Security Researcher Held In Jail For 8 Months Because He Wrote An Angry Blog Post, Released For Now

Over the past month or so we've written a few times about security research Justin Shafer. As you may recall, he first came to our attention, when the Justice Department decided to subpoena the identities of five Twitter users because Shafer had tweeted a smiley emoji at them. No, really. I'm not exaggerating. That's literally what happened. Shafer saw some Twitter users discussing a case totally unrelated to his own, tweeted an emoji, and the DOJ is demanding the identity of those he tweeted the emoji at.

That then got us more interested in what the hell happened to Shafer -- where it appears that the DOJ had a weird vendetta against him. His house was raided three separate times -- mainly because he had helped expose security problems with some software. The company complained that Shafer had violated the CFAA, and thus his house got raided and all of his family's electronics were seized. Of course, he wasn't charged with anything because there was nothing to charge him with. Then there was a second raid. Same result. No charges. Shafer was apparently getting fed up with FBI agent Nathan Hopp (he initially misheard the name as "Hawk"). Eventually, after finding out about another case that Hopp was involved in, he did some online digging of public, online records to find out more about Hopp. Then he did something unwise, and which I would not recommend, but which it's hard to see how it could be illegal. And that is that he contacted Hopp's wife, after finding her Facebook page -- and asked her to have Nathan return the stuff that had been seized.

And, yes, this is a dumb thing to do, no matter how angry or frustrated you might be. But... is it criminal? Well, the DOJ claimed it was, leading to a third raiding and Shafer being arrested for "cyber stalking." And then things got even crazier, because after being released on bail, Shafer was quickly dragged back to jail and had been locked up since April, because he blogged about the case. The conditions of his release said that he couldn't use social media to contact Hopp or his family. The DOJ claimed -- and a magistrate judge amazingly agreed -- that the blog post (1) was social media (2) was "indirect contact" and (3) broke the conditions of his release. And thus, he was in jail. Last month, his lawyers appealed that decision, claiming it was a First Amendment violation.

And, on Friday he was released from jail as a judge agreed to release him, pending the trial (also, apparently there's a superseding indictment coming soon, so we'll see if the DOJ has anything more than "he sent some inappropriate Facebook messages."). The conditions of his release still seem fairly ridiculous as it includes this:

The defendant shall not have access to any computer.

Of course, immediately after that it also talks about how he can use a computer, but all usage will be monitored. It's a bit confusing, but it appears that he can use his own computer in very limited ways, if it has monitoring software, but cannot use other computers. And he's barred from social media (Facebook, Twitter). He's allowed to blog, if the blog posts "comply" with the rest of the release conditions -- including not "providing identifying information" on the people he's accused of "cyber stalking" or encouraging or inviting "others to contact or harass such persons." And, generally speaking, it's probably a good idea for him to refrain from such activity whether or not it was a condition of getting freed.

Still, it's difficult to see (a) why he was arrested in the first place and (b) why he sat in jail for 8 months over a blog post. The whole case still just stinks of the DOJ getting angry at the guy because he didn't roll over when they raided his house twice.