by Douglas Lucas
At a time when a new megaleak seems to hit the Internet every week, the imprisonment of journalist Barrett Brown is causing many to ask if it is legally safe to share hyperlinks to leaked document troves containing credit card or personal identifying information—the kind of content the Dallas native is locked up in part for linking to. In fact, some media professionals are censoring such evidentiary links out of their work—they are not providing bibliography—citing his case as the reason. The risk is best assessed by looking at the transcript of the writer’s second and final sentencing hearing on January 22, obtained by Revolution News. It lays out the Department of Justice’s attack, the defense’s arguments, and the judge’s position, bringing into focus what little clarity is available for an uncertain environment.
First it is important to understand what Brown did.
In December 2011, Anonymous cracked into the servers of the Austin-based private spy firm Stratfor—and Brown was in close contact with the hacktivists, having published on data they exfiltrated from other spies and having promoted their work to international media. He even reached out to CEO George Friedman, offering to make redactions to copied or “stolen” emails, a move the plea deal he eventually struck construed as accessory after the fact: hindering hacker Jeremy Hammond’s arrest. Sentencing the writer, judge Sam A. Lindsay would say Brown “crossed the line in journalistic inquiry into criminal conduct when [he]abandoned the role as an observer and reporter of events and offered to aid Hammond.” Lindsay’s is a bloodless definition of journalism that turns protecting a source into crime on the excuse that—as the factual stipulations put it—the journo was working on “behalf” of the lawbreakers, a framing that seems to blame Brown for his anarchic goals.
While Stratfor was on the ropes, on December 25, 2011, Anonymous released to a wide audience on pastebin.com this link: http://wikisend.com/download/597646/stratfor_full_b.txt.gz. Wikisend is a file-sharing website, and the destination, stratfor_full_b.txt.gz, was a compressed document listing credit card data for Stratfor customers—not, as is sometimes mistakenly reported, the firm’s emails, which WikiLeaks later began publishing. The file has since been removed from the website, perhaps taken down by administrators.
That same day, someone by the handle FreeEmAll posted the link to the crowded #AnonOps chat room (the name short for Anonymous Operations), which was busy discussing the Stratfor hack. Conversation scrolled down screens so fast that, according to journalist Quinn Norton, it was very difficult for anyone to read it at pace.
Referring to FreeEmAll’s post, Brown asked #AnonOps, “What was in that?” To the best of his recollection, he told Revolution News, he had not read the pastebin release. Someone answered that the data listed Stratfor clients, and Brown replied that the information would substantially advance his research syndicate Project PM’s investigation into mass surveillance, disinformation technology, and related topics. That makes his motive clear.
The writer then downloaded the file—he never opened it, he told us—and pasted the link into his own channel, #ProjectPM, to share with fellow researchers. Such communication is precisely what the World Wide Web was designed for.
The Department of Justice probably discovered Brown’s posting of the wikisend address by inspecting logs on his seized equipment—the journo did not take digital security measures—following his September 12, 2012 arrest for making threats (arguably legal ones) against FBI agent Robert Smith for investigating him and his mother in connection with Project PM.
Behind bars, Brown found himself hit on December 4, 2012 with a 12-count indictment for, in the authorities’ language, possessing stolen data and transferring the link. Right on page one, the Department of Justice, describing the defendant’s action, shared http://wikisend.com/download/597646/stratfor_full_b.txt.gz themselves. During the Stratfor hack, other journalists publicized the address too (directly or indirectly), but escaped prosecution, raising the question: Was the loud advocate for Anonymous singled out for his dissidence?
The indictment confronted the writer with a maximum of 45 years:
Brown pled not guilty, and on March 5, 2014, it seemed he might escape the link-sharing matter altogether. That’s when the defense filed a motion to dismiss all counts but the second; in response, the government dropped the targeted counts the same day, before the judge had even made a ruling. The prosecution presumably felt additional pressure from the looming amicus brief on the same issue that was going to be filed the next week by the Electronic Frontier Foundation, Reporters Committee for Freedom of the Press, Reporters Without Borders, Freedom of the Press Foundation, and PEN American Center. On April 29, 2014, Brown took a plea deal that did not mention the posting of the wikisend address at all, and the question seemed set aside permanently.
However, at Brown’s December 16, 2014 and January 22, 2015 sentencing hearings, the Department of Justice successfully argued the defendant should be held accountable for “relevant conduct” including deeds done by himself or others in what the prosecutor and the judge both described as “jointly undertaken criminal activity,” namely the Stratfor hack—and that included the compromise of credit card data. The prosecution was able to bring up the link-sharing matter because, as defense lawyer Marlo Cadeddu told D Magazine, “under federal law, a judge is technically allowed to sentence a defendant based on conduct that was uncharged, [or]charged and dismissed, or even charged and acquitted. That’s because the standard of proof at trial is beyond a reasonable doubt while the standard of proof at sentencing is by a preponderance, i.e. more likely than not. […] The government can dismiss charges if it wishes, but if the court thinks you probably did it, you can still be sentenced based on those charges. […] Essentially, the government loses but then gets to punish you anyway.”
It is clear from the indictment and the transcript that prosecutor Candina Heath is willing to go after people on flimsy theories, and catching a case alone can be punishment enough. If defendants are denied bail, they can be detained for years—prior to his final sentencing, Brown spent more than 850 days behind bars. If they hire lawyers, they must pay legal costs. No matter what the accused try to do, the odds are incredibly stacked against them: 97 percent of federal cases end in plea bargains.
The authorities’ arguments do not even have to make sense. As the defense’s motion to dismiss the indictment points out, the first count alleges Brown trafficked in “authentication features”—but the law defines those as springing only from governmental “issuing authorities,” not credit card companies. The flat-out error is reminiscent of the prosecution’s earlier indictment, regarding Brown’s threats, crazily interpreting the writer’s disapproving retweet of Fox News analyst Bob Beckel advocating the murder of WikiLeaks editor-in-chief Julian Assange—“illegally shoot the son of a bitch”—as Brown somehow threatening the FBI agent. These irrational accusations are the Department of Justice wildly swinging punches wherever it can, aiming to take down the journalist, but not in any accordance with reason and only allowed to box because we let it.
Physical key versus radio dial
At the January hearing, Heath did put forth a theory that is at least coherent, but renders the digital Internet only in terms of the tangible offline world.
Heath argued that a link—or a “means of accessibility” in her parlance—is like a physical key, and since a drug dealer giving one for a room with illegal narcotics to someone else constitutes trafficking, Brown was guilty of that crime.
Heath: Your Honor, Mr. Brown did take possession of the accessibility of that data by taking the link to the file and reposting it to make it available to other people. In the real world—I am trying to think of an example even in drug deals when a drug dealer has a key to an apartment and gives the key to somebody for them to go to the apartment. They are physically not taking drugs and moving them themselves. They are giving a key or a means of accessibility to the items that they want traffic in, so giving the key to the other person so that person can then go retrieve the items themselves, that type of situation has occurred in drug cases. So in this situation, the key here would be the link. He has provided access to the data and it is stolen data, and he knows that it is stolen data. I don’t know there is any question about that. So the actual making available for that to other people is the trafficking of the data, Your Honor. […] Brown made accessible the data to other people by providing the data link to the file.
But the defense compared the link to a direction and pointed out that it does not itself contain the content it points to.
Cadeddu: He didn’t move the data and give it to someone else, and the analogous situation in child pornography would be if someone said I found child pornography on X website, so you can go look there. That would be equivalent, and there is no case, I have never had a case—never seen a case where that is considered trafficking.
Perhaps the appropriate analogy for reading something widely available on the Internet and showing it fellow researchers online with a link is hearing information on the public airwaves that everyone else is hearing too, and then telling the office to tune their radios to that station. That picture of cyberspace as an ubiquitous, intangible medium would place the legal culpability on the broadcasters of stolen credit card data, not those listening to them, as transmissions that are available everywhere are like air: to be used freely. There was not a single tangible key that Brown had possession of; anyone can tune in to the Internet, and more than one URL can lead to the same web resource.
Of course, the prosecution’s interpretation won.
Judge Lindsay: the Court does believe that through analogy there is sufficient evidence and adequate basis to apply the two-level enhancement for trafficking; therefore, the Court overrules the defense’s objection to the enhancement for trafficking pursuant to United States Sentencing Guidelines Section 2B1.1(b)(11)(B)(i) and 2(11).
Brown’s sentence was enhanced for the fraudulent credit card charges, so the journalist was nailed for other people’s deeds—yet the Stratfor data was widely accessible in the public domain.
He told Revolution News that he sees the use of the illicit transactions against him as a violation of a requirement the prosecution had to meet the “but-for” standard, which states that the plaintiff must prove that “but for the action, the result would not have happened”: that without his posting of the wikisend address, the abuse of the credit cards would not have taken place.
The defense placed great emphasis on the fact that http://wikisend.com/download/597646/stratfor_full_b.txt.gz was in the public domain before Brown shared it, since that means no one needed his post to make the fraudulent charges—they could have found the file by reading the pastebin release. According to the Internet Archive’s earliest copy, the Anonymous “paste” had been viewed more than 8,000 times within just a week of its publication, so those viewers are all people who could have abused the compromised data.
Cadeddu: The information was already in the public domain. The link that he reposted was reposted in the Project PM IRC Channel, but it was already out there in Pastebin in an entirely public location, so there is no—the government can’t prove causation. The Fifth Circuit has held that you have to have—you have to—in order to hold someone accountable for loss, there has to be causation and there simply isn’t. There is no way—the government has presented no evidence to show that Mr. Brown ever used a credit card or that any person who had access to the Project PM IRC used any of the credit cards.
As for the prosecution and the public-or-private distinction, they simply didn’t care.
Heath: With regard to the stolen data being in the public realm doesn’t undermine the fact that what was stolen data that then was procured by Mr. Brown and retransmitted or remade available to other individuals
Heath: Your Honor, I don’t think the issue comes down to whether it is a public or private place. […] The individual can leave it at a public location and tell the other person where to go find it and provide them a map to a public location where they can find the item. I think there are all instances or ways in which data or physical items, in this case this is trafficking in electronic data. In this case, Mr. Brown made accessible the data to other people by providing the data link to the file.
The Department of Justice did not see Brown’s sharing as First Amendment speech, which would protect his publication of truthful information obtained in a lawful manner—except in the judge’s eyes, the journalist was “all a part of the hackers’ efforts,” as Lindsay put it, and not someone obtaining knowledge legally.
Lindsay did not address the public-private distinction per se, but considered the short amount of time—about an hour and 45 minutes, according to the defense—between the Anonymous publication and Brown’s sharing of the link; the judge did not spell out the implications of the fact that the time span was brief, yet in light of his other statements, he almost certainly viewed it as an indication that the defendant was taking part in jointly conducted criminal activity by posting the wikisend address, not observing the hack as an audience member.
Judge Lindsay: Now, does not the record reflect that the prior posting—let me say it like this, does not the record reflect or do not those exhibits reflect that between the time of the prior posting and Mr. Brown posting that the lapse of time was approximately one to two hours? Wasn’t there a one to two-hour window?
Judge Lindsay: As the Court alluded to earlier, the prior posting of this information was not quote, unquote, hours apart, but instead occurred between a one- and two-hour window.
Brown told Revolution News he never agreed to criminal activity vis-a-vis the credit card numbers. He said, “I absolutely supported hacks against any and all entities connected to criminal elements within the espionage and law enforcement communities. But I’ve never been involved in the use of credit card information to harass anyone, and was always vocal in my opposition to some of the stuff that [Anonymous hacking crew] LulzSec in particular did in terms of causing difficulties to random civilians for their own amusement. That didn’t stop the [“cybersecurity”] firm Imperva from claiming I was their spokesman, nor did it stop the prosecution from trying to portray me as a member in some of the pre-sentencing documents that remain sealed.”
The 34 year old also told us, “As with much else in this case, I watched the judge entirely disregard the prosecution’s requirement to meet the ‘but-for’ standard with a mixture of horror over my own unjust punishment and triumph over yet another opportunity to demonstrate that the rule of law is a convenient myth. In this instance, though, there’s also the additional concern that others could now be prosecuted for linking. Of course by having rejected the original plea offer of one count of identity theft, I’d risked a much lengthier prison sentence in order to protect others from that precedent, and now that role had been partly wasted (though not entirely, as by rejecting that offer I also managed to avoid having to plea to their faked fraud charges, which was also a major sticking point for me.)”
The judge’s conclusion
What was crucial for Lindsay was his determination that Brown was a participant in the Stratfor hack, even if the journo was not cracking systems himself. This suggests the free assembly concept does not realistically offer much protection, as has been the fate for many adversarial writers, such as Abdulelah Haider Shaye, a Yemeni journalist imprisoned supposedly for alleged ties to al-Qaeda. The decline of free assembly protection is of increasing importance as proposed legislation seeks to grant the government the authority to use the most powerful tool in their arsenal, the Racketeer and Influenced Corrupt Organizations Act (RICO), against hackers—perhaps those merely in chat rooms with hacktivists could be more easily targeted after such a change. Association is becoming guilt enough, but individuals’ actions should be the basis for culpability.
It is impossible to assess the exact nature of Brown’s involvement in the attack on the firm. The evidence Lindsay claimed proves Brown’s lawbreaking involvement is mostly under seal, and even if it weren’t, trusting a version put forth by the authorities is dubious. The writer told Revolution News that “corrupt FBI agents routinely perjured themselves in this case” and said as much in his allocution to the judge, who of course trusted the bureau like family.
Certainly Brown worked as a propagandist and advocate for Anonymous, and went beyond that into civil disobedience, as we discussed in July, but he disapproved of harming innocent bystanders—yet that distinction did not matter. Relying on the 1999 Fifth Circuit case United States v. Hammond (no relation to Jeremy Hammond), Lindsay held the writer responsible for “relevant conduct,” which included “all reasonably foreseeable acts and omissions of others in furtherance of jointly undertaken criminal activity.” To determine Brown’s responsibility under that concept, the judge considered the scope of the criminal activity and decided the credit card losses were within it.
Judge Lindsay: the Court concludes that Mr. Brown collaborated with and supported the hackers, identified targets, provided advice, strategized and assisted in organizing hacker activities. He also used the hackers to obtain credit card and other information illegal to exploit and harm other persons or entities that he personally targeted in retaliation for their investigation of him. […] the Court concludes that the information in these three [not publicly available, likely under seal]exhibits together with the information in the [sealed]pre-sentence report is sufficient to support a finding that the scope of the criminal activity that Mr. Brown agreed to jointly undertake with Anonymous and related hacker groups included the use of stolen credit card information as a means of exploiting, harassing, ruining, or destroying targeted persons and businesses and that the losses caused by the hackers who were actually used the credit card stolen during the Stratfor hack, and that is S-t-r-a-f-o-r [sic]making unauthorized charges to Mr. Brown [sic]regardless of when the unauthorized charges were made using credit card information posted by Mr. Brown or some other person who participated in the hack.
Arguing for leniency, defense lawyer Charles Swift summarized the concern that led to such great interest in Brown’s legal ordeal.
Swift: If I as a journalist send a link with thousands and thousands and thousands of documents in it from one of these parts, and I post it, I may be potentially liable unless I can’t post or send anything in the digital age without knowing exactly what is in it.
The defense’s point and the public’s interest do not seem to matter to federal prosecutors, who probably have no problem with everyone being liable for everything they share. Among other concerns, this could lead to a user posting a link leading to a perfectly legal website that is subsequently changed without the user’s knowledge to a website with illegal content, and the authorities seeing the latter version and pressing charges for what had been above-board sharing. More broadly, the government would love to get better control over the exchange of information on the Internet, which still retains a Wild West character where forces like Anonymous, WikiLeaks, and the pirate movement are managing to bypass authoritarian restrictions on communication.
But Lindsay did not address everyone’s liability directly, and responded to Swift’s statement above by narrowing the focus to Brown and what the judge saw as the journalist’s participation in jointly undertaken criminal activity.
Judge Lindsay: Well, I really think it is a bit more than that […] you have to consider the totality of the conduct. When I consider the totality of the conduct, I ruled the way I did because I think that he was more involved than what he wants me to believe, and I am not basing that on argument, I am basing that on a collection of documents and some testimony. […] I have to see what the real issue is. And all I am saying is his involvement in posting that link is more than what it appears or what the defense wants the Court to think. All I have to say is he was more involved than he wants the Court to believe and I think that is more than adequately supported by the record […] So I guess what I am saying is what took place is not going to chill any First Amendment expression by journalists. […] I will stand by my statement that what the Court is doing with respect to that is not going to chill any First Amendment expression by any journalist because it was more than just the mere posting. It goes to his involvement with others who were involved in this same activity. That is why I found that that was relevant conduct, and that conduct was foreseeable.
Lindsay’s claim the media would not be chilled has turned out to be false.
Editors warning reporters not to get “Barrett Browned” for sharing AM torrent link.
— Dell Cameron (@dellcam) August 19, 2015
Journalists who refrain from linking due to Brown’s case should at least publish—in the articles themselves as opposed to merely on Twitter—their reasoning, which would document the chilling effect in a way that may later prove useful in court.
Sharing is caring
The question is about more than just linking to leaked document troves with credit card or personal identifying information—merely visiting them is actually at stake.
According to the indictment’s second count, regarding access device fraud, which was dropped for the plea deal, Brown possessed the data he linked to—but every time users visit web addresses, they download, and thus, in the authorities’ eyes, possess, the contents in order to view them at all. In fact, certain Internet protocols and browsers, designed to improve the speed and responsiveness of the web-browsing experience, preemptively download link targets before the user even clicks anything. Thus simply encountering a link leading to a document trove with the requisite forbidden information may be enough to put users under the scope of the Department of Justice’s theories.
Lindsay may be more reasonable than federal prosecutors in that if users are not connected to the exfiltration of the documents at all or if they delay their use of public data until that brief window of time expires and more visitors read it, he might not find them guilty. Only those who are willing to endure the legal process, though, should consider judges’ opinions the relevant ones.
The Department of Justice terrifying media professionals and ordinary users alike into not linking or visiting web addresses amounts to surrendering the Internet, the new global tool that uniquely enables mass collaboration in resistance. This is not an acceptable course of action, but journalists so far are doing the authorities’ work for them, choosing to cease linking, serving as bad role models for their readers, and invoking Brown as a justification for their actions when in fact the defendant stood for anarchism.
For law to work, it must be predictable, and Brown’s case shows it isn’t; there is little to no use in trying to predict what these federal prosecutors might indict. Their irrationality is another reason why their power should be bypassed for what is just. Readers should visit web addresses wantonly and share links prolifically, establishing by action acceptable practice.