It may have been improper in some grand sense, but that's not what Professor Kerr was addressing. He was addressing whether or not the conduct fit the laws in question, as interpreted by the relevant case law.

Alex Stamos doesn't even really try to refute that. Instead he provides context that suggests that it was an injustice to apply those laws to Aaron Swartz. That's a separate question, and one that Kerr apparently intends to address in a follow up post.

The thing that's going to disappoint me is if Kerr strictly analyzes whether the prosecutor choosing to bring the charges was unlawful, which I imagine it probably wasn't -- it's standard operating procedure.

Which is its own problem. But the problem with what prosecutors did is that prosecutors are allowed not to bring the charges and did anyway, notwithstanding the epic disproportionality of the charged penalties to the acts.

In other words, the problem is that the law is defective, and prosecutors could have had a conscience and not abused that fact to break this kid, but they failed at being human, and for that they are culpable. Morally and ethically if not legally.

That's supposed to be the second blog post.

While we wait though, I wonder Aaron's lawyers ever explained to him that thirty five years was an all but impossible outcome of this case, that seven years was a longshot and some type of non-incarceration a distinct possibility. If his lawyers for some reason didn't make that clear they did him no favors.

Now whether pervasive overcharging to extract pleas is itself ethical is another question ...

My comment based on the cited refutation is exactly related to what Professor Kerr was addressing. While technology law is very undeveloped and much of the penal code can theoretically reach into civil territory -- a small tweak of the facts and the entire matter becomes civil rather than penal. For example if Mr. Swartz had performed a buffer overflow exploit to gain access to JSTOR we'd both agree this was a criminal matter. If we're talking about violation of the private TOS of JSTOR, including circumventing their IP bans by using another public and legally available IP at MIT then we're dealing with a civil matter. These are the kinds of murky waters we have to deal with in our generation, but I think the distinction is pretty clear.

I guess I don't see that as a matter of law. The wire fraud statue talks of false pretenses, regardless of the method of circumvention, reconnecting after being banned looks like false pretenses to me. As for civil versus criminal, the law makes no such bright line distinction - almost every crime with an identifiable victim is also a tort.

Now admittedly I'm not an expert at internet law (though I do have a JD), but Professor Kerr is. Unless your contention is that he doesn't understand the technical details well enough to render an opinion, I don't see how you or the linked article refute his opinion given that you neither of you address it head on (i.e. using the case law).

I respect Professor Kerr's expertise and the case he cited is still relevant to my original assertion. In the cited case an employee specifically used a another employee's credentials to gain unlawful access. But in this case, Mr. Swartz didn't falsely impersonate anyone by simply using another publicly available IP that he was rightfully permitted to obtain.

He changed his MAC address, which is impersonating another device, so in this case it is exactly like the use of 'another employee's credentials'.

While I agree that it was entirely inappropriate for the prosecutor to bring criminal charges into a matter that had already been settled in civil court, leaving out the iterations of MIT coming up with ways to prevent Aaron form downloading things and Aaron coming up with ways to get around them really changes the analysis.

To be fair, the person cited in your refutation is an expert hired by Swartz's lawyer to prove Aaron innocent. He may be in possession of better facts, but as they say, "IANAL."