On soggy scrambled Eggs at the Hyatt Regency in Lexington, Ky., Tor Ekeland does his best to cheer up Deric Lostutter, a 30-year-old hacker who is about to be sentenced to federal prison. “It’s terrifying,” said Lostutter.
“It is what it is,” replies Ekeland, a fast-talking 48-year-old lawyer who sports a neat beard and crisp blue suit for this morning’s hearing. “You will know what your future will be after today. You know what I mean?”
Some four years earlier, Lostutter, a member of the hacker collective Anonymous, attacked local authorities in Steubenville, Ohio, who he said covered up the rape of an unconscious 16-year-old girl by police officers. high school football players. He and another man hacked into the team’s fan site and posted a video in which Lostutter, wearing a Guy Fawkes mask, threatened to doxize players and local officials (posting their private information online) to they didn’t apologize to the girl. The hack and its aftermath helped to rebrand Anonymous as a legitimate activist force. Not only were the rapists convicted, but an investigation led to the conviction of three school employees (on charges ranging from allowing minors to drink to obstructing official business). Lostutter pleaded guilty to lying to an FBI agent and violating the Computer Fraud and Abuse Act (CFAA).
After breakfast, Ekeland accompanied Lostutter to the courthouse, where a judge sentenced him to 24 months in prison, the maximum allowed under the plea deal and, despite Ekeland’s best efforts, a year more than one of the rapists in Steubenville had received. The prosecutor said the conviction would send a message that “hacks will be taken seriously as crimes, and not as pranks or publicity stunts.” After the hearing, Ekeland countered that the sentence was actually about “the DOJ afraid of the power of social media to organize social protests.”
Ekeland can be a bit radical at times, having been a corporate lawyer in Manhattan. But six years ago, he traded his big salary for a not-so-lucrative private practice. Today, he is one of a handful of defense attorneys specializing in computer crimes. “I’m much happier,” says Ekeland, who shows up to our first meeting in jeans and a black T-shirt. The corporate concert was boring, he explains – “it made me an alcoholic” – and he rarely saw a courtroom. When he first arrived in New York City prior to law school, he was involved in experimental theater, and it was the theatrical aspects of court that prompted him to study law. Litigation “is super stressful,” he says. “I love him, however.”
His first client was a notorious Internet troll named Andrew “Weev” Auernheimer, who was sentenced to 41 months in federal prison for exposing a flaw in an AT&T website that left tens of thousands of private email addresses vulnerable. “When Weev’s case happened,” Ekeland says, “I was like, ‘This is it! “He was successful in having his client released on appeal – Auernheimer became a white supremacist shortly thereafter. Ekeland has since defended hackers against charges ranging from investigating municipal website defenses to conspiring to access federal email accounts. Jay Leiderman, a California defense attorney who shares the hacker niche, says Ekeland is “very good” at his job: “He stands up for ungrateful shit and has a lot of stuff going through his teeth. And he does it just because people need help. (“The political act of resistance really appeals to me,” Ekeland says.)
Most of his business involves the CFAA, a 1984 law said to have been passed after President Ronald Reagan watched War games—The 1983 thriller in which a teenage boy Matthew Broderick hacks the mainframe controlling America’s nuclear weapons. Prosecutors say the CFAA is an essential tool in protecting the country’s computers and networks, but critics see it as a clumsy law that carries ridiculously long sentences. Over the years, Congress has tightened penalties and broadened the range of offenses prosecutable under the law, which the definition of a “protected computer” is so broad, according to the National Association of Criminal Defense Lawyers, that it could apply to “every computer connected to the Internet.”
Exhibit A for the detractors of the law is Aaron Swartz, the Internet genius who committed suicide in 2013 while indicted for downloading millions of copyrighted academic articles from from a paid website. A team led by Carmen Ortiz, the former US prosecutor in Massachusetts, had threatened Swartz with up to 35 years in prison and a million dollars in fines. “She will never be forgiven,” said Ekeland. “Already.”
Another Ekeland client was Fidel Salinas, who claims the US government tried (unsuccessfully) to get him to hack Mexican drug cartels after he was accused of probing a Texas County website at looking for vulnerabilities. He has been charged with 44 counts relating to cyberstalking and computer fraud. Ekeland helped bring him down to a single misdemeanor conviction.
In one particularly insane case, a client claimed he was charged with child pornography as part of an FBI attempt to cover up sensitive agency documents he obtained. (He also claimed federal officials drugged and interrogated him, causing a psychotic breakup – the FBI won’t comment.) But Ekeland feeds on insanity. “It’s getting really hard to know what’s real,” he says. “Am I a delusional paranoid person or is this really true – or is this person lying to me?” It’s pretty fun. And then there was the moment when prosecutors accused Ekeland and his co-counsel of inappropriately accessing a classified document. “They were all outraged and basically accused us of hacking into the fucking FBI,” he recalls. In fact, the agency had posted the document on its website.
Hand it over, and Ekeland is inclined to launch into a long tirade about the CFAA’s nefarious intentions. “The government wants to be able to completely control information, because information is power and it controls the narrative,” he says. Hackers “scare people. They make them feel vulnerable; there is hysteria about it.
A legislative effort to limit the overbreadth of prosecutions – Aaron’s Law, after Swartz – has stalled on Capitol Hill, and Ekeland is not optimistic about his prospects under the Trump administration. “All the good people I know at DOJ are leaving,” he said. “All the bottom-feeders and people who haven’t gone up will now float up.”
After Lostutter’s conviction, he and Ekeland walk half a mile to the Hyatt, where they pick up leftovers from the breakfast buffet and talk about how Lostutter will spend his time in custody. “You should write a book,” Ekeland told him, still trying to be optimistic. “It’s funny. The universal advice for all of my clients, because they have such interesting cases, is, ‘Take the time, write a book.’