Rep. Zoe Lofgren Introduces Aaron's Law [pdf] • Hacker News Board

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#51

Post by tptacek » Wed, Jan 16, 2013, 3:06 AM UTC

coopdog wrote: post #48

tptacek wrote: post #33

Earlier quoted context omitted.

Do I want a better sentencing system for computer fraud, so that it remains possible for companies to defend themselves without needing to spend hundreds of thousands of dollars every quarter finding every conceivable loophole an attacker might exploit, while not leading to a situation where simply using a computer turns a simple offense into a 6 year prison sentence? Yes, that is what I want, and I don't think it's…

Potentially. I think what got him is the argument that because he was authorised only in accordance with the terms of use, once he violated the terms of service he was now an unauthorised cracker (despite not actually cracking any system/software), and was going to go down under the CFAA. I think the intent of the law is to remove the terms of use from determining whether or not the use is authorised. So since guests…

The problem I'm bringing up is that Kerr and Granick have both pointed out that TOS violations weren't the only problem, or even the most severe problem, facing Swartz's defense. His attempts to evade filtering had the added misfortune of setting him up to "appear guilty" at trial.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#52

Post by spinlocked » Wed, Jan 16, 2013, 3:11 AM UTC

tptacek wrote: post #47

spinlocked wrote: post #44

Earlier quoted context omitted.

Its too late for that. Look to the future instead. Will having Arron's Law in place, coupled with civil outcry and petitions we've seen , prevent the next Aaron from being over-zealously prosecuted? I think the answer is: not entirely, but its a huge, practical step in that direction. This is one of those things that you celebrate, not dismiss cynically. Think of an alternate reaction. Why not create a petition on th…

I'm not being cynical. The fact that Aaron's Law wouldn't have helped Aaron isn't a cynical point. I don't oppose the act at all. TOS violations shouldn't be felonies. This is one of those ridiculous message board arguments where both parties agree, and the argument is actually not about the issues about about the metaissue of how people are posturing. Do you believe federal criminal sentencing is sensible or just? H…

If you could kindly edit your top comment by requesting readers to contact their representatives to help get this passed, THEN i will move on. Till then I have a pretty low opinion of you.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#53

Post by btilly » Wed, Jan 16, 2013, 3:13 AM UTC

marshray wrote: post #49

jacquesm wrote: post #40

Earlier quoted context omitted.

I read the Granick piece. One thing that strikes me as completely absurd is that the plea deal is for a substantially lower sentence and that if the plea deal is rejected the prosecution will go for a much higher punishment, sometimes as much as 10 times as much as offered in the deal. It would seem to me that if you offer a guilty plea that is 10% of what you intend to seek that if such an offer is on the record tha…

> is rejected the prosecution will go for a much higher punishment, sometimes as much as 10 times as much as offered in the deal In this case it sounds like the prosecutor was going for 70x the plea offer before the plea was even rejected. Simply outrageous.

Not exactly. The statutory limit was that much. The prosecutor claimed to be planning to press for about 12-14x the plea offer.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#54

Post by marshray » Wed, Jan 16, 2013, 3:13 AM UTC

tptacek wrote: post #7

Would Aaron's Law have helped Aaron? Both Orin Kerr and Jennifer Granick have said that his actions in evading filtering and shutoffs on MIT's networks would have created a plausible argument for the prosecution that he had been evading specific code-based authorization mechanisms and would have known his access was unauthorized. If you read Reason, you're immediately suspicious of laws with people's names on them; t…

Re: his actions in evading filtering and shutoffs on MIT's networks

Have you seen any halfway credible summary on what he did? I'll probably read the formal indictment eventually, but I'm not expecting a real balanced presentation. To be clear: just asking if anyone has a good hyperlink.

For example, I'd like to know what did he do on the Wifi other than change his MAC address?

It's said he "broke into" the wiring closet. Did he use an axe? Pick the lock? Was it unlocked? Once in, did he simply plug in to the Ethernet like any good network citizen would do (to avoid hogging the Wifi).

Once on the network, did he root boxes or simply request documents that the server was happy to give him?

EDIT: OK I found this http://unhandled.com/2013/01/12/the-truth-about-aaron-swartz... written by Alex Stamos, expert witness for Aaron's defense. Alex is well-respected. I know thing or two about network security and this piece certainly sounds like how I would view it.

The wiring closet he "broke into" wasn't even locked and "was also used to store personal effects by a homeless man"? This prosecution is a complete and total outrage.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#55

Post by AnthonyMouse » Wed, Jan 16, 2013, 3:15 AM UTC

spinlocked wrote: post #23

tptacek wrote: post #7

Would Aaron's Law have helped Aaron? Both Orin Kerr and Jennifer Granick have said that his actions in evading filtering and shutoffs on MIT's networks would have created a plausible argument for the prosecution that he had been evading specific code-based authorization mechanisms and would have known his access was unauthorized. If you read Reason, you're immediately suspicious of laws with people's names on them; t…

Lofgren's proposal appears to address the EFFs main concerns: https://www.eff.org/deeplinks/2013/01/aaron-swartz-fix-draco... Legislating against what you term "prosecutorial misconduct" is far fetched. Can you imagine how you would word that legislation without hampering law enforcement efforts against the real bad guys? Do you really want that? Having the law named after Aaron would be more than symbolic, it would…

>Lofgren's proposal appears to address the EFFs main concerns

Does it? I don't see anything reducing the excessive penalties, just somewhat narrowing what qualifies for them.

Let me be clear, I think this bill is a good bill -- I don't see anything wrong with it except that it is incomplete. It solves only a small subset of the problems we need to solve here. Narrowing the definition of unauthorized access can only be a good thing, but I could reasonably argue that it is still too broad given the current penalties, and remains incredibly vague notwithstanding that this would explicitly exclude certain things. So either the penalties still need to come down significantly, or what qualifies needs to be further narrowed, or both. But it's a good first draft. A step in the right direction.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#56

Post by anigbrowl » Wed, Jan 16, 2013, 3:18 AM UTC

gyardley wrote: post #50

anigbrowl wrote: post #31

Earlier quoted context omitted.

Well, it's a problem with sentencing in general. If you have $2m and I steal $1m from your safe, it's judged a much worse crime than if you have $200 and I steal all of it, even though the outcome for you is a lot worse in the second case. Ideally the imposition would be quantified in terms of the marginal cost to the injured party, but then there's another economic theory that says we have to multiply that by the pr…

Sure, the legislation won't go anywhere if you go out of your way to make it seem like a one-party issue. Some of us have been reaching out to our GOP representatives, especially those who've expressed prior concerns about prosecutorial abuse of power. I see Darrell Issa - on the Oversight Committee, and hardly a liberal - has already agreed to look into the appropriateness of Aaron's prosecutors' behavior. It's real…

This legislative proposal is too narrowly tailored to address prosecutorial overreach in general, and I'm not sure it would have even made much difference in this case.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#57

Post by jacalata » Wed, Jan 16, 2013, 3:19 AM UTC

tedunangst wrote: post #12

bhousel wrote: post #3

The important stuff: SEC. 2. ELIMINATION OF CERTAIN VIOLATIONS OF AGREEMENTS OR CONTRACTUAL OBLIGATIONS, RELATING TO INTERNET SERVICE, FROM THE PURVIEW OF CERTAIN CRIMINAL PROHIBITIONS. (a) FRAUD AND RELATED ACTIVITY IN CONNECTION WITH COMPUTERS. - Section 1030(e)(6) of title 18, United States Code, is amended by striking ‘‘alter;’’ and inserting the following: ‘‘alter, but does not include access in violation of an…

And the important question: was jstor's tos the only mechanism used to deny Aaron access?

As I understand it, this was the only 'ongoing' access control. However MIT individually blocked his MAC address, so he then changed it to get back on the network. But I'm not sure where the need to plug his laptop into a cupboard came in, so I must be missing something.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#58

Post by btilly » Wed, Jan 16, 2013, 3:19 AM UTC

tptacek wrote: post #7

Would Aaron's Law have helped Aaron? Both Orin Kerr and Jennifer Granick have said that his actions in evading filtering and shutoffs on MIT's networks would have created a plausible argument for the prosecution that he had been evading specific code-based authorization mechanisms and would have known his access was unauthorized. If you read Reason, you're immediately suspicious of laws with people's names on them; t…

I am not a lawyer. Or even close.

However the fact that he had to commit physical trespass in order to place his laptop giving him access to the network tells me that he was not merely in violation of the terms of use, and therefore he actually was unauthorized under the terms of the amended act. Thus it would not have helped Aaron.

But it would help others. It is a step in the right direction. I support it.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#59

Post by strlen » Wed, Jan 16, 2013, 3:20 AM UTC

rayiner wrote: post #10

tptacek wrote: post #7

Would Aaron's Law have helped Aaron? Both Orin Kerr and Jennifer Granick have said that his actions in evading filtering and shutoffs on MIT's networks would have created a plausible argument for the prosecution that he had been evading specific code-based authorization mechanisms and would have known his access was unauthorized. If you read Reason, you're immediately suspicious of laws with people's names on them; t…

The depressing lulziness if a sentence that scales with the number of documents downloaded is matched only by that of sentences that scale with the weight of the drugs carried.

I think you meant "if a sentence that...", right?

This goes even further: if one was to carry drugs in a ziplock bag (or whatever else they're carried in, I am probably one of the few people on HN who doesn't know), when calculating the charges, it's not uncommon for the weight of a ziplock bag to be added to the weight of whatever is in it. God help someone who decides to stash the drugs away inside their spare wheel in their car.

Angry nerds is a force we can use for good -- reforming CFAA os probably useful on its own merits (I fully support this legislation), but majority of people being judicially bullied into unreasonable plea bargains (or worse, manifestation of physical or mental illness such as suicide and heart attacks) are not being charged under CFAA.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#60

Post by anigbrowl » Wed, Jan 16, 2013, 3:21 AM UTC

nullc wrote: post #43

jacquesm wrote: post #40

Earlier quoted context omitted.

I read the Granick piece. One thing that strikes me as completely absurd is that the plea deal is for a substantially lower sentence and that if the plea deal is rejected the prosecution will go for a much higher punishment, sometimes as much as 10 times as much as offered in the deal. It would seem to me that if you offer a guilty plea that is 10% of what you intend to seek that if such an offer is on the record tha…

Sadly, coercive plea deals are the norm in the US, especially in Federal cases. It's the same most places, but it doesn't have to be that way: http://digitalcommons.law.yale.edu/cgi/viewcontent.cgi?artic...