Today in Philadelphia, the 3rd Circuit Court of Appeals is hearing Andrew "Weev" Auernheimer's appeal of his 2012 conviction under the much-maligned Computer Fraud and Abuse Act (CFAA). Auernheimer is currently serving a 41-month term in prison for what the government says was "unauthorized access" of AT&T's servers in 2010.
Gawker itself published the information Auernheimer and another man, Daniel Spitler, collected as "Apple's Worst Security Breach," in 2010. That piece led to an FBI investigation of Auernheimer and Spitler. Both were charged under the CFAA; Spitler copped a plea and testified against Auernheimer.
Auernheimer and his defenders, who include the Electronic Frontier Foundation, are insisting to the appellate court that in fact there was no "unauthorized access" involved here. They point out that Auernheimer's co-defendant Daniel Spitler simply discovered a bug: He noticed a small hole in the way AT&T automatically filled in the email field of a login page for its iPad users.
Spitler then used a spider program that exploited that bug, and with it mined the 114,000 email addresses of everybody from defense officials to Harvey Weinstein that he and Auernheimer sent to then-Gawker reporter Ryan Tate.
This, Auernheimer's lawyers point out in their legal brief, is a far cry from "hacking":
AT&T chose not to employ passwords or any other protective measures to control access to the e-mail addresses of its customers. It is irrelevant that AT&T subjectively wished that outsiders would not stumble across the data or that Auernheimer hyperbolically characterized the access as a "theft." The company configured its servers to make the information available to everyone and thereby authorized the general public to view the information.
The government continues to maintain the access was unauthorized, regardless.
Yes, there's a hint in there that Auernheimer hasn't helped his own cause here by being a braggart. Adrian Chen profiled the man (as "the internet's best terrible person") for Gawker back in 2012, and he's a fellow given to grand pronouncements, to put it mildly.
That doesn't change the fact that the CFAA is, by wide agreement, not a great law. A lot of legal experts, including those defending Auernheimer, find it overbroad. There are several efforts afoot to reform it. As one of the EFF attorneys put it to the Guardian:
One of the big problems of this case has always been that Auernheimer can be unsympathetic. The thing is, when you couple a very bad law [the CFAA] with the prosecutor having brought the decision being able to go after who they like, or who they don't like, that's a problem.
[Photo Credit: AP.]
To contact the author of this post, please email firstname.lastname@example.org.