We hear about cybercrime every day. We're under siege, they tell us. If it's not the Russian hackers, it's the child pornographers, or the gamers out to crack the copy protection codes, or Anonymous lurking behind every corner of the Internet, waiting to nail you for the lulz. Be afraid, little computer junkie. Your reliance on the Internet is fraught with danger but Uncle Fed is here to make it all better.
Aaron Swartz: Liberate Academia
Aaron Swartz took a laptop into an unlocked closet at MIT and downloaded academic research papers stored at JSTOR. Academic research papers we, the people, paid for. He objected to it being locked in a password-protected prison, available to academics but not the public at large.
I object to that as well. Every time I try to access scholarly research and find it locked in the JSTOR vault, I object to it, because I am not a student nor an academic, nor does my local library subscribe to JSTOR, and so it is inaccessible to me on all levels. Yet I paid for that research to be done.
I agreed with Swartz in 2010 when he did it and I agree with him now. The prosecutor in his case, however, did not. If the Grand Jury indictment is any indication, the assistant US Attorney in the case made Swartz seem like the guy who walked into the bar with a loaded AR-15 to rob the bartender of fifteen bucks. Here is but one small example:
As JSTOR, and then MIT, became aware of these efforts to steal a vast proportion of JSTOR's archive, each took steps to block the flow of articles to Swartz's computer and thus to prevent him from redistributing them. Swartz, in term, repeatedly altered the appearance of his Acer laptop and the apparent source of his automated demands to get around JSTOR's and MIT's blocks against his computer.
Horrors. In English, he downloaded a bunch of articles from JSTOR and when blocked, worked around the block to download some more. The phrasing, of course, makes it sound like he was the Academic Bandit, out to steal state secrets and sell them to terrorists.
Here is what he really did, according to the forensic analyst who was to be his expert witness in his trial:
Aaron did not “hack” the JSTOR website for all reasonable definitions of “hack”. Aaron wrote a handful of basic python scripts that first discovered the URLs of journal articles and then used curl to request them. Aaron did not use parameter tampering, break a CAPTCHA, or do anything more complicated than call a basic command line tool that downloads a file in the same manner as right-clicking and choosing “Save As” from your favorite browser.
Aaron did nothing to cover his tracks or hide his activity, as evidenced by his very verbose .bash_history, his uncleared browser history and lack of any encryption of the laptop he used to download these files. Changing one’s MAC address (which the government inaccurately identified as equivalent to a car’s VIN number) or putting a mailinator email address into a captured portal are not crimes. If they were, you could arrest half of the people who have ever used airport wifi.
Yet. Aaron Swartz was facing the possibility of going to jail for thirty-five years. That would be roughly equivalent to second-degree murder. For liberating academic articles?
Unjust justice.
Julie Amero: Wrong place, wrong time, wrong operating system
In 2007, Julie Amero had the misfortune to sign onto a compromised computer which unfortunately was sitting in the middle of a classroom full of school kids. As the malware triggered popup after popup in those days of Internet Explorer 6, Amero didn't know how to make it stop or what was in store for her as a result of nothing she actually did. Because she had been told by the regular classroom teacher not to turn off the computer, she didn't think that was an option to stop the flying popups parading across the screen. Ultimately, she did turn the monitor off, but it was too late.
The prosecutor in her case threw the book at her and the lead investigator was an incompetent with an ego the size of a three-terabyte hard drive. She was facing 40 years in jail for exposing children to pornography, and if it had not been for the efforts of a lot of people including computer forensic experts, Julie Amero would be serving time today. Even though the prosecutor agreed ultimately that she was not at fault for what happened, she still had to plead guilty to a lesser charge and agree never to teach children again.
Her husband passed away not long after her case was fully resolved, Julie Amero cannot ever earn a living as a teacher or substitute teacher again, and to this day she carries the stigma of the accusation because she was forced to plead to something in order to satisfy the prosecutor, who never should have brought charges in the first place.
Unjust justice.
I don't know what compels prosecutors to think they should deliver injustice in the form of cybercrime crusades at people. I don't know if it's their lack of understanding or the perception that the public is so fearful of those who commit crimes with a computer that they feel free to make examples of those who do not actually commit crimes with a computer but appear to have committed some kind of crime with one.
What I do know is that Aaron Swartz' partner, friends and family are heartbroken today, because he did not see a future with any hope in it, whatever the specific reason might have been.
What I do know is that Julie Amero lost everything, including her unborn child and perhaps her husband too, because she had the misfortune to boot up someone else's computer with an operating system infected from beginning to end with malware and spyware.
Neither of them committed crimes that caused harm to their neighbors, their communities, families, or anyone else. Neither of them actually committed crimes at all that I can see.
Yet their lives are inexplicably changed and not for the better because prosecutors thought they should make an example of them.
Something needs to change. Education? Rational laws? When we're having a huge national squabble over gun laws, doesn't it seem insane that these two people could have spent up to 40 years in federal prison for...what?
Rest in peace, Aaron Swartz. May your family find peace and comfort in knowing that perhaps there is a way to make sure what happened to you doesn't happen to another. May we all find that place.
