Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

documentcloud.org

Post reply on HN
Print view View original

281–290 of 324 posts

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#281

Post by wisty »

jancona wrote: post #194
mukyu wrote: post #4

The title is inaccurate. It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered if the IP he was using was blocked (by JSTOR) or cut off of the network (by MIT), and finally connected a laptop in a basement networking closet. I guess you could say that is 'hacking' in the unauthorized access sense, but not in any meaningful sense. It isn't…

How is this not "unauthorized access" "in any meaningful sense"? They blocked his IP, they blocked his MAC, and he hid a machine in a wiring closet to get on MIT's network. What would he have to do to make it "meaningful"?

Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that.

He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents.

This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent of "checking out too many library books whilst wearing a false mustache".

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#282

Post by jancona »

wisty wrote: post #281
jancona wrote: post #194

Earlier quoted context omitted.

How is this not "unauthorized access" "in any meaningful sense"? They blocked his IP, they blocked his MAC, and he hid a machine in a wiring closet to get on MIT's network. What would he have to do to make it "meaningful"?

Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that. He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents. This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent…

So it should only be illegal if a hacker wouldn't think it's lame? Got it.

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#283

Post by Homunculiheaded »

bricestacey wrote: post #275
Homunculiheaded wrote: post #269

Earlier quoted context omitted.

Even among state universities access to electronic journals for guests is becoming increasingly rare (usually prohibited in the license agreement). Also if you look to much into how scholarly communications works, the idea of charging 50k is insane since that vast majority of the cost of journals are actually paid for by universities in the first place. edit: although I do agree with your point that in with the curre…

I would be impressed if it's an actual trend that guests were being blocked from accessing licensed content. I work in this field and I can say that almost all databases and journals have IP authentication, generally with the entire campus IP range white listed. If the vendors don't implement that, they generally use password protected accounts. There are some alternatives such as uploading a list of barcodes, Referr…

The configuration I've seen is to have not only guest accounts but also to have guest computers which are on a separate IP range, same with the guest wireless network. The important issue is actually what do the details of your license agreement say regarding guest users. Some state universities will actually request for this to specifically allowed since in many states it's considered, even if unofficially, a right of tax payers to have access if they need it

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#284

Post by comex »

jancona wrote: post #282
wisty wrote: post #281

Earlier quoted context omitted.

Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that. He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents. This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent…

So it should only be illegal if a hacker wouldn't think it's lame? Got it.

As a hacker, I think this would solve a lot of problems in the world. ;p

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#285

Post by wisty »

jancona wrote: post #282
wisty wrote: post #281

Earlier quoted context omitted.

Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that. He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents. This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent…

So it should only be illegal if a hacker wouldn't think it's lame? Got it.

Nah. It should only be illegal if normal people can't do it. Most of what Aaron did is stuff lots of people do.

There's a difference between wearing a dummy badge that says "I am Gary Host", a badge that incorrectly says "I am Bill Gates" (as that would be some kind of identity theft) and forging a passport in "Gary Host"'s name. What aaronsw did was far closer to the first.

Now, you could argue that scripts are power tools, and using them requires a higher standard of behavior. If you are driving a plane, giving dummy credentials over the radio is a lot more serious than a kid with a toy CV radio.

Even then, the dummy credentials didn't really cause any damage. The damage was done by the script itself. Even if he used his real name, the damage would have been done.

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#287

Post by GHFigs »

kragen wrote: post #276
GHFigs wrote: post #220

Earlier quoted context omitted.

Frankly, I think most of the claims in your post are bonkers, but this one sticks out: This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR. "During November and December, 2010, Swartz used the "ghost laptop" (i.e., the Acer laptop) at MIT to make over two million downloads from JSTOR. This is more than one hundred times the numb…

Well, it does seem that if JSTOR serves 7000 institutions around the world, having that number effectively jump to 7100 for a couple of months shouldn't be a big drama. Also, it's pretty surprising to me that the average number of downloads at MIT was about 1.4 per person per month. (2 million / 100 / 12000 people / 2 months.) I would have expected at least one order of magnitude higher.

if JSTOR serves 7000 institutions around the world, having that number effectively jump to 7100

I understand what you're thinking, but that's not what happened. He downloaded a hundred times MIT, not a hundred times the average institution. You're assuming that MIT is close to average, but there is no reason to think that. I strongly suspect that MIT is a bigger user than (for example) Rye Neck High School or the Scottish Agricultural College.

http://about.jstor.org/participate-jstor/participants

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#288

Post by a3_nm »

_delirium wrote: post #27

The repeated use of "stole" in the indictment is interesting, even beyond the usual metaphorical usage to discuss copyright infringement. In this case, the indictment alleges that the documents were stolen from JSTOR , which does not even own them! In the vast majority of cases JSTOR scanned documents whose copyright is owned by someone else, and acquired or was donated a non-exclusive license to distribute copies vi…

> But effort expended to build a private repository consisting of copies of things you don't own doesn't give you ownership of the result

Surprisingly, it sometimes does in the EU: http://en.wikipedia.org/wiki/Database_right

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#289

Post by jmaygarden »

wnoise wrote: post #241
Zak wrote: post #200

Earlier quoted context omitted.

Unless JSTOR is itself at risk of prosecution for something, it doesn't make a whole lot of sense to me that they'd care how Federal prosecutors felt about their public statements.

Everybody is at risk for federal prosecution. Everybody. http://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp/... http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx

I immediately thought of that book as well. As Silverglate frequently points out, the federal attorney is using extreme penalties to force a plea deal in this case. It's de facto denial of a fair trial when the Sword of Damocles (i.e. 35 years in prison) is hanging over your head.

Re: Aaronsw indicted for hacking MIT network to download millions of JSTOR docs

#290

Post by kragen »

ars wrote: post #280
kragen wrote: post #231

Earlier quoted context omitted.

I admit that I don't have statistics [edit: on libraries], but most libraries in the world are not large or in the US, and JSTOR's prices for a "small" library in "the rest of the world" are much, much larger than [edit: wrong — comparable to or perhaps a bit larger than, but not much, much larger than] their entire budget. Check out http://support.jstor.org/csp/PriceCalculator/ . This code (for Chrome) gives me a ye…

It's sad that you have to write javascript code to do that! (But also cool that you did. :) "Complete Current Scholarship Collection" for 22751.90 is a duplicate of all the things above it. So I think some of the entries have been double counted. The real price for most libraries may about 1/2 or less of your estimate (they won't be interested in everything). And 20,000 to 40,000 is (well, shouldn't) be a lot of mone…

Oh, thanks for finding that error!

I think you're thinking very much of US salaries. $40,000 a year shouldn't be a lot of money for a public library in the US, because it's the salary for a single employee (or the total costs for half an employee!), and the wonderful public library system in the US does indeed have multiple libraries. But world GDP per person is about US$10k per year, compared to the US's US$47k — and the bulk of that GDP comes from a few rich countries with only a small fraction of the population. An average country is something like Jamaica, Thailand, or the Dominican Republic, where the per-capita GDP is something like US$8.8k.

So US$40k per year is the salary for almost five employees. Except that within Jamaica or Thailand (or, to a lesser extent, the US) the median salary is much lower. And it's probably not the prime minister's niece who's working the librarian job. So maybe it's more like eight to ten employees.

So, yeah, most libraries — even measured numerically, but especially measured by the number of people who rely on them — are a lot poorer than what you're used to.

I haven't checked yet to see if the National Library here in Buenos Aires has JSTOR access.

Post reply on HN