WikiLeaks founder Julian Assange was arrested today after Ecuador’s UK embassy revoked his asylum status, ending a stay of more than six years. The US Department of Justice revealed that Assange is charged with one count of violating the Computer Fraud and Abuse Act (CFAA). It’s a far less aggressive charge than many people feared Assange would face — but one that could still be ominous news for the free press.

The US government’s case against Assange has remained mysterious for years. In theory, he could have faced accusations of stealing government property or violating the Espionage Act by publishing leaked documents from whistleblower Chelsea Manning. This would have immediately raised huge questions about the First Amendment. “Any prosecution by the United States of Mr. Assange for Wikileaks’ publishing operations would be unprecedented and unconstitutional, and would open the door to criminal investigations of other news organizations,” warned the American Civil Liberties Union after Assange’s arrest.

Assange could have faced charges of espionage or stealing government property

But the indictment is comparatively modest. It claims Assange tried (seemingly unsuccessfully) to crack a password that would have helped Manning cover her tracks, thus conspiring to get secret government files without authorization. He faces up to five years in jail — which is a serious threat, but only a fraction of Manning’s commuted 35-year sentence, and courts rarely apply a crime’s maximum penalty.

The CFAA is a notoriously overbroad law that can be easy for prosecutors to abuse. But according to attorney Tor Ekeland, who has worked on several high-profile CFAA cases, the Justice Department’s argument here is relatively shaky. Among other things, there’s usually a five-year statute of limitations on CFAA charges, and Manning’s document leaks stopped in 2010. Ekeland says the Justice Department is stretching that limit by invoking a section that classes hacking as an act of terrorism, but a court might take issue with its strategy. “It’s not that strong an indictment,” he says.

The Justice Department might still be looking at other charges, including espionage. But if the UK turns over Assange specifically for this CFAA violation, prosecutors can’t simply indict him for new crimes later. “If this is the indictment that they presented to the UK for extradition, they’re locked into it,” says Ekeland. “The United States government can’t bring him to the United States and add 50 charges.”

That said, we’ll probably see an extended legal fight over extradition in the UK, and we don’t know what information might surface during that period. Assange’s lawyers will likely fight the attempt to extradite him, and Ecuador’s president Lenín Moreno claimed he’d been assured the UK would deny requests from any country with the death penalty — although that’s not necessarily a guarantee.

The Justice Department is sidestepping a First Amendment firestorm

By charging Assange with a hacking violation, the Justice Department is sidestepping a direct war over the right of news outlets to publish leaked information. “I think they’re using the CFAA because of how utterly chilling — and likely unconstitutional — it would be to use the Espionage Act against a publisher,” says Jesselyn Radack, who has represented former NSA contractor Edward Snowden and other whistleblowers in court.

And some WikiLeaks critics argue Assange isn’t being charged over any legitimate journalistic practice. “While journalists do publish material that is gathered by sources, we don’t help the sources pick the locks on the safes that hold the information,” wrote New York Times reporter Katie Benner on Twitter.

But the CFAA is still being wielded as a weapon against someone who published leaked information, and given the law’s scope, there’s no guarantee it won’t be applied to more traditional reporting. Intercept writer Micah Lee noted that prosecutors called the practice of deleting chat logs and putting files in a cloud storage folder part of the “conspiracy” between Assange and Manning — “what stops them from charging other journalists with ‘conspiracy’ for deleting metadata and chat logs to protect sources, encouraging sources to leak documents, or using whistleblower submission systems?” he asked.

Meanwhile, Assange still has some legal trouble outside the US. As Reuters reported earlier today, a British court found him guilty of skipping bail back in 2012, when he refused an extradition order from Sweden in a now-dropped sexual assault investigation. The charge carries a maximum of 12 months in jail.