President Obama proposed new laws to protect Americans and “especially our kids” from hackers during his State of the Union address. Swaddled in that almost tender-sounding language, though, was a plan that would strengthen the government’s ability to go after journalists like Barrett Brown.
In fact, the new cybersecurity legislation would further criminalize the kind of activity for which Brown is due to be sentenced in Dallas federal court on Jan. 22. Judge Sam A. Lindsay will decide whether to let Brown, 33, off with time served for the more than two years he’s already spent behind bars, or imprison him for a maximum of eight-and-a-half years. Brown struck a deal to plead guilty to, among other charges, a Computer Fraud and Abuse Act (CFAA) felony.
That particular element of the case against Brown demonstrated how he, as a journalist, worked with hackers to expose corporate behavior. The CFAA violation involved his efforts to shield one of his sources, Anonymous hacktivist Jeremy Hammond, from prosecution. Hammond, a self-described anarchist based in Chicago, broke into the computer systems of the private intelligence firm Stratfor hoping to expose wrongdoing and corporate malfeasance.
Brown’s prosecution fits a pattern that has seen the U.S. government treat online journalists, crusading bloggers and idealistic hacktivists as enemies more than new-style investigative reporters. Already, his sentence stands to chill those who would emulate him in conducting real-time, public research into leaked data troves. At the last hearing in Brown’s case, in December, journalist Quinn Norton testified that his prosecution was “absolutely chilling” to 21st Century journalism.
Easier Prosecutions
With President Obama’s legislation, it will become easier for prosecutors to pursue such people. The proposals would, among other things, broaden the meaning of “unauthorized access” such that the Department of Justice could more easily turn the sharing of hyperlinks into illegal “trafficking” as they see fit. Prosecutors accused Brown of that but dropped nearly that entire indictment amid sharp criticism that they were bending the law and attacking free speech.
Brown’s guilty plea allowed him to escape an indictment that construed the sharing of a hyperlink as identity theft. The opening for prosecutors was that the file was said to contain canceled credit card data and user password material hacked out of Stratfor’s servers.
One crucial difference was that Brown had no plans to profit from the sharing of the link, precisely the kind of criminal fraud the law was drafted to stop. Instead, he thought the information might aid his virtual research syndicate ProjectPM, which was investigating shadowy cybersecurity contractors that work for law enforcement and intelligence agencies. Indeed, he publicly criticized hackers who spilled the personal data of innocent bystanders.
That difference won’t matter under the new proposals. The Computer Fraud and Abuse Act, under which Brown will be sentenced, would be amended to define unauthorized access as something done “for a purpose that the accesser knows is not authorized by the computer owner,” a practically limitless definition. The law will also make hacking that’s now a misdemeanor a felony.
Cybercosa Nostra?
The proposed legislation will also give federal prosecutors authority to use the most powerful weapon in their arsenal against hackers: The Racketeer and Influenced Corrupt Organizations Act, known commonly as RICO. The government would then have the discretion to pursue hackers and hacktivists alike with the same tools used to dismantle the mafia and drug cartels.
The government already seems to consider people like Brown a threat. Consider the effort they have poured into his case alone: the prosecution tried to take away funds donated for his defense, gagged him from speaking out about his case, fished for the names of ProjectPM members, pursued a case against his mother, and argued that he and Anonymous “secretly plotted the overthrow of the government.”
In other words, prosecutions like that pursued against Barrett Brown, may well become more common. They will certainly be easier to bring forward. And the government will have even more authority to rein in alliances between journalists and hacktivists, and other previously unheard voices exposing how governments and corporations work together in the dark corners of cyberspace.
