{"id":542,"date":"2013-01-30T16:04:25","date_gmt":"2013-01-30T20:04:25","guid":{"rendered":"http:\/\/blog.payne.org\/?p=542"},"modified":"2013-01-30T16:04:25","modified_gmt":"2013-01-30T20:04:25","slug":"letter-to-carmen-ortiz-about-aaron-swartz","status":"publish","type":"post","link":"https:\/\/payne.org\/blog\/letter-to-carmen-ortiz-about-aaron-swartz\/","title":{"rendered":"Letter to Carmen Ortiz about Aaron Swartz"},"content":{"rendered":"

Stepping off my usual entrepreneurship topics, here’s a letter I sent to Carmen Ortiz, Stephen Heymann, and Scott Garland (the prosecutors in the Aaron Swartz<\/a> case) earlier this week.<\/p>\n

I’m expecting precisely zero effect on anything here, but it captures my analysis of what happened. \u00a0Apart from the sadness and tragedy, I think we all need to be very mindful of the growing gaps between technology and our laws.<\/p>\n

 <\/p>\n

January 28, 2013<\/strong><\/p>\n

The Honorable Carmen M. Ortiz<\/a>
\nUnited States Attorney for Massachusetts
\nJohn Joseph Moakley
\nUnited State Federal Courthouse
\n1 Courthouse Way, Suite 9200
\nBoston, MA \u00a002210<\/p>\n

Dear Mrs. Ortiz:<\/p>\n

I\u2019m writing you (and Mr. Heymann), as many have, regarding Aaron Swartz. \u00a0I know emotions are high, and I\u2019m sorry the criticism has been so unfair and uninformed. \u00a0I\u2019m sharing constructive comments I hope will be helpful as you consider this matter. \u00a0I\u2019ve reviewed the public court documents and several relevant legal opinions. \u00a0I am a pioneer of the Internet economy, and a technology and business method expert in the subjects of this case.<\/p>\n

It is clear Swartz did something wrong and should have been punished. \u00a0However, I have come to agree the prosecutorial stance did not match the severity of Swartz\u2019s deeds.<\/p>\n

I believe that you and Mr. Heymann were doing \u201cwhat any good prosecutor would do\u201d, and as you\u2019ve noted, prosecutors don\u2019t make the laws and penalties. \u00a0However, the CFAA is unusually broad and ambiguous, by design, to address a major policy issue. \u00a0Technology is advancing much faster than our laws, and the Justice Department has argued for legal flexibility with this Act (e.g. Richard Downing’s House Judiciary Subcommittee testimony in Nov, 2011). \u00a0That flexibility requires discretion in application, perhaps more than any other statute you prosecute.<\/p>\n

This case is a nearly perfect test of that discretion, because it\u2019s missing most of the typical criminal elements. \u00a0Swartz was not pursuing financial gain. \u00a0He wasn\u2019t trafficking in credit cards, passwords, national secrets, or confidential\/proprietary information. \u00a0He didn\u2019t destroy data or access personal records. \u00a0He didn\u2019t access something he wasn’t supposed to; he accessed more than he should have.<\/p>\n

Swartz, like any MIT guest, was allowed to download JSTOR articles. \u00a0He enjoyed no greater access than any normal user would, but he violated JSTOR\u2019s Terms of Service (ToS) by automating his download process. \u00a0His violation of MIT\u2019s guest ToS is less clear: \u00a0MIT is famously and widely known for an open campus and network, and there\u2019s a reasonable argument MIT\u2019s effective<\/em> ToS is much more permissive. \u00a0(Also, MAC address manipulation is not analogous to VIN tampering; if it were, it would criminalize the \u201cChange MAC Address\u201d feature available in nearly every consumer router.)<\/p>\n

Regarding damages, JSTOR\u2019s articles are freely available at 7,000 institutions worldwide, and many documents are public domain. \u00a0 MIT\u2019s $50,000 annual subscription amounts to $136\/day, a starting point for calculating damages. \u00a0However, subscription fees have limited use in determining damages, because they mix the access costs with document value. \u00a0For example, PACER\u2019s public documents \u201ccost\u201d $0.10\/page, but their value is zero. \u00a0JSTOR\u2019s quick civil settlement, their public stance in this case, and their subsequent public release of millions of articles are all extremely telling.<\/p>\n

Swartz did not destroy or damage data or infrastructure. \u00a0There\u2019s no (public) evidence his actions caused more than minor service outages and investigation costs at MIT and JSTOR. \u00a0Swartz’s actions were “minimally criminal”, and justice should have been sought on those terms. \u00a0(In addition, if your case had prevailed on the basis of ToS violations, there\u2019s a solid appeal to void this interpretation for vagueness. \u00a0It\u2019s nearly impossible to pass the \u201caverage citizen\u201d test for defining criminal behavior with CFAA+ToS.)<\/p>\n

At this point, you will likely say Swartz would have had every opportunity to make these arguments. \u00a0That’s true of course, but I\u2019d respectfully say it\u2019s disingenuous. \u00a0From the moment you indict and issue a press release, you frame the case. \u00a0The use of Secret Service resources, the home search warrant, the discovery refusal to provide raw hard drive images, the superseding indictment, and the reported plea negotiations & constraints; these all signal that Swartz\u2019s acts were extremely serious, worthy of government resources. \u00a0Furthermore, Mr. Heymann is a seasoned prosecutor and computer crime expert; \u00a0the judges, jury, MIT, and JSTOR take cues from his stance.<\/p>\n

Again, the unique ambiguity in the CFAA demands a prosecutorial duty of discretion above and beyond normal. \u00a0Our goal is to seek justice, and to that end, I share several suggestions. \u00a0First, I strongly recommend you proactively and immediately release all non-exempt case documents, and consider selectively waiving FOIA exemptions for other material. \u00a0The content may be unflattering, but transparency would be a very powerful leadership act on your part. \u00a0The people have a right to know how their attorneys conduct business, and the full record will help us enact the best policies.<\/p>\n

Second, I would encourage you to support sensible CFAA revisions. \u00a0For critics, this case is a poster example of why the statute needs to be less vague. \u00a0Congress looks to Justice for advice, and you now have the best perspective of any prosecutor on finding a balance between (a) a flexible law, (b) a clear definition of criminal behavior, and (c) the prosecutor\u2019s duty of discretion.<\/p>\n

Third, I suggest you consider future CFAA cases more carefully, especially cases missing the obvious criminal elements. \u00a0The computer fraud case volume is relatively thin, making each case a bounds test almost by definition.<\/p>\n

I pray you find these thoughts helpful in this sad and tragic story, and I hope they constructively capture the broader criticism about proportionality.<\/p>\n

Finally, if an informal discussion regarding this matter (or fraud policy in general) would ever be useful, I would welcome that opportunity.<\/p>\n

My email is <andy [at] payne [D O T] org<\/a>>.<\/p>\n

Sincerely,<\/p>\n

Andrew C. Payne<\/p>\n

Cc: \u00a0 \u00a0 \u00a0 Stephen P. Heymann<\/a>, Assistant U.S. Attorney
\nScott L. Garland, Assistant U.S. Attorney<\/p>\n","protected":false},"excerpt":{"rendered":"

Stepping off my usual entrepreneurship topics, here’s a letter I sent to Carmen Ortiz, Stephen Heymann, and Scott Garland (the prosecutors in the Aaron Swartz case) earlier this week. I’m expecting precisely zero effect on anything here, but it captures … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-542","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/posts\/542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/comments?post=542"}],"version-history":[{"count":0,"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/posts\/542\/revisions"}],"wp:attachment":[{"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/media?parent=542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/categories?post=542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/payne.org\/blog\/wp-json\/wp\/v2\/tags?post=542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}