Aaron’s Law: Why Reforming the CFAA Solves Very Little
Likely none. One major point in the argument against this law and its prosecution has been the steep sentences attached to its violation; if found guilty, a party could spend up to 35 years in prison. The topics of prosecutorial overreach and judicial discretion aside, it’s highly unlikely that Swartz would have spent an amount even close to this behind bars, even after falling under its purview by downloading approximately 4 million files from a protected database. Decriminalizing an activity that many people engage in unknowingly probably would not prevent prosecutors from seeking a sentence against actors like Swartz who violated other key portions of the law.
While no physical or economic harm was ever incurred (indeed, the stolen data was returned and neither JSTOR nor MIT, the location of the hacker’s computer, ever pressed charges), policing the illegal downloading of privately owned digital property is currently a very attractive endeavor. The CFAA is but one tool available to plaintiffs and prosecutors to protect their rights to evanescent property. The tech and legal community’s distaste for this law is, and will remain, inextricably connected to our apparent difficulty or unwillingness to nail down a workable definition of property rights in data or construct a reasonable, sustainable system for protecting intellectual property. Defining scope and policy for such a slippery concept could, in fact, create more problems than it actually solves as the nature of data and intellectual property tends to be unlike physical property, for which laws are better suited. As attorney Michael Phillips points out, stealing in the “analog” world is a relatively simple concept. Stealing an item of value from one party deprives that party from its ability to realize its value. Even a returned good has lost some element of its value; delay in sale, change in new, unused status.
This model of property rights is echoed in many intellectual property infringement statutes. But electronic data does not depreciate in the same way, and no harm is immediately clear when the “stolen” “goods” are returned. As Chris Gayomali points out in his piece on The Week, the current values placed on data privacy and copyright control vastly outstrip the practical economic loss felt by victims of copyright infringement and reflect instead an attempt to deter wrongdoers with exorbitant judgments. Making room for civil disobedience, when internet and information use constitutes a large portion of our daily speech, is important, but is complicated when that disobedience tramples on the existent rights of our neighbors. Until our society becomes more comfortable with what the Internet hath wrought and how the legal system can be better tailored to reflect this reality, activists like Swartz will need remain activists willing to risk jail time (and whatever that mean under the given laws) for their causes. Given the pace of legislation and substantial interest in preserving property rights, I would bet on this risk for many years to come, regardless of any legislative success.