Reddit review puts some teeth into “Aaron's Law”
arstechnica.com
arstechnica.com
Uh, what about the part where he snuck into a network closet and plugged directly into a piece of infrastructure so he could be on a subnet he knew he wasn't supposed to have direct access to? Wouldn't that still be considered unauthorized access? I'd like to think that if someone breaks into my home LAN, they won't beat the rap just because I also happen to run a free open hotspot in an attached VLAN sandbox.
Reread the first line I quoted. What part of the redefinition of "unauthorized access" makes it no longer apply to plugging into a network layer you know you're not authorized to be on, for the purposes of circumventing a technological access barrier like the JSTOR antiscraping system?
In any case, all of the MAC addresses he used were authorized to be on the MIT network until they stopped working without notice. Doesn't the bill now state that changing MAC addresses is not circumvention?
1. Trespassing. This is not germane to this discussion though. 2. Unauthorized circumvention of a technological measure (i.e. deliberately hooking up to a trusted subnet to evade the blocks that had been place on his previous network access)
Aaron would very well still have been in violation of even the proposed law, as worded now.
It's hard to know whether his presence in the closet legally counted as trespassing or not, but from my understanding (and the fact that he wasn't being prosecuted for it), I don't think it applied here.
He was escalating his level of privilege by connecting at a deeper level than he had been granted access to.
The closet router was deeper than that -- inside that layer of defense. Aaron didn't just plug in for bandwidth or permanence -- he did it because it was a trusted subnet that would evade the protections and restrictions MIT places on their public access points.
But still— unlocked closet, unsecured network, all, we are given to understand, because of a very lenient open network policy. If he was not "authorized" access, what is the authority, and when would the authorization have taken place? It seems a terribly tough row to hoe.
> It seems a terribly tough row to hoe.
Indeed, I'm finding myself in a strange place in this debate, because I do think that computer crime laws are very vague and extremely harsh, including the ones Aaron was being prosecuted under. But I think Aaron's defenders go too far when they claim he was completely innocent.
I also don't understand how "changing one's MAC or IP address [in order to circumvent] 'technological access measures'" doesn't constitute a violation in principle, even if their proposed bill decides to whitelist those two behaviours notwithstanding other portions of the bill.
It is a violation in principle; the real world equivalent would be having a posted picture saying "DO NOT ADMIT THIS MAN INSIDE" but Aaron walks up wearing a ridiculous faux mustache and gets admitted anyways.
IMHO it's explicitly whitelisted not because of the principle, but because it's the behavior Aaron employed that they're trying to make legal in the future.
Um no. You don't need to circumvent anything to be "unauthorized".
Oh good grief. That's so vague it could mean jumping a queue, or even less. Here, a criminal circumvents technological access barriers. http://i0.kym-cdn.com/photos/images/newsfeed/000/182/549/cPx...
And if I find an open telecoms cab and tap your phone that is still an offense.
Burglary is already against the law. I might suggest that you don't leave any conspicuous ethernet jacks in your front yard where passers-by might be tempted.
I just submitted it to the new queue.
1) CFAA should have been scrapped entirely and a new law written, this time in good faith, and actually taking into account the technology of the first decade of the 21st century. This law should keep an open path to sensible application for at least a few decades to come.
2) This is unlikely to pass as-is when corporate interests haven't put their fingers into the pot yet.
[1] http://www.lofgren.house.gov/images/stories/pdf/aarons%20law...
E.g. there have been times when new legislation was first added to U.S. Code not as a new section, but as a bunch of deletions/additions that make it very hard to tell what the end result is supposed to look like.
However if you find that neat you may also find it neat how they end up placing these bills passed into law into the legal code. It's done manually just as you say, but the ones doing the work sometimes notice issues which they footnote (e.g. I've seen a lot of "foo was probably meant instead of bar" footnotes).
>E.g. there have been times when new legislation was first added to U.S. Code not as a new section, but as a bunch of deletions/additions that make it very hard to tell what the end result is supposed to look like.
Ha! Typical, at some point politics had to show it's ugly head :) I thought that eventually some sort of consolidation took place (a release, if you will) and then subsequent modifications were based off of that one.
Other times they pass the law and it just kind of floats out there, in the "Statutes-at-Large" until some poor legislative assistant decides to/gets told to go consolidate the groups back into appropriate titles of USC (which requires another bill in Congress).
Even when you're making a law which is basically just a diff to the U.S. Code though, the various interactions of each of the changes can be difficult to discern the real meaning of. But on the other hand it's nice to be able to simply fix the broken part of a law without having to do a full rewrite.
And yet, when caught he commits suicide. And now he is a martyr... Can you imagine the pain his family is in right now just because this guy had to commit illegal acts and couldn't pay for his crimes?
The government has long believed it has the power to do whatever it wants to secure whatever end it deems good for the people.
We saw it in the 30s with Olmstead, in the 50s with the FBI under Hoover and the House Committee on Unamerican Activities, in the 60s with COINTELPRO and use of FBI resources to disrupt the civil rights movement, and in our current time with the war on terror, the use of torture, drones, body scanners, and in the prosecutorial realm with mandatory minimums, etc.
Ortiz is not a bad apple, she is amongst the best and brightest of the US DOJ. You can tell from her other cases that she is extremely clever about using the resource of the government to bully the weak and advance the interests of the powerful.
Let me repeat, she is not a bad apple, she is the best the system can produce and what it aims to produce. It is not a law that needs changing but an attitude. The foul stench of the holier than thou zealotry starts at the top and permeates its way throughout the entire system.
[1] http://en.wikipedia.org/wiki/Brady_v._United_States
[2] http://en.wikipedia.org/wiki/Plea_bargaining_in_the_United_S...
The problem, rather, is that prosecutors can credibly threaten to convict with such severe prison sentence that your best option is take an oppressive plea deal. Abolishing plea bargains doesn't help that; if anything, it makes the problem worse by sealing one relief valve in the whole process.
OTOH, there is something to be said for "DDOSing" the archaic justice system by collectively forcing all cases to go to trial, something others have proposed. But you just need enough committed accuseds to do that, not a new law.
Abolishing the plea bargain would by no means fix the broken system, but it would be a good start.
You're claiming that the entire bushel of apples is rotten, but that wouldn't make any single one good.
No Judge or Prosecutor should ever be elected its just to dangerous and to make a start I suggest that supreme court Justices should have a minimum of at least 20 years experience as a Judge - not as one recent one zero experience being just an academic lawyer.
Federal judges (like the judge that was hearing Aaron's case) are not elected; they are appointed by the President and confirmed by the Senate. Same for Supreme Court justices; you may remember Justice Sotomayor being appointed by President Obama and being confirmed by the Senate. Given the way that politics are, it's unlikely that a judge with 20 years of experience will be appointed to the Supreme Court: over a 20-year career as a judge, they will have inevitably made a controversial decision that the "other side" would fairly/unfairly pick apart.
The point about Judges or prosecutors being not selected because they have pissed off one side or the other stands - I think the UK system is safer as it mush harder for politicians to block or influence.