"I'm flabbergasted that this could be called anything other than a hack," the prosecutor said, addressing a trio of skeptical-looking judges in the US Third District Court of Appeals. The government was restating its case that, by obtaining private email addresses after exploiting a security loophole on AT&T's website and forwarding them to the media, Andrew "weev" Auernheimer had violated the Computer Fraud and Abuse Act.
Last March, weev, the notorious internet troll who seems to be equally celebrated and reviled, was convicted of accessing a computer without authorization and identity fraud, and sentenced to serve 41 months in prison.
"He had download the entire iOS system on his computer, he had to decrypt it, he had to do all of these things I don't even understand," Assistant US Attorney Glenn Moramarco argued. Here, on a Wednesday morning in Philadelphia, before a packed courtroom, the federal prosecution argued that a hacker should spend three and a half years in prison for committing a crime it couldn't fully comprehend.
Previously, Orin Kerr, a law professor at George Washington University and weev's defense attorney, had argued first and foremost that there was no criminal hacking to speak of. According to Kerr, what weev and Daniel Spitler (who pleaded guilty to avoid jail time) had done while working as an outfit called Goatse Security was entirely legal, even though it embarrassed public officials and some of the country's biggest corporations.
Goatse didn't steal passwords or hack into a server, Kerr argued. Instead, they effectively discovered a major security flaw in AT&T's network. When given the proper query, the telecom's public website would cough up a registered iPad owner's email address.
'He had to decrypt and decode, and do all of these things I don't even understand,' said the prosecutor. Later, he compared weev's deeds to hackers '[blowing] up a nuclear power plant in New Jersey.'
"There is no unauthorized access," Kerr said at the beginning of his appeal. When anyone can access data simply by entering an address onto a browser, "it is effectively public," he said.
Spitler and Auernheimer were able to pull 114,000 email addresses of iPad users—including those of high-profile individuals like Michael Bloomberg, Rahm Emmanuel, and the CEO of the New York Times—essentially by writing code that automatically entered those queries. Instead of quietly notifying Apple and AT&T, however, as security experts typically do, Goatse sent the addreses to Gawker, which published them in redacted form, along with a more detailed explanation of how the breach occurred.
LOCATION, LOCATION, LOCATION
In the courtroom, Kerr was eager to argue why weev's actions didn't violate the CFAA, a 1986 law that has been criticized by law scholars for being too vague and outmoded. But the judges were more interested in examining the issue of venue.
That's because, in an apparently arbitrary decision, the US Justice Department moved Auernheimer's trial to New Jersey, from Arkansas, where he's from. Goatse's exploit had very little to do with New Jersey at all—a small percentage of the obtained email addresses belonged to Jerseyites, but none were ever made public—so Kerr argued that the impact to the state was circumstantial, not pivotal.
There was no reason this trial shouldn't have been held in Hawaii, as a judge later remarked.
"Almost the entire thing was about venue," Tor Ekeland, an attorney who also represents Auernheimer, told me after the trial. "Nothing happened in New Jersey. No victims, no possession." He guessed that the Justice Department had chosen the state because it had a large computer crimes department, or because AT&T's headquarters were there, which proved irrelevant to the case, as he wasn't charged with any crimes against the company.
Some observers said that it appeared that the court may have been considering rejecting the case on grounds of venue, in order to prevent a precedent that enabled computer crimes to be tried anywhere that they had obliquely impacted residents who use the internet, which could potentially be everywhere. Speculation arose that this would be grounds to overturn a weak case without making a direct affront on the CFAA itself. The prosecution stated for the record that neither Auernheimer nor his computer nor Gawker were located in New Jersey.
In its opening statement, the government made an incendiary comparison that seemed to reflect the nature of its understanding of the crime: the prosecution compared Auernheimer's deeds to hackers "[blowing] up a nuclear power plant in New Jersey" in an attempt to illustrate how it was a relevant venue. "It doesn't matter where the server is located."
The judges did not appear to buy the argument.
Weev supporters outside of the courtroom this morning.
After the hearing, the dozens of supporters who'd filled the seats, many who'd made the trek from New York and beyond, filed out of the courtroom. "We have other interesting cases today, you know," one of the judges quipped, to scattered laughter.
Outside the courtroom, Kerr told me he was "cautiously optimistic" about his arguments' reception. He declined any further comment.
Journalists, lawyers, activists, and weev's friends anxiously congregated in the lobby. They generally seemed optimistic about the appeal, though many were also preoccupied with the treatment Auernheimer was receiving inside the prison. He'd been placed in a Secondary Housing Unit, and since last May, has been kept in solitary confinement most days. It was hard to say for certain, but weev's adversarial and anti-authoritarian nature—which continues to find an outlet on Twitter—was suspected to have played a role.
Katelan Foisy, a friend who corresponded with weev through letters, told me his typically exuberant outlook had grown dark.
"I would love to see him get out of solitary. That practice needs to be stopped," she said. "I hope this speeds things along."
Ekeland, his lawyer, also said the prison was isolating weev.
"He says he's sent me ten to twenty letters. I've received one." They're also not allowing him access to books or religious materials, Ekeland said. (Auernheimer is Mormon, though he only practices sporadically.)
The law should apply to everyone equally, not just precious snowflakes.
A couple dozen of his friends and supporters all went to lunch after the hearing, where they exchanged stories and talked politics. A software developer proudly showed me a page on the Encyclopedia Dramatica where he'd been made the target of weev's legendary trolling; it accused him of having ties to the mob and hosting websites with links to child pornography. Justine Tunney, the controversial Occupy Wall Street figure, showed off a little trolling of her own: a White House.gov petitionthat calls for replacing the federal government with tech companies.
When I asked each about weev, most smiled, almost guiltily.
The common line about weev is that there's no doubt he's done some terrible and distasteful things—the online stalking of a female blogger, the homophobic and anti-Semitic trolling, for instance. But, they say, he shouldn't be serving time for pointing out a flaw that AT&T and Apple left open to the public.
"The law should apply to everyone equally," Deviant Ollam told me, "not just precious snowflakes."
This issue of venue may offer weev a glimmer of hope for a way out of jail, and if it does, it could pave the way to an incrementally more just system for prosecuting computer crimes.
Still, the fundamental flaws of the CFAA looks as if they will remain unaddressed, granting prosecutors far too much power and leeway over digital activists and whistleblowers. The prosecution had compared internet traffic to kidnapping, hacktivism to nuclear terrorism, and admitted to not really grasping why, exactly, they had convicted this man.
As such, it's unlikely that the government would be able to process the complexities inherent in weev's motives and deeds. Sympathy for the internet's best troll was in short supply both outside and behind bars. His supporters understand this.
"Does weev deserve to be in jail? Probably. Yes. But not for this," someone said after the hearing. The table agreed—and these were his friends.
0 comments:
Post a Comment