Look, if your issue here is that there's no apparent bright line that needs to be crossed to violate the CFAA --- that you don't have to break a 128 bit AES key for instance, or inject a ROP payload --- I guess that's a valid complaint, but it speaks to a pretty profound (and very common, especially with nerds) misunderstanding about the way the law works.

The prosecution does not need to produce a cryptographically signed unimpeachable notarized audit log spelling out exactly which parts of the US Code Swartz broke at each timestamped moment of the day.

Instead, they have to convince a jury that a reasonable person should believe that Swartz knew he was violating JSTOR's terms, took constructive steps to violate those terms, and did so purposefully to commit a fraud.

All we have to go on is the story laid out in the indictment; Swartz has a side to tell here too. But if you just go on the indictment, I think there's a pretty decent case to be made against him.