Some laws operate like hidden trap doors \u2014\u00a0everyone walks across the trap at one point or another, but only a handful of us actually fall through. For the rich, it\u2019s the law against insider trading<\/a>; for the rest of us plebs, it\u2019s the Computer Fraud and Abuse Act<\/a>.\u00a0<\/p>\n<\/div>\n On Thursday, federal law enforcement arrested journalist Tim Burke<\/a> and arraigned him in court in handcuffs. Twelve of the 14 charges levied against him in the since-unsealed indictment<\/a> are under the Computer Fraud and Abuse Act (CFAA), the federal anti-hacking statute.\u00a0<\/p>\n<\/div>\n The story begins with Tucker Carlson\u2019s extremely cursed interview of Kanye West in 2022. Most interviews are edited for clarity; in this case, the interview was cut to exclude a rambling, antisemitic rant. That unaired clip and others made their way to Vice<\/em><\/a> and Media Matters through Burke, who downloaded them from LiveU, a streaming service that media companies use to share video files. The FBI raided Burke\u2019s home last year, seizing phones, laptops, hard drives, and notes.\u00a0<\/p>\n<\/div>\n The indictment is an incredible example of how the CFAA tortures the English language. It accuses Burke of \u201crepeatedly utiliz[ing] the compromised credentials to gain unauthorized access to the Victim Entities\u2019 protected computers.\u201d Burke and his lawyers<\/a> have maintained that\u00a0he found the video clips after using demo login credentials that had been posted publicly on the internet, and that the files could be shared via unsecured, public URLs.\u00a0<\/p>\n<\/div>\n If so, that probably wasn\u2019t the ideal IT setup for the media outlets that were using LiveU. They may have, in fact, objected very strongly to strangers being able to access their outtakes. But is that enough to establish \u201cunauthorized access\u201d? Should it be?<\/p>\n<\/div>\n For a good long time, it was ambiguous whether violating a website\u2019s terms of service could be a felony<\/p>\n<\/div>\n<\/div>\n The universe of wack CFAA prosecutions is rich and diverse because the CFAA is so easy to weaponize. The statute hinges on access \u201cwithout authorization\u201d or access that \u201cexceeds authorization.\u201d It doesn\u2019t really specify what a \u201cprotected computer\u201d is. (A better question might be: what\u2019s an unprotected computer?<\/em>) For a good long time, it was ambiguous whether violating a website\u2019s terms of service could be a felony with serious jail time. The 2021 Supreme Court decision in Van Buren v. United States<\/em><\/a> narrowed the CFAA down enough that that\u2019s no longer a concern<\/a>. (The timing was inadvertently clutch, as shortly thereafter Netflix began to crack down on password sharing<\/a> and<\/em> everyone started getting whipped up over AI companies scraping websites<\/a> against operators\u2019 wishes.)\u00a0<\/p>\n<\/div>\n Because Burke is a journalist, what may come to mind first is the case against journalist Matthew Keys<\/a>, convicted in 2015 after he posted the content management system credentials for his erstwhile employer into a public chatroom while urging others to deface the website. Keys, whose actions there resemble neither hacking nor journalism, was prosecuted under a provision of the CFAA prohibiting \u201cdamage without authorization.\u201d It\u2019s a different section of the law, though the same sticky problem with the meaning of \u201cauthorization\u201d pops up yet again.\u00a0<\/p>\n<\/div>\n But Burke\u2019s case is much more analogous to those of much-lamented and admired Aaron Swartz<\/a> (sometimes called \u201cthe internet\u2019s own boy<\/a>\u201d) or the unlamented and less-admired Andrew \u201cweev\u201d Auernheimer<\/a> (often called \u201ca notorious troll<\/a>\u201d and \u201ca terrible person<\/a>\u201d), both of whom were famously prosecuted under the CFAA for scraping readily available information.\u00a0<\/p>\n<\/div>\n Auernheimer\u2019s conviction stemmed from a script that automatically accessed a series of public URLs that unfortunately contained AT&T customer information. Swartz was prosecuted for scraping JSTOR, a paywalled academic database that could be freely accessed on MIT\u2019s campus network. Theoretically, his access began to \u201cexceed authorization\u201d when he signed into the network as Gary Host (G. Host, or Ghost), and then when, after campus IT attempted to block his computer for excessive server requests, he spoofed his DNS.<\/p>\n<\/div>\n Swartz and Auernheimer aren\u2019t known as journalists, though both are associated with media publications \u2014\u00a0Swartz was a contributing editor to the left-wing magazine The Baffler<\/em>, and Auernheimer sometimes writes for the Daily Stormer, a white supremacist website he has helped manage on the technical side. Their respective prosecutions speak to that side of their personalities. Swartz scraped JSTOR in hopes of liberating scholarship for the whole world; Auernheimer, who did not write any of the code he was jailed for, acted as the official hype man for the AT&T breach<\/a> because he loves attention.\u00a0<\/p>\n<\/div>\n Auernheimer\u2019s conviction was overturned<\/a> in 2014 by an appeals court on a technicality; Swartz\u2019s case never went to trial because he died in 2013. Aaron\u2019s Law<\/a> \u2014 a bill to reform the CFAA \u2014 was proposed in the wake of his suicide but stalled in Congress.<\/p>\n<\/div>\n If these two men had been written into a novel, their characters would be derided as ham-fisted symbols of the noble and ignoble instincts that drive journalism. As it is, it\u2019s maybe shocking that journalists aren\u2019t being prosecuted all the time. When you define \u201cauthorization\u201d that loosely, of course a journalist will end up on the hook \u2014\u00a0journalism in the modern day is the act of using your computer in a way someone somewhere would really rather you did not.\u00a0<\/p>\n<\/div>\n The case against Tim Burke is almost a bizarre historical throwback. On all sides \u2014 the legislature, the courts, and even the DOJ<\/a> \u2014\u00a0people seem to know that there is something wrong with the CFAA. It\u2019s a law that can be made to fit a dizzying array of scenarios, to take down progressive idealists and literal neo-Nazis with equal efficacy. And here we are again, squinting at websites and asking, \u201cIs this a protected computer?\u201d<\/p>\n<\/div>\n<\/div>\n