By Christie Thompson, ProPublica, Jan. 18, 2013

When Reddit co-founder and internet freedom activist Aaron Swartz committed suicide last Friday, he was facing up to 13 felony counts, 50 years in prison, and millions of dollars in fines. His alleged crime? Pulling millions of academic articles from the digital archive JSTOR.

Prosecutors allege that Swartz downloaded the articles because he intended to distribute them for free online, though Swartz was arrested before any articles were made public. He had often spoken publicly about the importance of making academic research freely available.

Other online activists have increasingly turned to computer networks and other technology as a means of political protest, deploying a range of tactics — from temporarily shutting down servers to disclosing personal and corporate information.

Most of these acts, including Swartz's downloads, are criminalized under the federal Computer Fraud and Abuse Act (CFAA), an act was designed to prosecute hackers. But as Swartz's and other "hacktivist" cases demonstrate, you don't necessarily have to be a hacker to be viewed as one under federal law. Are activists like Swartz committing civil disobedience, or online crimes? We break down a few strategies of "hacktivism" to see what is considered criminal under the CFAA.

Publishing Documents

Accessing and downloading documents from private servers or behind paywalls with the intent of making them publicly available.

Swartz gained access to JSTOR through MIT's network and downloaded millions of files, in violation of JSTOR's terms of service (though JSTOR declined to prosecute the case). Swartz had not released any of the downloaded files at the time his legal troubles began. 

The most famous case of publishing private documents online may be the ongoing trial of Bradley Manning. While working as an intelligence analyst in Iraq, Manning passed thousands of classified intelligence reports and diplomatic cables to Wikileaks, to be posted on their website.

"I want people to see the truth… regardless of who they are… because without information, you cannot make informed decisions as a public," Manning wrote in an online chat with ex-hacker Adrian Lamo, who eventually turned Manning in to the Department of Defense.

Both Swartz and Manning were charged under a section of the CFAA that covers anyone who "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer…"

The charges hinge on an interpretation of this section that says anyone in violation of a website's terms of service is an unauthorized user. Because they're unauthorized, all of their activity on that website could therefore be considered illegal. Both were charged with felonies under the CFAA, on top of other allegations.

The Ninth and Fourth Circuit Court of Appeals have ruled that such an interpretation of the CFAA casts too wide a net. With the circuit courts divided over whether a broad definition of "unauthorized" is constitutional, it may fall on the Supreme Court to ultimately decide.

Assistant U.S. Attorney Steve Heymann of Massachusetts was the lead prosecutor in Swartz's case. (He was known for winning a 2010 case that landed hacker Albert Gonzalez 20 years in prison.) Heymann offered Swartz a plea bargain of six months in prison but Swartz's defense team rejected the deal, saying a felony and any time behind bars was too harsh a sentence. Swartz's family blamed his death in part on "intimidation and prosecutorial overreach."

As a result of Swartz's suicide, some lawmakers are now calling for a review of the CFAA. On Tuesday, Rep. Zoe Lofgren (D-Calif.) proposed a piece of legislation called "Aaron's Law," which would amend the law to explicitly state that merely violating a site's terms of service cannot fall under the federal CFAA.

Distributed Denial of Service

A Distributed Denial of Service, or DDoS attack, floods a web site's server with traffic from a network of sometimes thousands of individual computers, making it incapable of serving legitimate traffic.

Continue reading »

Rep. Zoe Lofgren (D-CA) introduced “Aaron’s Law” on Tuesday night, announcing it via the user-generated site Reddit. The piece of legislation would modify the the Computer Fraud and Abuse Act to exclude terms of service violations. “There’s no way to reverse the tragedy of Aaron’s death, but we can work to prevent a repeat of the abuses of power he experienced,” Lofgren wrote. “The government was able to bring such disproportionate charges against Aaron because of the broad scope of the Computer Fraud and Abuse Act (CFAA) and the wire fraud statute.” Read the full bill here.

Meanwhile, The Hill reports that federal prosecutors came under fire yesterday by lawmakers for their "ridiculous and trumped-up" charges against Aaron Swartz:

“The charges were ridiculous and trumped-up,” Rep. Jared Polis (D-Colo.) told The Hill. “It's absurd that he was made a scapegoat. I would hope that this doesn't happen to anyone else.”

Polis called Swartz — a co-creator of Reddit who was accused of stealing articles from a computer archive at the Massachusetts Institute of Technology — a "martyr" for why Congress should limit the discretion of prosecutors.

Rep. Zoe Lofgren (D-Calif.) said the government's handling of the case was “pretty outrageous.”

“Based on what I know, I think the Department of Justice was way out of line on the case,” she told The Hill.

Rep. Darrell Issa (R-Calif.) has said that his Oversight panel will take a look at the case to determine if the federal prosecutors acted inappropriately:

Issa expressed sympathy with some of Swartz’s goals. While “cybercrime and hacking has to be taken seriously,” he said, Congress should take up Swartz's cause of making more information freely available to the public.

“We're looking at the real question of open government,” Issa said. “Has the government or even MIT been holding back materials that the public has a right to know?”

Issa said he wanted to make sure “that what is paid for is as widely available as possible to the American people.”

Many materials on JSTOR are funded by public universities or government research grants. Subscriptions to JSTOR cost thousands of dollars.

He also said “whether or not there was excessive prosecution is something we’ll look at.”

All three lawmakers -- Issa, Polis, and Lofgren -- serve on the House Judiciary Committee, which has jurisdiction over the Justice Department. They also worked with Swartz and his group "Demand Progress" in 2012 to defeat online piracy legislation that was backed by the entertainment industry.

Aaron Swartz keynote - "How we stopped SOPA" at F2C:Freedom to Connect 2012, Washington DC on May 21 2012.

The websites of the U.S. Department of Justice and the Massachusetts Institute of Technology (MIT) were knocked offline on Sunday, and the work is being attributed to the hacktivist collective, Anonymous.

DOJ.gov and MIT.edu were both back online Monday morning.

The action was taken as a tribute to the late Aaron Swartz, a co-founder of the site Reddit.com and at the age of 14, co-developed the RSS web protocol that is the key component of much of the internet's publishing infrastructure.

In another tribute, hundreds of academics worldwide have begun tweeting links to their copyright-protected research in Swartz's honor, using the hastag #pdftribute. Links from Twitter posts with the hashtag are being collected at Pdftribute.net. The links appear to be to academic papers.

In a statement about his death, Aaron’s family and partner wrote in part:

"Aaron’s insatiable curiosity, creativity, and brilliance; his reflexive empathy and capacity for selfless, boundless love; his refusal to accept injustice as inevitable—these gifts made the world, and our lives, far brighter. We’re grateful for our time with him, to those who loved him and stood with him, and to all of those who continue his work for a better world..."

"Aaron’s death is not simply a personal tragedy. It is the product of a criminal justice system rife with intimidation and prosecutorial overreach. Decisions made by officials in the Massachusetts U.S. Attorney’s office and at MIT contributed to his death...Today, we grieve for the extraordinary and irreplaceable man that we have lost.”

Aaron’s funeral will be held at 10 a.m. on Tuesday, January 15th at Central Avenue Synagogue, 874 Central Avenue, Highland Park, Illinois 60035. Announcements about memorial services in other cities will be posted here in coming weeks.

If you ever have thoughts of suicide please speak to someone, in the USA call 1-800-273-8255 or find numbers for your country here.

The hacktivist collective Anonymous has released what it claims to be a cache of personal details of members of the Westboro Baptist Church, after members of the extremist religious group said on Twitter that they would picket Sandy Hook Elementary School in Newtown, Connecticut, the scene of a mass shooting where 26 children and adults were killed on Friday.

Supporters of Anonymous appeared to have taken down the extremist group’s website, most likely through a distributed denial of service, or DDoS attack. They also posted a YouTube video (above) threatening to “destroy” the group.

Westboro is a small extremist group based in Topeka, Kansas, notorious for picketing the funerals of soldiers and victims of shootings with signs and banners claiming tragic events are God’s punishment for the existence of homosexuality.

A document posted on Pastebin claims to reveal physical addresses of the group’s founding Phelps family, telephone numbers, even a social security number, and background information on the group. It's unclear how public these personal details already were for Westboro’s members, given their controversial activities.

A representative of Westboro, believed to be its regular spokeswoman Shirley Phelps-Roper, also carried out a Reddit IAmA, or “Ask Me Anything,” earlier Sunday under the nickname GodSentCTShooter, not surprisingly meeting few questions and plenty of irritation from Redditors.

This isn’t the first time Westboro and Anonymous have clashed. In February 2011 a supporter of Anonymous took part in a radio debate with Shirley Phelps-Roper, during which a small group of hackers surprised Roper by taking down several parts of Westboro’s site during the show.

Anonymous has trounced Reddit to take the top spot in the 2012 Time 100 poll, an annual list of the world’s 100 most influential people. With Time posed to pick the ‘real’ winner, the Internet has had its say in who is really shaping the world.

Time:

When the poll closed at 5 p.m. on Friday, Anonymous had racked up more than 395,000 “yes” votes, up from just 40,000 a day earlier, leapfrogging not only over Martin (who ends up with over 264,000 “yeses”) but also over Narendra Modi, the Chief Minister of India’s Gujarat state, who finishes in third place. Modi supporters had shown some muscle during the polling: they cast nearly 257,000 “yes” votes for their favorite. The controversial politician, however, had high negatives: he received almost 267,000 thumbs-down votes.

The full list of nominees here.

Another message from the Anonymous collective. This time, they want war.

To the Citizens of the United States and the United States Government.
We are Anonymous.

In the past few months, our collective has been organizing the operation known as Operation Blackout. Part of the operation's purpose was to alert the people of the coming bill that was to be called the Stop Online Piracy Act.

This Act would give Congress the power to censor any internet website they wish without consent from the Citizens of the United States. This act would've also had the power to jail any person who infringed on its new copyright law for an equivalence of five years. This copyright law would've had the power to destroy social networking sites such as Facebook and YouTube. Video gameplay and free movies would cease to exist.

However, Operation Blackout was a success. As a collective, we've managed to spread the word and alert the masses. Internet giants such as Google, Wikipedia, and Reddit became hand-in-hand with us as we all managed to make an impact on the decisions of our, "free government". But as we've seen with Megaupload, the government may not need a bill to be passed to get their way. Other operations we've conducted over this time period have awaken the people to the nightmare that is the United States Government. Sections 1031 and 1032 of the National Defense Authorization Act have been ratified. Yet we face new threats.

The United States Government is seeking to pass the Cyber Security Act of 2012. This act is as Orwellian as it sounds; it will endanger our collective and we will not stand by and watch while this government of lies prepares to take away our freedoms. The National Security Agency insists on labeling us as a leaderless, terrorist organization. The question is, "who do we terrorize?". Can it possibly be that the United States government is truly scared of us? Nevertheless, The time for action is now.

Continue reading »