Manning case tests computer fraud laws’ credibility

by John Naughton

The Observer

Do you think that, as a society, the United States has become a basket case? Well, join the club. I’m not just thinking of the country’s dysfunctional Congress, pathological infatuation with firearms, addiction to litigation, crazy healthcare arrangements, engorged prison system, chronic inequality, 50-year-old military-industrial complex and out-of-control security services. There is also its strange irrationality about the use and abuse of computers.

Two events last week provided case studies of this. The first was Bradley Manning’s conviction. Although acquitted of the most serious charge of “aiding the enemy,” he was convicted of six counts of violating the 1917 Espionage Act and on two counts of violating the Computer Fraud and Abuse Act (CFAA). In theory, he could face 136 years in jail for downloading secret government files and giving them to WikiLeaks.

Just to put that in perspective, cast your mind back to March, 16 1968, when a platoon of U.S. soldiers led by Second Lieutenant William Calley entered the hamlet of My Lai in what was then South Vietnam. They rounded up between 70 and 80 villagers and then shot them dead. In all, between 347 and 504 My Lai civilians were murdered that day by U.S. troops.

Eventually, there was a court martial, just like the one organized for Manning. Despite claiming that he was following orders from his commanding officer, Calley was convicted on March 29, 1971, of premeditated murder for ordering the shootings and was given a life sentence. Two days later, President Richard Nixon ordered that he should be released, pending an appeal against his sentence, which was later reduced. Calley eventually served 3½ years under house arrest at an army base.

So: 3½ years house-arrest for ordering and participating in the premeditated murder of scores of unarmed civilians. And potentially 136 years for downloading stuff — including compelling video evidence of a war crime by U.S. forces — and giving it to WikiLeaks. Makes you think, doesn’t it?

Where do computers come into this? Simply that the two convictions under the CFAA provide 20 extra prison years over and above what the Espionage Act stipulates. As the Electronic Frontier Foundation puts it: “In the government’s mind, the Espionage Act can be used to punish a leaker of information, and if that person merely used a computer to get that information, they are guilty of an additional felony. So someone who emails documents they got off a government computer to a journalist will face 10 more years per charge than a government official who photocopied documents he got off a shelf and physically mailed them to the same journalist.”

Last week also saw the publication of a Massachusetts Institute of Technology report into its role in the arrest and prosecution of Aaron Swartz, the young hacker who committed suicide last January after an aggressive prosecution by U.S. government lawyers. His alleged crime? To devise an ingenious way of downloading thousands of academic articles from the JSTOR archive using a laptop concealed in a cupboard at MIT and hooked up to the university’s network.

Nobody knows why Swartz did what he did. Given that he was an open-access activist, it’s possible that he disapproved of JSTOR’s paywall and wanted to make the fruits of academic research available to all. After he was arrested, he returned all of the downloaded copies to JSTOR, paid their legal expenses and JSTOR indicated that they would not be taking further legal action.

All this cut no ice with the prosecuting attorney, who saw her duty as “protecting the use of computers and the Internet by enforcing the law as fairly and responsibly as possible.” To that end, Swartz was arraigned on 13 felony counts — two of “wire fraud” and 11 of violations of the same CFAA that was used to top up Bradley Manning’s jail time.

The MIT inquiry was led by Professor Hal Abelson, one of MIT’s most distinguished computer scientists, and it is long (182 pages), thorough and dispassionate. Given that the Swartz case never got to trial, it is the most detailed account we are ever likely to get of the events leading up to his suicide.

It contains lots of lessons for MIT (and indeed any other university) and one for the rest of us: that the CFAA is a pernicious and flawed statute in urgent need of reform. Hard cases make bad law. But bad law also makes for hard cases. Just ask the Manning and Swartz families.