What, then, was the underlying crime, if not this unauthorized access nonsense where access was allegedly unauthorized only because he was supposedly hiding his identity? Keep in mind that it wasn't copyright infringement (which normally isn't criminal anyway), because it wasn't JSTOR pressing charges, it was MIT.

>Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it.

But there are two issues here: There is what prosecutors did, and what the law allowed them to do. Even if you don't have a problem with the prosecutors, we can still have a problem with the law and work to have it changed.

>In fact, they have a duty to do so.

No they don't. They have prosecutorial discretion. If the application of the law in a particular case is ridiculous, they have no legal or professional obligation to press those charges.

You either break the law, or you don't. The law should be the same for everybody and should NOT be applied selectively. It's actually outrageous that you imply otherwise.

Because this happens it's precisely the reason for why we have ridiculous laws in the first place. If this goes on pretty soon everybody will be a criminal, but the world will still turn for you, until you manage to upset somebody you shouldn't have.

And since we are on the subject, that's how the law works in totalitarian states.

This viewpoint is incredibly naive, and also wrong.

The law is not black or white, it is selectively enforced all the time, and context does matter in its application.

If it was illegal to break a lock (black and white), then the guy who breaks a lock to steal your TV gets the same sentence as the guy who breaks his own lock because he forgot his keys, and the same as the guy who breaks a lock to get into a burning building to save a child, etc. Obviously this is ridiculous, but even so, how could we possibly cover all of the motivations for breaking a lock?

How could we cover all of the motivations for hiding your identity? How could it ever be black and white if we can't?

If we could, then the entire justice system could then be automated.

But here's the thing: That's why it isn't illegal to "break a lock." It's illegal to e.g. steal things. Because that's what we want to prohibit, not breaking locks, even if breaking locks is a thing mostly done by criminals who are trying to steal things.

http://dictionary.findlaw.com/definition/breaking-and-enteri...

I'm a lock troll. I like to go around breaking people's locks. I never steal anything, I just break locks because I'm a prick like that.

This guy I know, Franky, broke a lock the other day in order to save a child from a burning building.

How would you propose a black and white system handle this? Do I get to run around breaking locks with impunity, or are we going to punish Franky for the method of his good deed. I mean, the good deed's nice and all, but irrelevant to the matter at hand right?

2) You have an exception to such laws for exigent circumstances or implied consent.

Here is the flaw in your argument: We don't have to nail everything down to nail part of something down. We don't have to define "exigent circumstances" mathematically or put the badge number of authorized fire marshals in the statute. That doesn't mean we can't do better than obscenely broad and vague nonsense like "unauthorized access to a computer."

There is a reason we have laws more specific than "anyone who does anything bad shall be punished by a fine of up to one hundred trillion dollars or up to one thousand years in prison."

I don't think we're actually in disagreement. Maybe my analogy was just that badly thrown together?

The CFAA is the same way. It prohibits unauthorized access, which seems like it would generally be bad (though it's vague enough that who knows) and with no provision for looking into the circumstances to evaluate how bad, then goes on to impose penalties as though the unauthorized access was in furtherance of something like terrorism or bank fraud rather than accessing a wifi to check your email, even though the latter is still covered and subject to the same extreme penalties.

And none of this is about black and white, which is why I objected to the example. Wanting black and white laws is about fighting vagueness: Too much specificity is bad because it's too complicated and no one can understand it (see: tax code), but too much vagueness is also bad -- even worse -- because then you have no possible way to know what it actually means until you get told by a judge, by which point it's far too late.

The problem with your example is that it isn't an example of too much vagueness, it's an example of too much breadth. Take two examples: "Don't do things" and "don't do bad things without a good reason." The first isn't really vague at all -- it just covers everything, which is useless and stupid. So the problem is that it's too broad. The second isn't too broad -- it's pretty good at only criminalizing things that ought to be -- but it's hopelessly vague.

And it's overbreadth which is the trouble with "it is illegal to break locks." It covers breaking locks even for good reasons. So you need a list of exclusions or you end up like the DMCA: You're allowed to break them if they're your locks, or if necessary in order to do something legitimate, etc. Which is actually a counterexample of being okay with relatively simple laws and not needing a list of caveats to go along with them. Because we can't make things that simple, or we get the DMCA and the CFAA, which are both terrible and need to be seriously overhauled.

Damnit man! Don't give them ideas!

It depends on how the selection is done. If a prosecutor declines to prosecute because the law breaker is of a particular race, rich, politically powerful, etc. then that is an abuse of discretion.

However, we want prosecutors to be selective when it comes to saying that someone might have been justified even if the law as written doesn't explicitly acknowledge the justification (or acknowledges it but as a factor for the judge to consider). Speeding and running red lights because you are impatient and reckless is a different matter than speeding and running a red light because your passenger is bleeding profusely.

We also need to give prosecutors some discretion just to manage the case load. Unless we are willing to spend a lot more on both prosecutors and the court systems, we want them to be able to say "I will focus my time and attention on this murderer even if it means letting that shoplifter go with an extremely favorable plea bargain or even unpunished."

I'm not implying anything. That is actually how it works now. If you don't like it, change it. But good luck, because first you're going to have to fix all of the laws before you try to force prosecutors to prosecute all of them or we'll all be going to trial at the same time and the entire world will grind to a halt.

>If this goes on pretty soon everybody will be a criminal

There is no "pretty soon" about it.

Actually, we're well past that point. Until the past few years, only tiny special interest groups ever heard about things like this. Now, it has the potential to blow up into national news. Maybe this is progress.

I definitely don't think he was implying that the law be selectively applied to different people. However, law is not black and white. Law interpretation is up to a judge (in countries with a Common Law system) and is based on precedent. AnthonyMouse was simply saying that if the application of a certain law in a certain situation is ill-fitting, the judge/attorneys have no reason to pursue those charges.

I still don't see what it has to do with locking up MAC randomizers.

are you actually asking? read section II of this article: http://www.volokh.com/2013/01/14/aaron-swartz-charges/

the charges were wire fraud, computer fraud, unauthorized access, and computer damage.

> because it wasn't JSTOR pressing charges, it was MIT

when the charges are federal crimes, prosecutors decide whether or not to press charges. not wanting to press charges does not magically make criminal acts not criminal. if a guy beats the crap out of his girlfriend, and his girlfriend does not want to press charges, the prosecutor can still press charges.

No, it was rhetorical. The point is the charge that MAC spoofing was relevant to was unauthorized access, but if MAC spoofing is sufficient to prove "unauthorized" then MAC spoofing would virtually always be unauthorized access to whatever you're accessing with a spoofed MAC. That interpretation would make MAC spoofing illegal without any underlying crime.

>when the charges are federal crimes, prosecutors decide whether or not to press charges. not wanting to press charges does not magically make criminal acts not criminal.

I'm not sure that's always true. If one of the elements of the crime is that what the defendant did was unauthorized (as was the case here) then if every victim authorized the behavior that element of the crime wouldn't be satisfied, no?

i agree. but its not. MAC is one piece of evidence. without the other evidence, the charges would probably be worthless.

> If one of the elements of the crime is that what the defendant did was unauthorized (as was the case here) then if every victim authorized the behavior that element of the crime wouldn't be satisfied, no?

In theory, I suppose. However, JSTOR not pushing for charges is not the same as JSTOR "authorizing" Aaron to access those files.

The trouble is that the other evidence can be just as spurious and circumstantial. It's the selection bias problem: You do a hundred thousand things in the process of downloading a journal article and fifteen of them are "suspicious" but those are the fifteen they present to a jury when trying to convict you.

Even if he had changed his MAC address by buying a new laptop / NIC and connecting it, they probably would have still tried to charge him with the same thing.

The wording of what is alleged from the indictment is: "He sought to defraud MIT and JSTOR of rights and property by: ... b. Repeatedly taking steps to change his and his computer's apparent identities and conceal his and his computers' true identities".

For that same argument to be applied to someone else, there would have to be several aspects:

  * The change of MAC would have to be repeated (although obviously they could construct a similar argument if you just did it once to clone a white-listed MAC).
  * The 'intent' behind changing the MAC address would have to be to obtain something that could not be obtained otherwise. This could be by spoofing a white-listed MAC address, or changing away from your black-listed MAC address that was blacklisted to stop you doing something the network owner doesn't want you to do with their network.

That is exactly what the law says in this case. The government has declared that MAC randomization is the creation of fraudulent identities for the purposes of authentication, not unlike creating fraudulent photo identification.

You can say that randomizing a MAC address is not a crime, just as one can say that creating a fake passport for a movie is not a crime. The crime is in using that fake identification for authentication, which is obvious when customs asks for your passport, but undetectable when a network is using MAC addresses to enforce policy. If subverting that network policy is a felony, then MAC randomization is, by law, sometimes an involuntary felony.

While MAC addresses are obviously not a form of identification to technical folks, this stance would not be unprecedented as the US has also made it a felony to forge another trivially forged pseudo identify, Caller ID[1]. Enforcement of CNID spoofing is much easier given the nature of the phone system, since only a few providers bridge from VoIP to POTS.

[ 1 https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation... ]

This doesn't mean "oh noes! fake mustaches are against the lawz!!!11 they are going to lock up all the actors!"

I've changed my MAC/moustache plenty of times to "deceive some guards". Actually I'm doing it right now, this Comcast modem is a utter pain in the ass...

Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit? Was Aaron's curl script A-okay right up until the point that he deceived?

Two questions you need to seriously answer to make changing your MAC address on Comcast's network to be the exact same thing as what Aaron did:

1. Are you bypassing a security mechanism by changing your MAC address?

2. Did you gain something and/or cause them losses exceeding $5,000?

This question seriously calls into question your profile description of "security guy". A security mechanism based on MAC is as effective as a security mechanism based on asking a stranger whether their name is Aaron Swartz, because Aaron Swartz isn't allowed on this network.

Please stop.

Note, that doesn't mean I think you should get 30 years in prison for simply walking across my lawn.

Agreed, which is one reason it is important in this conversation to separate false identity from trespassing.

The relevance of the security measure is that it serves to prove that the trespasser knew he wasn't allowed on the property.

Ah! Exactly! Which is why this conversation is important. The OP has said that he effectively always says no when asked if he is "Insert Name". My example is also poor, because asking someone if they are Bob Dylan also informs them that Bob Dylan is restricted from entry, which means something to the law.

A better example would be a security system based on something fleeting and baseless, like your favorite color. You might have always liked the same color, or you might change favorite colors every year, or you might just tell people a different color because no one really knows what your favorite color is but you anyway. If the security call box asked you what your favorite color was, you told them something random, and they let you in, is that illegal? The security guard never said that people whose favorite color is X are not allowed, he just asked what your favorite color was, and then he let you in.

Favorite colors are non-specific enough that you might reasonably not know. But MAC addresses aren't like favorite colors. Every Ethernet device has a unique one. If you find your MAC address banned, I think you can reasonably conclude that you're being singled out.

I agree that I'm darting around, but it's in the interest of truth. Here's the problem: if Aaron was running an automated MAC randomization system for the purpose of personal privacy, he would never have known that his MAC was blocked. The details of his case show that he was aware, but this OP describes a situation in which there is no awareness. If the law is primarily concerned with the knowledge aspect, this can be attended to on a case by case basis. However, much of the discussion has suggested that a MAC is an identifier, and any alteration of this identifier is criminal. This should not be the case.

His defense team vigorously contested the searches of his home, office, computers, even the netbook found in the closet at MIT under the aegis of his expectation of privacy at MIT; his team also attempted to have wire fraud indictments dismissed by challenging the notion of IP and MAC address "spoofing" constituted false statements. If Swartz had been continuously "spoofing" his addresses, he surely would have raised that point. Instead, he appears to stipulate that he was altering his addresses to bypass the authorization controls at MIT.

I wrote the first line of this comment a couple hours ago because I remembered reading this on Sunday, but it took me a while to track down the exact filing.

https://ia700504.us.archive.org/29/items/gov.uscourts.mad.13...

>By the same token, obtaining new IP addresses by “spoofing,” i.e., changing, the Acer’s MAC address, Indictment, ¶¶19(a)-(c), 27(a)-(c), also cannot constitute false statements or misrepresentations or omissions of material fact, nor can Swartz’s use of an automated collection device which made it appear that multiple people were requesting articles rather than a single person making multiple requests, Indictment, ¶34(c). //

So they're really claiming that writing a program to appear to be many people accessing data when only being one person, that program solely being to gain unauthorised access, wasn't fraudulent at all.

Does anyone genuinely believe that?

Yes. Engineers deal with uncooperative systems all the time. One might have the task of getting SCADA system A to integrate with financial system B, and report to management system C. But SCADA system A rate limits requests from a single origin, and the financial calculations will be inaccurate without more frequent updates. So, the engineer creates a system that appears to be multiple different origins to SCADA system A, and the world still turns.

I think what terrifies lawmakers and non-technical people is that, for the first time in history, computers present a potential world in which their expectations of the outcome of force and command do not apply; a virtual universe in which the laws are entirely different, and it takes bending over backwards to make the old laws of the physical world apply in the virtual world. So they do the only thing they know how, apply the physical world's laws of force and command to that chunk of the physical world at the opposite end of the virtual world, in a scale that is proportional to their vast fear instead of the actual behavior.

Look I've done MAC spoofing, switched UA's, tunnelling, used VPNs and such; it's not rocket science - certainly a moderately computer able person with legal training is going to be able to understand such things.

It's like signing up for multiple API keys in contravention of the ToS, you know it's not authorised.

There's nothing especially technical about what happened my only incredulity is that anyone supposes a person doing such a hack wouldn't know it's not _authorised_ (ie countenanced by the system owners). The first thought in addressing the access limit is that switching IP and/or MAC and/or UA is likely to enable access to 3(?) more JSTOR docs - but there's a realisation implicit within that of the JSTOR owners having only authorised a very limited access.

Now if we're talking about the ridiculousness of the proposed sentence that's an entirely different matter ...

As an aside I'm surprised no-one has crowdsourced the gathering of all JSTOR docs, they'd need an index, a script to pass the links to a person for download and a repository for upload. It would be just as copyright infringing as any other method but far harder to trace - the majority of it could be automated I'd expect (perhaps not the JSTOR registration).

Now, is it the case that if you habitually use MAC address randomization and try to access a network repeatedly without permission, your randomization of MAC address might be interpreted as a way of trying to get around blocks? This is quite possible, and will be handled by a jury that probably doesn't understand why anyone would randomize their MAC address any more than they would understand why anyone would habitually walk around wearing a ski mask. I think that's a legitimate concern.

I would hope that someone would realize that wearing a ski mask for no reason has considerable downsides, while changing you MAC address for no reason has none.

What if someone uses different devices instead of changing the identifier of one device? A policy that very explicitly says you can only take so much food on a plate, but that anyone can take a new plate, doesn't suggest that the server is too concerned about how much food is served.

On this note, I recall several years ago while in college getting a mass email from administration that warned students not to wear masks during Halloween on the street because doing so was banned in the city. A quick googling just now doesn't turn up anything of the sort, though it does seem some other states have laws concerning masks, though often with exceptions for children, holidays, religion, education, etc.

Who specifically has suggested that it should be the case? You're constructing a strawman or not reading what people are writing.

The criminal act is continuing to do something after you've been told to stop.

The fact that something is easy to bypass doesn't mean it's legal to bypass.

In fact, that "Aaron Swartz isn't allowed on the network" example is perfect. If I have a sign saying "Bob isn't allowed on my property" and Bob comes on my property, that's trespassing.

You can't answer legal questions with engineering. They are different fields with different goals.

Yes, and it's not the same as MAC blocking.

You can't answer legal questions with engineering

Technology changes the subtleties upon which laws are based, so you necessarily have to answer a legal question with certain aspects of engineering.

A network that is protected by MAC identification cannot be directly compared to a room protected by a lock and key. In the case of Aaron, you can point to his modification of the MAC as an awareness that his is skirting network policy. Whether breach of network policy should be a felony is another discussion. However, someone who maintains privacy by randomizing his MAC is in a very different situation that looks strikingly similar to the case at hand. Will the courts understand the difference? We can only hope.

Now imagine if each key is valid for only five openings of the door. When someone comes back to your place for a sixth time and their key doesn't work anymore, is it really reasonable to be upset if they choose another key from the bowl?

> 1. Are you bypassing a security mechanism by changing your MAC address?

As far as I can tell? Quite possibly. If I don't make my router use my laptop's MAC address then I get hit with a captive portal at random times. This appears to be a security measure, though in my unresearched opinion I believe it to be a mis-firing of a security measure.

> 2. Did you gain something and/or cause them losses exceeding $5,000?

Considering the cost of my bill, it won't take me all that long to cross that limit.

The situation would be different if you were not paying Comcast, but still using technical trickery to defeat their network security and access their bandwidth.

So you really think that Comcast doesn't want you on their network with a router spoofing a laptop MAC today?

It's the intent to be somewhere you know (or ought to know) you aren't wanted that matters.

2.

It's not just "I did $5,000 worth of business." If Comcast had a program where they sold "router-attached Internet" for a price difference that totaled $5,000 over the price you paid for "computer-attached Internet" then you would hit CFAA levels.

Their captive portal demands that I install client side software. If they didn't want me to do this, there are definitely better ways of letting me know about this than a captive portal. Why would they captive portal someone they intend to let use their service?

What concerns me here is the degree to which I seemingly have to guess at Comcast's motives.

> It's not just "I did $5,000 worth of business."

So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for.

How is a layman, who is apparently responsible for evaluating the legality of his own actions, supposed to make a distinction?

I don't understand about the captive portal. Do you really think they don't want you on their network with a router?

The fact that their motives are unclear would be a good argument in your favor in case you were in court. Note that there wasn't any doubts about MIT's motives. Aaron isn't an idiot and he knew they were trying to keep him off the network.

2.

So on one hand we are violating the terms of service for a connection we paid for... and on the other hand we are violating a terms of service for a connection we paid for.

I don't understand how this is a reply.

If I use fraud to buy something you would sell for $8000 for $6000 instead, that's only $2000 worth of damages.

Comcast is preventing me from accessing their network unless I install their client side software. I am circumventing the technical measure in place to enforce this demand by changing my MAC address such that they think I have their software installed.

Am I in violation of their ToS for doing this? The hell if I know, but it seems entirely plausible.

Is this activity illegal? Like most questions in law, the answer is, "it depends".

Are you paying Comcast for internet? If so, its probably not illegal because they have authorized you to access the internet through their networks.

However, if Comcast's network authentication was based on MAC addresses and you spoofed yours to match a paying customer's, that would probably be wire fraud.

> Or, if it is the "something valuable" part, would gaining access to that "something valuable" have been an issue if there was no deceit?

I'm not sure what other laws would be relevant if there was no deception, but it certainly wouldn't be wire fraud. Deception is a pretty integral component to fraud.

It's more akin to wearing a fake mustache, than using a fake id.

Technically. Yes, I think that anyone who understands the technology agrees with this. The problem is that the courts are enforcing it as if it were the digital equivalent of a photo id, and this is not a small problem.

What really worries me is when someone on HN talks the same way.

If changing your MAC is not itself an issue, how do we determine what (normally legal) things you cannot do after (legally) changing your MAC?

Orders to do something obviously wrong should be followed, because the law is the law. Nice thinking there.