In New York on Saturday, a public memorial was held for Aaron Swartz, who committed suicide last week. Among the remembrances of Aaron's genius, his commitment to progressive causes, his idealistic beliefs of making this a better world, there was also an action plan laid out by his partner, Taren Stinebrickner-Kauffman:

"Aaron was targeted by the FBI," said ThoughtWorks chairman Roy Singham, Swartz's employer before his death. "After PACER, they targeted him. He was strip-searched. Let's not pretend this wasn't political," he argued before being interrupted by applause.

Swartz's partner Taren Stinebrickner-Kauffman framed her call to action in terms of Swartz's beliefs: "Aaron believed there was no shame in failure. There is deep, deep shame in caring more about believing you're changing the world than actually changing the world."Stinebrickner-Kauffman, also an activist, named five targets for action:

• Hold the Massachusetts US Attorney's office accountable for its actions in prosecuting Aaron;
• Press MIT to ensure that it would "never be complicit in an event like this again";
• "All academic research for all time should be made free and open and available to anybody in the world";
• Pass and strengthen "Aaron's Law," an amendment to the Computer Fraud and Abuse Act that would narrow prosecutorial discretion for computer crimes;
• Advocate for fundamental reform of the criminal justice system.

"His last two years were not easy. His death was not easy," Stinebrickner-Kauffman said. Still, she urged the audience to "think big and think tiny… 'The revolution will be A/B tested,'" referencing three of Swartz's favorite maxims. "Look up and not down."

There is no justice in criminal justice when Aaron faced more time in prison than we give rapists and other violent criminals. While we can't know everything that was going through his mind at the time he decided to hang himself, we do know that just two days prior to his death, the US Attorneys involved in his case (Carmen Ortiz and Stephen Heymann) refused to entertain a plea deal by his attorney, saying that Swartz would have to plead guilty to each count and vowing to "aggressively pursue" his prosecution.

The US has become a society in which political and financial elites systematically evade accountability for their bad acts, no matter how destructive. Those who torture, illegally eavesdrop, commit systemic financial fraud, even launder money for designated terrorists and drug dealers are all protected from criminal liability, while those who are powerless - or especially, as in Swartz's case, those who challenge power - are mercilessly punished for trivial transgressions. All one has to do to see that this is true is to contrast the incredible leniency given by Ortiz's office to large companies and executives accused of serious crimes with the indescribably excessive pursuit of Swartz.

This immunity for people with power needs to stop. The power of prosecutors is particularly potent, and abuse of that power is consequently devastating. Prosecutorial abuse is widespread in the US, and it's vital that a strong message be sent that it is not acceptable. Swartz's family strongly believes - with convincing rationale - that the abuse of this power by Ortiz and Heymann played a key role in the death of their 26-year-old son. It would be unconscionable to decide that this should be simply forgotten.

Over on TechDirt, they're asking this question: Why, two days before Aaron Swartz' arrest, did the Secret Service take over handling of the case? Their question comes from Marcy Wheeler's excellent reporting on new documents disclosed in his case:

According to a suppression motion in his case, however, two days before Aaron was arrested, the Secret Service took over the investigation.

On the morning of January 4, 2011, at approximately 8:00 am, MIT personnel located the netbook being used for the downloads and decided to leave it in place and institute a packet capture of the network traffic to and from the netbook.This was accomplished using the laptop of Dave Newman, MIT Senior Network Engineer, which was connected to the netbook and intercepted the communications coming to and from it.Later that day, beginning at 11:00 am, the Secret Service assumed control of the investigation. [my emphasis]

In fact, in one of the most recent developments in discovery in Aaron’s case, the government belatedly turned over an email showing Secret Service agent Michael Pickett offering to take possession of the hardware seized from Aaron “anytime after it has been processed for prints or whenever you [Assistant US Attorney Stephen Heymann] feel it is appropriate.” Another newly disclosed document shows the Pickett accompanied the local cops as they moved the hardware they had seized from Aaron around.

Her point is well-taken: According to the Secret Service website, they get involved in computer crime investigations in limited situations, and downloading academic papers from JSTOR fits none of the criteria.

But if you go and look at the testimony of the Secret Service before Congress, you might find the answer there. In April 2011, Special Agent Pablo Martinez testified before the Senate Judiciary Subcommittee on Crime and Terrorism. The purpose of his testimony was to inform the subcommittee about measures to coordinate and investigate computer crimes which could result in economic loss. Buried in that testimony, there is this:

Continue reading »

F2C2012: Aaron Swartz keynote - "How we stopped SOPA", May 21, 2012

I know as I stare at the blank page in front of me that I cannot do justice to this post, that my feelings of sadness and anger will prevent me from the eloquence I wish I could have. So I apologize to you, the reader and I apologize to Aaron Swartz for failing to find the words that his memory is owed.

I knew of Aaron, having been on common lists and sharing common acquaintances and frequently, common political aspirations. But I can't say that we had much in the way of interactions. Still, what I knew of him, genius is not too strong a word. How else could you describe the person who developed RSS at the age of 14? Or sold Reddit to Conde Nast (effectively making him independently wealthy) at the age of 20? He could have sat back on his laurels then, but Aaron had a mission: to make information free and available to all on the internet. Remember, information is the ultimate democratizer and Aaron believed that the internet was a great democratizing tool.

But genius does not necessarily make you smart. Aaron took risks that were not wise and that others warned him against. And those risks ultimately cost Aaron Swartz his life.

Yes, Aaron took his own life. Yes, Aaron suffered from depression, which he wrote about as well as anyone else I've seen and instantly identifiable to anyone who has suffered from it as well.

But Aaron was also facing a terribly bleak future in prison for decades, although his actions hurt no one and put no one in danger. But he had the bad luck of his case coming across the desk of Carmen Ortiz, US Attorney in Massachusetts. Lawrence Lessig, one of Aaron's mentors:

But all this shows is that if the government proved its case, some punishment was appropriate. So what was that appropriate punishment? Was Aaron a terrorist? Or a cracker trying to profit from stolen goods? Or was this something completely different?

Early on, and to its great credit, JSTOR figured “appropriate” out: They declined to pursue their own action against Aaron, and they asked the government to drop its. MIT, to its great shame, was not as clear, and so the prosecutor had the excuse (s)he needed to continue his war against the “criminal” who we who loved him knew as Aaron.

Here is where we need a better sense of justice, and shame. For the outrageousness in this story is not just Aaron. It is also the absurdity of the prosecutor’s behavior. From the beginning, the government worked as hard as it could to characterize what Aaron did in the most extreme and absurd way. The “property” Aaron had “stolen,” we were told, was worth “millions of dollars” — with the hint, and then the suggestion, that his aim must have been to profit from his crime. But anyone who says that there is money to be made in a stash of ACADEMIC ARTICLES is either an idiot or a liar. It was clear what this was not, yet our government continued to push as if it had caught the 9/11 terrorists red-handed.

Continue reading »

This is not about Aaron Swartz but it is inspired by Aaron Swartz' specific circumstances. It is instead a post about prosecutorial discretion, and how crimes involving computers are often misunderstood and sensationalized for the purpose of scaring the general public and 'sending a message' to others out there.

We hear about cybercrime every day. We're under siege, they tell us. If it's not the Russian hackers, it's the child pornographers, or the gamers out to crack the copy protection codes, or Anonymous lurking behind every corner of the Internet, waiting to nail you for the lulz. Be afraid, little computer junkie. Your reliance on the Internet is fraught with danger but Uncle Fed is here to make it all better.

Aaron Swartz: Liberate Academia

Aaron Swartz took a laptop into an unlocked closet at MIT and downloaded academic research papers stored at JSTOR. Academic research papers we, the people, paid for. He objected to it being locked in a password-protected prison, available to academics but not the public at large.

I object to that as well. Every time I try to access scholarly research and find it locked in the JSTOR vault, I object to it, because I am not a student nor an academic, nor does my local library subscribe to JSTOR, and so it is inaccessible to me on all levels. Yet I paid for that research to be done.

I agreed with Swartz in 2010 when he did it and I agree with him now. The prosecutor in his case, however, did not. If the Grand Jury indictment is any indication, the assistant US Attorney in the case made Swartz seem like the guy who walked into the bar with a loaded AR-15 to rob the bartender of fifteen bucks. Here is but one small example:

As JSTOR, and then MIT, became aware of these efforts to steal a vast proportion of JSTOR's archive, each took steps to block the flow of articles to Swartz's computer and thus to prevent him from redistributing them. Swartz, in term, repeatedly altered the appearance of his Acer laptop and the apparent source of his automated demands to get around JSTOR's and MIT's blocks against his computer.

Horrors. In English, he downloaded a bunch of articles from JSTOR and when blocked, worked around the block to download some more. The phrasing, of course, makes it sound like he was the Academic Bandit, out to steal state secrets and sell them to terrorists.

Here is what he really did, according to the forensic analyst who was to be his expert witness in his trial:

Aaron did not “hack” the JSTOR website for all reasonable definitions of “hack”. Aaron wrote a handful of basic python scripts that first discovered the URLs of journal articles and then used curl to request them. Aaron did not use parameter tampering, break a CAPTCHA, or do anything more complicated than call a basic command line tool that downloads a file in the same manner as right-clicking and choosing “Save As” from your favorite browser.

Aaron did nothing to cover his tracks or hide his activity, as evidenced by his very verbose .bash_history, his uncleared browser history and lack of any encryption of the laptop he used to download these files. Changing one’s MAC address (which the government inaccurately identified as equivalent to a car’s VIN number) or putting a mailinator email address into a captured portal are not crimes. If they were, you could arrest half of the people who have ever used airport wifi.

Yet. Aaron Swartz was facing the possibility of going to jail for thirty-five years. That would be roughly equivalent to second-degree murder. For liberating academic articles?

Unjust justice.

Julie Amero: Wrong place, wrong time, wrong operating system

In 2007, Julie Amero had the misfortune to sign onto a compromised computer which unfortunately was sitting in the middle of a classroom full of school kids. As the malware triggered popup after popup in those days of Internet Explorer 6, Amero didn't know how to make it stop or what was in store for her as a result of nothing she actually did. Because she had been told by the regular classroom teacher not to turn off the computer, she didn't think that was an option to stop the flying popups parading across the screen. Ultimately, she did turn the monitor off, but it was too late.

The prosecutor in her case threw the book at her and the lead investigator was an incompetent with an ego the size of a three-terabyte hard drive. She was facing 40 years in jail for exposing children to pornography, and if it had not been for the efforts of a lot of people including computer forensic experts, Julie Amero would be serving time today. Even though the prosecutor agreed ultimately that she was not at fault for what happened, she still had to plead guilty to a lesser charge and agree never to teach children again.

Her husband passed away not long after her case was fully resolved, Julie Amero cannot ever earn a living as a teacher or substitute teacher again, and to this day she carries the stigma of the accusation because she was forced to plead to something in order to satisfy the prosecutor, who never should have brought charges in the first place.

Unjust justice.

I don't know what compels prosecutors to think they should deliver injustice in the form of cybercrime crusades at people. I don't know if it's their lack of understanding or the perception that the public is so fearful of those who commit crimes with a computer that they feel free to make examples of those who do not actually commit crimes with a computer but appear to have committed some kind of crime with one.

What I do know is that Aaron Swartz' partner, friends and family are heartbroken today, because he did not see a future with any hope in it, whatever the specific reason might have been.

What I do know is that Julie Amero lost everything, including her unborn child and perhaps her husband too, because she had the misfortune to boot up someone else's computer with an operating system infected from beginning to end with malware and spyware.

Neither of them committed crimes that caused harm to their neighbors, their communities, families, or anyone else. Neither of them actually committed crimes at all that I can see.

Yet their lives are inexplicably changed and not for the better because prosecutors thought they should make an example of them.

Something needs to change. Education? Rational laws? When we're having a huge national squabble over gun laws, doesn't it seem insane that these two people could have spent up to 40 years in federal prison for...what?

Rest in peace, Aaron Swartz. May your family find peace and comfort in knowing that perhaps there is a way to make sure what happened to you doesn't happen to another. May we all find that place.