Live data from Hacker News

Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

documentcloud.org

151–160 of 324 posts

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#151
I don't understand why the US Attorney is suggesting he be charged with such ridiculously inflated charges.

Reviewing the Indictment report, "JSTOR did not permit users... to download all of the articles from any particular issue of a journal." Further, "JSTOR notified its users of these rules, and users accepted these rules when they chose to obtain and use JSTOR’s content."

So basically JSTOR is claiming Aaron violated their terms of use. Their terms of use are likely an adhesion contract with a passive shrinkwrap notification. (remember ReasonableAgreement.org ?). It is not certain that Aaron did in fact agree to such terms, or what consequences doing so and then violating said terms should have. Regardless, JSTOR proclaiming certain terms may not be sufficient to deny Aaron of his rights as a consumer, citizen, and human.

The report goes on to claim that Aaron took action to "avoid MIT’s and JSTOR’s efforts to prevent this massive copying". MIT and JSTOR allowed users to access their network, with no system in place to ensure that a user was a student (by design, as MIT admits) or that they were using their real name (or a single MAC address). A researcher accessing JSTOR is really less of a concern than other potential types of access so perhaps this is not a good system. The report suggests Aaron took action to "elude detection and identification" but courts have held that anonymous speech and action are valid parts of society. They take issue with his using a Mailinator address but such an email address is just as valid as any other and simply allows others to read ones mail.

The report whines that the "rapid and massive downloads and download requests impaired computers used by JSTOR to service client research institutions". This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR.

MIT acted to ban the IP ranges that they believe were in violation of their rules. Users were to use the network to support MIT’s research, or at least not obstruct it. However, very likely Aaron was conducting research. Any hindrance to other users may have been the responsibility of MIT's infrastructure team.They further request users "maintain the system’s security and conform to applicable laws, including copyright laws" seemingly suggesting Aaron was in violation of copyright. Very importantly, MIT should remember that when it comes to copyright "Reproduction for purposes such as criticism, comment, news reporting, teaching, scholarship, or research, is not an infringement of copyright." The last point of MIT rules is that users "conform with rules imposed by any networks to which users connected through MIT’s system" which makes little practical sense and is certainly selectively enforced. Assuming a JSTOR web server is now a network, so is my personal web server. On all html files on my webserver I link to a ReasonableAgreement-style notification that no user may browse such files between 8am and 11pm EST. Any MIT student, faculty member, or guest who connects during those hours is in violation and should be kicked by MIT, for if a rule is to be fair it should be consistently enforced. This third rule is simply a CYA clause and is its selective enforcement is arrogant.

To conclude, the document does suggest that perhaps Aaron did violate the JSTOR terms of use for their website. When a normal business decides to deal with a violation of their terms of use they deactivate that customer's accounts. However, Ithaka Harbors Inc., a “non-profit” organisation (Presidents yearly compensation is over $400,000 – see their 2009 Form 990 at http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338... ) funded by the Mellon Foundation and the Gates Foundation and committed to “the core values of higher education” and to a “deep understanding of technology” (ha), decided to alert the feds. As to MIT's claims that Aaron broke their rules for using their internet connection, it seems he neither obstructed MIT's research nor violate laws or copyright laws. As to their third claim, he may have violated the terms of a "network" but so do a significant portion of MIT’s users everyday.

Why is the Obama administration pursuing an investigation in Wire Fraud and Computer Fraud?

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#152
post #49

Earlier quoted context omitted.

SATA = 3 Gbps throughput with minimal overhead USB HD's top out about 200Mbit/s. JSTOR's RAID arrays should be able to drown his laptop without breaking a sweat.

Did it specify that he was writing to local disk? If I did a stunt like this, I'd probably try to write to some cloud storage like Amazon S3. I'd bet that Amazon's servers can drown JSTOR's, particularly if there's a big pipe like MIT's in-between.

Yeah, it said he went in at least once to swap out the external disk. I assumed it was USB and not eSATA or something.

Also, it's a lot easier to find the owner of a Amazon account (credit card) than a "ghost" laptop under a cardboard box in a closet.

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#153
post #4

The title is inaccurate. It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered if the IP he was using was blocked (by JSTOR) or cut off of the network (by MIT), and finally connected a laptop in a basement networking closet. I guess you could say that is 'hacking' in the unauthorized access sense, but not in any meaningful sense. It isn't…

The indictment mentions only one laptop, BTW. No indication he signed up with "different laptops".

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#154
post #98

From the JSTOR website ( http://about.jstor.org/participate-jstor/worldwide-access ) "Our ultimate long-term objective is to make JSTOR available to everyone who wants access to it, while doing so in a way that ensures sustainability of the service." Cynically, it seems like the bit about "ensures sustainability" can be translated as "we will aggressively prosecute in order to protect our bloated salaries."

The salaries of Ithaka Harbors Inc. (JSTOR's holding company), a supposedly not-for-profit organisation are indeed bloated. See pp. 7-8, 23, 26 of http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338...

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#155

One hopes he is smart enough to have a solid legal argument for what he has done. If he loses the legal battle then it's going to set a bad precedent for all these academic document stores to continue keeping hold of this information. On the other hand, if he were to win then it may make it harder for groups like JSTOR to continue restricting access to their data.

A solid legal argument for switching your MAC address, hiding a laptop in a closet, and deliberately concealing your face to try to avoid recognition? He isn't going to win that defense.

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#157

JSTOR's statement http://about.jstor.org/news-events/news/jstor-statement-misu... JSTOR Statement: Misuse Incident and Criminal Case The United States Department of Justice announced today the criminal indictment of an individual, Aaron Swartz, on charges related to computer fraud and abuse stemming from his misuse of the JSTOR database. We have been subpoenaed by the United States Attorney’s Office in this case and…

This sounds very hypocritical. If their "Mission and Work" is to support scholarly work and academic usage, and encourage usage of large sets of data, why are they suing Aaron's ass instead of working with him to further understand what were his needs that their system was lacking and how they could reduce that gap? Why else would Aaron hack their system if not for research?

Sounds like instead of spending money in improving their system and security, they found a more beneficial (to their eyes) approach: charging Aaron will instead set the example.

Edit: see @mbreese's correction.

Edit 2: looks like my comment missed some important pieces of the puzzle. See further down the thread.

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#158

JSTOR's statement http://about.jstor.org/news-events/news/jstor-statement-misu... JSTOR Statement: Misuse Incident and Criminal Case The United States Department of Justice announced today the criminal indictment of an individual, Aaron Swartz, on charges related to computer fraud and abuse stemming from his misuse of the JSTOR database. We have been subpoenaed by the United States Attorney’s Office in this case and…

This sounds very hypocritical. If their "Mission and Work" is to support scholarly work and academic usage, and encourage usage of large sets of data, why are they suing Aaron's ass instead of working with him to further understand what were his needs that their system was lacking and how they could reduce that gap? Why else would Aaron hack their system if not for research? Sounds like instead of spending money in i…

They aren't suing him... this is a criminal case:

The criminal investigation and today’s indictment of Mr. Swartz has been directed by the United States Attorney’s Office

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#159

Earlier quoted context omitted.

Information wants to be free.

Information doesn't want to be anthropormphized.

"anthropormphized" --> "anthropomorphi[zs]ed", from anthropos = "human" + morphe = "form" + ize/ise = "make", i.e. "make the form of a human".

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#160
post #121

Earlier quoted context omitted.

> They do own the right to the composition of their collection This was the point I was trying to make. They own their database, even if they don't own the articles in it. The GP poster was trying to claim that they didn't "own their archive".

> the right to the composition of their collection Is this a right recognized under US law?

§ 103. Subject matter of copyright: Compilations and derivative works

(a) The subject matter of copyright as specified by section 102 includes compilations and derivative works, but protection for a work employing preexisting material in which copyright subsists does not extend to any part of the work in which such material has been used unlawfully.

(b) The copyright in a compilation or derivative work extends only to the material contributed by the author of such work, as distinguished from the preexisting material employed in the work, and does not imply any exclusive right in the preexisting material. The copyright in such work is independent of, and does not affect or enlarge the scope, duration, ownership, or subsistence of, any copyright protection in the preexisting material.

http://www.copyright.gov/title17/92chap1.html#103

Post reply on HN