On his first day of work in San Francisco they took his laptop. Condé Nast had just bought Reddit, the founders had moved into the Wired offices, and the IT department collected the team’s machines to copy the drives “to ensure they had a copy of all our data”. What came back were iBook G4s with a Condé Nast desktop, a corporate screensaver and spy software pre-installed: “when they gave us the machines we didn’t even have administrator access on them”. The connection ran through the IT headquarters in Delaware, “presumably the better to spy on us on”. Aaron Swartz wrote all this on his blog two weeks later. By lunchtime on that first day he had locked himself in a bathroom stall and started crying.

He was twenty. He left the company in January 2007, two and a half months in.

That first day already holds the rest of it: a computer you cannot modify and a network that watches you without letting you inspect it. Six years later he would die under thirteen federal counts for downloading academic articles.

A technical adolescence#

At fourteen Swartz is one of the authors of the RSS 1.0 specification. At fifteen he is working on the technical infrastructure of Creative Commons with Lawrence Lessig; in the same circles he meets Tim Berners-Lee and the W3C’s work on metadata. These are years when the interesting part of the web still happens in mailing lists, and he is inside it as a peer, among people twenty years older than him.

He enrolls at Stanford and leaves after a year for Y Combinator’s first batch, with a project called Infogami that ends up folded into Reddit. Then the acquisition, the office, the bathroom.

What follows doesn’t look like a career. Open Library at the Internet Archive, an open catalogue with one page for every book ever published. Watchdog.net on the data of elected officials. Demand Progress, which in 2011 organizes the campaign against SOPA and wins it the following January. Along the way, in 2008, he downloads some 2.7 million federal court documents from PACER through a free trial running in a handful of libraries: public records the system charged eight cents a page for. The FBI opens a file and closes it without charges.

Where he parts from the cypherpunks#

Swartz shares with the cypherpunk movement a distrust of central authority and the conviction that code is a form of political action. The target, though, is different.

Cypherpunks protect by withholding: cryptography makes a message unreadable to anyone who shouldn’t read it, and privacy is the power to reveal yourself selectively. Swartz protects by exposing. His problem is that you can’t read what others have written: research funded with public money and rulings of public courts, locked behind a payment.

The relationship with the law changes too. Malcolm Harris, who knew him, puts it this way: publicizing public information

was a sort of hacking, but where the law is not something to dodge but another system with vulnerabilities and loopholes.

“Fixing the world”, for him, meant access, not anonymity.

JSTOR, MIT, thirteen counts#

Between September 2010 and January 2011 Swartz connects a laptop to a router inside an MIT network closet, keeping it covered with a cardboard box, and runs a script that mass-downloads articles from JSTOR. Roughly 4.3 million documents in the last episode, on top of the 450,000 of the two before it: the traffic forces JSTOR to block all of MIT for three days. He is arrested by the campus police and a Secret Service agent on January 6, 2011; the agent had turned up alongside the detective MIT had called in for his computer expertise.

On June 3, 2011 Swartz settles with JSTOR in a civil agreement: he certifies he kept no copies, hands over the only disk, pays $26,500. JSTOR tells the prosecutors it isn’t asking for criminal charges and would rather avoid them. The U.S. Attorney’s Office goes ahead anyway. On July 14, 2011 the indictment carries four counts: one of wire fraud, three of violating the Computer Fraud and Abuse Act. The press release announces up to 35 years in prison. On September 12, 2012 a superseding indictment carries thirteen, the same four broken into separate charges, with no new conduct. On paper the maximum rises to 95 years.

These are paper numbers: MIT’s own review panel would put a realistic sentence at around seven years if he were convicted at trial. The plea offers, which the parties recount in conflicting versions, range from three to thirteen months. The talks stall on one point: the prosecution never grants a guarantee of no jail time, nor will it drop the charge from a felony to a misdemeanor. When defense counsel warns the prosecutor that Swartz is a suicide risk, the prosecutor answers that the office could have him locked up.

Swartz refuses and pushes for trial. He kills himself in his Brooklyn apartment on January 11, 2013, aged twenty-six.

MIT, over those two years, chooses to stay neutral: no public statement, though his family, his lawyers and two faculty members ask for one. The panel that would later review the Institute finds that it had never sought prosecution and did not know who he was until the arrest. It also notes that MIT’s decision-makers did not look at the charges until a year after the indictment, and it disposes of the neutrality like this:

neutrality in responses was not consistent with neutrality in outcomes, and MIT was not neutral in outcomes.

He never said what he meant to do with those articles. In December 2015, in the New Republic, Harris rereads everything Swartz had written and arrives at this reconstruction:

His prosecutors claimed Aaron was downloading academic papers files to release them publicly, a tactic that’s advocated in the Guerrilla Open Access Manifesto, a rousing piece in the collection that’s uncertainly credited to Aaron […]. Based on what I know about Aaron, I don’t think that was his intention. I suspect he planned to release only the public-domain work that was being improperly kept behind a paywall. I don’t think he intended to break the law, I think he meant to skirt it. I think he believed that mattered.

It’s a hypothesis, and Harris presents it as one. And he adds:

Plenty of legal scholars and technology experts thought Aaron had kept on the right side of the letter of the law, but the criminal justice system is resistant to the kind of hacking he tended to practice.

It never reached a courtroom.

The manifesto#

The Guerrilla Open Access Manifesto carries Swartz’s signature, July 2008, Eremo, Italy, written during a meeting on the future of libraries. Two pages.

But sharing isn’t immoral — it’s a moral imperative. Only those blinded by greed would refuse to let a friend make a copy.

The prosecution used it as evidence of intent, and from that point on establishing who wrote it became a legal problem. The editor of the collection of Swartz’s writings suggests multiple authors, and Harris finds that plausible. How much of that manifesto he wrote himself, and how much of it he still stood behind three years later, remains undetermined.

The text says one thing the indictment could never contain: that you take access, instead of negotiating it with publishers.

What is still open#

The distinction between hiding and making visible only holds up so far, and the one who breaks it is Swartz himself. In 2012 he writes, together with Kevin Poulsen, DeadDrop: the anonymous dropbox system for whistleblowers that later became SecureDrop, which dozens of newsrooms now run. That software does what cypherpunks do: it protects a person by hiding them. The two things belong together because the target is the same: whoever decides who gets to know what.

Harris closes on a counterfactual: he wonders whether Swartz ever considered fleeing the country, doubts it, and adds that “maybe if he had lived to see Edward Snowden make dodging extradition look good, things would have been different”. Five months after Swartz’s death, Snowden was in Moscow.

On everything else the ledger is messier than the usual telling. JSTOR opened up the oldest, out-of-copyright part of its catalogue in September 2011. Congress never passed the Computer Fraud and Abuse Act reform named after Swartz, introduced in 2013 and reintroduced in 2015; it was the Supreme Court that narrowed the statute, in 2021, with Van Buren v. United States, ten years after the MIT network closet, and on the “exceeds authorized access” clause that the superseding indictment against Swartz had already dropped. Someone else carried out the manifesto’s programme, downloading everything and redistributing it: Sci-Hub, which Alexandra Elbakyan founded the same year Swartz was arrested, outside the law of whichever country hosts it.

The paywall on research paid for with public money is still there. The answer to the question Swartz was asking came as an indictment, and that is the only answer it has had.

Sources#