‘Aaron’s Law’ Reintroduced as Lawmakers Wrestle Over Hacking Penalties

The proposed bill would update the Computer Fraud and Abuse Act to keep small violators from being charged under federal law.

Participants compete behind their computers during an "ethical hacking contest" in Geneva.
National Journal
Kaveh Waddell
Add to Briefcase
Kaveh Waddell
April 21, 2015, 8:55 a.m.

More than two years after the death of Aaron Swartz, a pro­gram­mer and on­line act­iv­ist who took his own life after be­ing charged with data theft, law­makers are try­ing for a second time to pass a bill that would soften the terms of the law he was charged un­der.

Demo­crat­ic Sen. Ron Wyden of Ore­gon and Demo­crat­ic Rep. Zoe Lof­gren of Cali­for­nia on Tues­day re­in­tro­duced the so-called “Aaron’s Law,” which they say would clear up vague lan­guage in the Com­puter Fraud and Ab­use Act to keep low-level vi­ol­at­ors from get­ting in trouble with the law.

As it stands, ac­cess­ing a com­puter without au­thor­iz­a­tion is a fed­er­al crime, something crit­ics say can lead to the ag­gress­ive pro­sec­u­tion of small-time law­break­ers. The bill would nar­row the scope of the CFAA so that ba­sic of­fenses like vi­ol­a­tions of a web­site’s or soft­ware’s terms-of-ser­vices agree­ment could not lead to fed­er­al charges. It would also lim­it pro­sec­utors’ abil­ity to bring fed­er­al charges on top of state charges.

“At its very core, CFAA is an anti-hack­ing law,” Lof­gren said in a state­ment. “Un­for­tu­nately, over time we have seen pro­sec­utors broad­en­ing the in­tent of the act, hand­ing out in­or­din­ately severe crim­in­al pen­al­ties for less-than-ser­i­ous vi­ol­a­tions. It’s time we re­formed this law to bet­ter fo­cus on truly ma­li­cious hack­ers and bad act­ors, and away from com­mon com­puter and In­ter­net activ­it­ies.”

The pro­posed law is sup­por­ted by Re­pub­lic­ans Rand Paul of Ken­tucky in the Sen­ate and Jim Sensen­bren­ner of Wis­con­sin in the House.

“I am proud to join Sen. Wyden and Rep. Lof­gren today in of­fer­ing this bi­par­tis­an and bicam­er­al le­gis­la­tion which will amend the Com­puter Fraud and Ab­use Act,” Paul said. “Aaron’s Law will re­duce over­broad pro­sec­u­tions and ad­just un­fair sen­ten­cing prac­tices.”

Swartz, the bill’s name­sake, was charged in 2011 un­der the CFAA for gain­ing un­au­thor­ized ac­cess to JSTOR, a sub­scrip­tion-based lib­rary of aca­dem­ic journ­als and pa­pers. He al­legedly down­loaded al­most 5 mil­lion art­icles from the data­base. Swartz was fa­cing up to 35 years in pris­on and $1 mil­lion in fines when he was found dead in his apart­ment in Janu­ary 2013.

The CFAA in its cur­rent form is harm­ful to com­puter se­cur­ity re­search­ers—who hack in­to devices and net­works to find and ex­pose vul­ner­ab­il­it­ies—ac­cord­ing to the Elec­tron­ic Fron­ti­er Found­a­tion, be­cause it ex­poses re­search­ers to li­ab­il­ity and pun­ish­ment at the same level as ma­li­cious hack­ers.

The re­in­tro­duc­tion of Aaron’s Law comes after a week after Wyden and Demo­crat­ic Rep. Jared Pol­is of Col­or­ado pro­posed an up­date to the Di­git­al Mil­leni­um Copy­right Act, which would also seek to re­duce the bur­den of li­ab­il­ity that se­cur­ity re­search­ers face when they at­tempt to get in­to devices and net­works.

Aaron’s Law was first in­tro­duced in 2013, months after Swartz’s death, but it stalled in the face of dif­fer­ences between the spon­sors, Wyden and Lof­gren, and House Ju­di­ciary Com­mit­tee chair­man Bob Good­latte.

This post has been up­dated with a state­ment from Sen. Rand Paul.

What We're Following See More »
Senate Rules Aims to Speed Confirmation of Nominees
12 minutes ago

"Republicans on Wednesday will begin a push to change Senate rules in a way that would allow the faster confirmation of President Trump's nominees, after months of complaints that Democrats are dragging out the process. The Senate Rules Committee will meet in the afternoon to consider a resolution that would reduce post-cloture debate for most Executive Branch nominees from 30 hours to just 8 hours. The goal is to prevent Democrats from stretching out debate over several days."

GOP Holds onto AZ-08 Seat Narrowly
24 minutes ago

Arizona Republican Debbie Lesko won a special election to fill the deep red seat Trent Franks retired from earlier this year. Unofficial balloting had her up 52.9% to 47.2%. This victory is a bit close for comfort, considering Donald Trump's 21-point victory there in 2016. This victory will do very little to calm GOP nerves five months before Election Day.

Apple CEO To Meet With Trump
58 minutes ago

Apple CEO Tim Cook will meet with President Trump today, "at a time of heightened trade tensions between the U.S. and China with technology caught up in the spat. Both countries have proposed import tariffs on each others' products, but the U.S. has been tough on Chinese technology firms." China is an important market for Apple, and Cook is expected to bring up the worsening trade relationship.

Mick Mulvaney Admits To Selling Access As Representative
1 hours ago
District Court: Trump Must Reopen DACA
1 hours ago

U.S. District Judge John D. Bates ordered the Trump Administration to continue DACA, and for the first time, ordered it be reopened to new applicants. Bates said the decision to end the immigration program was "'arbitrary and capricious' and therefore 'unlawful.' However, he stayed his ruling for 90 days to give the Department of Homeland Security a chance to provide more solid reasoning for ending the program." Bates is the third judge to rule against the Trump administration. "Federal judges in California and New York have also blocked the administration’s plans on [the same] grounds, and ordered the administration to renew work permits for immigrants enrolled in the program."


Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.