Internet activist and Reddit co-founder Aaron Swartz's suicide in January 2013 shocked friends, family and admirers alike. Friends, family and fellow activists blamed an overzealous prosecution by the U.S. Attorney's office -- an allegation prosecutors denied -- over Swartz's efforts to download the entire JSTOR academic database on the Massachusetts Institute of Technology's servers via a hidden computer and a program which allowed him to do so remotely. MIT, which had an open guest access policy but maintained "neutrality" on the federal prosecution of Swartz, came under fire as well, prompting the university to undertake a review of its policies.
The much-delayed report is notable for its in-depth timeline of events, which document the events which led to Swartz's arrest from the university's perspective, the tick-tock of the prosecution as it made its way from the state to federal courts at the insistence of the U.S. Attorney's office (USAO) -- which denied the state access to evidence and forced them to drop their case against Swartz for accessing university property -- and the series of meetings taken by the university leaders, its Office of General Counsel (OGC) and its outside counsel prior to Swartz's suicide.
Taken together, it provides a clearer picture of the gaping holes in the prosecution's case against Swartz, the prosecutor's mindset -- which appears to bear out at least some of the allegations of Swartz's supporters -- and MIT's own utter lack of interest in what occurred on their own campus and for which a young man was being prosecuted with them as the alleged victim.
1. The U.S. Attorney blamed Demand Progress's blogpost and petition effort for his decision to seek further charges and more jail time for Aaron than initially outlined.
The prosecutor said that the straw that broke the camel's back was that when he indicted the case, and allowed Swartz to come to the courthouse as opposed to being arrested, Swartz used the time to post a "wild Internet campaign" in an effort to drum up support. This was a "foolish" move that moved the case "from a human one-on-one level to an institutional level." The lead prosecutor said that on the institutional level cases are harder to manage both internally and externally.
2. Though the staff costs to MIT were part of the fact pattern establishing the charges against Swartz, the university spent twice as much money dealing with prosecutors as with the actual "crime."
MIT applied hourly rates as follows: (a) for the IS&T personnel, it applied rates used to estimate software development costs; and (b) for the personnel with MIT Libraries, it used actual salary and benefits to calculate an hourly rate. In this letter, MIT informed the prosecutor that for some of the individuals listed, identified by name, the relevant time expended by them occurred after law enforcement became involved. Although this calculation was not made in the letter, applying the estimated hours to the hourly rates would have resulted in a figure of $10,104.75. The portion of this amount incurred before the arrest was under $3,500. The remaining time, and its estimated value, was incurred responding to the prosecution's requests for documents and information after the arrest of Aaron Swartz.
3. When MIT explained to prosecutors that the continued prosecution of Swartz would be expensive and potentially harmful to the university, the U.S. Attorney compared their problems to that of a rape victim asked to account for her consensual sex life (and said that all defendants who choose to go to trial, which they are guaranteed under the Constitution, are just hurting victims).
MIT's counsel noted that no one at the Institute was looking forward to the time, disruption and stress involved in testifying at hearings and trial. The prosecutor's response was that it disturbed him whenever a defendant "systematically re-victimized" the victim, and that was what Swartz was doing by dragging MIT through hearings and a trial. He analogized attacking MIT's conduct in the case to attacking a rape victim based on sleeping with other men.
4. The prosecution never asked MIT to confirm or deny whether Swartz was authorized to use the network -- but being allegedly unauthorized to use the network was key to the charges against Swartz -- and MIT never volunteered this information.
As discussed in the next section, MIT was expressly named as one of two victims of Aaron Swartz's conduct, the other victim being JSTOR. Among the charges was that Aaron Swartz had violated Section 18 of the United States Code §1030(the Computer Fraud and Abuse Act, or CFAA) by "accessing the MIT network without authorization" or by "exceeding authorized access"; and that the damages to MIT and JSTOR exceeded $5,000. For the CFAA, authorization of access to the MIT network is based on the rules of access set down by MIT (just as authorization of access to JSTOR documents is based on the rules set down by JSTOR). Thus MIT might be expected to play an important role in the interpretation of its access rules. Should there be a trial, MIT employees would likely be witnesses called to explain the rules. Moreover, during the plea bargain process, MIT might be asked to comment on the rules and could take the opportunity to come forward with a statement about the rules.
Despite the importance to the legal proceedings of MIT's interpretation of its own rules, the initial investigation paid little attention to how these rules applied to the authorization of people attempting to access the network. According to the Cambridge Detective involved in the prosecution, he asked repeatedly whether the laptop found in the closet was authorized to be there and to do what it was doing: he was told "no." On the other hand, the Review Panel spoke with personnel from IS&T and OGC, and with MIT's outside counsel, about their interviews and discussions with federal law enforcement during the entire period of the government's prosecution, from the date of Swartz's arrest until his suicide. They reported uniformly that no one from the government's investigatory team asked specifically whether Swartz — the person, as opposed to his laptop — was allowed to use MIT's network, nor were they specifically asked whether this use constituted access without authorization or access that exceeded authorization. (This distinction between the person and the laptop and its significance for the CFAA is discussed in Appendix 11.) Similarly, until very late 2012, Aaron Swartz's defense team did not raise any questions about this issue in their interviews with MIT personnel or their discussions with OGC or with MIT's outside counsel. Nor did Swartz's defense raise this issue with MIT prior to filing its motions to suppress (see section II.B.2), which referenced the allegations of unauthorized access and MIT's policies with regard to those allegations.
Consistent with its neutrality posture (see sect ion III.A.3), MIT paid little attention to the details of the charges. MIT did not undertake its own analysis of whether the crime of gaining unauthorized access or exceeding authorized access of MIT's network had occurred. Nor did it bring to the attention of the USAO or the defense the possibility that MIT's policies and practices cast doubt on this allegation in the indictment, as the Media Lab Director had noted that MIT could consider doing (see section III.B.1).
5. Despite supposedly maintaining a posture of "neutrality" of responses (but not outcomes) to prosecution and defense requests of the university, which included a refusal to openly call for the end of the prosecution, MIT reversed course in October 2012 and chose to support the prosecution's efforts against Swartz to maintain their own reputation in the face of his defense's efforts to exonerate him.
MIT decided that it would not be neutral with regard to defending MIT's employees or attacks made on the Institute's integrity. That concern played out in the months that followed.
For example, when the government's investigation had begun, in January 2011, OGC made the decision that the lead prosecutor, the Secret Service Agent, and the Cambridge Police detective could directly telephone and email previously interviewed IS&T employees without first going through an MIT attorney for follow-up questions, provided no new topics were covered (see section III.A.1). In early September 2012, after consultation with outside counsel, OGC decided to allow this direct conduct to continue during the government's preparation for the suppression hearings and trial. However, this did not occur for the defense: the defense was never given permission to interview or consult with any MIT employee without the presence of an MIT attorney, nor did it ever ask for such permission.
Another example is that MIT's outside counsel conveyed to the government what MIT wanted the government to consider in its arguments that MIT had not violated law in gathering evidence.
A third example concerns document production. When MIT provided documents in December 2012 to the defense (pursuant to subpoena), MIT's outside counsel later provided — without being asked — the same documents to the government. (This occurred in early January 2013.) However, MIT did not, reciprocally, voluntarily provide to the defense the same documents that it provided to the government. Similarly, MIT did not produce to the defense, even though requested by subpoena, documents that the defense sought from MIT but that MIT had already provided to the government.
And one extra:
Swartz allegedly led MIT police officers on a foot chase around Cambridge prior to his initial arrest.
When the cyclist reached the north side of Central Square, the officer who was following him decided to pull ahead of him and stop him to ascertain his identity.
While exiting his car, the officer held his credentials so that they could be seen and motioned for the bicyclist to stop. The bicyclist complied. The officer explained that he was an MIT Police officer and wanted to speak with him. The cyclist first said that he didn't speak with strangers. The officer again displayed his badge, as well as his photo ID. The cyclist then said that MIT Police were not "real cops" and refused to talk to the officer. At that point the cyclist dropped the bicycle to the ground and started running back toward Central Square, on Massachusetts Avenue. The officer chased him briefly, but the individual was outrunning him, and the officer returned to his car, made a U-turn, and followed, maintaining visual contact. The suspect slowed to a walk, and the officer, still in his car, watched and followed him. The first MIT Police officer radioed the second and told him where the suspect was located. Once near the suspect, both MIT Police officers and the special agent left their vehicles and chased the suspect around parked cars. They apprehended and handcuffed him.
[Image of of Aaron Swartz in 2008 via Wikimedia Commons]