Rep. Zoe Lofgren has introduced a bill to amend the CFAA, which is the law that federal prosecutors used to prosecute Aaron Swartz. A PDF of the proposed legislation can be found here. The amendment changes the language of the CFAA so that mere violation of a website’s terms of service can no longer be construed as a federal felony.
That’s right. Did you know that violating a website’s Terms of Service could make you a felon and subject you to up to 20 years in prison? If you didn’t, don’t worry: you’re probably no different than most Americans. That’s because the CFAA doesn’t actually state expressly that violating a website’s Terms of Service is a crime under the CFAA. Here is the relevant language of one of the statutes in question:
Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both.
And:
Whoever … knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value … shall be punished … [with fines or imprisonment up to 20 years depending on the specific provision violated…]
Federal prosecutors used these incredibly broad statutes to charge Aaron Swartz with 13 felonies for doing no more than breaching a website’s Terms of Service—or rather, breaching a contractual agreement.
To give you an idea of how absurd this is, consider the following: when you agree to a website’s Terms of Service, you are entering into a contract. Breach of Contract is traditionally a civil wrong, meaning that you can be held liable for economic damages, but not for criminal penalties. Even Fraud is traditionally a tort: it is a civil wrong that makes you economically liable to the injured party, but does not subject you to criminal penalties.
Federal prosecutors used the overbroad language of the CFAA to turn a civil wrong into a federal felony. What should have been a private right of action was turned into a serious federal criminal offense by federal prosecutors with an ax to grind. Indeed, the Ninth Circuit Court of Appeals, in a 9-2 en banc opinion, decided in April of last year that Federal prosecutors should not be using the anti-hacking provisions of the CFAA to prosecute what amounts to a civil wrong:
In the case of the CFAA, the broadest provision is subsection 1030(a)(2)(C), which makes it a crime to exceed authorized access of a computer connected to the Internet without any culpable intent. Were we to adopt the government’s proposed interpretation, millions of unsuspecting individuals would find that they are engaging in criminal conduct.
Unfortunately, the Ninth Circuit’s ruling is only binding within their West-coast jurisdiction, and thus was not applicable to Aaron Swartz’ prosecution.
How is it possible for prosecutors to use such vastly broad interpretations of federal law to charge people with crimes? There are various reasons for this, but several prominent factors come to mind. In a recent HuffPo article, Radley Balko discussed the vast power that is now wielded by American prosecutors. Balko notes that prosecutors derive much of their power from two chief sources: the ever-expanding number of criminal provisions that overpopulate the nation’s law books, and the deterioration of traditional legal protections that protected criminal defendants at trial—namely, the ancient requirement that a person intend to commit a criminal act in order to be found guilty:
There has also been a trend over the last 20 years or so toward laws that don’t require prosecutors to show criminal intent. This means you can be prosecuted for crimes you had no idea you were breaking — even laws you actively tried not to break. A 2010 study co-authored by the National Association of Criminal Defense Lawyers and the Heritage Foundation found that in its rush to criminalize more and more behavior, Congress has been passing poorly-drafted laws that increasingly lack any requirement at all to show intent. Even when intent is included, the study found, it tends to be vague and open to interpretation (which also means open to abuse) by prosecutors.
This all means that, as a practical matter, “If a prosecutor has it out for you, he can probably find a law he can plausibly argue you’ve broken.”
Balko is not the first one to describe this problem. On previous occasions, I’ve noted the Judge Posner’s remarks from a 1998 case in which he observed the increasingly obscure complexity of the federal criminal code:
The federal criminal code contains thousands of separate prohibitions, many ridiculously obscure, such as the one against using the coat of arms of Switzerland in advertising, or using “Johnny Horizon” as a trade name without the authorization of the Department of the Interior…
The problem was also discussed by civil rights lawyer Harvey Silvergate, who noted in his 2010 book that federal criminal statutes have become so vague and obscure that the average person arguably commits three felonies a day without even realizing it.
Lofgren’s bill is an urgently needed amendment that will prevent federal prosecutors from using the CFAA to convert a civil wrong into a serious criminal act. Prosecutors have a lot of power, but at the end of the day, they must still abide by the law. This bill is a small chip in the massive marble column that is the federal criminal code, and I urge you to support it.