Today, we save the Internet (again): fix the CFAA!

Read this if you want to stay out of jail.

When my friend Aaron Swartz committed suicide in January, he'd been the subject of a DoJ press-release stating that the Federal prosecutors who had indicted him were planning on imprisoning him for 25 years for violating the terms of service of a site that hosted academic journals. Aaron had downloaded millions of articles from that website, but that wasn't the problem. He was licensed to read all the articles they hosted. The problem was, the way he downloaded the articles violated the terms and conditions of the service. And bizarrely -- even though the website didn't want to press the matter -- the DoJ decided that this was an imprisonable felony, under the Computer Fraud and Abuse Act, which makes it a crime to "exceed your authorization" on any online service.

The DoJ reasoned that if the law said that doing anything "unauthorized" was a crime, and if the long, gnarly hairball of legalese that no one reads before clicking "I agree" set out what you were allowed to do, then violations of that "agreement" were a felony.

Aaron's death galvanized some Congresscritters to do something about this oversight. The ancient CFAA predated the widespread use of terms of service in everyday activities like hanging out with your friends, reading the newspaper, getting an education or signing up for a dating service. Congress did not intend to create a situation where companies that provided services could put any unreasonable condition they wanted into an "agreement" you might never see ("By using this website, you accept all terms and conditions") and then ask the DoJ to put people in prison for decades if they violated them.

The reform to CFAA was welcome and long overdue. But the DoJ has asked some members of the House Judiciary Committee to make it worse.

Under the amendments, which might be voted on as early as April 10, violating terms of service could be defined as racketeering -- so that you could be prosecuted as though your violation of terms of service made you into a mobster.

They also add "conspiring" to violate terms of service to the list of offenses that are a felony under the CFAA. So you can be thrown in jail just for talking about ways to violate terms of service.

The amendments also make it a felony to obtain information that you are entitled to obtain, if you do so in a way that violates terms of service. My wife and I share some online accounts, including our "family" airmiles account with British Airways, which we both contribute to and use, but only my wife can see the details of them (she signed up for the service, so it's linked to her login). We're both entitled to see those details, but poor service design makes it impossible to do this without sharing a login and password. No problem, except that BA's terms of service forbid this. So looking up my own airmiles, which I earned, and which I'm entitled to see and use, would be a felony under these amendments because I was looking at them in a way that violates BA's terms.

The amendments also include increased powers for seizure of property, which will enable the Feds to take away the assets you might use to defend yourself against a CFAA claim.

This is a trainwreck. It will allow the DoJ to put every single American Internet user in prison at their discretion, because we all violate terms of service every day. For example, Seventeen magazine's terms of service forbid you from visiting its website if you're under eighteen (!), and that means that its 4.5 million underage readers would all be felons under the CFAA, and liable to decades in prison.

The fact that Congress is contemplating this is a testament to its awful authoritarian venality. The fact that they're doing it as part of a reform triggered by Aaron's death is a fucking travesty.

Aaron helped design the widgets that put through 8,000,000 phone calls to Congress about the awfulness of SOPA and killed legislation that everyone on the inside considered unstoppable. Now, Demand Progress -- the group Aaron helped found -- has got another "Tell Congress" widget, which we've embedded for today. You can (and should) embed it too. You can get your own at, along with a cute tool to put your social media profile photo behind bars and let your friends know what's going on.

Today, we save the Internet. Again.

Demand Justice for Aaron Swartz


  1. What about mashups and API consumption? You are many times accessing websites indirectly (think embedded Google Maps). Also, I am sure this rule will be solemnly ignored according to who is accessing the website. Otherwise, I would just have a lot of fun adding the following disclaimer to any website:
    “You are not authorised to access this site if you are or have been a member of the US congress”

  2. So if a Congresscritter makes a campaign promise online and then fails to do it can we throw them in jail?

    I really wish before they could inflict these things on the people they had to live with them for a year themselves.

  3. What was Aaron’s view on pop-up forms appearing every fucking time a page is loaded, even if you’re one of the 95% of the world’s population that cannot meaningfully compile it?

  4. I think everyone should have a boilerplate EULA for engaging in conversation with them. Then, when a law enforcement official decides to engage you in conversation, you state that by engaging your conversation they agree to the following *whatever etc. etc.* – like reverse Miranda rights. Stuff like “if you perjure yourself about the contents of either party’s half of the conversation or physical actions conducted therein, in a court of law, you could be subject to severe [i wish I could add ‘and overly-punitive’ but that tongue-in-cheek wouldn’t work well here] civil and criminal penalties…” 

    and “if any statements are recorded, that recording must be preserved for a minimum of 5 years and/or handed over to the subject(s) of the recording for preservation in case of any civil or criminal actions against any party participating in the filming of the recording.”

    and “I reserve the right to record myself in any situation in which I feel threatened or that I feel might protect my innocence in a court of law” 

    Anyone got any more ideas for this?

    I’m liking it! We can call them Aaron’s Rights. :)

    [edit: Oh, and if this turns out to be legally invalid for private citizens, form a single-person LLC for yourself and have the EULA apply to interactions with your corporation in the form of yourself. If corporations are citizens and can force this upon other citizens, citizens should become corporations to force this *equally* upon everyone (until we all realize how utterly crazy and nonsensical things have become)]

Comments are closed.