Orin Kerr: Why I Am Representing Auernheimer Pro Bono on Appeal

http://www.volokh.com/2013/03/21/united-states-v-auernheimer-and-why-i-am-representing-auernheimer-pro-bono-on-appeal-before-the-third-circuit/

by rdl • 13 years ago

220 110 13 years ago

volokh.com

gruseom• 13 years ago

Question for the local counsel: how much harder is Kerr's job made by entering only at the appeal stage, as opposed to if he had been representing Auernheimer from the beginning? e.g. are there issues/arguments he won't be able to bring up now that he could have earlier?

Lazare3• 13 years ago

I can give you the general answer to that:

At the trial stage, you can argue matters of fact. Stuff like "my client was at home in bed when the events occurred" or "those teeth marks don't evem match his dog!"

Since we are now at the appeal stage, barring something huge, all the facts the trial court decided were true have to be assumed true. So he can't now argue that Weev didn't actually access AT&Ts servers. All he can discuss now is whether the court correctly applied the law to the facts it determined at trial, and that means...

...that it won't hamper Kerr at all. The facts here aren't disputed; everyone agrees on what Weev did, how AT&Ts servers were configured, where Weev was, where the servers were, how AT&T responded to the breach. The dispute is entirely down to how the court applied the law (or indeed, whether it was even in the right court), and that's stuff which is best addressed (in some ways, only addressable) at the appeal level.

TL;DR: It doesn't make Kerr's job harder at all; in fact he can only do his job at the appeal stage, as his concerns are very much with the trial courts decision, not with the facts the court based that decision on.

redthrowaway• 13 years ago

So if the Appeals court can only decide if the law was applied correctly, does that mean it would have to go to the Supreme Court in order to determine if the law is constitutional?

rayiner14• 13 years ago

My only addition would be that things like what Weev's state of mind was when he did these things are matters of fact that will be assumed true on appeal. So in addition to "he didn't actually access the servers" you also can't argue "he didn't really intend to do this or that."

macchina2• 13 years ago

I don't think it matters because Kerr is just arguing that the district court interpreted and applied the law incorrectly. An appeals court has full power in these areas. It would only be a problem if they wanted to introduce facts or procedural/evidentiary arguments not presented to the trial judge, or if they want to overturn the trial court's decision on procedural/evidentiary/factual matters.

bradleyjg2• 13 years ago

Some arguments have to be made at every level or can be lost (i.e. 'preserved for appeal'). It looks like in this case the issues Kerr wants to appeal have not been lost. In any event the appellate stage is a more natural fit for an academic than the trial stage.

DannyBee2• 13 years ago

Normally, you need to preserve arguments for appeal if they are related to evidence. It's unclear which, if any, arguments have not been preserved. However, at the same time in federal court, appeals courts generally have broad discretion to consider legal arguments not raised below, particularly if they are just about the law, not about some particular piece of evidence.

All this said, Kerr is only consulting/helping out AFAIK. He is not the arguing attorney (I hope). He's not really a litigator (he has about 3 years of experience in it, most of it from very early days of his career).

I am doubtful that his expertise would have really mattered at the trial stage. You can either convince a judge of something, or you can't.

rdl• 13 years ago

I wonder if Marcia Hofmann is doing this individually (and pro bono) or as EFF.

macchina2• 13 years ago

This is fantastic news. Hopefully this gets overturned and narrows the scope of the CFAA to where the government can't put people in prison for exposing security flaws on unrestricted areas of the web.

Lazare3• 13 years ago

Good to hear. I have quite a lot of respect for Kerr; he's one of the foremost experts in this area (the intersection of the 4th ammendment with computers and networks), and I think Weev's case is a serious injustice.

As an aside, I actually think it's clear that Weev's case is a vastly larger injustice than Aaron Swartz's case.

Swartz clearly violated the law in an act of willing and knowing civil disobedience. The law restricts people from unauthorized access to a network; Swartz and the MIT network admins played a game of cat and mouse as they kept banning him, and he kept finding new ways of gaining access to the network. There's no way to argue Swartz didn't realize that he was gaining unauthorized access to a network. At one point he was hiding his face from security cameras; there's no way to spin that as "oh, he thought he was doing something perfectly allowable!" And once caught, he was offered a reasonable plea deal.

In contrast, Weev...fairly clearly did not gain unauthorized access to a network. It was a publicly available website, and no one ever tried to stop him. His actions were at worse borderline, and yet he ended up with a sentence MUCH higher than Swartz.

I have a lot of sympathy for Swartz (not least because of his tragic suicide), but at the end of the day he knowingly and wilfully violated the law in an act of civil disobedience, and was offered a plea deal of less than a year. Weev probably did not violate the law, and was sentenced to years in prison.

Weev needs and deserves help. I had to cheer a bit when I saw Kerr was going to be helping him.

sigzero• 13 years ago

Didn't he use an unpublished link? That would be "unauthorized" to me.

cheald3• 13 years ago

http://en.wikipedia.org/wiki/Security_through_obscurity

jonathanwallace• 13 years ago

Can you clarify what "published" means in the context of a http link? Preferably citing the appropriate section in the RFC, http://www.w3.org/Protocols/rfc2616/rfc2616.html?

ghshephard3• 13 years ago

Curious - did I do something "unauthorized" by entering:

https://news.ycombinator.com/item?id=5419914

Into the URL bar? (One less than this article's URL)

mcherm2• 13 years ago

That strikes me as a very surprising position to take.

So you consider it a felony to enter in a browser some URL that has not been been "published". What exactly counts as published? For instance, if I created another page that links to it, is that "published"? Is it still "published" if I later delete that other page? Is it "published" if someone else somewhere in the world creates a page linking to it, but I never create one? What if I print a riddle in the newspaper, which says that the answer to the riddle is the URL in question... is that "publishing" it? What if it's a really HARD riddle? What if I don't print the riddle in the newspaper, but it's a really easy riddle... something like "just add one"?

I honestly do not think that whether you "publish" a URL should be used as an indicator of whether access is authorized. Every web server I have ever heard of has the ability to return a "401 Unauthorized" error code, and to do so or not based on the credentials of the person connecting. If I were writing the law, I would say that guessing a password to put in such a box, or accessing it with a malformed request used a bug in the server to bypass such a credential check would certainly qualify as "unauthorized access", but that "AT&T didn't bother to require a check before returning the data to any browser that asked for it" would be evidence that it was explicitly authorized.

mk3• 13 years ago

basically if he looses the court. 404 page may result in getting orange jumpsuit and nice check to be paid. In my opinion leaving personal information accessible to general public (i.e. no authentication needed) is a crime. Letting journalists know is not a crime. In this case AT&T is responsible for misplacing personal data, and not the guy who had free access to it. In some ways it's really similar to Aaron Swartz case, as both guys found a way to get the data, and both got sued. I would suggest looking into this case more closelly as if he ends up in jail or pays a dime, a simple misuse of some companies website and/or public API (think Google Maps, etc.) Could land you in jail

rayiner14• 13 years ago

Honestly, both are/were/would have been bad test cases. With Swartz you've got two issues in the same case: downloading JSTOR articles and trying to get on MIT's network despite being banned. It's easy to support the former without supporting the latter and "muddled" makes for a bad test case.

With Weev, you've also got two issues. He was not just convicted of downloading things from AT&T's network. If that was the beginning and end of it, it would have made for a good test case. Instead, he downloaded tends of thousands of pieces of personal information then bragged on IRC how he was going to sell it to scammers to damage AT&T. That's not "civil disobedience." That's malicious.

Note that this is on appeal, so the jury's verdict on the "fraud in connection with personal information" charge is to a degree locked in. On appeal, you don't get to argue: "the jury was wrong, he didn't really intend to sell the information to scammers or to use the information maliciously." The jury is empowered to decide whether they believe the defendant's story or not, and on issues of credibility it's almost impossible to overturn the jury's finding on appeal.

Thus, you're left arguing from a very weak position: yes, the guy did commit fraud in connection with personal information, but changing letters in a URL isn't "illegal access of a network" so the CFAA charge should be dropped. So at best you're hoping for a remand to re-sentence without the CFAA conviction, and the fraud charge by itself carries a maximum penalty of more than 41 months anyway.

eridius• 13 years ago

I agree with you completely here.

However, I think that it's worth arguing from that weak position. I've had a hard time articulating why I think that a) weev's online actions aren't illegal, and yet b) why weev should still be punished. But arguing from that weak position and getting the CFAA charge dropped would actually resolve this issue. My problem with what weev did, and why I think he should be published, is because of his malicious intent. So getting the CFAA charge dropped would be a win for everyone, but leaving the fraud charge in place would still appropriately punish weev (although I think 41 months is too high).

rsingel• 13 years ago

He didn't brag about selling them. It was a joke. Read the IRC logs. What did he do? He wrote the media.

warfangle2• 13 years ago

So anyone who scrapes facebook and gathers a bunch of email addresses and brags on IRC about how they could sell them to scammers is now liable for a federal felony?

gre• 13 years ago

If he didn't actually sell the information, is it really a crime? Is it really intent? I can type out or even copy/paste a bunch of words, but does that prove intent? The guy is a troll--it's expected he would try to get a rise out of people.

chetanahuja• 13 years ago

Wildly extrapolating from current trends : (Old, out of touch, heavy handed government officials, increasing complexity of technology landscape, anonymous, bitcoin, various governments creating secret "cyber-war" units, stuxnet etc..) we're heading to a breakdown and reconfiguration of the entire power balance between the "lawyer-types" who run the government now and the hacker types who are mostly relegated to the sidelines of the society for now. I remember seeing footage of a congressional sessions (just after SOPA was sidelined) where the phrase "let's call in the nerds" was used repeatedly. Then there's crap like this http://www.volokh.com/2013/03/13/i-dont-really-understand-wh...

This is not a sustainable power structure and it's going to change. Let's hope the transition is peaceful and gradual for everybody's sake.

kyboren• 13 years ago

You think this is new? DoD delegated "Information Warfare" (what would now be called 'cyberwar') duties to NSA in 1997. In fact, the reconfiguration of the power structure is explicitly touched upon in NSA's own journal Cryptolog, in the Spring 1997 issue (Vol. XXIII, No. 1) -- http://cryptome.org/2013/03/cryptologs/cryptolog_136.pdf.

danso2• 13 years ago

Mr. Kerr is a standup guy. Not everyone agreed with his measured defense of prosecutorial conduct in Aaron Swartz's case (https://news.ycombinator.com/item?id=5053754) but he has always been firm in opposing the misuse of the CFAA on principled and constitutional grounds. That he's defending someone that even the Reddit crowd despised (for personal reasons) is a confirmation of Kerr's respect for principles.

fnordfnordfnord6• 13 years ago

>...even the Reddit crowd despised

That's a terrible standard. There are some pretty awful things said by Redditors, especially in Weev's recent thread.

I think Kerr's defense of Weev is less for Weev's personal sake than it is for the sake of Kerr's vocation. Either way I'm glad he is stepping up.

_delirium• 13 years ago

Yes, that's what makes me quite trusting of his claimed motivation. Weev is one of the less sympathetic defendants you can find in this case in general, and is not aligned with Kerr's own politics or personality either (Kerr is generally a moderately conservative guy, in favor of law-and-order but with strong safeguards for liberty).

That leads me to suspect that Kerr is especially worried about the precedents here, much more than he's worried about Weev's own fate.

danso2• 13 years ago

I guess what I mean is that as a purported figure of Internet freedom and federal overreach, weev is not a great poster boy. Usually, when you're in the position of picking battles to fight, as Kerr is, you want everything in your favor, and hell, why not a defendant that you have no problem being associated with. Kerr's insistence on turning back a flawed law apparently outweighs whatever distaste he might have for weev on a personal or political level. So, good on Mr. Kerr.

javert• 13 years ago

I hadn't been following this case, but this was interesting.

Why has the federal government turned into such a bully? This feels like a threat to all honest citizens.

smsm424• 13 years ago

Why? Because the honest citizens allowed it to. Sometimes actually begged it to.

mpyne3• 13 years ago

You say "turned into" as if it hasn't often been exactly like this.

mikesena• 13 years ago

This is ridiculous.

I'm all for the representation, but I'm against the trolling nature of HN and alike.

Look at the comments posted the other day. You hated this kid. And still hate him. Only because he claimed to be bigger than he thought he was, which is true.

But, an injustice was still done. Yes, the guy is a tool. A big tool. And he's lucky to have this opportunity. But grow some balls HN. Either flame him again, or apologise, because now saying "Yes he was mistreated" is just flawed.

georgemcbay• 13 years ago

I never commented on previous weev stories but I think it is completely rational to believe both that he's a giant asshole and also that he was mistreated by receiving a huge prison term for something that I can barely see as a crime, let alone a serious one.

Where's the flaw in thinking both of these things?

jhales• 13 years ago

I was at the sentencing and the prosecution argued that spoofing the user-agent constituted fraud...

https://addons.mozilla.org/en-US/firefox/addon/user-agent-sw...

My friend also informed me:

" HTTP has an error code, 401, for unauthorized access. AT&T responded with code 200 meaning OK."

The more one finds out about this case the more incredible it is.

lessnonymous• 13 years ago

This, to me, is the totality of the case: AT&T said accessing that data was OK. If it wasn't they should have returned a 401 or challenged for further authentication.

Incrementing a phone number by one doesn't make it illegal to call it. If the person at the end then says "who are you" and you lie, then that's fraud. But if they just tell you something, there's no way anyone can claim that you obtained that information unlawfully.

nookiemonster2• 13 years ago

Increment is the wrong word. They implemented the Luhn algorithm, which is not the same as i++

AnthonyMouse3• 13 years ago

Here's the problem with all of this: If you send a sufficiently vulnerable server a specially crafted request, you can get it to come back with "200 OK" and a list of everybody's credit card numbers. Conversely, if you're an employee of Foo, Inc. and you sign in to a secure server with your personal account and try to do something privileged, it's going to come back with "401 Unauthorized" and not give you anything even though you are actually authorized, and if you then sign in with your employee account it will allow you to do that thing.

As a general rule what the machine says has a very strong relationship with whether or not you're authorized to do something. The issue is that if you're not authorized then a properly functioning machine just won't let you do it, which means that it seems impossible for anyone to violate this law against a server that is working properly.

The only way anyone can be capable of breaking this law is if the server is not working properly and allows them to gain access without authorization. Which is why "unauthorized access" is such a vague and hopeless disaster. Going by the normal mechanism for determining whether you have authorized access, namely whether the server allows you to do something, would mean that no one could ever commit the crime, because either you never actually gain unauthorized access since you're prevented by a server with sufficient security, or you succeed in convincing the server to let you do something which under normal circumstances implies that you're authorized.

Seemingly the only way anyone would ever be convicted is based on a pile of circumstantial nonsense about how the defendant should have known they weren't authorized to do something that the server allowed them to do, even though normally you are authorized to do anything the server allows you to do.

So it becomes a de facto law against "doing bad things with a computer" -- not a specific prohibition against anything in particular, just something you stick to anybody who you don't like, because hey, if you did something "bad" then it wouldn't be authorized, right?

calhoun137• 13 years ago

Many people can't imagine how what weev did is a crime according to the law, and comments in HN threads about legal issues seem to be based on the assumption that the legal system is a consistent set of rules, sort of like the axioms of mathematics, in which a certain question or problem is posed and by a correct application of the rules of the legal system it is possible to come to a definite conclusion about what the law says. However, there is an amazing paper which shows that in virtually every case, a "correct" application of law actually leads to different conclusions which contradict each other.

This excellent paper is by Karl N. Llewellyn and is called "Remarks on the Theory of Appellate Decisions and the Ruled or Canons about how Statutes are to be Construed"[1] I once read almost the whole thing, and the following quote from the first page sums up his main point pretty nicely.

"The major defect in [the legal system] is a mistaken idea which many lawyers have about it—to wit, the idea that the cases themselves in and of themselves, plus the correct rules on how to handle cases, provide one single correct answer to a disputed issue of law. In fact the available correct answers are two, three, or ten. The question is: Which of the available correct answers will the court select—and why? For, since there is always more than one available correct answer, the court always has to select."

IIRC, he discusses the role of precedent as an important aspect of deciding how to apply the law, but also the ability of a judge to decide to overturn a precedent for a wide variety of reasons. He also discusses the role played by the intention of law makers when passing law, which is ultimately a subjective judgment made by a person, and which is not spelled out in the actual written law itself.

The paper is considered something of a classic, and I would encourage everyone to take a look at it.

[1] http://mtweb.mtsu.edu/cewillis/Hermeneutics/Llewellyn%20on%2...

smsm424• 13 years ago

>>>> Importantly, however, only e-mail addresses were obtained. No names or passwords were obtained, and no accounts were actually accessed.

Why is it important? If, as Orin Kerr claims, emails were public information, so were names and passwords, if stored under the same scheme. So if he accessed names and passwords, it would be also authorized access by the same logic. But it seems to me somehow Orin Kerr feels the weakness in this argument. Since he doesn't really expects people to believe that if you find a hole in a site that allows downloading account passwords via exploiting some vulnerability in HTTP server sending it some specially crafted data - he feels that it is necessary to emphasize that passwords weren't accessed. But many people consider their personal email no less private than their password - so if it wasn't OK to take the password (and by emphasizing that no passwords were taken Orin Kerr seems to implicitly admit it would be important if the passwords were taken) then it also wasn't OK to take the emails.

On the question of felony though he may have a point. Felony is a grave crime that renders the criminal second-class citizen long after the prison term has been served. I think for non-violent crime that did not result in actual grave harm it is too much, and while I remain unsympathetic to Auernheimer's person, I think if Orin Kerr succeeds in somehow reducing it to lesser grade (or cause a change in the law that leads to that) it would be great.

smsm424• 13 years ago

Interestingly enough, whoever downvoted it didn't bother to counter-argument. Because yeah, why bother?

jessaustin2• 13 years ago

I upvoted your top comment but I'm definitely downvoting this whinging about downvoting. That shit has to stop, or HN will become truly unreadable.

nookiemonster2• 13 years ago

Hey, here's a cool story about Weev: He's totally the kind of guy society should tolerate.

http://bedizen.livejournal.com/258763.html

flyinRyan8• 13 years ago

Go back to 4chan or reddit please. The law isn't your personal playground to arrest people you don't like. Accessing a public URL isn't a crime. Nor is being an asshole (of which you should be very glad!).

josephlord• 13 years ago

So the authorities should charge him with harrassment, privacy invasion, extortion, copyright infringement (of the photo(s)) whatever is applicable for the things that are described in that article (or anything else) that he has done.

Do not sentence him to 41months for the fact that AT&T breached its customers privacy and Weev let the press know or for accessing unprotected URLs.

Orin Kerr: Why I Am Representing Auernheimer Pro Bono on Appeal

Related Stories