A few months later, I got a note from Aaron saying he had some data, could he have a login on my server. I don’t usually do that, indeed had never given anybody a guest account on my systems, but Aaron was special and so I gave him an account, and didn’t think much about it. Then a month or so later we noticed that he had uploaded over 900 gigabytes of data. That was a lot. But, he was a bright guy, so I wasn’t totally surprised. I made a note of it and didn’t think twice as we had plenty of disk space.
Then the phone rang. Aaron was on the line. The government had abruptly turned off the experimental library system and issue a notice saying they had been attacked and had called the FBI. They had shut down the entire 20-library trial. They were talking about having been hacked. This was serious.
. . .
Two things happened then. First, I got a lawyer and told Aaron to get a lawyer. We looked at what had transpired, and it was my strong opinion we had done nothing wrong. We had not violated any agreements or terms of service. Sure, the courts weren’t expecting somebody to grab 900 gigabytes of data from a public terminal, but as I told the FBI, “it isn’t a crime to surprise a bureaucrat.” This was public data and we got it from a public facility. We were clean.
The second thing that happened is I started to scrub the data hard, looking for privacy violations. I found thousands of documents that disclosed, against the court rules, personal information such as Social Security Numbers, names of minor children, names of confidential informants, the home addresses of law officers, private details of medical conditions that should never have been disclosed.
It took me two months to do this work. The audit results were written up and certified letters were sent to 32 Chief Judges of district courts. They initially ignored the audits. But, I kept sending them out, and by the third time I sent out notices I was stamping in big red ink “Third and Final Notice.” A bit cheeky in a letter to a Chief Judge of a U.S. District Court, but it did get their attention.
The U.S. Senate also took notice and sent a strongly worded letter to the Judicial Conference of the United States. The courts made a few minor changes in their privacy practices, and a few judges, to their credit, started taking the issue seriously. For the most part, though, we didn’t get anywhere. The free access pilot remained terminated. The courts raised their rates.
146
