‘Aaron’s Law’ Reintroduced as Lawmakers Wrestle Over Hacking Penalties

The proposed bill would update the Computer Fraud and Abuse Act to keep small violators from being charged under federal law.

Participants compete behind their computers during an "ethical hacking contest" in Geneva.
National Journal
Kaveh Waddell
Add to Briefcase
Kaveh Waddell
April 21, 2015, 8:55 a.m.

More than two years after the death of Aaron Swartz, a pro­gram­mer and on­line act­iv­ist who took his own life after be­ing charged with data theft, law­makers are try­ing for a second time to pass a bill that would soften the terms of the law he was charged un­der.

Demo­crat­ic Sen. Ron Wyden of Ore­gon and Demo­crat­ic Rep. Zoe Lof­gren of Cali­for­nia on Tues­day re­in­tro­duced the so-called “Aaron’s Law,” which they say would clear up vague lan­guage in the Com­puter Fraud and Ab­use Act to keep low-level vi­ol­at­ors from get­ting in trouble with the law.

As it stands, ac­cess­ing a com­puter without au­thor­iz­a­tion is a fed­er­al crime, something crit­ics say can lead to the ag­gress­ive pro­sec­u­tion of small-time law­break­ers. The bill would nar­row the scope of the CFAA so that ba­sic of­fenses like vi­ol­a­tions of a web­site’s or soft­ware’s terms-of-ser­vices agree­ment could not lead to fed­er­al charges. It would also lim­it pro­sec­utors’ abil­ity to bring fed­er­al charges on top of state charges.

“At its very core, CFAA is an anti-hack­ing law,” Lof­gren said in a state­ment. “Un­for­tu­nately, over time we have seen pro­sec­utors broad­en­ing the in­tent of the act, hand­ing out in­or­din­ately severe crim­in­al pen­al­ties for less-than-ser­i­ous vi­ol­a­tions. It’s time we re­formed this law to bet­ter fo­cus on truly ma­li­cious hack­ers and bad act­ors, and away from com­mon com­puter and In­ter­net activ­it­ies.”

The pro­posed law is sup­por­ted by Re­pub­lic­ans Rand Paul of Ken­tucky in the Sen­ate and Jim Sensen­bren­ner of Wis­con­sin in the House.

“I am proud to join Sen. Wyden and Rep. Lof­gren today in of­fer­ing this bi­par­tis­an and bicam­er­al le­gis­la­tion which will amend the Com­puter Fraud and Ab­use Act,” Paul said. “Aaron’s Law will re­duce over­broad pro­sec­u­tions and ad­just un­fair sen­ten­cing prac­tices.”

Swartz, the bill’s name­sake, was charged in 2011 un­der the CFAA for gain­ing un­au­thor­ized ac­cess to JSTOR, a sub­scrip­tion-based lib­rary of aca­dem­ic journ­als and pa­pers. He al­legedly down­loaded al­most 5 mil­lion art­icles from the data­base. Swartz was fa­cing up to 35 years in pris­on and $1 mil­lion in fines when he was found dead in his apart­ment in Janu­ary 2013.

The CFAA in its cur­rent form is harm­ful to com­puter se­cur­ity re­search­ers—who hack in­to devices and net­works to find and ex­pose vul­ner­ab­il­it­ies—ac­cord­ing to the Elec­tron­ic Fron­ti­er Found­a­tion, be­cause it ex­poses re­search­ers to li­ab­il­ity and pun­ish­ment at the same level as ma­li­cious hack­ers.

The re­in­tro­duc­tion of Aaron’s Law comes after a week after Wyden and Demo­crat­ic Rep. Jared Pol­is of Col­or­ado pro­posed an up­date to the Di­git­al Mil­leni­um Copy­right Act, which would also seek to re­duce the bur­den of li­ab­il­ity that se­cur­ity re­search­ers face when they at­tempt to get in­to devices and net­works.

Aaron’s Law was first in­tro­duced in 2013, months after Swartz’s death, but it stalled in the face of dif­fer­ences between the spon­sors, Wyden and Lof­gren, and House Ju­di­ciary Com­mit­tee chair­man Bob Good­latte.

This post has been up­dated with a state­ment from Sen. Rand Paul.

What We're Following See More »
Revised Senate Bill Would Add Penalty for Going Uninsured
40 minutes ago
58 House Republicans Ask Ginsburg to Recuse on Travel Ban
1 hours ago

The letter reads in part, "There is no doubt that your impartiality can be reasonably questioned; indeed, it would be unreasonable not to question your impartiality. Failure to recuse yourself from any such case would violate the law and undermine the credibility of the Supreme Court of the United States.” Ginsburg said last year, "He is a faker. He has no consistency about him. He says whatever comes into his head at the moment. He really has an ego."

Richard Anderson to Take Over at Amtrak
1 hours ago
Cornyn Says Health Vote Needed This Week
2 hours ago
State Dept. Anti-Semitism Office Will be Unstaffed
3 hours ago

"Its remaining two staffers, each working half-time or less, would be reassigned as of that date. The Trump administration, which has yet to name an envoy to head the office, would not comment on the staffing change. At full staffing, the office employs a full-time envoy and the equivalent of three full-time staffers."


Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.