who are appointees, they're appointed by the administration, and that job is often a stepping stone towards running for a state AG job or some other political office) and the sad fact is that in many parts of the country there are more people who want to throw the book at people they perceive criminals than there are people concerned with proportionality or preserving the rights of defendants. In fact, most people are complete hypocrites about legal process and will cheerfully make completely opposite arguments depending who is int he hot seat and why.
So there's a clear incentive for prosecutors to paint anyone they catch as some Moriarty-like crime lord and of course that makes great news copy - big number, cooperative prosecutor, astonished neighbors saying they never realized they were living next to a crime lord, all heavily edited for maximum emotional impact within the tight constraints of the 'Action News' format (http://en.wikipedia.org/wiki/Action_News - the reason local TV news in the US is so awful is because it's manufactured on a template rather than crafted in response to the facts of the story).
And of course, there's no requirement to report the much less interesting (to most people) outcome of someone having their charges downgraded to a few months in jail and a fine. Because of the first amendment it's difficult for defendants to keep their name out of the media pending the outcome of a trial (whenever courts put anything under seal news organizations tend to file suit to gain access while mouthing platitudes about 'the public's right to know') and there's no way to compel the media to give equally prominent coverage to defendants whoa re acquitted, exonerated, have charges downgraded and so on.
Just look at the percentage of "pleaded guilty" cases, that completely bypass the judicial system. The prosecutors can claim how they convicted another dangerous haxxxor, the general public applauds and the popularity helps them eventually get into Congress, important post or whatever.
This is not really all that different from how patent trolls work - they usually require payments that are slightly lower than the expected cost of defence (which may or may not be successful, and you'll have to pay for it no matter what the outcome is). So most companies do the math and simply pay to make them go away.
Also, it's exactly the issue that killed Aaron Swartz ...
For instance, a few years ago, some dude in Alberta killed a foreign worker: a welder from Thailand. That guy's life was worth six years in jail.
http://www.cbc.ca/news/canada/edmonton/killer-of-thai-welder...
I'm also appalled by that someone who fills a form with garbage and clicks Submit is even called a "hacker", let alone being charged with anything.
> Plus 30 years? That doesn't make any sense. Why not give me life plus a thousand years?
> Keep pushing.
- Dilbert S02E12 "The Virtual Employee"
If the is no consistency nor comprehensibility and predictability to the law, it is no longer law. It is merely capricious authoritarian behavior.
We can only hope!
Had he found a vulnerability in the site, what do you think he would have done? He doesn't seem to be a white hat, but does the county have a vulnerability reporting policy? (my guess is no.)
I equate what he did with a burglar snooping around a house and checking for an open door or window to break in.
I think the laws they used were wrong--but it appears he was up to no good.
The emphasis is on "appears". You can't convict anyone on (your personal) "suspicions".
This isn't true.
I do it quite a bit, so do other people who have no malicious intentions. Some professionals do it quite publicly, and even blog about it.
Check out this guy, not just scanning for, but actually exploiting shellshock to execute commands on servers he doesn't own, internet-wide:
http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
Are we better off with him in prison?
That's true, but he can reserve his outrage for people who didn't appear to be up to no good.