Participating organizations, which include members of the Internet Defense League such as Reddit and Wordpress, have asked their users to contact Congress this week to express their support for reform of the CFAA.
A 1986 law designed to reduce Internet hacking, the CFAA allows the federal government to prosecute Internet users for various computer-related offenses.
“The CFAA is punishing too much of our behavior online and too much of our activity,” said Matt Wood, policy director for Free Press Action Fund. The Free Press is a member of the Internet Defense League (IDL). Approximately 30,000 websites participate regularly in the organization’s Internet freedom campaigns.
“Even when people do things that we might want to punish, it’s providing penalties that are far too severe,” he said. “It’s threatening people with decades in prison for simple activities that may or may not be a crime in the first place, and certainly shouldn’t be a felony.”
The CFAA broadly prohibits anyone from accessing a computer “without authorization,” which can be interpreted by prosecutors as violating a website’s terms of service. Facebook’s terms of service bar users from using pseudonyms. Google prohibits access to people younger than 13.
If prosecuted by the federal government, penalties for violating the CFAA could range from misdemeanors to felonies.
“We hope to see the penalties reduced so that when there is a crime, the punishment actually fits the crime; and things like simply violating terms of service are decriminalized,” said Wood.
Computer programmer, Internet activist and Chicago-native Aaron Swartz, who helped develop RSS feeds, Creative Commons and Reddit, was arrested at the Massachusetts Institute of Technology in 2011 and was charged by federal prosecutors for two counts of wire fraud and 11 counts of violating the CFAA. He faced 35 years in prison and $1 million in cumulative fees for downloading 4.8 million academic articles from JSTOR and violating the online library’s terms of service.
Aaron took his own life on January 11. He was 26 years-old.
The Internet advocacy week of action also calls for support of Aaron’s Law, drafted by U.S. Rep. Zoe Lofgren (D, CA-19), which is named after Swartz. It would narrow the reach of the CFAA to exclude breaches of terms of service, meaning if Internet company users agree to a term of service, violation of that term of service could not be used to prosecute a felonious charge.
“We should prevent what happened to Aaron from happening to other Internet users,” said Lofgren in a statement posted on Reddit on January 15. “The government was able to bring such disproportionate charges against Aaron because of the broad scope of the Computer Fraud and Abuse Act (CFAA) and the wire fraud statute.”
According to a second post by Lofgren on Reddit, published February 1 to include revisions, the draft of Aaron’s Law was updated to limit the reach of the CFAA by defining "access without authorization" as the “circumvention of technological access barriers.”
The draft has not yet been formally introduced as a bill.
“The CFAA is a truly draconian bill that’s incredibly outdated,” said Evan Greer, campaign manager for Fight for the Future, a nonprofit Internet freedom advocacy group and member of the IDL.
Greer said the CFAA allows corporations to write the law and determine whether someone is committing a federal offense because companies write their own terms of service.
“We don’t think anyone should go to jail for violating things that you see when you go a website and just click ‘accept,’ nobody actually reads those,” he said.
But a draft of legislation that would strengthen the CFAA has been making its way around the House Judiciary Committee. The legislation would intensify penalties for computer-related offenses and update the CFAA to include attempted cyber crimes as punishable offenses.
“What’s at stake here is a bill that is extremely open-ended and puts the power in the hands of the judicial system to pick and choose who they want to prosecute,” said Greer. “That really has a chilling effect on free speech, it has a chilling effect on activism and makes it difficult to protect the Internet as a vessel for freedom of expression and social change.”
Greer said members of Congress needed to be further educated about what the Internet is and how it works. He said large corporations that have a vested interest in clamping down on “hackers” are using scare tactics to influence congressional delegates.
David Segal, executive director of Demand Progress, said under the CFAA's current policies most Americans could be considered criminals.
Demand Progress is hosting a rally on the steps of Moakley Courthouse in Boston on April 13 to advocate for reform of the law many attribute as the cause of Swartz’s death.
“(CFAA is) a hallmark of authoritarianism that runs contrary to the interests and wants of most Americans and to the values upon which our country was founded — and stifles free speech and innovation,” said Segal in a statement.
“Now is the time for reform."