Aaron Swartz and the CFAA

**Aaron Swartz** (1986-2013) was an American programmer, writer, open-access activist, and co-founder of Reddit. His work shaped core infrastructure of the early web. His federal prosecution and 2013 suicide at age 26 catalyzed ongoing debates about the **Computer Fraud and Abuse Act (CFAA)**, open access to research, and prosecutorial discretion. ## Technical contributions By age 15: - Co-developer of the **RSS 1.0** specification. - Architect of the **Creative Commons** technical infrastructure with Lawrence Lessig. - Co-founder of Infogami, merged into Reddit in 2005. Received stock in the merger; left shortly after. Subsequent work: - Co-developed **Markdown** with John Gruber. - Early **web.py** framework. - Wrote a significant portion of the **Open Library** codebase at Internet Archive. - **tor2web** and the **SecureDrop** whistleblower-submission system (originally 'DeadDrop'). - Co-founder of **Demand Progress** — the activist organization central to defeating SOPA / PIPA in 2012. ## The JSTOR prosecution In 2010-2011, Swartz downloaded approximately **4.8 million academic articles** from JSTOR via MIT's network. He connected a laptop to MIT's wired network (which was open to guests), automated the download, and did not publicly redistribute the articles before being stopped. JSTOR did not press charges and asked prosecutors to drop the case. MIT took a neutral position. Federal prosecutors (led by **Carmen Ortiz**, US Attorney for Massachusetts) charged Swartz under the CFAA with **11 felony counts**. Exposure: up to **35 years in federal prison + $1 million in fines**. Prosecutors offered a plea deal: 6 months in federal prison + felony record. Swartz refused. Trial was scheduled for April 2013. ## Death **January 11, 2013**: Swartz died by suicide in his Brooklyn apartment. He was 26. His family and partner directly blamed prosecutorial overreach. Lessig called it 'the product of a criminal justice system rife with intimidation and prosecutorial overreach.' The statement from his family: 'Aaron's death is not simply a personal tragedy. It is the product of a criminal justice system rife with intimidation and prosecutorial overreach.' ## Legal and legislative aftermath - **'Aaron's Law'** introduced in Congress (2013, Rep. Zoe Lofgren + Sen. Ron Wyden) to narrow CFAA's definition of 'unauthorized access.' Has not passed as of 2026. - **MIT internal report (Abelson report, 2013)** — found MIT had been 'neutral' but argued this neutrality effectively amplified prosecutorial pressure. - The prosecution is frequently cited in federal-prosecutor training materials as an example of **disproportionate charging**. - Ortiz defended the prosecution and later ran for Massachusetts Governor; she did not win. ## The CFAA The **Computer Fraud and Abuse Act** (1986, extensively amended) criminalizes 'unauthorized access' to computer systems. Critics have long argued: - The statutory definition of 'unauthorized access' is dangerously vague. - It has been applied to cases far beyond traditional hacking — violating terms of service, automated web scraping, academic research on machine learning, security research. - Sentences scale rapidly with counts; prosecutors can stack charges for the same underlying act. **Van Buren v. United States (2021)** narrowed CFAA somewhat — the Supreme Court held that 'exceeds authorized access' means accessing areas one is forbidden from, not misusing areas one is permitted to access. This would likely have changed how the Swartz case was charged, had it existed then. ## Cultural significance Swartz is widely cited in: - **Open-access advocacy** — his 'Guerilla Open Access Manifesto' (2008) argued for making academic research freely available. - **Prosecutorial-overreach critique** — his case is taught in criminal law and legal ethics courses. - **Intellectual freedom debates** in library science and academia. - **Tech community memorialization** — conferences, scholarships, the Aaron Swartz Day (November 8). ## The 'consistent inconsistency' observation Increasingly cited in 2024-2026 discussions of AI training data: > Aaron Swartz faced 35 years for downloading 4.8 million academic articles he never redistributed. AI companies have scraped hundreds of millions of copyrighted works — including entire book libraries, all of Reddit, Wikipedia, YouTube transcripts — and use them as training data to produce commercial products that generate hundreds of billions of dollars in market value. None of those companies' executives face prosecution. The legal system treats one form of unauthorized bulk data access as a serious crime; another, at vastly larger scale, as a business model. Whether the distinction is coherent is the contested question. 'Training is fair use' is the industry position; class-action lawsuits (New York Times v. OpenAI, Andersen v. Stability AI, Bartz v. Anthropic) are actively testing it. This comparison is central to the broader critique of AI governance — see related notes on AI policy and intellectual property. ## Films and books - **'The Internet's Own Boy: The Story of Aaron Swartz'** (2014 documentary, directed by Brian Knappenberger). - **'The Boy Who Could Change the World'** (2016, collected writings). - Multiple academic papers in legal and computer science journals. ## Related - Linux Kernel AI Coding Assistants Policy (2026) — context in which the Swartz comparison is frequently raised now.