«

»

Aaron Swartz, RIP

I mentioned this in the comments on Alex’s post on the David Gregory thing, but it’s worth a post on its own. Aaron Swartz, who helped invent the RSS at age 14, founded Reddit and played a key role in the COICA/SOPA/PIPA fight, committed suicide this weekend:

He was a Harvard University fellow studying ethics when he was charged in 2011 with stealing nearly 5 million articles from a computer archive at the Massachusetts Institute of Technology.

He faced 13 felony charges, including wire fraud, computer fraud and unlawfully obtaining information from a protected computer. Prosecutors said he intended to distribute the articles on file-sharing websites.

Swartz pleaded not guilty, and his trial in federal court was scheduled to begin next month. If convicted, he could have faced decades in prison and steep fines.

So what were these crimes? The first was that he accessed the PACER online court records system, downloaded about 20% of it and posted it online. The FBI investigated but didn’t charge him. That in itself was ridiculous. Swartz didn’t “hack” anything. He created a program to download public records. Universities and law firms pay a fee to access PACER but that fee is is of dubious legality for access to public records that are, in no way, private. But by bypassing the system, he annoyed some people.

The current prosecution was for accessing JSTOR, which stores academic journals, using a laptop connected to MIT’s network. He was charged with all kind of hacking-related charges, but the reality is a a little different says an expert witness:

I know a criminal hack when I see it, and Aaron’s downloading of journal articles from an unlocked closet is not an offense worth 35 years in jail.

The facts:

MIT operates an extraordinarily open network. Very few campus networks offer you a routable public IP address via unauthenticated DHCP and then lack even basic controls to prevent abuse. Very few captured portals on wired networks allow registration by any visitor, nor can they be easily bypassed by just assigning yourself an IP address. In fact, in my 12 years of professional security work I have never seen a network this open.

In the spirit of the MIT ethos, the Institute runs this open, unmonitored and unrestricted network on purpose. Their head of network security admitted as much in an interview Aaron’s attorneys and I conducted in December. MIT is aware of the controls they could put in place to prevent what they consider abuse, such as downloading too many PDFs from one website or utilizing too much bandwidth, but they choose not to.

At the time of Aaron’s actions, the JSTOR website allowed an unlimited number of downloads by anybody on MIT’s 18.x Class-A network. The JSTOR application lacked even the most basic controls to prevent what they might consider abusive behavior, such as CAPTCHAs triggered on multiple downloads, requiring accounts for bulk downloads, or even the ability to pop a box and warn a repeat downloader.

Aaron did not “hack” the JSTOR website for all reasonable definitions of “hack”. Aaron wrote a handful of basic python scripts that first discovered the URLs of journal articles and then used curl to request them. Aaron did not use parameter tampering, break a CAPTCHA, or do anything more complicated than call a basic command line tool that downloads a file in the same manner as right-clicking and choosing “Save As” from your favorite browser.

Aaron did nothing to cover his tracks or hide his activity, as evidenced by his very verbose .bash_history, his uncleared browser history and lack of any encryption of the laptop he used to download these files. Changing one’s MAC address (which the government inaccurately identified as equivalent to a car’s VIN number) or putting a mailinator email address into a captured portal are not crimes. If they were, you could arrest half of the people who have ever used airport wifi.

The government provided no evidence that these downloads caused a negative effect on JSTOR or MIT, except due to silly overreactions such as turning off all of MIT’s JSTOR access due to downloads from a pretty easily identified user agent.

JSTOR — you remember them? the victims? — declined to pursue charges. The professors whose articles were on JSTOR are now posting the articles online as a protest. Even the journals can’t care since they only bought one-time rights. MIT declined to press charges on trespassing (possibly the only crime committed) but was unclear on other charges. That was just the opening the federal prosecutor needed to go after someone who’d pissed off the wrong people. Greenwald:

Swartz never distributed any of these downloaded articles. He never intended to profit even a single penny from anything he did, and never did profit in any way. He had every right to download the articles as an authorized JSTOR user; at worst, he intended to violate the company’s “terms of service” by making the articles available to the public. Once arrested, he returned all copies of everything he downloaded and vowed not to use them. JSTOR told federal prosecutors that it had no intent to see him prosecuted, though MIT remained ambiguous about its wishes.

But federal prosecutors ignored the wishes of the alleged “victims”. Led by a federal prosecutor in Boston notorious for her overzealous prosecutions, the DOJ threw the book at him, charging Swartz with multiple felonies which carried a total sentence of several decades in prison and $1 million in fines.

Lessig:

From the beginning, the government worked as hard as it could to characterize what Aaron did in the most extreme and absurd way. The “property” Aaron had “stolen,” we were told, was worth “millions of dollars” — with the hint, and then the suggestion, that his aim must have been to profit from his crime. But anyone who says that there is money to be made in a stash of ACADEMIC ARTICLES is either an idiot or a liar. It was clear what this was not, yet our government continued to push as if it had caught the 9/11 terrorists red-handed.

The result of this “theft” was an 18-month prosecution, decades in potential federal prison time and relentless financial pressure. They made sure they drained whatever financial resources he had and forbad him for getting money from elsewhere. These things did not “cause” Aaron’s suicide, per se. He clearly had other issues. But they certainly didn’t help.

Lessig’s penultimate paragraph is also worth savoring:

That person is gone today, driven to the edge by what a decent society would only call bullying. I get wrong. But I also get proportionality. And if you don’t get both, you don’t deserve to have the power of the United States government behind you.

For remember, we live in a world where the architects of the financial crisis regularly dine at the White House — and where even those brought to “justice” never even have to admit any wrongdoing, let alone be labeled “felons.”

And that’s the point. We have given the federal government far too much power to harass, intimidate and bankrupt anyone they’ve decided they don’t like. Swartz’ case was not unusual; it’s standard operating procedure. Silvergate’s excellent book Three Felonies a Day catalogues case after case where this sort of thing has happened. One of the favored tactics is to cut people off from real legal help. Businesses are allowed to escape prosecution if they cut some token targets lose. Forfeitures laws are used to prevent assets from being used to procure competent legal help. Even legal defense funds are attacked.

I’m not a conspiracy-minded person. I don’t think they singled out Swartz because of his activism, per se. But I’m sure it didn’t help. I’m sure that when an overzealous ambitious prosecutor saw a chance to take down someone prominent who was annoying the government … well she had the tools to do it.

Read the links above. Read Patterico. And realize that this could be any of us.

10 comments

No ping yet

  1. mrblume says:

    It’s fine blaming the prosecutors, and certainly they are responsible for their actions. But let’s be honest, we are talking about a society where if today’s morning paper reads “Man faces 50 years for jumping a red light”, people will just wonder “I should have another bowl of cereal”.

    Thumb up 3 Thumb down 3

      
  2. HARLEY says:

    Just as stupid for being arrested for a bit of machined steel and injected molded plastic…

    Thumb up 7 Thumb down 0

      
  3. tomchamberlain says:

    This isn’t my point but for the record he…

    - didn’t help invent RSS (he authored an alternative RSS standard that wasn’t adopted)

    - didn’t found Reddit (his company was purchased a year after Reddit was founded and was bought out because the Reddit founders couldn’t deal with his personality)

    - his “key role” in SOPA is debatable (I can’t find a single news story he was mentioned in before he committed suicide)

    That said I have two points here…

    1. Regardless of how serious the crime is Swartz knew the consequences of breaking this law because of his experience with PACER and chose to break it anyway. In fact, he chose to break several others as well (it is still breaking and entering even if the door to the wiring closet is unlocked)

    2. Swartz was an avowed leftist. A couple of his last tweets (@aaronsw) were used to support the idea of minting a platinum coin to circumvent the debt ceiling. Ask yourself what precedent is set by that plan. To my eyes the precedent is “The executive branch should be able to do anything it wants regardless of the intent of the law”

    How is what happened to him any different?

    The Federal Prosecutor (a.k.a. Executive branch’s Proxy) wants to send him to jail regardless of how the person who was actually stolen from feels (a.k.a. against the intent of the law which is to protect the person whose property was stolen). This is important because his leftist beliefs forced similar consequences on others yet he not only supported those ideals but championed them. Then when the government came for him he cries foul.

    I’m not saying it isn’t a tragedy that he lost his life nor am I excusing the idiotic federal prosecutor who would try to put him in jail at a time when we’re letting rapists and murderers out early for lack of space. But what happened to him was the logical consequence of what he chose to do. He obviously thought he could act without consequence and when the consequences were imposed on him he killed himself. That’s tragic but it isn’t heroic.

    Thumb up 1 Thumb down 0

      
  4. Hal_10000 says:

    1. Whether he broke the law or not is highly debatable. If you read the article I quoted extensively, it’s quite likely the worst crime he committed was trespassing. As far as JSTOR was concerned, he just violated their terms of service. I would think that when the person you are accused of stealing from refuses to prosecute you, that might indicate you weren’t stealing. And describing what he did as hacking is absurd. He wrote python scripts.

    2. I don’t care is Swartz was a Zoroastrian Communist. It was still a ridiculous and vengeful prosecution and you can’t stop on that shit hard enough.

    Thumb up 8 Thumb down 1

      
  5. tomchamberlain says:

    Hal – here’s my problem with that: We’re a nation of laws.

    I have no problem fighting the good fight or trying to limit these types of prosecutions. But the way to do it is through your congressman not through breaking the law. This isn’t someone who smoked pot and is unfairly being charged as a dealer. Swartz knew exactly what laws he was breaking, he knew exactly what the penalty was and he broke them anyway.

    On that note I also don’t have a problem with civil disobedience. But the whole point of that is to demonstrate the consequences so people will be appalled by them. If his goal had been civil disobedience he should have gone to court and pled his case. And if worse came to worse suffered through the penalties.

    (Lessig’s argument boils down to “because it was easy and JSTOR shouldn’t have cared it probably wasn’t against the law” which is clearly BS)

    As for his politics let me put it another way. I’m against the death penalty, if a murderer is put to death I’m against that. But I’m not going to make a big deal about it. Because, while I’m against murdering a murderer, that person is dying by the rules he chose to live by. The same is true of someone who supports a powerful government having their life ruined by that powerful government. I’m against it but I wouldn’t bother writing a blog post lamenting it.

    Thumb up 1 Thumb down 2

      
  6. Hal_10000 says:

    Hal – here’s my problem with that: We’re a nation of laws.

    But we aren’t. We’re a nation where the federal government in particular wields enormous prosecutorial power. Where they can financially ruin you with bogus charges or terrify you by piling on felony charge after felony charge (there were originally five charges; when he refused to plead, they added eight more) — even ones they know are bogus as the AG in this case certainly did — in an effort to get you to plead guilty to something so they can pin your hide to the wall. Look at what happened in the Aaron Sandusky case. He was legally selling marijuana in compliance with Colorad law. He wanted to fight it out all the way to the Supreme Court so they could revisit Raich. But the federal prosecutor offered him a five-year prison is he plead guilty and threatened decades in prison if he didn’t. He caved.

    This, like many high-profile prosecution, was never intended to go to a jury who would very likely have found for Swartz. The feds spent 18 months pursuing him, recently piled on more felony charges and were threatening 50 years in prison. They clearly were hoping he’d plead guilty to something so they can get five years.

    To take just one charge: wire fraud. This is a catch-all for many many crimes, usually used to prosecute fraud using a computer or financial crimes. But the victims in this case specifically said they had not been deprived of something of value. There was no fraud: he used his own ID and a network that he was authorized to access.

    This is how our government operates. This is what they do.

    I’ve written before about this here: about how the tools designed to deal with the 90′s crime wave are being abused now that crime rates are low. This is the same thing. Tools have been handed to prosecutors to deal with cyberterrorists and hackers. But you give them those tools and they will use them to rack up convictions and jail sentence to pad their resumes. This case is not unique. Not at all. And it could be anyone next time.

    Thumb up 8 Thumb down 1

      
  7. AlexInCT says:

    2. I don’t care is Swartz was a Zoroastrian Communist. It was still a ridiculous and vengeful prosecution and you can’t stop on that shit hard enough.

    ^^^^^ THIS!

    Thumb up 2 Thumb down 0

      
  8. Hal_10000 says:

    I thought of this today: a good demonstration of why this prosecution was bullshit. Record companies have created scripts and bots to watch YouTube videos of artists they are trying to promote so they can boast a video has been seen umpteen million times. This caused Youtube considerable annoyance and expense to fix their view counters to account for this. And I believe it violates their terms of service. What they’re doing is really not very different from what Swartz did. But where are the prosecutors descending on them?

    Thumb up 0 Thumb down 0

      
  9. dbaggins says:

    I think this whole tragedy just shows how hopeless outdated the legal system at large is with regards to the internet. The legislation that we currently have in place shows a complete lack of understanding about severity, what actually should be considered criminal activity and the appropriate punishments in response to these violations. What Swartz did is really no different than the act of PETA activists trespassing on corporate property to free animals from product testing. However, the punishment receivable differs DRASTICALLY between the former and latter simply because of the system of draconian laws that we still have in place when it comes to the internet. Animal rights activists aren’t subject to 30 year sentences for “liberating” cows from a farm so why is a internet activist subject to that egregious penalty when he’s basically liberating information, information that the broad community as a whole (including those he purportedly wronged) already agrees should be freely available? These weren’t confidential government articles that were going to put people at risk, but rather a series of scholarly publications that people have agreed should be largely free.

    Thumb up 0 Thumb down 0

      
  10. AlexInCT says:

    I think this whole tragedy just shows how hopeless outdated the legal system at large is with regards to the internet. The legislation that we currently have in place shows a complete lack of understanding about severity, what actually should be considered criminal activity and the appropriate punishments in response to these violations.

    I think the problem goes far beyond the laws themselves to the very people interpreting said laws and meting out the consequences of breaking them. Way too many of these lawyers and judges are clueless about modern technology and how things work, and yet, they are the ones making the decisions. New laws are not going to change things much when the people overseeing the system are unable to grasp most of it. In fact, I foresee new laws making it all far, far worse, because they will be written to serve the special interts of certain groups, and more importantly a government that wants to abrogate itself even more power to control everyone and everything, instead of the people.

    Thumb up 0 Thumb down 0

      

Comments have been disabled.