I read the Granick piece. One thing that strikes me as completely absurd is that the plea deal is for a substantially lower sentence and that if the plea deal is rejected the prosecution will go for a much higher punishment, sometimes as much as 10 times as much as offered in the deal. It would seem to me that if you offer a guilty plea that is 10% of what you intend to seek that if such an offer is on the record that a small multiple of that (say twice as much) should become the new maximum sentence. It's utterly frivolous to mess around with 90% or more of a sentence just to put pressure on people, that's poker table tactics and we're dealing with people's lives here.

The most worrying bit is the part where she says that people will plead guilty to things they did not actually do just to not have the chance at a much worse sentence during a trial stacked against them. This is not about justice at all, it's just a numbers game.

Sadly, coercive plea deals are the norm in the US, especially in Federal cases. It's the same most places, but it doesn't have to be that way:

http://digitalcommons.law.yale.edu/cgi/viewcontent.cgi?artic...

See also http://www.hup.harvard.edu/catalog.php?isbn=9780674051751

For reference, here in the UK people (typically) get 33% off their sentence if they plead guilty. There was a push in 2011 to make it 50%, but that was rejected.

However the people being prosecuted don't know in advance what sentence they will receive exactly. Sentencing is carried out after the verdict (sometime quite a while after if "pre-sentence reports" need to be compiled). There are sentencing guidelines, so they have a reasonable idea or starting point, but there is much variation in these due to many different mitigation or aggravating factors.

Particularly at the "low" end, a person may not know whether they will be getting 33% off a community order or 33% off a jail sentence.

Still, there are very, very few occasions where it is reported that innocent people plead guilty due to the reduction in risk. That may also be due to the reasonable lengths of the starting sentences.

The majority that go through the courts, that is those who are actually guilty, plead guilty. They get a small "reward" for not tying up the courts unnecessarily.

My personal opinion is that in an ideal world we wouldn't offer any plea deals, but we don't live in that world. Yet.

"Still, there are very, very few occasions where it is reported that innocent people plead guilty due to the reduction in risk."

Is part of the plea bargain deal not discussing your innocence? In other words, how do we know whether people taking plea bargains are innocent?

No. It's not a deal thats "made" per-se, there are no conditions to be haggled over, its simply that Judges will automatically award the reduced penalty at the sentencing stage if the defendant pleads guilty.

> is rejected the prosecution will go for a much higher punishment, sometimes as much as 10 times as much as offered in the deal

In this case it sounds like the prosecutor was going for 70x the plea offer before the plea was even rejected. Simply outrageous.

Not exactly. The statutory limit was that much. The prosecutor claimed to be planning to press for about 12-14x the plea offer.

> The prosecutor claimed to be planning to press for about 12-14x the plea offer.

Is that better? There comes a point where it doesn't make a difference anymore.

Ever see a sale like that? Where one day something costs 10 bucks and then the next day it's 170? Me neither. That's not a deal. It's blackmail. Do what we want or we'll do our best to destroy your whole life. Justice, eh?

We'll let you off the hook if you pay us $200 of the $2000 that you may or may not actually owe us. And just in case you've missed it, there are four snipers at the top of the roof. I don't know what they're doing there, but thought you might wanna know.

Never mind the nonlinear severity function of time in prison. Which gives me another idea - fungible jail time. I'd have spent a day in jail for Aaron.

> Which gives me another idea - fungible jail time. I'd have spent a day in jail for Aaron.

Not a good idea. Well connected people will get off lightly.

As has been documented with China's "body doubles":

http://www.slate.com/articles/news_and_politics/foreigners/2...

Connected in what way? Bernie Madoff isn't going to find any friends to do time for him.

Monetary compensation though? That's a whole nother can of worms. Although I've got to wonder if the incentives are aligned such that it would encourage better prison conditions.

How about Al Capone. They had a hard enough time putting him away, if he could have mobsters rotate through jail to do time for him they would have never kept him behind bars.

Gangs? You already get promoted for doing time, providing opportunities for volunteering seems unwise.

hm. Well, if we allow a volunteer to stop volunteering at any point, this necessitates that the actual inmate remains in jail (concurrently) until the original sentence is completely fulfilled. So a 20 year gangbanger rap might turn into 4 5-year sentences. Or 20 1-year sentences. But the latter might be foolish, as the gang would lose power if most members were out of the game.

Just was trying to think of ways for 'social proof' that certain sentences were outrageous and ridiculous (beyond juries, since their "peer" requirement has been effectively destroyed in today's specialization-based society).

I've spent some time thinking about this myself, and about time vs money tradeoffs. Depends on what you think prison is for. If it's rehab, rehabbing a group of friends doesn't seem to work. If it's a safe place to keep bad people, you're not keeping them there. If it's about punishment, then maybe.

But prison sucks not just because you have to eat crappy food. It's because you have to eat crappy food everyday. If a rotating crew each serves one day, what's that? I can go a day without eating. This is a sum of the parts less than the whole situation. And the key is that people in jail aren't free to pick their schedule. You don't get to swap out with a buddy so you can attend your sister's wedding. If you're stuck in a shitty place unless you get someone to cover your shift, you're not in prison. You're working at walmart.

Incidentally, I've read that hiring prison doubles is a thing in China. It's illegal, so you're effectively under house arrest for the duration to avoid detection, but you're also not in prison. The guy you hired to show up and say your name is.

If a sentence is outrageous, you get a crowd of people to march around and protest until the governor or president grants a pardon. That's the existing process to deal with exceptional circumstances.

> rehabbing a group of friends doesn't seem to work

And if it were gangsters, it seems like it would have the opposite effect. Three square meals a day and some downtime to plan your next misdeed. And heck, the same goes for activists actually. So there would have to be no personal contact. Not that the US prison system is in any way about rehab.

> If it's a safe place to keep bad people, you're not keeping them there ... This is a sum of the parts less than the whole situation

Well presumably only other bad people sign up to help out bad people, and the idea would be that only with enough support, the sum of the parts would indeed be reduced. Trying to gauge my own utility function, it feels that sentences from between 3 months to 2 years would have corresponding increasing harshness on life-as-I-know-it. Under and it's a vacation, over and my present existence is basically completely gone. Of course those with a different uh, world view, would have a wildly different utility function.

OTOH this is clearly not a DIY avenue, and if that political will were actually available, instead of further codifying the prison industry why not just actually fix the damned legal system instead - vague laws, prosecutorial overreach, understandable due process, right to representation, broken sentencing, etc.

Not just that. Real criminals would find a way to force others to take their place.

I really like your idea of "pricing" using multiples of the prison sentence if plea bargain isn't accepted. This forces market dynamics that the prosecution much consider. I don'w know if 2x, 1.5x or 3x is the right amount, but whatever the multiple, the prosecution knows that the accused is actually weighing the benefits based on the fact that they know they are innocent or guilty instead of treating their awareness of their own guilt as irrelevant, which is something a 10x multiple does.

At 10x, knowing that you are innocent is completely irrelevant to the issue at hand and it simply becomes a choice between the lesser of two evils, because a good is not a realistic option.

This. The law should be rewritten to prohibit prosecutors from entering into plea deals of less than X% of the maximum sentence they are prosecuting someone for, with the exception of plea/immunity deals that include providing incriminating evidence in another case or against another person. Not sure what X% should really be, but it should be sufficiently high as to prevent prosecutors from using the large delta between plea and conviction sentences as leverage. My initial thought would be 50%.

You're missing my point. They can offer plea deals as low as they want, but then not ask for more than twice that in a subsequent trial.

I think I got your point. I just approached the problem from the other side. I think limiting a prosecutor's ability to bargain would be easier from a legislative standpoint than getting involved in sentencing, and more effective since the sentence asked by the prosecution is really just a recommendation. Either way, the important part is ratio of sentence to plea bargain, if I understood you correctly.

Prosecutors will go for very low plea bargains if their case is shaky, with huge penalties for not accepting the plea, so many shaky cases never make it to trial. By reversing the situation you end up with half of the maximum rather than maybe 10% of it, in effect most plea offers would increase rather than stay at their current level and many more cases would have to be tried.

I think that the idea here is to prevent prosecutors from charging people when they only have a really shaky case then using the leverage of a small plea to force people into pleading guilty. If prosecutors don't want to lose cases, and they can't force people to accept really low pleas then they would have to stop trying to get people on really shaky cases.

Well that is the whole point - if the case is shaky (i.e., the accused is likely to be innocent), then the case should be either dropped or go to trial.

Any system that results in accepted guilty pleas for such cases is broken and evil, and should be destroyed.

There may be a problem, no matter which side you approach it from.

Suppose the prosecution makes an offer, they're willing to go lower, but only if they think the defense will accept. The defense then rejects the offer, perhaps with the implication they might accept a lower offer. If a lower offer is made, the defense can reject it but now they have less risk—since the offer was made the prosecution is bound to x% beyond that.

Some people might view that as gaming the system and I'm not sure it could be tuned to avoid that. On the other hand it might improve honesty on both sides of the table. The ratchet effect may keep the defense from being intimidated. The net effect should promote not guilty pleas among the innocent, but ideally it should not have that effect on the guilty.

Biter. ;)

https://news.ycombinator.com/item?id=5064673

Mainly linking because I took two other stabs at ways to address the prosecutorial issues here.

Re: his actions in evading filtering and shutoffs on MIT's networks

Have you seen any halfway credible summary on what he did? I'll probably read the formal indictment eventually, but I'm not expecting a real balanced presentation. To be clear: just asking if anyone has a good hyperlink.

For example, I'd like to know what did he do on the Wifi other than change his MAC address?

It's said he "broke into" the wiring closet. Did he use an axe? Pick the lock? Was it unlocked? Once in, did he simply plug in to the Ethernet like any good network citizen would do (to avoid hogging the Wifi).

Once on the network, did he root boxes or simply request documents that the server was happy to give him?

EDIT: OK I found this http://unhandled.com/2013/01/12/the-truth-about-aaron-swartz... written by Alex Stamos, expert witness for Aaron's defense. Alex is well-respected. I know thing or two about network security and this piece certainly sounds like how I would view it.

The wiring closet he "broke into" wasn't even locked and "was also used to store personal effects by a homeless man"? This prosecution is a complete and total outrage.

This meets your "halfway credible" standard, although I can't vouch for its ultimate accuracy:

http://www.volokh.com/2013/01/14/aaron-swartz-charges/

This blog describes a scenario in which JSTOR blocked Aaron's IP, then MIT blocked his MAC address, then JSTOR blocked an MIT IP range after he kept circumventing their attempts to cut him off. Ultimately, "Swartz broke into a closet in the basement of a building at MIT and connected his computer directly to the network — hiding his computer under a box so no one would see it."

It's worth noting that Prof. Kerr stated that he used the indictment as a significant source of the facts in his legal analysis. I would be inclined to trust it a lot less as an account of what actually happened than for the analysis of what the law says given the facts he describes.

"Hiding his computer under a box so no one would see it."

That's always the part on TV where the defense objects to the prosecution drawing inferences or something like that.

Even if we saw him on authentic video placing a box over a computer, it's still something very different to say it was so no one else would see it.

Exactly. Even if it was "so no one else would see it", for all we know that "someone else" to Aaron was the homeless person that kept his stuff in that closet.

I wouldn't have thought that hiding his face with a bike helmet would have mattered. After all, I do weird things any time I know I'm being watched by a camera; there's one on the elevator at the garage that I habitually cover.

Orin Kerr said that stuff matters at trial.

As I posted elsewhere, it seems that "sneaky" and "strange" are equal to "wrong" and "guilty" in most people's eyes.

Okay, that tears it! Somebody has replaced tptacek.

What did I say? Did you really think of me as someone who thought it was important to be forthcoming with surveillance cameras?

No, I hadn't. It's your emphasis and attitude that come across as completely different. I kept trying to tell ya, the legal machine looks a lot different when you examine it as if you're the one at odds with it.

By abusing computer fraud laws to needlessly persecute Aaron Swartz, these Boston prosecutors have done grave damage to the entirely legitimate enterprise of having the state help protect individuals and businesses from criminals who can and do hire out superior security talent. Look at HN over the last two days: anyone who's ever been convicted of a computer crime, even if that crime involved the mass theft and subsequent resale of credit cards, is a newly minted hero of the cause of openness. That's Boston's doing.

The law cannot hope to capture every possible nuance of all conceivable offenses. As every lawyer who's ever argued with a Hacker on HN has pointed out, the law is not a programming language and courts aren't computer architectures. We want our rules, laws, and metalaws to provide every protection to the accused that they reasonably can, but at some point it's always going to come down to the discretion of humans appointed to positions of authority. Those authorities need to be equal to the task, or we delegitimize the whole effort.

I'm sad about what happened to Aaron. I look at the photos of him in his teens hanging out with Dave Winer and Lawrence Lessig; he was a small kid, and I have a big 13 year old. I exchanged an email or two with him, but my wife didn't know him at all and she's upset, as I would assume any parent reading about this would be. And obviously in light of what happened, I'm a little harsh on how I interacted with Aaron online --- not on the prosecution threads, but you know, on threads about "hollywood launches" and stuff like that.

But beyond that, what happened offends me in principle. If they're not the exact same principles that you've had offended, that doesn't matter much, does it? The justice system seems to have achieved a pretty high level of coverage in offended principles.

> anyone who's ever been convicted of a computer crime, even if that crime involved the mass theft and subsequent resale of credit cards, is a newly minted hero of the cause of openness

Specifics? I don't recall seeing this, but maybe I'm just unobservant.

> The law cannot hope to capture every possible nuance of all conceivable offenses

On the other hand, the point of having the law instead of The Decider is that acceptability of a particular behavior can be reasonably foreseen. And for the long standing laws most everybody now thinks of as self-evident (murder,rape,robbery,etc), this is basically the case. But the problem with many newer widely-scoped laws, especially federal ones, is that they're highly vague and allow so much leeway, the question becomes quite unanswerable. Are these vague laws primarily used to punish bona fide criminals? Yes. But when we fail to examine the law for what it conceivably could do and instead take comfort in what it usually does, when we fail to stand up for injustices against people who are ultimately not very nice, we set ourselves up for exactly what happened here - a grave injustice against an unlucky blatantly-undeserving target. It's simply the only thing remaining that provides any check on the expedience of the Deciders.

I unfortunately never interacted with Aaron. I identify with a lot of his optimism, even while feeling older than his naivety. I think we've probably had similar principles offended in this case. It just took a tangible incident with high wtf-levels to offend yours, where as mine go off for hypothetical possibilities and run-of-the-mill wtf-levels.

> I'm a little harsh on how I interacted with Aaron online --- not on the prosecution threads, but you know, on threads about "hollywood launches" and stuff like that.

Those prosecution threads should give you pause just the same, and Aaron is absolutely not the only person that you've acted like that with. I respect you tremendously for your technical knowledge, but for someone who reminds people to 'stay classy' and who claims the moral high ground with some regularity a bit of introspection wouldn't hurt. I'd respect you a lot more still. I'm very happy to see you come around in your way of thinking about this particular case though.

You're definitely the same Jacques I remember. I haven't come around on this case; I have the same opinion of it I always had. Like Aaron's own lawyer, I was confident he was at no real risk of serving time --- first time offender, no commercial purpose, no co-conspirators, minimal attempt to hide, no damage. It was hard to fathom that he'd do worse than credit card thieves. Unlike his lawyer, who was privy to all sorts of facts neither you nor I had, I was unaware of the psychological games the prosecution was playing. Have you noticed how shocked everyone is at what happened? That's because what happened was shocking. I think what Aaron did was wrong, but like I said at the time, I was hoping he'd do well at trial.

I definitely don't think of myself as any classier than you; I think we occupy opposite poles of some deranged message board energy sphere. Or you're the heat miser and I'm the cold miser. Either way, I can spot a dumb argument as quickly as you can, and just because I'm imperfect doesn't mean I'm not going to point them out.

> I haven't come around on this case; I have the same opinion of it I always had.

I'll take your word for it but I'm getting a different impression.

Aaron was fairly clearly being made an example out of, and I think that after the expansion of the indictment (http://news.ycombinator.com/item?id=4528083, a thread in which you commented, and which came before the thread about Aarons friends setting up a defence fund) that would have been pretty obvious even to those not already of that opinion.

Maybe I'm slightly more sensitive to this stuff because of some of the things that happened in the wake of reocities.com but let's just say that if Aaron had charges worth a few decades thrown at him for TOS violations and unauthorized access I should probably be in jail for at least several decades because of that little gig.

I know everybody is shocked at what happened, but I'm far more shocked at Aarons' suicide than at the travesty of justice perpetrated there, there are lots more examples of such things happening on a daily basis.

I think my mentality about the law is different enough from the one that prevails on HN that I appear much more conservative or authoritarian than I am. I say something anti-authoritarian and I sound like I've done a 180.

We should stop talking about us, or at least, about me. This isn't about me/us.

> I say something anti-authoritarian and I sound like I've done a 180.

That's probably it. I couldn't help but notice.

> This isn't about me/us.

Agreed.

Yes, it does. Things that make you seem like you are being a criminal hurt. The hard thing is that sometimes either option looks bad.

For instance, IIRC, Weev deleted the download script that pulled data from AT&T and the data itself, once publicity had been gotten. That was construed at trial as deleting evidence.

But part of the prosecutors' case was that Weev et. al. planned to exploit the data. In that case, keeping the data would have been used against them as well.

Burglary (entry for the purposes of committing an offense) is broken down into three sub-categories: forcible entry, unlawful entry where no force is used, and attempted forcible entry. It doesn't matter if you use a tank or a paperclip, or even if you're successful.

You're not the first person to think up the "but it wasn't locked (very well)!" defense. :)

Of course, but then we ought to apply reasonable standards of trespass before we can talk of federal-level "breaking and entering". He was present as a guest on MIT campus and the trespassing charges had even been dropped.

Show me a university campus where the students don't poke around in unlocked basements and closets and I'll show you a worthless university.

Entering a wiring closet with a lawful excuse is permitted. You genuinely thought it was the door to the bathroom, or smelled smoke.

Entering a wiring closet with lawful intent but not a lawful excuse is trespass. For example someone left a light on and you wanted to turn it off. The property owner can generally have you removed and file a civil case.

Entering a wiring closet with unlawful intent is a crime. For example your MAC address has been blocked from the wireless network and you intend to plug in to avoid that block.

So hopefully it makes sense now. They can't just charge him for breaking into the closet (unless he did property damage), but they can charge him in addition to another crime (and you can argue till your blue in the face if THAT was a crime, I don't have an opinion). Its like the magical "with intent to distribute" if you cut up your drugs into lots of little baggies.

(IANAL, but I did have one explain this stuff to me years ago in relation to an employee termination)

So if he entered a supply closet at the library to borrow a pen, and then he evaded taxes with that pen, he "broke in" even if the library allowed people to borrow pens from that unlocked closet?

Breaking into a supply closet is not a fact that helps establish any element of tax fraud.

So it's "breaking in" if it helps the prosecution's case, by definition.

What a weird system.

"What a weird system."

A little yeah. But check this out. If you steal something, you won't automatically go to jail. Someone has to sue you because of that first. Same thing, I think.

He wasn't charged with breaking & entering. The fact of his "breaking in" to the wiring closet was used to establish his intent and understanding that his actions were unauthorized. It's part of a pattern of facts that established the elements required to charge him with fraud.

Well somehow the press and everyone started reporting that Aaron "broke in" to the closet where the wires were gathered and I figured they were using a legal term of art.

If we can s/broke in/entered/ without changing the meaning, then this "breaking" use sounds like pure spin.

It's spin (the closet was quite unmaintained given its dual use as a homeless shelter), but it's also legally meaningful when talking about the network access he obtained in there.

Lots of places are unlocked that you're still not supposed to go into. How hard it is to get into somewhere you're not supposed to go is completely irrelevant, as is how hard you have to work to evade someone trying to get you off their network.

MIT has a pretty open unofficial policy when it comes to trespassing, as one would expect from any school with a dominant hacker culture. People used to go into network closets, pick locks, go into maintenance tunnels, etc. There's a very visible/popular student club on campus devoted to this.

That doesn't mean there aren't limits, and MIT clearly thought those limits were violated here.

Which is something that apparently shocked Swartz. In fact, whatever the administration at MIT may have felt at the time, Swartz wasn't violating the community norms as I understood them. Maybe there's something sacred about wiring closets at MIT, but every other place there seems to be a hobbyist lockpicking playground.

This is obviously a situation where the community norms of MIT have collided painfully with the policies of its administration. Swartz thought the norms would be controlling; he miscalculated: it was the policies that mattered.

Is there any evidence that MIT's 'policies' were anything other than made up on the spot?

As far as I can tell it looks like "OMG! The attacker has changed his MAC address! We don't know how to stop him! He's stealing all the priceless research papers...call the DHS cyber-espionage defense unit for help! the packets are coming from INSIDE THE WIRING CLOSET!!"

"Let's stop the guy who keeps on breaking into our network" is not "made up on the spot."

MIT gives you wide power on the Internet. You aren't firewalled at all. I'm not even sure if they filter port 25.

But you also have the responsibility that comes with that power. The fact that they don't wrap you in bubble-wrap doesn't mean you can't hurt yourself or others.

> MIT gives you wide power on the Internet. You aren't firewalled at all.

So since Swartz was considered a guest on the MIT campus, he could hardly have been "breaking in" to this wide-open non-firewalled network.

You should really just read the account in the indictment, it's quite accessible: https://www.documentcloud.org/documents/217115-20110719-schw.... I think many of us would take issue with how the indictment derives appropriate charges, but the factual account seems relatively straightforward and thorough.

The validity of this bill, of course, has nothing whatever to do with its name. That's self-evident. So we should evaluate it on its merits, even if there may be a demonstrable tendency in the past for bills with sensationalistic names to lack substance.

Ignore ad nominum arguments, you say?

You're right, of course.

I am not a lawyer. Or even close.

However the fact that he had to commit physical trespass in order to place his laptop giving him access to the network tells me that he was not merely in violation of the terms of use, and therefore he actually was unauthorized under the terms of the amended act. Thus it would not have helped Aaron.

But it would help others. It is a step in the right direction. I support it.

The depressing lulziness if a sentence that scales with the number of documents downloaded is matched only by that of sentences that scale with the weight of the drugs carried.

Seriously, how does that even make sense? The idea of a sentence that is accelerated if it's your Nth offense makes sense. A sentence accelerated by malicious destruction (of any sort) makes sense. Accelerate if done for commercial gain. Accelerate for deliberately obstructing investigations. Accelerate for being the ringleader of a conspiracy.

But a sentencing structure that says "fuck it, all we have to go on is damages, so go make up a plausible story and we'll use that to figure out where on the X axis of this spreadsheet you figure out" --- and "plausible story" is exactly the term when you learn about the burden of proof here --- it makes no sense at all. The same mindset, intent, and actions can't generate radically different outcomes based on how many iterations a for() loop makes before you get caught.

Well, it's a problem with sentencing in general. If you have $2m and I steal $1m from your safe, it's judged a much worse crime than if you have $200 and I steal all of it, even though the outcome for you is a lot worse in the second case. Ideally the imposition would be quantified in terms of the marginal cost to the injured party, but then there's another economic theory that says we have to multiply that by the probability of capture in order to achieve deterrence by means of a criminal's indifference curve.

And at that, we're not even committed to any kind of intellectual theory of sentencing int eh first place - some lawmakers thinks sentencing is a punitive matter, some rehabilitative, and so on. Gestural politics are the norm in American criminal justice; which goes some way to explaining how we only recently had mandatory minimum sentences recognized as unconstitutional, and how the crack/cocaine disparity was addressed even more recently, despite its blatantly obvious unfairness.

I don't think legislation will go anywhere, since the house GOP will probably sink it in the name of personal responsibility.

Sure, the legislation won't go anywhere if you go out of your way to make it seem like a one-party issue.

Some of us have been reaching out to our GOP representatives, especially those who've expressed prior concerns about prosecutorial abuse of power. I see Darrell Issa - on the Oversight Committee, and hardly a liberal - has already agreed to look into the appropriateness of Aaron's prosecutors' behavior.

It's really not that hard to tie the type of bullying Aaron went through to the bullying suffered by more GOP-friendly victims like the Reese family out in New Mexico. You can wrap it all up in a nice bow of Fast & Furious. If you want the House GOP to pass this legislation, why don't you do your part and reach out?

This legislative proposal is too narrowly tailored to address prosecutorial overreach in general, and I'm not sure it would have even made much difference in this case.

I agree completely - but it's a good step in the right direction. I didn't mention it in the letters I've already written, because I didn't know about it, but I'll certainly be working it into the letters I haven't written yet.

Hopefully you'll do the same.

> Sure, the legislation won't go anywhere if you go out of your way to make it seem like a one-party issue.

And to pile on, it's hardly only GOP members who believe in "personal responsibility". But that doesn't let overzealous prosecutors off the hook anyways.

It's a hack to make it easier to put major drug distributors, commercial piracy operations, etc, away for longer sentences on the assumption that if you're downloading a million documents, you must be engaged in some large criminal enterprise.

Really, no crime needs more than a few degrees (it's good enough for murder, after all). Even things like aggravating factors can be used pretty unfairly.

Worse, according to Granick, this made-up number is laundered into a finding of fact that is given deference at appeal.

I think you meant "if a sentence that...", right?

This goes even further: if one was to carry drugs in a ziplock bag (or whatever else they're carried in, I am probably one of the few people on HN who doesn't know), when calculating the charges, it's not uncommon for the weight of a ziplock bag to be added to the weight of whatever is in it. God help someone who decides to stash the drugs away inside their spare wheel in their car.

Angry nerds is a force we can use for good -- reforming CFAA os probably useful on its own merits (I fully support this legislation), but majority of people being judicially bullied into unreasonable plea bargains (or worse, manifestation of physical or mental illness such as suicide and heart attacks) are not being charged under CFAA.

Lofgren's proposal appears to address the EFFs main concerns:

https://www.eff.org/deeplinks/2013/01/aaron-swartz-fix-draco...

Legislating against what you term "prosecutorial misconduct" is far fetched. Can you imagine how you would word that legislation without hampering law enforcement efforts against the real bad guys? Do you really want that?

Having the law named after Aaron would be more than symbolic, it would be a perpetual reminder that overreach against programmers who in general want to make the world a better place can result in massive civil outcry, and to a large extent address your concerns too.

Do I want a better sentencing system for computer fraud, so that it remains possible for companies to defend themselves without needing to spend hundreds of thousands of dollars every quarter finding every conceivable loophole an attacker might exploit, while not leading to a situation where simply using a computer turns a simple offense into a 6 year prison sentence?

Yes, that is what I want, and I don't think it's too much to ask for.

After I wrote the comment above, I worried that it would read as a contrarian barb at any attempt to move forward with better computer crime laws. I don't mean it that way, which is why I went back and pointed out that Lessig thinks it's "critically important". But I meant my first question as I wrote it: would Aaron's Law really have helped Aaron?

Its too late for that. Look to the future instead. Will having Arron's Law in place, coupled with civil outcry and petitions we've seen , prevent the next Aaron from being over-zealously prosecuted?

I think the answer is: not entirely, but its a huge, practical step in that direction. This is one of those things that you celebrate, not dismiss cynically.

Think of an alternate reaction. Why not create a petition on the whitehouse to make this small step a reality instead of cynically dismissing it? Remember, your pessimism can influence a whole audience into inaction. Recent precedent suggests.

I'm not being cynical. The fact that Aaron's Law wouldn't have helped Aaron isn't a cynical point. I don't oppose the act at all. TOS violations shouldn't be felonies.

This is one of those ridiculous message board arguments where both parties agree, and the argument is actually not about the issues about about the metaissue of how people are posturing. Do you believe federal criminal sentencing is sensible or just? Here, I'll just speak for you: no you don't. We disagree on nothing. Let's move on.

If you could kindly edit your top comment by requesting readers to contact their representatives to help get this passed, THEN i will move on. Till then I have a pretty low opinion of you.

Potentially. I think what got him is the argument that because he was authorised only in accordance with the terms of use, once he violated the terms of service he was now an unauthorised cracker (despite not actually cracking any system/software), and was going to go down under the CFAA.

I think the intent of the law is to remove the terms of use from determining whether or not the use is authorised. So since guests from any IP were authorised on MIT and JSTOR, despite the fact that he violated their terms of use, they then couldn't have hit him at all with the CFAA.

The problem I'm bringing up is that Kerr and Granick have both pointed out that TOS violations weren't the only problem, or even the most severe problem, facing Swartz's defense. His attempts to evade filtering had the added misfortune of setting him up to "appear guilty" at trial.

Guests from any IP, except Aaron's IP. Until he got a new one. And then another.

Hypothetical Question: someone is accessing your network in an unauthorized way. How do you tell them? An IP is not a person, so how do you make your desire that they stop known? Block their IP? What if they come back with a new one?

Do you really think that any legal change would reduce the need for security auditing of apps? I'm afraid that seems awfully unlikely to me. Even if US-based attackers would be deterred, there are plenty of places in the world the Internet reaches but US jurisdiction doesn't.

I think the effort put into securing computers is an inevitable dead-weight loss. Laws against pollution don't make everyone stop polluting; some polluters will just find creative ways to conceal what they're doing. Definitely doesn't mean I think pollution should be legal.

Computer security, at least while attached to the Internet, doesn't work that way. When all it takes is one attacker anywhere in the world to write a worm that compromises everyone, everyone needs to secure their systems.

Some problems really are best solved using technical means. If we stop building systems that can be exploited by arbitrary outsiders (yes, this is possible, and probably not that expensive in the long run if we standardize a few good protocols), then we can should be able to reach a point where a certain baseline of security can just be taken for granted.

The idea that abusing people's computers to disable their businesses or gain access to confidential information should be legal because "that problem is best solved using technical means" is so hostile to my perspective that there's probably little chance of us learning anything from each other by debating it.

For the record, that was not my thrust. (Can't speak for dlitz.)

I was just surprised at your suggestion that better laws would reduce your workload at Matasano.

You spoke for me well enough. If you reduce the number of computer criminals by 90%, it won't perceptibly change the amount of work that anyone has to put into writing secure programs, because the 10% of remaining criminals will still exploit everyone's vulnerabilities. If those laws impose friction on the rest of us (e.g. laws mandating wiretapping and/or filtering capability), then we all suffer huge aggregate costs for basically no gain.

>Lofgren's proposal appears to address the EFFs main concerns

Does it? I don't see anything reducing the excessive penalties, just somewhat narrowing what qualifies for them.

Let me be clear, I think this bill is a good bill -- I don't see anything wrong with it except that it is incomplete. It solves only a small subset of the problems we need to solve here. Narrowing the definition of unauthorized access can only be a good thing, but I could reasonably argue that it is still too broad given the current penalties, and remains incredibly vague notwithstanding that this would explicitly exclude certain things. So either the penalties still need to come down significantly, or what qualifies needs to be further narrowed, or both. But it's a good first draft. A step in the right direction.

The problem with prosecutorial discretion is that it allows prosecutors to drift down from the baseline sentencing (see: DACA re: DREAM Act) but also choose not to. In this case, the AUSA clearly decided that maximizing the sentence was the best way to get a plea bargain to increase his metrics of successful prosecutions.

The law is never going to be perfect, and our outcries do more to serve as a perpetual reminder (see: SOPA) against legal overreach than any law will be.

>Legislating against what you term "prosecutorial misconduct" is far fetched. Can you imagine how you would word that legislation without hampering law enforcement efforts against the real bad guys? Do you really want that?

Maybe it's less about "legislating against" the specific conduct, and more about oversight on incumbent prosecutors and ease of removal when someone proves themselves unworthy of the considerable power with which they've been trusted.

>not to mention the ridiculousness of criminal sentences

Perhaps if we didn't use incarceration as punishment for non-violent crimes, things would be a bit more civilized.

The issue is proportionality. I agree that Madoff is in jail, even though his crimes are not violent.

Why? He's not a physical danger to anyone. Surely you can think of more creative and productive forms of punishment.

My personal belief (which is significantly different from the law on the matter as I understand it) is that "unauthorized access" for computer crimes should require intentional, material deception. That means that they deceived someone (or their computer), that they did so intentionally, and that but-for that deception, access would not have been given.

I do believe that one could argue over whether changing one's MAC address (or IP) constituted that sort of deception. So in all honesty, it's possible that he would still be convicted by a standard like that, though I would like to think that he would not. Intention would seem to be hard to prove, though reasonable minds might differ.

Separately, I think that computer crimes have disproportionate penalties right now. I really don't see any reason why using a computer to steal money (or commit whatever other crime) should merit a greater sentence than stealing the same amount by other means. I am aware that it has been like this for some time, but hackers have had longstanding gripes with this state of affairs, dating back to Morris & Mitnick.

I looked quickly at the reddit comment thread that someone else linked to, and it appears that Lawrence Lessig has responded to a related question:

"would your proposed 'Aaron's law' prevent the situation by which Aaron was refused a plea deal that did not include jail time?" --alexwilhelm

"If "Aaron's Law" had been law, Aaron would not have been charged with a felony, and so there would not have been jail time to refuse." --lessig

http://www.reddit.com/r/technology/comments/16njr9/im_rep_zo...

edit: context

This response lowered my opinion of Lessig. Does he honestly believe this? In addition to the TOS, there were technical restrictions that Aaron evaded as well.

My Lessig is not always technically correct moment came while reading the future of ideas. He compares radio spectrum to an Ethernet hub, everybody plugs in and it just works. Problem is, there's a reason everybody moved from using hubs to switches, which are a lot more like centrally controlled cell towers. Its not a bad thing, but he is not a bits and bytes person.

I've never fully grokked the physical limits behind these newfangled unlimited spread spectrum ideas. Clearly there has to be some, and not knowing specifically what they are makes me highly skeptical.

"If you read Reason, you're immediately suspicious of laws with people's names on them; they're often more about PR than about well-thought-out policy changes."

What's Reason?

A libertarian-leaning magazine.

http://reason.com/