Aaron Swartz committed suicide last week. He was 26, a genius and my friend. Not a really good friend, but someone I had worked with off and on for 11 years, liked a lot, had laughed with frequently, occasionally shaken my head over and deeply admired. When I first met him he looked like this.
He had co-written a basic RSS spec the year before, when he was 14. He was to go on to play a fundamental role in Creative Commons. When you now search for stuff online, using its legal status as a search prerequisite, not just a text query (physics textbook, available to use or share, even commercially), you are doing something that Aaron's volunteer work helped to enable. People talk of him now as some kind of Data Liberation activist, which he certainly was, but principally he was and is one of the great architects of the commons, a builder, as Dave Weinberger stresses, not just a hacker -- though hacker, of course, is actually a name that programmers wear with pride. The guy who invented the World Wide Web had this to say about him: "Aaron dead. World wanderers, we have lost a wise elder. Hackers for right, we are one down. Parents all, we have lost a child. Let us weep."
Read that sentence again. "The guy who invented the World Wide Web had this to say about him." I want to stress that Aaron attracted praise like this not for being cute (though he was) or funny (though he was hilarious) or idealistic (he was certainly that.) He attracted praise like this because he built things (for free) that make us all more free, and built them so well that the guy who invented the World Wide Web (and legions of others) called him a genius. This is not Paris Hilton, in other words, famous for being famous. Nor is it some loony who is famous for being outrageously transgressive. (Though Aaron was certainly willing to be transgressive.) This is someone who is renowned for acts of altruistic and brilliant creation. More in his short life, than most of us will manage in our longer ones. He helped build the commons that enables you to read this. I say these points not only in sad farewell to Aaron, but because I think they are relevant to the discussion that follows.
Aaron committed suicide partly, his family said in a statement, because of a prosecution that many -- most notably Larry Lessig -- have described as overzealous, unbalanced and unfair, and actions by MIT which the family described as insensitive and disproportionate. (MIT has promised to review its actions to see if they were in error.) Enter Orin Kerr. Orin is also someone I know and like. And he is a very, very good legal scholar -- perhaps the foremost legal scholar in the country studying the strange things that happen when the criminal law strays into cyberspace. You can sample some of his excellent work here. Orin is also a former prosecutor himself. The principal characteristic of his work is that it is really thoughtful and balanced. I disagree with Orin about some things, but I almost always learn from his work. In addition, though Orin's views tend to be slightly -- actually not much -- more pro-prosecution than my own, he has been a vigorous and thoughtful critic of governmental overreach in computer crime and has proposed a variety of reforms that I think would make the law fairer and more just.
I say all these things for a reason. First, my views will inevitably be affected by the fact I knew and liked Aaron and that I still occasionally find myself in tears at the waste, the loss. Discount accordingly. Second, Orin has forgotten more about computer crime than I have ever known. If there are disagreements about the law, you should bear that in mind.
For all these reasons, when Orin wrote two posts about the prosecution of Aaron Swartz on the Volokh Conspiracy, I turned to them with interest. The posts are long, detailed and it is impossible to do them justice here. But if I were to sum up their arguments, they would go something like this. (These are my words, not his. Please read the originals to judge the accuracy of my characterization.)
People are really upset about Aaron Swartz's death. Because he was famous and had a lot of powerful friends, his prosecution is getting a lot of attention. But actually, when you look at his prosecution you find that it was a.) a reasonable application of the law to the facts and b.) not an abuse of prosecutorial authority as it is normally used. Yes, Aaron may have been over-charged, (charged with more crimes and higher penalties than the prosecutors actually thought he deserved.) But prosecutors routinely over-charge as the opening step in a plea bargaining negotiation. To the extent that Aaron couldn't live even with the possibility of the penalties that he might have received at the end of the day, then maybe he should not have been committing acts of civil disobedience in the first place. And -- most importantly -- if we think he was treated poorly, we should realize we are condemning the system as a whole, not just the treatment of Aaron, and we should beware of special pleading for this famous person and friend of the famous; our concern should go equally to the unknown, poor and poorly represented person.
I agree -- intensely -- with the last clause of that summary. Indeed, one of the puzzling things about Orin's postings is that he expresses both explicit and implicit criticism of the people who are protesting Aaron's treatment for being overly personalistic, focused on his particular qualities, his famous friends, etc. -- there are repeated mentions of his friendship with Larry Lessig, for example. The implication, it seems clear, is that we should not focus on this one case, but on broader problems in our legal system. This seems to be a straw man. I see no one saying "let's only be angry about Aaron Swartz." Indeed, almost all of the commentaries on Aaron's death have sought to find in it hints about what we should do better in the future; do better in data and intellectual property policies, do better in the way universities handle matters like this, do better in the way we understand "computer crimes," apply the Computer Fraud and Abuse Act, and think about prosecutorial discretion. It is true, of course, that Aaron's friends, and there are a lot of them, have also written about Aaron. But one can hardly accuse them of agitating only for their friend.
Take Larry Lessig for example. One can agree or disagree with him. But one could hardly accuse of him of failing to try to change the world in general, not just for his friends. There may be someone other than Larry who has spent more time trying to influence academic and personal opinion about the cyber-problems and democratic failures that affect complete strangers. Off hand, I can't think who that is. Presumably he is not estopped by that decades-long career of law reform from also being upset when one of his friends dies, from seeing in that death a larger pattern of injustice, or from asking that both in this specific case and in general, we should do things differently. It is also true that some of the commentators are Johnnies-come-lately to a field of computer crime in which Orin has labored for years. That can be irritating. Still, just because it took one person's death to bring them, is no reason not to welcome their arrival, or help build upon their indignation with what they find.
I think Orin's main point ("We should care about larger issues, not just Aaron Swartz") is absolutely right. It is a huge problem that the well-connected and the rich have more resources and thus that the system of justice or of government gives them different results. (Aaron, in fact, had devoted much of his tragically short life to the attempt to solve this very problem. Actually, I'd have to say he had pursued it even more assiduously than Orin, not that that matters now.) Fame is also important. The people on whom the press shine a light tug at our heartstrings and their predicaments are often dealt with in isolation from the large problems around them. That is a bad thing. I don't see anyone taking the opposing view.
I think that much of the rest of Orin's argument is -- very uncharacteristically -- rather one-sided. I think that in his descriptions of the facts, the issues surrounding prosecutorial discretion, and even sometimes of the law he tends to stress evidence against Aaron and to minimize or ignore facts that might put him in a more favorable light. Finally, I think Orin's account lacks sympathy. What I mean by sympathy is something very particular -- something that the humanist discipline of the law neglects at its peril. One kind of sympathy is bad -- and that is the kind Orin is writing against. We shouldn't base prosecutorial decisions on the fact that Aaron knew smart and famous people who can wax eloquent about his virtues, or on the fact that he looked young and appealing. That's the bad kind of sympathy, and Orin rightly warns us against it. But prosecution is a human act, a humanist art. Most of the prosecutors I know are humbled by the awesome responsibility of wielding the power of the state. They are aware that they wield it for people and against people, with all their complexities, their weaknesses, but also their strengths, their nobility, the things they do for good, their connections to others. They have discretion and they want to wield that discretion with sympathy and judgment -- for both victims and alleged perpetrators. And they want to learn from their mistakes -- and there will be mistakes.
I think, in the laudable attempt to avoid the bad kind of sympathy, Orin sometimes loses the good kind. There is not much, almost nothing in fact, in Orin's lengthy posts about the good things Aaron did. His "fame" and "connections" are touted repeatedly, but they are treated as exogenous -- they come from nowhere. We learn that Larry Lessig took Aaron to the Eldred v. Ashcroft oral argument when he was 15. There is no mention of why Larry did that. If we are to talk about prosecutorial discretion we must talk about both the positive and the negative sides of the defendant. Orin lingers on the negative acts and has nothing to say about the positive, except to dismiss them as "fame" or "connections." But where did this little kid from Illinois get that fame? Larry doesn't take just any 15 year old to the Supreme Court (and how many would want to go, even if he did?) Tim Berners-Lee doesn't rhapsodize about just any 26 year old. They did it because Aaron had done stuff, for free, to help people share, communicate, innovate and build. Clearly, no amount of positive social contribution can or should immunize one from criminal punishment. But prosecutors are supposed to look at both sides of the ledger in making judgments -- this is an holistic enterprise. Tim Wu in describing Aaron's prosecution said this. "We can rightly judge a society by how it treats its eccentrics and deviant geniuses--and by that measure, we have utterly failed." Orin might say that is focusing on Aaron's "fame." I think he is missing the point.
Strangely, Orin delves deep into Aaron's life and finds details to add on the negative side of the ledger but not the positive. He takes Aaron's aspirational writings, for example, to indicate that Aaron's idealism might make him particularly prone to civil disobedience, so Orin suggests that we must find a punishment sufficiently harsh to deter such behavior, presumably a stronger punishment precisely because of the idealism than that applied to the average Holmesian bad man. (One shudders to think of what would happen had this theory of prosecution been applied to Martin Luther King or Rosa Parks. What would it have taken to stop them personally from breaking the law?) But you will search his posts in vain for any serious discussion of the positive side of Aaron's life -- whether in his thousands of hours of volunteer work to help build an open web, or in his role in helping to found Demand Progress, a non profit organization that "works to win progressive policy changes for ordinary people through organizing, and grassroots lobbying. In particular, we tend to focus on issues of civil liberties, civil rights, and government reform." Reading Orin's post, one wouldn't know that the people who were upset by his death were upset not just because he was "famous" but precisely because Aaron had been working to make sure there was justice not only for the famous but for everyone. I would respectfully suggest that failing to show both sides of the picture is neither balanced nor a fair representation of how a prosecutor should make a decision on a proposed sentence.
If I went through Orin's post line by line, this article would be as long as a book. But here are some key examples.
The Computer Fraud and Abuse Act: To summarize brutally, one key argument about the interpretation of the Computer Fraud and Abuse Act is whether or not violation of mere terms of service can be enough to trigger the penalties of the Act. Many of us thinks this interpretation goes too far and at least one Appeals Court has agreed. One of the single most articulate protesters against this interpretation has been... Orin Kerr, a point he makes in his postings. You might expect that Orin would see, in at least part of Aaron's prosecution, the habit of prosecutors of overreaching under this interpretation of a law and treating "doing something the website's owners don't like" as a Federal crime. (In other words, you'd expect Orin to be joining the criticisms of those who see overreach -- at least in part.) Instead, Orin focuses on the fact that Aaron could also be charged with violating "code-based" restrictions, circumventing software encoded restrictions on behavior through a hack. It is true that the prosecutors did charge Aaron with circumventing code-based restrictions, though as I read it they also relied on the theory that he was violating the terms of service.
- "MIT operates an extraordinarily open network. Very few campus networks offer you a routable public IP address via unauthenticated DHCP and then lack even basic controls to prevent abuse. Very few captured portals on wired networks allow registration by any visitor, nor can they be easily bypassed by just assigning yourself an IP address. In fact, in my 12 years of professional security work I have never seen a network this open.
- In the spirit of the MIT ethos, the Institute runs this open, unmonitored and unrestricted network on purpose. Their head of network security admitted as much in an interview Aaron's attorneys and I conducted in December. MIT is aware of the controls they could put in place to prevent what they consider abuse, such as downloading too many PDFs from one website or utilizing too much bandwidth, but they choose not to.
- MIT also chooses not to prompt users of their wireless network with terms of use or a definition of abusive practices.
- At the time of Aaron's actions, the JSTOR website allowed an unlimited number of downloads by anybody on MIT's 18.x Class-A network. The JSTOR application lacked even the most basic controls to prevent what they might consider abusive behavior, such as CAPTCHAs triggered on multiple downloads, requiring accounts for bulk downloads, or even the ability to pop a box and warn a repeat downloader.
- Aaron did not "hack" the JSTOR website for all reasonable definitions of "hack". Aaron wrote a handful of basic python scripts that first discovered the URLs of journal articles and then used curl to request them. Aaron did not use parameter tampering, break a CAPTCHA, or do anything more complicated than call a basic command line tool that downloads a file in the same manner as right-clicking and choosing "Save As" from your favorite browser.
- Aaron did nothing to cover his tracks or hide his activity, as evidenced by his very verbose .bash_history, his uncleared browser history and lack of any encryption of the laptop he used to download these files. Changing one's MAC address (which the government inaccurately identified as equivalent to a car's VIN number) or putting a mailinator email address into a captured portal are not crimes. If they were, you could arrest half of the people who have ever used airport wifi.
- The government provided no evidence that these downloads caused a negative effect on JSTOR or MIT, except due to silly overreactions such as turning off all of MIT's JSTOR access due to downloads from a pretty easily identified user agent.
- I cannot speak as to the criminal implications of accessing an unlocked closet on an open campus, one which was also used to store personal effects by a homeless man. I would note that trespassing charges were dropped against Aaron and were not part of the Federal case."
I would however heartily endorse one aspect of Orin's discussion of the law, one that -- curiously -- doesn't lead him to think that the prosecutor needed to act more judiciously.
On the fourth issue, yes, the Swartz case does point to a serious problem with the Computer Fraud and Abuse Act. But that problem is not the definition of "unauthorized access," as some people seem to believe. (That definition is a problem, but with the Nosal case from the Ninth Circuit and likely Supreme Court review in the next year or so, I think the Courts are likely to take care of it.) Rather, the problem raised by the Swartz case is one I've been fighting for years: Felony liability under the statute is triggered much too easily. The law needs to draw a distinction between low-level crimes and more serious crimes, and current law does so poorly.
The Theory of Punishment: Orin says this "On the second question, I think the proper level of punishment in this case would be based primarily on the principle of what lawyers call "special deterrence." In plain English, here's the key question: What punishment was the minimum necessary to deter Swartz from continuing to try to use unlawful means to achieve his reform goals? I don't think I know the answer to that question, but that's the question I would answer to determine the proper level of punishment." He argues that Aaron's announced ideals would lead him to violate the law again and that therefore the prosecutor would be right to ask for a sentence sufficient to stop that hypothetical continued criminal conduct.
Now maybe this is right. But I think it is a lot more revolutionary than Orin gives it credit for and a lot more contentious than his post suggests. I return to the Martin Luther King or Rosa Parks examples. (Or if you prefer, the anti-abortion activist who trespasses on Planned Parenthood in order to spray paint his slogan.) Legislatures had enacted segregation laws. If Dr. King trespasses and violates state rules mandating segregation, and announces that he considers these laws wrong and that he will encourage others to do the same in the future, do we really believe that the prosecutor should ramp up the penalty until it would amount to special deterrence? What would that take? Death? Life imprisonment? Is that then "not disproportionate"? I would have thought that one of the reasons we treat the protester who acts out of conviction (even conviction we disagree with) more leniently, is that we recognize that this is not mere profit seeking, not mere personal interest, and that in the past, such protesters have eventually changed our minds about the rightness of the actions the law prohibits. There are limits to leniency, surely. But there seem few limits on Orin's special deterrence. Again, I think his post is more conclusory than is warranted, and again those conclusions run against Aaron.
I should note that Aaron's manifesto, which Orin quotes, argues in part that public domain articles should be freed from behind the paywalls that protect them. After his action -- though perhaps not because of it, you be the judge -- JSTOR decided, to their great credit, to free their public domain articles. Is that relevant to the sentencing decision? Orin does not mention it.
PACER: As part of the case against Aaron, Orin uses his prior behavior with the PACER system to argue for a propensity for continued criminal behavior -- at least that is how I read the section. "As far as I can tell, this "manifesto" was not just a casual remark or random thought. Rather, it seems to have been a set of principles Swartz believed in quite passionately. And his conduct appears to reflect that commitment. In the same year Swartz published the manifesto, he participated in the effort to download the entire contents of PACER. That led to an FBI investigation but no charges. And then the MIT/JSTOR incident followed soon after, in 2010, which led to the criminal charges in this case. If I'm right about what Swartz was trying to do, then I think some kind of criminal prosecution is appropriate in this case."
PACER is a system that charges a fee for court documents. Carl Malamud of Public Resource argued -- completely correctly in my view -- that the courts should not be charging a fee -- at least in the case of Federally-produced documents that are in the public domain under section 105 of the Copyright Act. During a government authorized free trial of the PACER system, Aaron downloaded approximately 20 percent of the court documents and donated them to Malamud's organization. Did the people who set up the free trial expect someone to download 20% of the court documents? I do not think so. Did Aaron break the law by doing so? Well, as Orin notes, the FBI investigated but did not prosecute. I do not think so. Again, we can argue about whether that is true -- Aaron did install a PERL script on a computer -- but Orin just seems to assume that he did. I would respectfully argue that one cannot responsibly do that. So can a prosecutor use what Aaron did with PACER as part of the decision to come up with a harsher sentence, because "this kind of behavior needs to be deterred in the future"? What if what he did with PACER was legal and socially beneficial? Then using that "evidence" to shore up Orin's theory of punishment is really troubling. Aaron's manifesto calls for civil disobedience, but it also calls for freeing public domain works - sharing those might be a violation of a term of service, and it might be a violation of a code based restriction. But it is not a copyright violation, and it could be an example of doing something that was legal, even if it irritated the powerful. A reader of Orin's post would likely miss those complexities. Again, the tie does not go to the accused. That's unfortunate. And the combination of Orin's questionable theory of punishment of those who profess civil disobedience, and his willingness to include protest behavior in the past that may well have been legal as evidence of future propensity of lawlessness is really disturbing. "Technically, last time you were demonstrating legally on public land. But that means that this time, if you actually trespass on private land, we can throw the book at you because we know you are a trouble maker. And as you are a trouble maker, we are going to have to throw that book pretty hard to deter you."
I could go on and on with this, but I think the point has been made. Orin's main point is that prosecutors routinely overcharge, this case is nothing special. I agree that they do, and I think it is a bad system. It works efficiently for the career criminal -- even if it may look more like an assembly line than justice. But its smoothness conceals many flaws -- the lack of match between behavior and charge, the psychological costs to victims when harms are plead down to offenses that were not really committed, the way that the operation of our criminal justice system goes on in private not in open court. But it also goes wrong when idealistic defendants are being prosecuted by ambitious prosecutors who at first threaten with enormous punishments and then with still more, in growing disbelief that the person is refusing to cop a plea. I mean it is just a game, right? Orin finds it puzzling that Aaron behaved as he did.
To my mind, this is one of the puzzles about Swartz. On one hand, he was deeply committed to civil disobedience and to the moral imperative of breaking unjust laws. On the other hand, he seems to have had his soul crushed by the prospect that he would spend time in jail. This is an unusual combination. Usually the decision to engage in civil disobedience comes along with a willingness to take the punishment that the law imposes. But despite Swartz's apparent interest in legal questions, he seems to have made his decision with a blind spot to the penalties that would actually follow. It's a strange situation.
Contemplating Aaron's suicide, I cannot find the words above to be a sympathetic account of his plight -- sympathetic in the second sense I mentioned above. I don't know if Orin has ever committed civil disobedience. From my own very limited experience, it is really scary, but you feel you have to do it anyway, often while you are really scared about consequences. I want to be clear. I would not have done what Aaron is alleged to have done. Those are not my methods. But I didn't think nor do I think anyone would think beforehand -- and here I most emphatically disagree with Orin -- that the charges would have inevitably been brought at this level or accompanied by this level of threatened punishment.
Orin spends a fair amount of time talking about the motivations in Aaron's life -- at least those motivations that indicate a propensity to future crime. There is little about what might have made the prosecutor pursue this charge so hard. Other former prosecutors have told me of the intense political and business pressure they face to bring high profile suits against real and perceived violations of intellectual property. Former Federal Judge Nancy Gertner said "If the U.S. attorney is going to take credit for every successful prosecution, not matter what the issues were, the U.S. attorney then winds up as 'Bostonian of the Year' for these prosecutions, then you know high-profile prosecutions are valued in the office," Gertner said. "Mr. Swartz was a high-profile prosecution. Whether they are right is another question." Gertner says this case and the suicide of a troubled young man merits attention to the rest of Ortiz's record. "What happens with the press, you don't talk about the cases which really reflect this kind of poor judgment. You talk only about the cases that succeed," Gertner said. "This is the example of bad judgment I saw too often." When asked if she was referring to the bad judgment of Carmen Ortiz, Gertner responded, "That's right."