People Staring at Computers

So, this is the first time I read about your case. I couldn't help but think of Aaron Swartz.

https://en.wikipedia.org/wiki/United_States_v._Swartz

Basically, he downloaded open access journals from an academic repository. But he did it by physically connecting a laptop to the MIT university network and hiding the device in a servicing space without authorization.

Downloading open access papers isn't an issue in and of itself. In fact, it's pointed out that Swartz wasn't prosecuted for theft or copyright violations. The charges mainly were founded on alleged fraud and breaking and entering.

https://crln.acrl.org/index.php/crlnews/article/view/8637/90...

The law applies in Aaron's case was the CFAA. The same law under which you faced scrutiny.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://www.law.cornell.edu/uscode/text/18/1030

Just like you, Aaron Swartz got into the sights of the Secret Service at the time. The difference between you and him is that Swartz was actually arrested, arraigned and finally indicted by a federal grand jury.

(The CFAA stipulates that the Secret Service has the authority to investigate you under 18 U.S.C. § 1030(d)(1) see: https://www.law.cornell.edu/uscode/text/18/1030)

> the case is clear

On the contrary.

The big criticism on the CFAA is that its application has spilled over into tort law and contract law. It's a law which defines computer and wire fraud in incredibly broad terms and phrases. This leads to criminal convictions within a civil law context. The CFAA creates a up a massive potential for being made liable for daily, unassuming actions - e.g. sharing a password - transforming a misdemeanor into a felony really fast depending on the context / circumstances.

As a result, the CFAA is an example of a law where the bar / standards for prosecution are determined / tested / evaluated on a per-case basis through the judicial process.

It's also why it's so hard to get clear cut answers from the EFF or your lawyers. Sure, there's precedent, but it remains unclear how things would have panned out in your specific case since it never went to court.

In Aaron's case, it was later pointed out that MIT didn't even actively seek federal prosecution:

https://www.wsj.com/articles/SB10001424127887324809004578637...

> why I needed consent

That's the thing. Strictly speaking: it's a choice, not an obligation. Laws and moral values or principles aren't preemptive. They don't stop you from doing something anyway. Their purpose is to create a formal framework of consequences that tie into your behavior.

Liability then is the probability you're going to be held accountable in a court of law.

(In the same vain: copyright doesn't stop you from actually copying protected works. It only has carries weight if it actually gets enforced. That is, the rights holders decides to seek damages, and/or the state seeks to prosecute you. And even then, you really only face hard consequences - fines, damages, jail time - if a court rules in the plaintiff's favor.)

The CFAA specifically explicitly mentions the condition "without authorization" a grand total of 10 times when it defines violations under 18 U.S.C. § 1030(a).

All in all, when you entered the store, went to a machine and installed that program, paying attention that you didn't have to agree to any terms of service, you very much entered that grey, murky, muddled area of broad interpretation of the CFAA, contract and tort law.

Not having that explicit consent or authorization creates a liability: if you were spotted or caught, you'd potentially face consequences per the legal framework and its interpretation in a court of law.

... and that's exactly what happened to you.

Probably someone at the Apple store caught onto what you were doing, made an internal report which found its way to Apple's legal team. Corporate legal compliance provides a playbook and one of those steps involves notifying law enforcement and, ultimately, the Secret Service.

Unlike Aaron Swartz, you were lucky in that the authorities felt that there wasn't enough grounds to make a case against you and press formal charges before federal court. From their perspective, that's a cost / benefit trade off: it's just not worth spending time and resources pursuing legal action if the outcome is already tenuous from the outset.

> a lot of people here in the comments seem to believe

There's a difference between legal truth and moral truth.

From the point of view of the legal framework, all you did was expose yourself to several legal liabilities. The legal framework itself doesn't hold any opinions whether that's smart or dumb. You were lucky that there were no serious consequences beyond a visit by the Secret Service.

The public, however, look at your actions through a moral lens. They see someone who willingly exposed themselves to such liability, and members of the public can/will hold and voice personal opinions about what happened.

While you never went to court, there's a consensus that your behavior did cross a moral line. Put more succinctly: "Who in their right mind would do a guerilla style installation of a desktop application on Macbooks in the Apple store and assume there's no potential for serious legal consequences?"

That's value attribution akin to "Why would you decide to run a red light in downtown Manhattan, in front of dozens of witnesses, law enforcement camera's,... and run the risk of getting caught?"

People on here feel like you made a bad judgement call regardless of who you are, or the project in and off itself. And that's even perfectly compatible with how they feel about the CFAA, Apple, the U.S. Secret Service and so on.

I think you do not understand. The artist wanted the show what is already happening, just something we are simply not protesting about in masses. Like the level of such hidden information grabbing is massive, but what do we citizens care? The photo had an effect, which bits and bytes are not having.

Yes the artist did something totally illegal and should be prosecuted. Who is going to prosecute the governments? I like your strong emotions and fail to understand why you do not see this is exactly what the artist hopes will happen - more emotional take on the current situation.

Thanks for spending time thinking through some of this :)

I think it "felt like 30" because I was nervous. Not because I thought it was illegal or unethical, but because I was breaking social norms. I see this as different from acting "unethically", and closer to what Erving Goffman would call a "breaching experiment".

I definitely did not want to raise any flags in the store itself, hence the staggered exit and furtive behavior. Again, not because I thought it was illegal or unethical, but because there was a certain way I wanted to see everything play out. If I got kicked out before I had a chance to exhibit the work, it would have made for a distractingly complicated story. I think this point is difficult for some folks who can only see this as a prank or security research, and don't understand how artists think and work and craft stories.

Regarding the question of what constitutes "public space" and legality of of using peoples likenesses for profit, there are some other great responses in this thread which explain the details (like the one here by sellyme). It's interesting for me to hear how most folks on HN assume that photography in the US operates more like the EU.

Wow, incredible response! I appreciate you taking the time to respond :)

I am very familiar with Aaron's case. I think your analysis is correct: some people believe I made a bad judgement call, and the CFAA is broad enough that this created a liability, even though we cannot know whether it was legal. I think my frustration with most armchair-analysis (not including you, CaptArmchair) is that folks confuse their moral certainty (I "made a bad judgement call") with legal certainty ("this is the kind of thing the CFAA protects us from"). But the law is a lot more complicated.

For me the concern is exactly (d)(1). When the CFAA is overly broad, and the ability to investigate is granted to all "offenses", where does that leave us? Can Apple cry "CFAA!" at anything they don't like? In practice, there are some checks and balances: in this case, Judge Lois Bloom decided to sign the warrant; Judge Judith Philips refused to prosecute. Is this enough? To me, seeing the ways the CFAA has been abused in other cases, it's not so clear.

I want to respond to you here because I think you've captured my point quite well in two ways, though maybe unintentionally. I really hope this gives you some personal insight somehow.

(Part I)

> I understood (and still believe) what I did was legal.

As you mentioned before, this work produced anger and fear, but you believe it was legal. I take that to mean that people in general understand what you did was wrong (morally) but the snapshot of the legal code at the time hadn't caught up with this intuition yet (as far as you know).

From a practical standpoint, I get why this is important to you. I don't have much to add on the legal side because I'm not a lawyer and I think it's focusing on a detail that glosses over the big picture of your actions. I feel like you're fixating on it for that exact purpose, though.

"I thought of violating rights in a way legislators hadn't even dreamed up yet! Violated tons of people's rights along the way, but the important thing is that I found a spot where those legislators forgot to dot the i's and cross the t's. That's what we should focus on". I wholeheartedly disagree. I think the focus is, and should remain, the people involved.

Whether you found a loophole or not is, in my mind, such a distant inconsequential second to the primary focus of your actions and their effects. You doing them in a possibly legally creative way is focusing on the wrong thing.

(Part II) > It is also undeniably art.

I assume this is based on me using "art" in quotes in another response, and you misunderstanding why I used the quotes.

So, imagine someone was punching people and the reason they gave was "boredom". I would use quotes there too, not because I doubt whether or not they were experiencing boredom, but because the word is being used as though it were a sufficient explanation of their actions. While it might be part of the explanation, it glosses over the most salient part of their action: the punching people bit. They also had a desire to punch people, and that desire is not encapsulated in the standard definition of "boredom", but they're using it as though it were in a way to gloss over it, even though it's the most important part of the whole thing. I think it's a sneaky trick to deny personal culpability so I'm putting the word in quotes.

Similarly, your use of "art" feels the same. Whether the end result had any artistic merit is beyond the scope of my comments. I'm saying that "art" as a motivation glosses over the most salient part of your actions: your desire to take something private irrespective of others desires to give that. The standard definition of 'art' doesn't adequately encapsulate that desire: I wouldn't say the most salient aspect of artists is that they behave in this manner. I think it's similarly a sneaky way to try and deny personal culpability by masking the most salient feature behind a more accepted term. But, to be crystal clear, what you did was take moments of people's lives they might not have wanted you to have and turned it into a spectacle for yourself... whether this resulted in art or salad is such a wildly distant second consideration it's practically immaterial (as far as me and others with similar reactions are concerned), let alone whether or not the resulting art or salad is legitimate... it's why your words echo the character in the movie saying "I was gentle".

For what it's worth though, I think it's nice to see you do sort of care on some level how your actions impact others, gives me a little bit of hope.