Bill To Rein In Federal Abuse Of CFAA Law Hits Congress; Named For Aaron Swartz
June 20, 2013 by Ben Bullard
A bill that aims to rein in the vague and easily-misapplied Computer Fraud and Abuse Act (CFAA), and hopefully curb a pattern of government bullying of online dissenters, was introduced in Congress today.
Congressmen Ron Wyden (D-Ore.) and Zoe Lofgren (D-Calif.) introduced thebill before the House of Representatives after soliciting input from the online Reddit community to help ensure the measure’s integrity.
Dubbed “Aaron’s Law” to honor the late Aaron Swartz, the bill is intended to end the government’s ability to use the CFAA to harass people who attempt civil disobedience but, because of CFAA’s current broadness, end up facing felony prosecution. Swartz killed himself earlier this year in the midst of an ongoing Federal investigation that, under the CFAA, could have sent him to prison for decades for sharing a trove of academic documents (most of which were created with public funds) to the internet.
The bill has the endorsement of the tech media, which has grown more and more incensed with the Administration of President Barack Obama as Federal scandals involving abuse of phone surveillance powers, broad online spy programs and targeted bullying of internet-based political activists continue to mount.
The two Congressmen made a strong case against enabling the U.S. Department of Justice and the FBI with pliable, permissive laws like CFAA in an opinion piece they co-authored for Wired magazine:
Vagueness is the core flaw of the CFAA. As written, the CFAA makes it a federal crime to access a computer without authorization or in a way that exceeds authorization. Confused by that? You’re not alone. Congress never clearly described what this really means. As a result, prosecutors can take the view that a person who violates a website’s terms of service or employer agreement should face jail time.
So lying about one’s age on Facebook, or checking personal email on a work computer, could violate this felony statute. This flaw in the CFAA allows the government to imprison Americans for a violation of a non-negotiable, private agreement that is dictated by a corporation. Millions of Americans — whether they are of a digitally native or dial-up generation — routinely submit to legal terms and agreements every day when they use the Internet. Few have the time or the ability to read and completely understand lengthy legal agreements.
Another flaw in the CFAA is redundant provisions that enable a person to be punished multiple times … for the same crime. …This allows prosecutors to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a single, solitary act.
In Swartz’ case, that’s exactly what happened.
But Aaron’s Law would clarify and rework the definition of “exceeds authorization” so that the burden of proof to demonstrate a suspect’s evil intent would fall on the state – rather than giving the state carte blanche to investigate and charge someone based on an obvious technicality. It would also change the overlapping sentencing provision in order to “ensure that the penalty enhancement is directed at repeat offenders rather than individuals facing multiple charges.”