Aaron Swartz
Image: Fred Benenson
When the leader of a computer crime ring was sentenced in Boston to 20 years in prison for his role in one of the country's largest-ever hacking cases in 2010, U.S. Attorney Carmen Ortiz vowed publicly to "use all available resources" to investigate and prosecute cyber criminals no matter where in the world the crime is committed.
Just months later, federal prosecutors under Ortiz's leadership didn't have to look far to build the controversial hacking case against entrepreneur and political activist Aaron Swartz, who was charged in 2011 in Boston federal district court with the unauthorized use of a university's networks to download millions of articles from the online archive of scholarly literature at the nonprofit JSTOR.
"Stealing is stealing whether you use a computer command or a crowbar, and whether you take documents, data, or dollars," Ortiz, the U.S. attorney for the District of Massachusetts since 2009, declared when she announced the charges against Swartz, a prominent figure in the advocacy for a free, open internet. "It is equally harmful to the victim whether you sell what you have stolen or give it away."
Swartz's suicide on Friday in New York at the age of 26 instantly triggered a wave of criticism of Ortiz and top prosecutors in her office, including Stephen Heymann, for their alleged overzealousness in the pursuit of criminal charges and for the insistence of incarceration as punishment. With the spotlight on Heymann, a career prosecutor, and Ortiz, who was appointed to the post under President Barack Obama, digital rights advocates are urging a review of the case itself and of the laws under which Swartz was indicted.
Supporters of Swartz blame the prosecution — including the emotional and physical toll of fighting charges from indictment to trial — as a contributing factor in the death. Swartz, who had long battled depression, was scheduled to go to trial in April in U.S. District Court for the District of Columbia. In the eyes of Swartz's champions, he's a hero of sorts — someone who wanted to put information into the public domain. A headline in the Boston Globe today called Swartz "the humanist hacker."
On the flipside, a prominent scholar of computer crime on Monday defended the merits of the charges, calling them the stuff that any good prosecutor would bring. And former prosecutors who've worked with Ortiz and Heymann, chief of the cyber crimes unit in the Boston federal prosecutors' office, contend that neither lawyer carries a reputation for unfairness. Swartz faced a potential maximum prison sentence of more than three decades, but prosecutors had offered a deal in which he would have spent six months behind bars.
Heymann is "not a cowboy," said Stephen Huggard, chair of the white collar practice at Edwards Wildman Palmer and a former chief of the public integrity section in the U.S. Attorney's Office in Boston. "His decisions are carefully considered. He's not trying to get a notch in his belt."
Heymann has long been recognized as a national expert in electronic crimes, prosecuting cutting-edge cases. Heymann, whose father was a top lawyer in DOJ under Attorney General Janet Reno, was a lead prosecutor on a high-profile case in 1996 that marked the first-ever wiretap on a computer network. The investigation led to charges against an Argentine man who was accused of hacking into Harvard University's computers. Heymann in 2010 received a DOJ award for distinguished service.
Donald Stern, a former U.S. attorney in Boston who's now senior counsel in Cooley's Boston office, called Heymann "a career guy" who doesn't allow any outside political rumblings to influence his decision-making. Stern called Heymann a "bright, hardworking and ethical prosecutor."
A spokeswoman for the U.S. attorney's office said Ortiz and Heymann are not speaking about the case against Swartz, a prosecution that was tethered to the U.S. Secret Service's New England Electronic Crimes Task Force.
The Secret Service set up task forces around the country following President George W. Bush's signing of the Patriot Act in the aftermath of the September 11 terror attacks. In 2009, the Secret Service announced the formation of three additional task forces in St. Louis, Kansas City and New Orleans "to identify, investigate, disrupt and dismantle individuals and criminal enterprises who are engaged in financial crimes.
The Swartz case wasn't the first brought by Boston-based federal prosecutors to make big news. In March 2010, Boston judges hit master hacker Albert Gonzalez with three concurrent two-decade sentences to prison for hacking several retailers' networks to steal customers' credit and debit card information. Gonzalez¹s victims included a wide range of retailers, including 7-Eleven Inc., shoe seller DSW Inc. and discount retailer The TJX Cos. Inc., which owns T.J.Maxx.
The district's continued aggressive prosecution of computer crimes also yielded an 82-month sentence in February 2011 against Asa Pala, who had pleaded guilty to one count of conspiracy to commit computer fraud and five counts of failure to file an income tax return. His scheme caused German citizens' computer telephone modems to call premium telephone numbers rented from German telephone companies by Pala's conspirators from 2003 through 2007.
In the Swartz case, prosecutors on January 14 asked the presiding judge to dismiss the prosecution. Swartz was charged with crimes that included wire fraud, computer fraud and unlawfully obtaining information from a protected computer. Charging documents said he did not steal any personal identifying information. JSTOR did not pursue a civil case against Swartz.
Government lawyers alleged that Swartz, without permission, used the networks of the Massachusetts Institute of Technology to download millions of JSTOR articles. In court papers, Heymann described as "incredible" the argument that Swartz did not know his conduct was wrongful.
"Swartz took great pains to hide his identity, to hide his laptop and its identifiers, and to hide his face by a bicycle helmet when he believed he could be seen leaving and entering the closet," Heymann said in a court filing in November. The university and JSTOR, Heymann said, "had blocked his communications repeatedly." Swartz, the prosecutor said, circumvented JSTOR's restrictions that limit the number of downloads.
In a lengthy piece published Monday on the legal blog The Volokh Conspiracy, Orin Kerr, who teaches computer crime law at George Washington University Law School, concluded that the charges against Swartz were "based on a fair reading of the law."
"None of the charges involved aggressive readings of the law or any apparent prosecutorial overreach," Kerr wrote. "Indeed, once the decision to charge the case had been made, the charges brought here were pretty much what any good federal prosecutor would have charged."
Kerr has long fought the overly broad reading of "unauthorized access" under the Computer Fraud and Abuse Act, the law Swartz allegedly violated. "This is not merely a case of breaching a written policy," Kerr wrote. "Rather, this is a case of circumventing code-based restrictions by circumventing identification restrictions. I don't see how that is particularly different from using someone else's password, which is the quintessential access without authorization."
Marcia Hofmann, a lawyer with the advocacy group Electronic Frontier Foundation, said in a blog post on Monday that "some extremely problematic elements of the law" — including vagueness of language — made it possible for prosecutors to pursue Swartz in the first place. The law, for instance, doesn't clearly explain the scope of "lack of authorization" when it comes to a person accessing a protected computer, Hofmann said.
"The specter of being incarcerated for years should never have haunted Aaron, but it did," Hofmann said. "Brilliant, talented, visionary people should be spending their time building our future, not worrying about wasting away in prison."
Over the weekend, Harvard Law School professor Lawrence Lessig penned a piece titled "Prosecutor as bully." Lessig, a friend of Swartz's, said the "outrageousness" of the story "is also the absurdity of the prosecutor's behavior." The government, Lessig said, "worked as hard as it could to characterize what Aaron did in the most extreme and absurd way." Lessig said "our government continued to push as if it had caught the 9/11 terrorists red-handed."
A lawyer for Swartz, Elliott Peters of San Francisco's Keker & Van Nest, said in an interview Monday that Swartz rejected one plea deal that would have involved pleading guilty to 13 felonies and spending six months in jail. (Martin Weinberg, a defense lawyer in Boston who earlier represented Swartz in the case, was not immediately reached for comment.)
"They saw this case as one that could be portrayed as a significant one and added to their portfolio," Peters said. "They tried to turn this case into something much more significant and worthy."
Peters questioned what he described as a lack of "proportionality and fairness" among the lawyers involved in the Swartz prosecution. Prosecutors, he said, made it "very, very clear" that Swartz, if he did decide to plead guilty, would have to serve some time behind bars.
In his discussions with the prosecutors, Peters said he made this clear: "We need to resolve this case in a way that doesn't destroy Aaron's life."
Boston Bureau Chief Sheri Qualters contributed to this story.
Reader Comments