In a federal courthouse in lower Manhattan, Judge Loretta Preska, who was previously asked to recuse herself due to a possible conflict of interest, sentenced Jeremy Hammond to 10 years in prison–the maximum sentence for the violation of the Computer Fraud and Abuse Act (CFAA) Hammond pled guilty to.
Hammond was indicted for hacking the servers of Strategic Forecasting (aka Stratfor) and leaking 5 million emails to WikiLeaks and releasing private information, including credit card numbers and physical addresses, from Stratfor’s database. He pled guilty to one conspiracy charge.
Upon hearing the sentence, the courtroom–packed with Hammond’s supporters and sympathetic activists–was notably distraught. Prior to the sentencing, when the judge asked for victims of Hammond’s crime to step forward, one man stood up and addressed the court saying that he was “a victim of NSA surveillance.” He was shortly thereafter restrained and removed from the courtroom.
In his statement to the court, Hammond said that his hack used a “zero-day exploit” in the Plesk webhosting platform. This gave him root access to Stratfor’s servers, which he used to release emails revealing that Stratfor was acting as a private intelligence firm in cooperation with law enforcement agencies and corporations. Among its activities were surveilling Occupy Wall Street protesters and spying for Dow Chemical on people campaigning for compensation for the victims of the Bhopal environmental disaster.
The broader significance of his case is that it illustrates the overreach of the CFAA, the same law that Aaron Swartz was prosecuted under before he committed suicide. The digital rights advocacy group Electronic Frontier Foundation, in a statement on its website, calls the law “draconian” and states that “damage figures for CFAA charges can easily be inflated” and “the sentencing guidelines are broken for the CFAA, leading to excessive sentences and unjust results.”
Roy Singham, the head of IT consulting firm Thoughtworks, where Aaron Swartz was employed at the time of his death, was present at a press conference outside the courthouse. Speaking to a small crowd of journalists, he said, “What is the complicity today between corporations and NSA surveillance? These titans of tech industry are celebrated as innovators, as disruptors. Why the discrepancy? No charges against these people and yet 10 years for Jeremy.”
Addressing the tech community directly, he continued: “This is an unacceptable outcome for the tech sector. I say shame on the rest of tech sector for not coming to Jeremy’s defense. It’s an embarrassment that there are so few tech sector people here with me today.”
Following his 10 years in prison, Hammond will have three years of supervised release. The conditions of his release include that he may only receive electronic equipment capable of Internet access with approval of his probation officer and that any computers or network-capable devices he owns will be subject to search and may have monitoring software installed on them by his probation officer.