Towards Learning from Losing Aaron Swartz: Part 2

Below is part 2 of the post Towards Learning from Losing Aaron Swartz

The CFAA is incredibly broad and covers swaths of online conduct that should not merit prison time.  To point out that under the CFAA, Aaron's defense was hard is not to say that I believe Aaron was guilty.  Aaron was authorized to access JSTOR as a result of being on MIT's campus.  The CFAA may protect the box from unauthorized access, but it does not regulate the means or the speed of access.  If you are allowed to download, and Aaron was, then it is not a crime to download really, really fast.  Even if the server owner would prefer you took your time.

Exactly because the CFAA arguably applies to Aaron's alleged actions,it should be amended.  It's also why prosecutors must be extremely careful and measured when bringing these cases.  Unfortunately, from Drew, to Nosal, to McDanel, to Aurenheimer to Swartz, they are not.  When so many thoughtful people, including former prosecutors, disagree with United States Attorney's conduct in these cases, we need to stop. 

Many people feel that Aaron's prosecution was disproportionate to the offense, if any, committed.  The government filed multiple, duplicative charges, hung 35 years, then 50, over Aaron's head and insisted that Aaron plead to multiple felonies and be incarcerated.  

Certainly, most federal cases I defended went much the same way: The government overcharges the case.  There are so many ways to lose and only one way, total acquittal, to win. The maximum potential sentence is terrifying.  While any first time defendant is unlikely to get the maximum, because defendants are sentenced based not just on the conduct proven at trial, but also on unproven "related conduct", the actual sentence can be quite high.  In this atmosphere of terror, the prosecutor offers a deal, usually before dispositive motions are heard, or before trial.  If my client waives her right to trial and appeal and admits felonious conduct, the government will suggest to the court a greatly reduced sentence.  If she refuses to do so, the prosecutor will return to the grand jury and add more charges to the case, thereby racheting up the opportunities to lose and the maximum lawful sentence.

This reality is discomfiting enough when your client has been caught red-handed with a car full of cocaine.  But when the facts are unclear, or the case arises under a vague and overbroad law, it becomes terrifying. I want to both acknowledge that regular defendants unjustly face the same tactics used against Aaron every day, and also identify ways in which those tactics are especially likely to produce unjust results in the computer crime context. 


Voluminous, overlapping charges may be typical, but they can give unfair advantage to the prosecution.  At trial, each charge is a chance for the prosecution to win.  Convict on one count, and you can likely punish the defendant for all of his conduct, because related conduct, even aquitted conduct, is part of the sentencing calculation.  In contrast, the defendant has only one way to win: He must be acquitted on all counts.  The more counts, the more chances for the government to win. Furthermore, having a lot of counts bolsters the government's case in front of a lay jury.  Jurors tend to infer that the defendant must have done something very wrong if the indictment is substantial and voluminous. When just disposition of the case requires jurors to understand technology, politics, economics, philosophy and physics likely outside of common experience, this tactic is all the more coercive. 


Aaron was in danger of doing real time behind bars, and that is terrifying. To really understand the pressure that federal defendants face, you have to understand something about the way that federal sentencing works.  

In federal court, sentences are almost entirely determined by the federal sentencing guidelines.  The guidelines were initially adopted to constrain judges' arbitrary sentencing practices, so similarly situated convicts would be sentenced similarly.  In practice, the guidelines set draconian sentences that would always rachet upwards, but almost never downwards.  Because one of the only ways to lower your sentence was to plead guilty and testify against someone else, the federal court system is replete with prosecutions based on snitches and liars.  When I was practicing, judges had to sentence according to the guidelines. Today, the guidelines are highly influential but technically discretionary, giving us the worst of both worlds -- arbitrary sentences informed by a strict and draconian regime.  

To calculate the sentence, you look at the defendant's past record and at the offense characteristics.  The factors are plotted along the X- and Y-axis on a sentencing table.  Cross-referencing these factors on the table gives the judge a range of months she should impose.  Along the X-axis, Aaron was criminal history category I, he had no prior convictions.  

Along the Y-axis, you look at the sentencing guideline for the particular case.  CFAA sentences are governed by §2B1.1, which providers for a base offense level of 6, and adds to that for loss and other characteristics of the offense. 

Sentencing under the CFAA is both harsher and less predictable than sentencing even in other fraud cases. Loss, and not the statutory maximum, determines the sentence in computer crime cases.  But, as I wrote in 2006 (pdf), in computer crime cases, the sentence is almost wholly dependent on a "reasonable estimate" of loss and the loss calculation is extremely malleable. The CFAA defines loss as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."

Nor do the guidelines limit loss in computer crime cases to foreseeable damages. While the definition of loss for other white collar fraud crimes punished under the same guideline includes only reasonably foreseeable monetary harm, a special rule for computer crime cases requires the court to include any reasonable cost to any victim, “including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other damages incurred because of interruption of service”, regardless of whether the harm was reasonably foreseeable or not. Also, the guidelines establish a lower burden of proof for loss calculations in sentencing. Generally, sentencing is by a preponderance of the evidence. However, the guidelines only require the judge to make a “reasonable estimate” of the loss. In other words, the government only needs to show by a preponderance of the evidence that the sentencing court made a reasonable estimate of loss, and that estimate is a factual finding entitled to great deference on appeal.

I don't know what the government claimed was the loss in Aaron's case. Allegedly, he downloaded 4.8 million articles and the cost to download each individual article was $19.  At that rate, Aaron arguably caused $91M in loss to JSTOR.  The government's opposition to the suppression motion alleged the information was "valued in the tens of thousands of dollars at the time." Another, or additional, claim of loss could be based on the amount of time MIT and JSTOR spent trying to stop Aaron from downloading. Given the low burden of proof, and the fact that such damage need not be foreseeable, loss numbers are very much in the control of the alleged victims. 

For Aaron, with such a fungible numbers in hand and such a low burden of proof, the government could have argued for almost any sentence it wanted.  Using just the base level of 6 and $70K in loss, Aaron would not be eligible to serve any of his sentence in a halfway house or on home confinement. He would be looking at 15 to 21 months of incarceration.  That number could get higher quickly.  Section 2B1.1 increases the base offense level to 12 if the conduct involved use of an "authentication feature" or "unauthorized access device". Alternatively, upwards adjustments may be warranted if the defendant used a special skill, abused a position of trust, or tried to obstruct justice. True, 35 years wasn't in the cards, despite the fact that's the sentence the government publicly waived over Aaron's head.  Neither was a maximum of 50 years, which was what the government arrived at after its perplexing choice to get a superceding indictment.  But Aaron could easily have come out to over a year in his guideline calculation.   


Reportedly, prosecutors offered Aaron three options: He could plead guilty to all 13 felony charges and the government would argue for a six-month prison term while Swartz’s lawyers argued for less time; he could plead guilty to all 13 felonies and accept a sentence of four months; or Aaron could go to trial and if he lost, the government would argue for seven years. 

Some have blithely said Aaron should just have taken a deal. This is callous. There was great practical risk to Aaron from pleading to any felony. Felons have trouble getting jobs, aren't allowed to vote (though that right may be restored) and cannot own firearms (though Aaron wasn't the type for that, anyway). More particularly, the court is not constrained to sentence as the government suggests.  Rather, the probation department drafts an advisory sentencing report recommending a sentence based on the guidelines.  The judge tends to rely heavily on that "neutral" report in sentencing.  If Aaron pleaded to a misdemeanor, his potential sentence would be capped at one year, regardless of his guidelines calculation.  However, if he plead guilty to a felony, he could have been sentenced to as many as 5 years, despite the government's agreement not to argue for more.  Each additional conviction would increase the cap by 5 years, though the guidelines calculation would remain the same.  No wonder he didn't want to plead to 13 felonies.  Also, Aaron would have had to swear under oath that he committed a crime, something he did not actually believe.

There's a more systemic problem here.  Plea bargaining in the face of potentially heavy sentences incentivizes guilty pleas even (or especially) where the case is weak, or the defendant is factually innocent. People plead guilty all the time to things they did not do, because they couldn't afford the right lawyer, because they are scared, because they think no one will believe them, because they are simply playing the odds. Especially when you have a case involving network policies, academic culture, technological infrastructure, and information of questionable economic value, asking a jury to decide what's "authorized" at the risk of prison is scary.

Lest we mistake plea bargaining for justice, ask yourself, why is a seven-year sentence just for a person who goes to trial, while one who pleads guilty should only be incarcerated for six months? Why should Aaron have received two additional months of incarceration in order to argue to the judge that his sentence should be lower?  This is not justice, this is horse trading.  It is typical, it happens every day, but it is also wrong.
The criminal process is byzantine and treacherous.  We rely on knowlegable lawyers to shepherd our loved ones safely through the system, even though we know that the system is broken.  We ourselves are afraid to be called as witnesses, to be inculpated.  We have no clear avenue through which we can say "Stop!"  Perhaps now is an opportunity.  


I've seen two petitions to the White House circulating, one for reforming the CFAA and one for removing the prosecutors from office.  

Real reform of the CFAA requires two steps: (1) a comprehensive rethinking of the statute, esp. since solving the Lori Drew problem would not have saved Aaron and (2) engaging not with the White House, but with Senators Leahy and Franken, the policy makers most likely to understand and support these efforts. Nevertheless, I'm going to sign this petition. The White House can know what I think.  

As for removing the prosecutors, yes, I am angry. But, I am the kind of person who tends to blame the system rather than the individual, and I believe systematic change is more likely to make a difference than a campaign against these particular officials. I want to know how and why the decision to charge was made in Aaron's case. I want to know why they were pushing for felonies and incarceration.  I want to know what JSTOR and MIT's role was. I want to better understand funding, incentives, evaluation metrics, bonuses and other perks prosecutors receive, for cybercrime and for other cases.  I want to insulate future prosecutors from the incentives to build their careers on conviction rates rather than crime prevention, to train them so that they don't get myopic, so that in their bones they know that behind their conviction rates are the hearts, minds and bodies of real people and their families. I want to change the conditions so that a newly-minted bully won't just take these prosecutors' places.

It is also true that in my criminal law career, I found the U.S. Attorney's office in the District of Massachusetts particularly immoral.  In one case, I was told that if my client failed to enter a plea that day, the prosecutor would obtain a superseding indictment and add embarrassing pornography charges to my client's computer crime case based on materials allegedly found on his hard drive but never disclosed to me in discovery.  Similarly, that office sought to imprison a man for collecting user emails to compile a list of best-selling books, despite the fact that the email collection would have uncontrovertably have been lawful had it occurred a nanosecond later. (U.S. v Councilman). 

I may sign that petition, but I need more time to think about that.  


I admire this community's anger and energy. We are not alone. There are great organizations out there fighting to improve the criminal justice system in specific ways that would have helped Aaron.  Every day there are people getting chewed up by the criminal justice system, rightly or wrongly, and these people tend to be poor, people of color, non-English speakers, the mentally ill, the addicted. The pressure the government regularly brings to bear on the least powerful of us, when combined with vague laws like the CFAA, can wreak devastation on innocent people from all walks of life.  My hope is that this community will productively cross-pollinate with criminal justice advocates and that together we are strong enough not only to change the CFAA but also the normalization of disproportionately harsh prosecutorial tactics.  

In the next few days, I'll post a short reading list and seek out compatriots at the ACLU, NACDL, and Federal Defender bar and talk to friends and colleagues about what's next.  

To Aaron's friends and family: I'm sorry.  In the aftermath of this great loss, all I know how to do is make a To Do list.  I am going to try to make changes that will reduce the chances that something like this happens again.  It will not bring our Aaron back. 


Dear Jennifer. What a gut wrenching situation. It's insightful to read about the staunch differences in what your justice system is in the United States versus what I see and read about in Canada. Honestly in Canada our system is weak. It's always making headlines about being too lenient. Even when the accused are found guilty, the sentences are laughable to most. Reading about what is going on in the US regarding this case, it doesn't make me feel any better about the justice system. Always challenges, but hopefully mistake will NOT continue to happen. -- Kimberly C., writer and contributor @ in Canada

You write that the economic damages could have been calculated by determining the per-page cost for each article, and multiplying by the number of articles.
You are an attorney and have read the indictment, as have I, and I think this is a significant misrepresentation of the facts.
The investigators felt they had significant evidence that Swartz's goal was to download the entirety of the JSTOR database, and to distribute it via torrent sites. Some of that evidence has not been revealed, and should not be, but the indictment suggests it is there.
The economic harm is not the cost per article. It is that Swartz's actions, had they been completed, might reasonably be thought to have put JSTOR out of business entirely, by distributing the full contents of its database for free.
That is a significant harm, and the indictment certainly makes it sound as if there is evidence we on the outside don't have access to.
JSTOR is a non-profit entity whose purpose, contrary to its portrayal in most media, is to provide (not restrict) access to journal articles, most of which existed only on paper prior to JSTOR (see, e.g., JSTOR does not hold copyright over the original articles, but only its digitized version, so had Swartz's intent been to argue that JSTOR's entire service should be crowdsourced (and perhaps funded by donation, like Wikipedia?), he was absolutely free to go set up such a service himself.
I won't pretend to be an expert in sentencing or charging, but taking an action that could reasonably be thought to have the intent to put a small, non-profit, 100% legal entity out of business definitely seems like what the CFAA was intended to stop, and should be used to stop.

There's an interesting history of plea bargaining along with a discussion on the "innocence problem" among the materials of the U.S. Sentencing Commission's 2012 seminar.
The U.S. has gone from looking at such bargains with suspicion to the regular use of shock and awe to coerce a bargain. The concept that the charges should result in an appropriate sentence if convicted has been lost, particularly as stated under 9-27.320 B.2 of the Principle of Federal Prosecution.

Basis for Sentencing. Proper charge selection also requires consideration of the end result of successful prosecution—the imposition of an appropriate sentence under all the circumstances of the case. In order to achieve this result, it ordinarily should not be necessary to charge a person with every offense for which he/she, may technically be liable (indeed, charging every such offense may in some cases be perceived as an unfair attempt to induce a guilty plea). What is important is that the person be charged in such a manner that, if he/she is convicted, the court may impose an appropriate sentence. Under the sentencing guidelines, if the offense actually charged bears a true relationship with the defendant's conduct, an appropriate guideline sentence will follow.

I agree with Daniel.
I'll start with this excerpt from Ms. Granick's piece, which is excellent but makes me want to quibble:
"There's a more systemic problem here. Plea bargaining in the face of potentially heavy sentences incentivizes guilty pleas even (or especially) where the case is weak, or the defendant is factually innocent. People plead guilty all the time to things they did not do, because they couldn't afford the right lawyer, because they are scared, because they think no one will believe them, because they are simply playing the odds. Especially when you have a case involving network policies, academic culture, technological infrastructure, and information of questionable economic value, asking a jury to decide what's "authorized" at the risk of prison is scary."
Part I is right on, except that it misses the other incentive in a system based on pleas -- USA's bring far too many cases because they don't need to marshall the necessary resources to go to trial in all of them. In my short stint defending juveniles accused of crimes, my colleagues fantasized on a daily basis about refusing to plead any cases out and force the prosecutors and the courts to back-log the calendar for years. Of course, it would end up screwing some of the clients who could get a better deal and since a lawyer's duty is to individual clients, it's not an option.
But in some parts of the world (France, e.g.) there are no plea bargains. If the gov't wants to put someone in a cage, they have to have a trial to do so. And they bring many, many fewer cases as a result. There are enough laws that the majority of us break on a daily basis to lock up most of the population, if such laws were enforced with the same vigor against all of us. But, of course, they are not. Again, from my days standing before judges in juvenile courts, the degree to which they thought of a 6 month jail sentence as seemingly part of the "normal" experience for poor non-white teenagers was appalling.
Our outrage at what was done to Aaron is justified, but we should be outraged at what is done a huge percentage of the close to 3 million people now behind bars in the US.
And it seems that Ms. Granick is outraged. . . but then she kind of cops out. It's especially a problem when we have such complicated laws, as in CFAA, and an academic culture, etc, she writes. And that's true, I suppose. But the systemic problem she writes of inflicts a great deal more harm under laws that have little to do with computers.
How do we end these abuses? Signing the petition for reform of the CFAA is not the solution to the systemic problem -- it will simply protect the largely middle class hackers of the world. Assailing Ms. Ortiz et al. is, while still not enough, a better solution, it seems to me - if it can generate a larger discussion about prosecutorial discretion. (And maybe it cannot.) Asking for more information, as Ms. Granick does, isn't necessarily wrong, but it feels a bit like Congress setting up a committee rather than acting on a problem everybody knows about. Does Ms. Granick have any doubt, based on the facts in the public record, that Ms. Ortiz abused the power of her office? If not, then certainly, get as much out there about the whole corrupt business, but start with making sure her career goes no further. She destroyed a life (and that would have been likely true even if Aaron were still alive).

I appreciate your analysis here; connecting Aaron's tragedy to the bigger issues of over-broad statutes and abuses of prosecutorial discretion is critical. But your to-do list at the end seems to imply that the only place worth fixing is the (clearly broken) CFAA. This doesn't go nearly far enough. Over-broad statutes are rampant in this country, and prosecutors are routinely compliant pawns of the status quo, burnishing their resumés by using near-universal criminalization to pick off vulnerable people while leaving corporate and political leadership untouched.
Henry Farrell put it well in a recent comment on Crooked Timber:
I'm entirely sure from knowing Aaron that if he were faced with the choice between collective action to free up information law and make life better for hackers, and action to remedy basic injustices and inequality in our society, he'd have pushed emphatically for the latter (he was interested in free information as an imperfect means to the end of remedying inequality, more than as an end in itself).
We clearly need to reform the CFAA, but (at best) that's a small start. Drug laws, laws dealing with immigrants, labor laws, public assembly regulations, etc. all lend themselves to this kind of abuse. And we need action to end the culture that rewards prosecutors for their eagerness to lock people away regardless of actual harm to society.

Thanks for writing this piece. There's been some discussion about it here and here.

Final thoughts re Aaron Swartz.
The more I have thought about this the more disturbed I get. My take: a brilliant young man with mental health issues is "adopted" by the Internet/PC/Info should be free crowd (yes Larry, Tim and Cory I mean you). He is coddled and "groomed." He is a kid, he can act out the things they dare not (but do talk about and fantasize about etc). If he gets into trouble, they as the "respected elders" can vouch for him and all will be well. He gets to do the dirty work (and as a result gets the praise from these elders which is personality needs) and they get the public platitudes. But this time Uncle Sam and MIT refused to go along. The brilliant but troubled Aaron cannot accept that he has done something "wrong" after all all his mentors tell him it was right and for a good cause and the government has no case. If he accepts the plea deal then his role as the "kid who can do anything" vanishes. If he fights on, well it seems his mentors are unable to deliver. All through this no one is dealing with Aaron's mental health issues and seemingly everyone has failed to teach him about either personal responsibility or cause and effect. Aaron is drowning in his loss of self identity. He does the unthinkable. The mentors and the parents -- Aaron's enablers and those who were "using him" for their own ends -- hold much of the responsibility but that defies their sense of self identity (we of the the "higher ethical ground" are always doing only that which is the "right thing to do") -- so they lash out and blame others.
In the world of the users (my word for those who abused their relationship with Aaron) MIT was wrong for not seeing that allowing repeated trespassing and hacking of its property and networks served a "greater good." The government was wrong for not agreeing that "moral intentions" trump actual physical criminal acts. The media can be used to help divert attention and guilt from those who really hurt Aaron and contributed to his downfall.
The "Information should be free" community abused one of its own most brilliant members. It is time that community look in a mirror and begin to accept responsibility for its own ugly role in Aaron's tragedy.

I'm not sure whether the parent post is a troll, but I will treat it as serious.
Firstly, the outrage widely felt isn't about how Aaron did right. Indeed, every serious commentary on Aaron's actions started with the fact that he did commit a crime of some sort. Rather, the commentary is on disproportion and overreach by the prosecution.
Secondly, the perspective of 'Aaron as victim' of cultish beliefs implies that any non-mainstream political position is cultish, and to support action on the basis of such belief is exploitation. This is a ridiculous stance, as it renders rationality to be synonymous with self-interest. While it condescendingly lends 'support' to a 'victim' who was quite able to think rationally - he was depressed, not psychotic, it also simultaneously devalues any heroic act.
This isn't to say that Aaron's act was heroic - it was foolhardy and irresponsible. However, the structure of your argument does not distinguish between rightful and wrongful un-self-interested acts, so it condemns both the brave and the foolhardy equally.

The prosecutors, Steve Heymann and Carmen Ortiz are scum. Decent people would refuse to shake their hand, eat in their presence, and if they saw them being beaten down on the sidewalk, would not call 911. Marking them personally with opprobrium, by asking Obama to fire them, is merely an expression of natural justice.
Changing the whole system is necessary. Giving these rogue prosecutors a taste of the penalties they so blithely call down on innocent and guilty alike starts the process.

Frightening. How did we managed to get here with such unjust law practice? I think we need both work on fixing the system and removing bully as soon as we see those.

"But, I am the kind of person who tends to blame the system rather than the individual"
But the system is made up of individuals. These individuals choose their actions. If we have a system which defies reason and harms defendants, it is because individuals' choices made it so. Why should the consequences only affect the institution, and not the individuals who made it so? These individuals willfully made others suffer, so why should they not suffer as a result?
These prosecutors ruin lives, willfully, and have driven some to end theirs. Surely, the least that must happen is they lose the authority to continue doing so?
Thank you for your words and insight. Few in our community understand how the justice system works, especially at the federal level. We need that understanding if we're to make productive changes to it. Thank you for sharing yours with us!

Add new comment