CFAA reform was already looming, but the suicide of 26-year-old Reddit co-founder Aaron Swartz in January helped galvanize groups to change the law so that not all hacking is considered the same and to make penalties less draconian in some cases. Swartz killed himself as he faced up to 35 years in prison and a $1 million fine after prosecutors alleged he stole more than 4 million documents from the JSTOR database of academic research papers at MIT.Things as simple as violation of a site's terms of service could be prosecuted as violations of the CFAA and could lead to years in prison. Most companies ignore and won't pursue these kinds of violations. In fact, JSTOR didn't want the federal government to pursue Swartz. Internet activists want these violations to be civil, rather than criminal. The initial version of the CFAA pushed by the Department of Justice reauthorization could have made the current law even worse, adding amendments that included racketeering and conspiracy to the possible charges internet users could unwittingly face for simple violations.
“Right now, what we’re experiencing is a cyberpanic in Congress and all this fear about cybercrime and computer attacks,” said Hanni Fakhoury, an attorney at the Electronic Frontier Foundation. “That’s why there’s been a renewed effort to use the CFAA aggressively. But the problem is a lot of the cases that get a lot of attention are where there aren’t really cybercrimes going on.”
CFAA reformers cite the dozen federal judges who have rejected prosecutors’ varied interpretations of the law. The result is confusion across the nation’s judiciary as to the CFAA’s proper role.
Luckily, saner heads seem to have prevailed and the legislation has been pulled off the fast track and out of cyber week, thanks to a flurry of lobbying efforts by activists. Rep. Jim Sensenbrenner (R-WI) had intended to take up the legislation in his subcommittee this week, but has postponed it now indefinitely. The lobbying by activist groups included a memorial service at the House of Representatives last week, and more than a dozen meetings with key lawmakers from both parties. In this case, Sensenbrenner and the Judiciary committee chair, Rep. Bob Goodlatte (R-VA), have been working with activists in what Demand Progress co-founder David Segal says is "good faith." This could actually be a case where internet activism ends up not just preventing a bad law from being enacted, but makes a bad law better.