Aaron's Law: Violating a Site's Terms of Service Should Not Land You in Jail

It won't bring him back. But the loss of the Internet activist has prompted a bill in Congress that would protect others from the same kind of prosecutorial abuse.

A week ago, Aaron Swartz -- social activist, geek genius -- took his own life. Facing the choice between a federal prosecutor who insisted that he either accept the label "felon" and go to jail or fight a million-dollar lawsuit against 13 felony indictments, Aaron took the third option, and hanged himself. And with that we all lost an incredible soul, one who had literally spent half of his 26-year-old life doing nothing except working for (at least his conception of) the public good.

Aaron's alleged "crime" was that he used MIT's network to access a database of academic journal articles (JSTOR) and download millions of those articles to his laptop computer. He didn't "hack" the network to secure those downloads: MIT is a famously open network. He didn't crack any special password system to get behind JSTOR's digital walls. He simply figured out how JSTOR was filing the articles that he wanted, and wrote a simple script to quickly gather those articles and then copy them to his machine.

We will never know for sure why Aaron did what he did. Any motives disclosed to his attorneys must remain secret. So the most the world can do is to speculate: What possible reason could Aaron have had for the JSTOR dump? And plenty of speculation there is:

One blog, for example, the famous kottke.org, speculates that Aaron wanted to run an academic analysis on the articles that he had taken. While at Stanford, Swartz had worked with a law student to download all the law review articles in the Westlaw database, to map funders of research with research conclusions. The result of that research was published in the Stanford Law Review, and showed a troubling connection between funders and their conclusions. At the time of Aaron's alleged "crime," he was a fellow at my Center at Harvard. The work of the Center? Studying the corruption of academic research (among other institutions) caused by money.

Democracy Now! has suggested a different motive. It uncovered a speech that Aaron gave at the University of Illinois at Urbana-Champaign in the fall of 2010, in which he may have been urging students to take advantage of the access that they had to sites like JSTOR to give the third world the same access to scholarly material. On this theory, Aaron's aim would have been to liberate JSTOR for the developing world -- a market in which JSTOR was not then flourishing.

The evidence supports both of these possibilities, though not perfectly in either case, and others too. What isn't supported are the accounts the government suggested in their breathless and ignorant press releases and indictment. There's nothing to support the idea that Aaron was simply going to "liberate" JSTOR -- Swartz was not a copyright anarchist, and any effective first-world distribution would easily have been taken down. Even more absurd was the suggestion that Swartz was trying to make money with the scholarly articles he had downloaded. Trust me on this: However much academics love articles from the Harvard Law Review, that love does not translate into money.

So what he actually intended the public cannot know. And if the public cannot know, the government certainly did not know. But that doesn't matter under the law as it stands. All the government had to show to launch its witch hunt against this young activist was that he had violated JSTOR's "terms of service" and taken (as in copied) something worth more than $5,000.

The "terms of service" (TOS) of any website are basically a contract. They constitute an agreement about what you can and can't do, and what the provider can and can't do. Not everything on a website is governed by contract alone: Copyright and privacy law can impose property-like obligations independent of a TOS. But the rules Aaron were said to have violated purported to limit the amount of JSTOR that any user was permitted to download. They were rules of contract. Aaron exceeded those limits, the government charged. He therefore breached the implied contract he had with JSTOR. And therefore, the government insists, he was a felon.

It's that last step that is so odd within the tradition of American law. Contracts are important. Their breach must be remedied. But American law does not typically make the breach of a contract a felony. Instead, contract law typically requires the complaining party to prove that it was actually harmed. No harm, no foul. And in this case, JSTOR -- the only plausible entity "harmed" by Aaron's acts -- pled "no foul." JSTOR did not want Swartz prosecuted. It settled any possible civil claims against Swartz with the simple promise that he return what he had downloaded. Swartz did. JSTOR went away.

But the government did not. In the weeks before his death, the government reaffirmed what they had been insisting upon for the 18 months before: jail, a felony conviction, and a bankrupting fine, or else Swartz was going to face a bankrupting trial.

This rule of American law is absurd -- especially in a world where prosecutors can't be trusted to make reasoned and proportionate judgments about who should be labeled a felon and who should not. A breach of contract is a breach of contract. It is not an act of treason. It is not a threat to the realm. If every breach of contract worth more than $5,000 were a crime, Manhattan wouldn't be the world's most amazing city. Manhattan would be a federal penitentiary, with every prominent Wall Street firm very well represented. Fail to execute a trade on time? Two years in jail. Back out on an acquisition? Thirty to life.

Computer law is different, however, because Congress didn't really understand this "wild west" (as the network was called when Congress passed the Computer Fraud and Abuse Act in 1986), and because geeks make them uncomfortable. For 25 years, the CFAA has given federal prosecutors almost unbridled discretion to bully practically anyone using a computer network in ways the government doesn't like. It does that by essentially criminalizing the violations of a site's "terms of service" in combination with obtain[ing] anything of" at least $5,000 in value. And even if in the vast majority of cases prosecutors exercised that discretion, well, in this case the abuse of that discretion has ended in tragedy. As Tim Wu so brilliantly describes, we have built a system of criminal law that depends upon our trusting the government. Few civil libertarians from either the right or the left, though, will be surprised that it turns out that the bureaucrats manning the battle stations cannot be trusted.

Aaron Swartz is dead -- in my view, as a friend who knew him well for more than a decade --at least in part because of this breach of its duty by the government. Carmen Ortiz, the U.S. Attorney overseeing the prosecution, demonstrated that breach with the ignorance she displayed when this indictment was announced. As she said then, "Stealing is stealing, whether you use a computer command or a crowbar," -- demonstrating she knows nothing about computers, and apparently nothing about crowbars. And the line prosecutor working for her breached that trust when he made it clear that his first priority was not decency or proportionality but one more notch on his prosecutor's belt, for a prosecution that had nothing to do with keeping America safe from "criminals."

But now Congress may actually do something to remedy at least part of this important flaw. Congresswoman Zoe Lofgren (D-CA) has introduced a draft bill -- importantly, first on Reddit, a platform Aaron had helped to build, and, once she gets the Net's feedback, in the United States Congress -- to change this rule of the CFAA and return contract law to its civil home. Her bill, which she calls "Aaron's Law," would limit the scope of the Computer Fraud and Abuse Act and exclude "crimes" that are nothing more than a breach of contract. No more "felonies." No more prosecutions resulting in prison sentences. Violations of the "terms of service" would be a breach, not a crime. Had that change been made before Aaron's death, the government's felony charges would likely have collapsed. Had the government's charges collapsed, Aaron Swartz, in my view, would still be frantically working to make the world a better place.

Lofgren should be praised for her quick and smart response to the mess that brought about this tragedy. This isn't the only change that computer and copyright law require. It's not even on the top 10 list of the causes Aaron was fighting for.

But it is an important start, and more changes can be added as people review the Reddit draft. And with the bipartisanship demonstrated by Darrell Issa's comments about this tragedy, it may well be an idea that even this Congress could pass.

It won't bring Aaron back. It won't restore his devastated family, or bring peace to his bewildered friends. But it could fix an important flaw in the law regulating the Internet, and more importantly, send a critical message to our insanely powerful government: You need to earn your trust with every single prosecution. And the fastest way to lose it is to bully to death a brilliant boy whose only real crime was to expect more from all of us -- and especially from the law.