22 ms·
Aaronsw indicted for hacking MIT network to download millions of JSTOR docs
- guywithabike 15y agoThis is almost too good: "As Swartz entered the wiring closet, he held his bicycle helmet like a mask to shield his face, looking through ventilation holes in the helmet."
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- mukyu 15y agoThe title is inaccurate. It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered if the IP he was using was blocked (by JSTOR) or cut off of the network (by MIT), and finally connected a laptop in a basement networking closet. I guess you could say that is 'hacking' in the unauthorized access sense, but not in any meaningful sense. It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection.
- SpikeGronim 15y agoIANAL, but legally speaking unauthorized access is a crime regardless of how easy it was to gain access.
- pyre 15y agoThis was struck down by the courts by the way. Why? If unauthorized access is a federal offense, and unauthorized access can be determined by (e.g.) a EULA, then it basically allows a business to dictate criminal law. For example: 1. This would allow all of those 'You agree that you are not a law enforcement official' B.S. 'terms of use' on warez servers to actually have teeth. 2. "If you are a {black,hispanic,gay,etc} person, you are not allowed to access my website." Do any of these sound reasonable? I should hope not.
- tedunangst 15y agoThat's because those restrictions are illegal themselves. "Don't download the whole database" is not an illegal restriction.
- pyre 15y ago* How about "You are not allowed to hyperlink to this page?" * How about that 'MySpace Hacking' case? From Wikipedia: Judge Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals." For these reasons, Judge Wu granted Drew's motion for acquittal. Government eventually decided not to appeal [16]. http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew
- tedunangst 15y agoI don't think hyperlinking is the crime in question for this case.
- sp332 15y agoHow did Aaron get access to the for-pay articles (page 9)? Also: nice going, Aaron! Drag research access into the 21st century, kicking and screaming! Does anyone think it's odd that an Acer laptop could write these files to disk faster than JSTOR could serve them?
- rryan 15y agoAnyone on MITNet has access to JSTOR articles free of charge to the user. Similarly the ACM, IEEE, etc. all have agreements like this with major universities.
- sp332 15y agoOh, so some articles are available to buy, and the subscription includes those and more? I thought the subscription was the subset.
- bricestacey 15y agoJSTOR offers packages and any articles not included in those packages can be purchased by individuals. Most choose instead to request it via interlibary loan and you'd have it within 24 hours usually.
- jdvolz 15y agoYeah, I was laughing about how an Acer laptop took down their service and did damage to their network. If I was JSTOR, I wouldn't prosecute just because it makes our company look ridiculous.
- awj 15y agoBecause, of course, JSTOR plans for 100x usage spikes and performs neither logging nor accounting, so serving a file is just as simple for them as downloading it is for the client.
- SpikeGronim 15y ago"Does anyone think it's odd that an Acer laptop could write these files to disk faster than JSTOR could serve them?" Nope. I bet the JSTOR servers are serving many concurrent requests. If he had the servers to himself then yes, that would be surprising.
- ramidarigaz 15y agoWhy would he do this? What is the purpose of having all those documents?
- jonknee 15y agoHe has a history of collecting and analyzing large data sets. This sounds about par for the course.
- streptomycin 15y agoInformation wants to be free.
- oasisbob 15y agoThis is from his personal site, http://www.aaronsw.com http://www.aaronsw.com: He is the author of numerous articles on a variety of topics, especially the corrupting influence of big money on institutions including nonprofits, the media, politics, and public opinion. In conjunction with Shireen Barday, he downloaded and analyzed 441,170 law review articles to determine the source of their funding; the results were published in the Stanford Law Review. From 2010-11, he researched these topics as a Fellow at the Harvard Ethics Center Lab on Institutional Corruption. He has also assisted many other researchers in collecting and analyzing large data sets with theinfo.org. His landmark analysis of Wikipedia, Who Writes Wikipedia?, has been widely cited.
- andymboyle 15y agoThe Boston Globe's got an article written on this that they're updating: http://www.boston.com/Boston/metrodesk/2011/07/cambridge-man-accused-hacking-mit-computers-steal-scientific-papers/6SVnqu3Yfo7OIrLQOYSz5M/index.html http://www.boston.com/Boston/metrodesk/2011/07/cambridge-man...
- danso 15y agoSo he allegedly goes out and buys a laptop just to do this heist...and then he blows his cover by doing a scrape fast enough to apparently bring down some of the MIT servers? Why was he in such a rush?
- nolite 15y agot the same time, he did this from Sept-Jan at full speed, and still only got half the archive... so..
- tlb 15y agoMost likely the servers crashed for whatever reason, and they looked at the logs and saw lots of recent accesses from a particular computer, and post hoc ergo propter hoc. Sysadmins often blame outlier users for crashes.
- rryan 15y ago"Aaron Swartz ... was a fellow at Harvard University’s Center for Ethics"
- llimllib 15y agoIt is not impossible to imagine a code of morality which views his alleged actions as ethical.
- rryan 15y agoDefinitely true -- I thought it was a relevant bit of information so I quoted it.
- llimllib 15y agoThat's fair, I was just refuting what your comment implied, that it was an unethical action. (I understand that you may not have intended to imply it. Just wanted to put that out there.) So since we don't disagree on that: Do you think what he did is ethical? edit: also, boston.com says he "is a fellow at Harvard’s University’s Center for Ethics". A quick google says that he was at least as of October 2010: http://www.google.com/search?hl=en&q=swartz+ethics+fellow+site%3Aharvard.edu&oq=swartz+ethics+fellow+site%3Aharvard.edu&aq=f&aqi=&aql=1&gs_sm=e&gs_upl=9112l11062l0l11132l16l12l2l0l0l6l170l1142l4.6l10 http://www.google.com/search?hl=en&q=swartz+ethics+fello...
- nickpinkston 15y agoI'd argue that he's fully ethical and it's our laws that are on the wrong side here. Pity the latter have the guns...
- samlevine 15y agoThe only reason he's not a hero is that he didn't put all the PDFs up on a torrent. We are the library now.
- JohnnyBrown 15y agoWouldn't any code of ethics endorsed by Harvard view hacking MIT as a virtuous act?
- jpeterson 15y agoAlternate link, in case these are taken down: http://pastebin.com/9vjfkigY http://pastebin.com/9vjfkigY
- keane 15y agoI get a 403 from MIT.edu so here are 1000 downloads of the pdf http://lts.cr/i/21cc51 http://lts.cr/i/21cc51
- troutwine 15y agoThe indictment asserts that Mr. Swartz intended to distribute the files downloaded but did not substantiate this claim. I wonder what proof they have of this? (There are, of course, a great many laws dealing with probable intent that need only convince a jury of said intent without demonstrating it's validity.)
- mbreese 15y agoRight... the real question seems to be what was he going to do with the files. The indictment doesn't really offer any evidence to this, and I doubt Aaron will be doing much talking until his defense.
- jgilliam 15y agoThat is what he normally does. http://www.nytimes.com/2009/02/13/us/13records.html http://www.nytimes.com/2009/02/13/us/13records.html
- kragen 15y agoThat was what he did in that case, but it wasn't what he did with the four hundred thousand law review articles he analyzed for conflicts of interest more recently.
- tptacek 15y agoThe indictment doesn't have to provide all the evidence presented to the Grand Jury, and the Grand Jury process itself is secret (the actual court case won't be).
- nitrogen 15y agoI've heard that, in drug law, possession of more than a certain amount is automatically interpreted as intent to distribute. Maybe the prosecutors in this case intend to argue something similar based on the nature or quantity of the documents retrieved.
- asciilifeform 15y agoThe man is a heroic martyr, who risked everything to set knowledge free. (Knowledge most of which was produced at the public's expense!) He may very well die in prison. Or perhaps he will be forced to publicly recant and merely be forbidden from using computers. I hope that in the latter case he will have the good sense to emigrate. One day, his tormentors will be harshly punished. Unless, of course, "the future is a boot stamping on a human face — forever." "Keeping medicines from the bloodstreams of the sick; food from the bellies of the hungry; books from the hands of the uneducated; technology from the underdeveloped; and putting advocates of freedom in prisons. Intellectual property is to the 21st century what the slave trade was to the 16th." (http://en.wikipedia.org/wiki/User:Lulu_of_the_Lotus-Eaters http://en.wikipedia.org/wiki/User:Lulu_of_the_Lotus-Eaters)
- tptacek 15y agoHE MAY VERY WELL DIE IN PRISON. Can we be done with this thread? I know for a fact that I am not the only one who has flagged it. No good can come of this. In a likely worst case given who we're talking about, Aaron will be prodded into commenting publicly on a criminal case. FLAGGED.
- jdp23 15y agoWhich of the HN guidelines does this violate?
- tptacek 15y agoNone of them. I think you'd be doing Aaron a favor to kill it, though.
- asciilifeform 15y agoYeah, let him become desaparecido in obscurity. Nacht und Nebel. What a "favor." Do you really think that he will be invited to post incriminating comments here from his jail cell?
- Deutscher 15y ago33. Swartz intended to distribute a significant portion of JSTOR’s archive of digitized journal articles through one or more file-sharing sites. How do they know this? Has he said something to that effect? --edited for formatting.
- nkassis 15y agoWell, I'm going to guess that the prosecution is putting that in there just in case they can get the jury to agree. They can claim anything they want, the jury has to decide if it's true without a doubt.
- niels_olson 15y agoUm, I don't know, maybe because he wrote a manifesto to that effect and has circulated various methods for doing so? He was sponsoring a google group for article requests for awhile. Seems to be gone now.
- carbonica 15y agoI wonder what they'll push for. He sounds pretty screwed if this evidence pans out. Looks like he could even end up with a few years' time if the prosecutors want. 1. Wire fraud maxes out at 20 years outside of a presidentially-declared emergency. No fine cap, it seems. http://uscode.house.gov/download/pls/18C63.txt http://uscode.house.gov/download/pls/18C63.txt 2. Computer fraud under 1030(a)(4) caps out at 5 years with no prior offense, no fine cap. http://uscode.house.gov/download/pls/18C47.txt http://uscode.house.gov/download/pls/18C47.txt 3. 1030(a)(2), (c)(2)(B)(iii) looks to be another cap of 5 years. Ibid. 4. 1030(a)(5)(B), (c)(4)(A)(i)(I),(VI) looks like another cap of 5 years. Ibid. IANAL, just trying my best to read the code itself.
- _delirium 15y agoThe repeated use of "stole" in the indictment is interesting, even beyond the usual metaphorical usage to discuss copyright infringement. In this case, the indictment alleges that the documents were stolen from JSTOR, which does not even own them! In the vast majority of cases JSTOR scanned documents whose copyright is owned by someone else, and acquired or was donated a non-exclusive license to distribute copies via its service. In many cases the documents are even public domain. The indictment continues the theft metaphor by discussing the effort and expense JSTOR incurred in scanning the documents, and the alleged attempt to render this less valuable by redistributing "its" documents, analogizing this to the loss someone suffers in a theft. But effort expended to build a private repository consisting of copies of things you don't own doesn't give you ownership of the result, any more than Google Books doing the same has given them ownership of the documents that they've scanned. If you scraped Google and "stole" their scans, you would be violating Google's Terms of Service, and Google might indeed feel subjectively like you've taken something of value (their exclusive access to this repository of scans), but I think it would be a stretch to say that you've "stolen" "their" documents.
- sp332 15y agoYeah, that bothered me too. Especially on page 14, where they demand that he give back the "proceeds obtained." How is that going to be determined in such an unrealistic sense?
- Alex3917 15y agoThey are talking about theft of services, not copyright infringement. In any event these charges are going to be very difficult to beat since they're federal, even though there are some obvious holes in the indictment. It will be almost impossible to get any of the evidence thrown out even if there was an illegal search and seizure. His best bet is probably to get the Harvard legal team to go to bat for him, although it's difficult to say how likely that is.
- _delirium 15y agoI wasn't really commenting on the legal sufficiency of the indictment, just the rhetorical dishonesty of accusing someone of "steal[ing] well over 4,000,000 articles from JSTOR" (quote from the indictment) when JSTOR didn't own those articles. They could've just alleged violation of JSTOR's TOS and thereby theft of network services. I suspect JSTOR or people sympathetic to them had a hand in writing the indictment, though; JSTOR has a long history of attempting to spread the misinformation that it somehow "owns" its archive.
- jgilliam 15y agoHe posted on his blog yesterday that there would be a "major announcement" on blog.demandprogress.org today, but nothing has been posted. http://www.aaronsw.com/weblog/updates http://www.aaronsw.com/weblog/updates
- JED3 15y agopublished http://blog.demandprogress.org/2011/07/federal-government-indicts-former-demand-progress-executive-director-for-downloading-too-many-journal-articles/ http://blog.demandprogress.org/2011/07/federal-government-in...
- pbreit 15y agoHe also wrote this yesterday: http://www.aaronsw.com/weblog/delegation http://www.aaronsw.com/weblog/delegation It doesn't seem directly related but still curious.
- runningdogx 15y agoThis is the most technically competent charging document I've ever read. I guess there must have been some hackers on the grand jury. Paragraph 35 & 36: which "protected computer" on MIT's network did he access? Certainly they're not trying to claim his laptop was a protected computer? Are they talking about the DHCP server or whatever registration frontend MIT has for the DHCP assignments? I have trouble with the concept that a violation of a computer use agreement (when there are no operative security barriers in place) constitutes a violation of the computer fraud and abuse act. Then again, I've always thought that act was vague and therefore overbroad. Obviously what he did was bad in some sense (at least from the perspective of JSTOR and MIT), but even if it should be a crime rather than a civil dispute or internal disciplinary action at MIT, I don't like the fact that just about any misbehavior on the internet becomes a federal case because the probability of no interstate resources being used is very low. Finally, I take issue with the notion that someone who is accessing a service through a public interface is criminally responsible for downtime if too high an access rate causes service degradation or an outage. The claims that JSTOR's servers were overloaded and (one?) even went down at some point are clearly there to set up a later claim of damages. Haven't they heard of rate limiting (in this case, since it was a rogue laptop stashed in a data closet, rate limiting by IP)? That wouldn't work against a concerted denial of service attack, but this was no denial of service attack. JSTOR seems to have been relying on manual intervention to stop article leeching that could lead to a (partial) outage. That's naive, and not a good idea.
- mbreese 15y ago> no operative security barriers in place I don't know... Even if my front door was open, you still aren't allowed to enter my house without my permission.
- johngalt 15y agoBut there is an element of permission inherent in DHCP. Your device is actively configuring my device specifically to allow network access. It's not an open door; it's a sign saying "This way please". That said, its obvious this was an attempt to circumvent access controls.
- mbreese 15y agoThis all hinges on what he was going to do with the documents. If he was looking to perform some large-scale analysis (such as he has done before) and publish the results academically, then this would fall under the academic mission of MIT, and therefore be legit. But if this were the case, why go through the hassle of hacking the system? Why not just ask JSTOR for cooperation? Or maybe he did, and they rejected it? There has got to me more to this story, because I just can't for the life of me believe that he would download the documents to "free" them on internet (as is alleged).
- GHFigs 15y agoA detail you missed is that Swartz was not a student or faculty member at MIT. He was a fellow at Harvard.
- mukyu 15y agohttp://blog.demandprogress.org/2011/07/federal-government-indicts-former-demand-progress-executive-director-for-downloading-too-many-journal-articles/ http://blog.demandprogress.org/2011/07/federal-government-in... “It’s even more strange because the alleged victim has settled any claims against Aaron, explained they’ve suffered no loss or damage, and asked the government not to prosecute,” Segal added. Nowhere do they say he did not do it however. cached: http://webcache.googleusercontent.com/search?q=cache:http://blog.demandprogress.org/ http://webcache.googleusercontent.com/search?q=cache:http://...
- _delirium 15y agoJSTOR is being very vague about their role in this, so that might unfortunately be wrong about just how settled JSTOR considers things on their side. Their statement feels extremely carefully worded: http://about.jstor.org/news-events/news/jstor-statement-misuse-incident-and-criminal-case http://about.jstor.org/news-events/news/jstor-statement-misu...
- Vivtek 15y agoJSTOR knows they'd better be very vague if they don't want too many rather intelligent people wondering just how they actually add value to the chain.
- gojomo 15y agoMIT (and the alleged disruption to other MIT JSTOR users' access) may also be relevant to the decision to charge. My understanding is that MIT has a freewheeling attitude to information, but also deep organizational and funding links to national security institutions. So their hacker ethos might tell them to brush it off, while their federal relationships require them to take a tougher stance.
- _delirium 15y agoIn terms of broader implications, I would actually have many fewer problems with MIT pressing straightforward trespassing charges. If he broke into a server room and messed with equipment there without the owner's permission, they could prosecute that under very ordinary state criminal law long predating the computer age. It's the weird "stealing documents from JSTOR" federal case under the Computer Fraud and Abuse Act that's more worrying, because it's extremely vague what those kinds of charges can cover (in some interpretations, essentially any violation of a ToS).
- deleted 15y ago[deleted]
- ck2 15y agotext version http://google.com/search?q=cache%3Ahttp%3A%2F%2Fweb.mit.edu%2Fbitbucket%2FSwartz%2C%2520Aaron%2520Indictment.pdf http://google.com/search?q=cache%3Ahttp%3A%2F%2Fweb.mit.edu%...
- keane 15y agoWhat is a Grand Jury? - http://grandjuryresistance.org/grandjuries.html http://grandjuryresistance.org/grandjuries.html
- ErikRogneby 15y agoThis was a good reminder of the importance of physical security.
- blinkingled 15y agoWhy the hell is MIT stashing information in closed systems in first place? I thought the idea (OCW etc.) was to enable more people to learn, participate and benefit from work of academics and researchers. Hell I even donate a few hundred bucks every now and then to OCW. It is mind boggling how the supposedly smart people are not getting their heads out of their asses so late in a world frighteningly short on distribution of knowledge that can be effectively used to solve the wicked problems that are crippling it for so long. We really need a global, openly accessible knowledge network and a platform where all eligible can contribute and collaborate to research at least when it comes to areas that impact human society at large - medicines, natural resources etc. It is hard otherwise to see how things like Cancer and Energy shortage can be tackled.
- basugasubaku 15y agoThe papers are from JSTOR, not MIT. MIT pays for a subscription to JSTOR like many other universities do.
- blinkingled 15y agoBut is it clear that MIT does not also store its research papers in JSTOR instead of making them publicly available? Reading the article I did not get that impression.
- rryan 15y agoWhile many researchers at MIT publish in journals that sometimes have restrictions on the distribution of their papers (exclusivity, etc.), most MIT publications are issued via: 1) DSpace http://dspace.mit.edu http://dspace.mit.edu (an open publishing platform for academic material. Most all theses produced by MIT researchers can be accessed by the public here) 2) as an MIT technical report (mostly published via dspace) 3) as an MIT "Working Paper" You can find more information here: http://libraries.mit.edu/docs/research-publications.html http://libraries.mit.edu/docs/research-publications.html Certainly, a huge number of MIT publications do end up being mirrored in JSTOR, but they are usually published via whatever journal or conference proceeding they are accepted to first. If an author cannot find a journal that is willing to publish their paper, then they will probably issue it as an MIT technical report.
- a3camero 15y agoContext: JSTOR blocks you automatically if you download articles in quick succession.
- feydr 15y agocan someone please explain what the deal is here for us uninitiated? sounds like they are throwing the book at him for stealing books? seriously? why is the prosecution being so aggressive? did he profit from it or something? this sounds so petty
- joeyh 15y agoThe cynic in me suspects that he has annoyed someone in power with his many other political activities (Demand Progress etc). When I first had contact with Aaron he was just this guy who wrote rss2email, it's been very inspiring to see him move on to hacking politics.
- phereford 15y agoHe violated Terms of Service for a large database of journals at an egregious rate. If he had stolen say...10,000 articles this may be a non-issue. The fact that they can tie 4,000,000 articles to him is what makes this so bad. The other part that is extremely bad is his measure to continually evade MIT MAC banning through spoofing. That measure of evasion proves, to some extent, his intent to steal and is a form of computer fraud.
- awj 15y agoI wouldn't be too surprised if him causing a month (months?) long interruption of JSTOR for an entire campus deeply involved in government contracts was also part of the ire.
- ojbyrne 15y agoFrom the JSTOR website (http://about.jstor.org/participate-jstor/worldwide-access http://about.jstor.org/participate-jstor/worldwide-access) "Our ultimate long-term objective is to make JSTOR available to everyone who wants access to it, while doing so in a way that ensures sustainability of the service." Cynically, it seems like the bit about "ensures sustainability" can be translated as "we will aggressively prosecute in order to protect our bloated salaries."
- guywithabike 15y agoJSTOR's not doing any prosecution. In fact, if you read other comments / stories, it sounds like they don't want the DA to prosecute him.
- keane 15y agoThe salaries of Ithaka Harbors Inc. (JSTOR's holding company), a supposedly not-for-profit organisation are indeed bloated. See pp. 7-8, 23, 26 of http://www.guidestar.org/FinDocuments/2009/133/857/2009-133857105-06a32823-9.pdf http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338...
- pmb 15y agoFor those that don't like reading, the document describes multiple employees of the "nonprofit" with compensation in excess of 200k.
- maxniederhofer 15y agoThis reminded me of Jacques Mattheij's list of ideas for startups (see http://jacquesmattheij.com/My+list+of+ideas+for+when+you+are+looking+for+inspiration http://jacquesmattheij.com/My+list+of+ideas+for+when+you+are...): "(45) OpenPapers A place where all academic research that has been funded in part by public funds is published, journals be damned. Hopefully with deep pockets to fight off the lawsuits."
- ak217 15y agoFor NIH-funded studies, PubMed Central is actually doing a pretty good job. It would be great if PMC actually had a mandate to collect papers for all US federal grant-funded research, though.
- jluxenberg 15y agoarXiv seems to fit this bill, and has a reasonable bulk data access policy http://arxiv.org/help/bulk_data http://arxiv.org/help/bulk_data
- prosa 15y agoDemand Progress PAC's website is down, but they released a statement: (from: http://webcache.googleusercontent.com/search?q=cache:9k5ryiXKKwsJ:blog.demandprogress.org/+blog.demandprogress.org&cd=1&hl=en&ct=clnk&gl=us&source=www.google.com http://webcache.googleusercontent.com/search?q=cache:9k5ryiX... ) Cambridge, MA– Moments ago, Aaron Swartz, former executive director and founder of Demand Progress, was indicted by the US government. As best as we can tell, he is being charged with allegedly downloading too many scholarly journal articles from the Web. The government contends that downloading said articles is actually felony computer hacking and should be punished with time in prison. “This makes no sense,” said Demand Progress Executive Director David Segal; “it’s like trying to put someone in jail for allegedly checking too many books out of the library.” “It’s even more strange because the alleged victim has settled any claims against Aaron, explained they’ve suffered no loss or damage, and asked the government not to prosecute,” Segal added. James Jacobs, the Government Documents Librarian at Stanford University, also denounced the arrest: “Aaron’s prosecution undermines academic inquiry and democratic principles,” Jacobs said. “It’s incredible that the government would try to lock someone up for allegedly looking up articles at a library.” Demand Progress is collecting statements of support for Aaron on its website at …URL… “Aaron’s career has focused on serving the public interest by promoting ethics, open government, and democratic politics,” Segal said. “We hope to soon see him cleared of these bizarre charges.” Demand Progress is a 500,000-member online activism group that advocates for civil liberties, civil rights, and other progressive causes. About Aaron Aaron Swartz is a former executive director and founder of Demand Progress, a nonprofit political action group with more than 500,000 members. He is the author of numerous articles on a variety of topics, especially the corrupting influence of big money on institutions including nonprofits, the media, politics, and public opinion. In conjunction with Shireen Barday, he downloaded and analyzed 441,170 law review articles to determine the source of their funding; the results were published in the Stanford Law Review. From 2010-11, he researched these topics as a Fellow at the Harvard Ethics Center Lab on Institutional Corruption. He has also assisted many other researchers in collecting and analyzing large data sets with theinfo.org. His landmark analysis of Wikipedia, Who Writes Wikipedia?, has been widely cited. He helped develop standards and tutorials for Linked Open Data while serving on the W3C’s RDF Core Working Group and helped popularize them as Metadata Advisor to the nonprofit Creative Commons and coauthor of the RSS 1.0 specification. In 2008, he created the nonprofit site watchdog.net, making it easier for people to find and access government data. He also served on the board of Change Congress, a good government nonprofit. In 2007, he led the development of the nonprofit Open Library, an ambitious project to collect information about every book ever published. He also cofounded the online news site Reddit, where he released as free software the web framework he developed, web.py. Press inquiries can be directed to demandprogressinfo@gmail.com or 571- 336- 2637
- mbreese 15y agoJSTOR's statement http://about.jstor.org/news-events/news/jstor-statement-misuse-incident-and-criminal-case http://about.jstor.org/news-events/news/jstor-statement-misu... JSTOR Statement: Misuse Incident and Criminal Case The United States Department of Justice announced today the criminal indictment of an individual, Aaron Swartz, on charges related to computer fraud and abuse stemming from his misuse of the JSTOR database. We have been subpoenaed by the United States Attorney’s Office in this case and are fully cooperating. While we cannot comment on this case, we would like to share background information about the incident and about our mission and work with the academic community and the public. What Happened Last fall and winter, JSTOR experienced a significant misuse of our database. A substantial portion of our publisher partners’ content was downloaded in an unauthorized fashion using the network at the Massachusetts Institute of Technology, one of our participating institutions. The content taken was systematically downloaded using an approach designed to avoid detection by our monitoring systems. The downloaded content included over 4 million articles, book reviews, and other content from our publisher partner’s academic journals and other publications; it did not include any personally identifying information about JSTOR users. We stopped this downloading activity, and the individual responsible, Mr. Swartz, was identified. We secured from Mr. Swartz the content that was taken, and received confirmation that the content was not and would not be used, copied, transferred, or distributed. The criminal investigation and today’s indictment of Mr. Swartz has been directed by the United States Attorney’s Office. Our Mission and Work Our mission at JSTOR is supporting scholarly work and access to knowledge around the world. Faculty, teachers, and students at more than 7,000 institutions in 153 countries rely upon us for affordable and in some cases free access to content on JSTOR. Since our founding in 1995, we have digitized the complete back runs of nearly 1,400 academic journals from over 800 publishers. Our ultimate objective is to provide affordable access to scholarly content to anyone who needs it. It is important to note that we support and encourage the legitimate use of large sets of content from JSTOR for research purposes. We regularly provide scholars with access to content for this purpose. Our Data for Research site (http://dfr.jstor.org http://dfr.jstor.org) was established expressly to support text mining and other projects, and our Advanced Technologies Group is an eager collaborator with researchers in the academic community. Even as we work to increase access, usage, and the impact of scholarship, we must also be responsible stewards of this content. We monitor usage to guard against unauthorized use of the material in JSTOR, which is how we became aware of this particular incident.
- snikolic 15y agoIgnoring legality, Aaron's actions, case specifics, etc., I have to admit: I really wish that the data in question was free and publicly available.
- xefer 15y agoAnybody with a library card to a major public library can get this stuff for free over the web.
- snikolic 15y agoThere's an enormous difference between controlled access to individual globules of data, and free access to the entirety of a dataset.
- ak217 15y agoAnd you have a right to demand it: by federal law, all publicly funded research should be in the public domain (unless national security blah blah blah...). Unfortunately this law isn't enforced except in some aspects through provisions of all recent NIH grants (and maybe others).
- bricestacey 15y agoI don't understand why he was so desperate to access it via MIT. There are dozens of libraries in the Boston area with access to JSTOR with guest access to their network. If he wasn't in such a rush, he could have easily bounced around campuses and likely have avoided detection.
- eli 15y agoPerhaps to have enough legitimate traffic surrounding you to mask the fact that you're trying to download every single article.
- acangiano 15y agoWhen someone risks 35 years in jail for something like this, you know your justice system is broken. I know he won't get 35 years, but it's nevertheless outrageous that it could happen.
- kragen 15y agoDo you think he'd get life in Italy?
- sigil 15y agoConsider showing your support for Aaron here: http://act.demandprogress.org/sign/support_aaron/ http://act.demandprogress.org/sign/support_aaron/ Demand Progress is an organization Aaron co-founded. They've done some great watchdog work on things like PROTECT IP, the Patriot Act, the Internet Blacklist Bill etc.
- peterwwillis 15y agoWait a minute. All he needed was a guest account to access JSTOR? That's like saying, ANYONE IS ALLOWED TO DOWNLOAD FROM JSTOR. This isn't just bad security, this is no security.
- pak 15y agoMost academic journal repositories grant institutional access based on IP address blocks. Some institutions keep this narrow and force you to use an HTTP proxy, which gives them the ability to put additional institutional-level authentication in place. The upside is that you can access the journals from off-network, the downside is using the proxy can be a major pain. Other networks, e.g. MIT, are permissive with the IP restriction and don't mandate the use of one centralized proxy as long as you are on-network. I suppose that may change after this case.
- dlaw 15y agoNo, he connected to MIT's wireless network using a guest account. JSTOR grants full access to all MIT IP addresses.
- dgreensp 15y agoWhat Aaron did sounds seriously sketchy (sneaking into MIT wiring closets, trying to download the entire database, etc.), a fact that Demand Progress and several commenters here seem to be ignoring. Defending his actions would require a very strong, multi-pronged version of the argument "if it's physically / technologically possible, it must be ok." Can MIT legally limit guest access to its network? Can JSTOR limit access to its content? Well, technically, their software didn't limit it, right? He just changed his IP address and they let him right back on, gave him permission. And then he had to change his MAC address. And then physically move to a different building. But it doesn't matter anyway, because legal restrictions are legal restrictions. It's impossible to enforce every legal restriction in software. Put another way, we don't have to read JSTOR's server code to figure out if there's a violation of policy here -- the policy is written out as a legal document. In the hacker world, there's a tendency to think that if something's possible, even easy, then it shouldn't be considered "breaking in" or "stealing." If my Gmail password is "password," then of course you're going to read my email! I had it coming. In the real world, though, this is still a crime.
- VladRussian 15y ago>What Aaron did sounds seriously sketchy (sneaking into MIT wiring closets, trying to download the entire database, etc.), reminded me about ancient IP infringement case: http://en.wikipedia.org/wiki/Prometheus http://en.wikipedia.org/wiki/Prometheus
- jxcole 15y ago+1 for correlation with ancient Greek mythology. I seriously recommend Prometheus Unbound for a more modern treatment of the subject. http://andromeda.rutgers.edu/~jlynch/Texts/prometheus.html http://andromeda.rutgers.edu/~jlynch/Texts/prometheus.html
- rbanffy 15y agoCompared to that, 35 years in jail seems quite humane ;-)
- zavulon 15y ago
- executive 15y agoFantastic news! He deserves to rot in jail for wasting so much precious bandwidth.
- nostrademons 15y agoCompared to the millions of people who viewed "Friday"?
- gwern 15y agoHopefully you are being sarcastic. In case you were not, I've downvoted you.
- spinchange 15y agoIs the DOJ trying to 'make an example' here? JSTOR and MIT aren't pursuing this, the Feds are.
- tlrobinson 15y agoBallsy, considering his previous brush with the FBI over similar things: http://www.aaronsw.com/weblog/fbifile http://www.aaronsw.com/weblog/fbifile
- kaerast 15y agoOne hopes he is smart enough to have a solid legal argument for what he has done. If he loses the legal battle then it's going to set a bad precedent for all these academic document stores to continue keeping hold of this information. On the other hand, if he were to win then it may make it harder for groups like JSTOR to continue restricting access to their data.
- mark242 15y agoA solid legal argument for switching your MAC address, hiding a laptop in a closet, and deliberately concealing your face to try to avoid recognition? He isn't going to win that defense.
- pnathan 15y agoYeah, that one is going to be... problematic to explain away. sounds like he walked over the edge. Shame.
- kragen 15y agoHypothetically: wiring closets are normal places for computers engaged in always-on network services. Putting a box over a laptop can keep it from getting stolen. Your bike helmet can end up in front of your face for a while while you're taking it off or putting it on. Switching your MAC address is reasonable if there's a MAC address conflict, or if you've gone and apologized to the network infrastructure guys for causing problems and they accepted your apology but didn't have the password for the DHCP server handy. Try to remember you're seeing the picture painted entirely by the prosecution, without even the evidence that the grand jury saw to support it.
- mark242 15y ago"...or if you've gone and apologized to the network infrastructure guys for causing problems..." Read the indictment. He started on Sep 25th. He was blocked by IP on Sep 25. He switched his IP on Sep 26. The entire netblock was then blocked by admins. To try to turn the service back on for normal users, admins tried to block his MAC address on Sep 27, which worked until he changed it on Oct 2, and then added a second machine on Oct 8. Your "hypothetical" defense doesn't even come close to flying. This isn't a little misunderstanding; this is network admins blocking access, and being circumvented, multiple times.
- xer0x 15y agoI admire Aaron's persistence. Sadly it was quite rude of him to repeatedly crash JSTOR's servers. If only he'd throttled his script back a bit. Liberating those documents from JSTOR would have been quite a gift to society.
- kragen 15y agoIf the indictment is accurate, he did throttle back his script a bit, and continued to run it for several months after the last JSTOR server crash or blockage.
- keane 15y agoI don't understand why the US Attorney is suggesting he be charged with such ridiculously inflated charges. Reviewing the Indictment report, "JSTOR did not permit users... to download all of the articles from any particular issue of a journal." Further, "JSTOR notified its users of these rules, and users accepted these rules when they chose to obtain and use JSTOR’s content." So basically JSTOR is claiming Aaron violated their terms of use. Their terms of use are likely an adhesion contract with a passive shrinkwrap notification. (remember ReasonableAgreement.org ?). It is not certain that Aaron did in fact agree to such terms, or what consequences doing so and then violating said terms should have. Regardless, JSTOR proclaiming certain terms may not be sufficient to deny Aaron of his rights as a consumer, citizen, and human. The report goes on to claim that Aaron took action to "avoid MIT’s and JSTOR’s efforts to prevent this massive copying". MIT and JSTOR allowed users to access their network, with no system in place to ensure that a user was a student (by design, as MIT admits) or that they were using their real name (or a single MAC address). A researcher accessing JSTOR is really less of a concern than other potential types of access so perhaps this is not a good system. The report suggests Aaron took action to "elude detection and identification" but courts have held that anonymous speech and action are valid parts of society. They take issue with his using a Mailinator address but such an email address is just as valid as any other and simply allows others to read ones mail. The report whines that the "rapid and massive downloads and download requests impaired computers used by JSTOR to service client research institutions". This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR. MIT acted to ban the IP ranges that they believe were in violation of their rules. Users were to use the network to support MIT’s research, or at least not obstruct it. However, very likely Aaron was conducting research. Any hindrance to other users may have been the responsibility of MIT's infrastructure team.They further request users "maintain the system’s security and conform to applicable laws, including copyright laws" seemingly suggesting Aaron was in violation of copyright. Very importantly, MIT should remember that when it comes to copyright "Reproduction for purposes such as criticism, comment, news reporting, teaching, scholarship, or research, is not an infringement of copyright." The last point of MIT rules is that users "conform with rules imposed by any networks to which users connected through MIT’s system" which makes little practical sense and is certainly selectively enforced. Assuming a JSTOR web server is now a network, so is my personal web server. On all html files on my webserver I link to a ReasonableAgreement-style notification that no user may browse such files between 8am and 11pm EST. Any MIT student, faculty member, or guest who connects during those hours is in violation and should be kicked by MIT, for if a rule is to be fair it should be consistently enforced. This third rule is simply a CYA clause and is its selective enforcement is arrogant. To conclude, the document does suggest that perhaps Aaron did violate the JSTOR terms of use for their website. When a normal business decides to deal with a violation of their terms of use they deactivate that customer's accounts. However, Ithaka Harbors Inc., a “non-profit” organisation (Presidents yearly compensation is over $400,000 – see their 2009 Form 990 at http://www.guidestar.org/FinDocuments/2009/133/857/2009-133857105-06a32823-9.pdf http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338... ) funded by the Mellon Foundation and the Gates Foundation and committed to “the core values of higher education” and to a “deep understanding of technology” (ha), decided to alert the feds. As to MIT's claims that Aaron broke their rules for using their internet connection, it seems he neither obstructed MIT's research nor violate laws or copyright laws. As to their third claim, he may have violated the terms of a "network" but so do a significant portion of MIT’s users everyday. Why is the Obama administration pursuing an investigation in Wire Fraud and Computer Fraud?
- white_devil 15y agoThere must be a reason why the US government wants to harass/bully/imprison Aaron.
- woodall 15y agoPosted in another thread: http://news.ycombinator.com/item?id=2782752 http://news.ycombinator.com/item?id=2782752 This is not the first time he has done something like this if memory serves me. In late 2008 Mr. Swartz and Carl Malamud went to select libraries, ones with free PACER access, and proceeded to download ~700 GB of information that was behind a paywall. After which they made all of it available on Mr. Malamud's website. http://arstechnica.com/tech-policy/news/2009/04/case-against-pacer.ars http://arstechnica.com/tech-policy/news/2009/04/case-against...
- deleted 15y ago[deleted]
- budu3 15y agoIs this what our tax money is going into. Aaronsw just presents a soft target for the Feds.
- cpeterso 15y ago> The indictment alleges that Swartz, at the time a fellow at Harvard University, intended to distribute the documents on peer-to-peer networks. That did not happen, however, and all the documents have been returned to JSTOR. All the documents have been returned?!
- neuroelectronic 15y agoDid he ever manage to republish the articles? Doesn't look like it.
- andreyf 15y agoWhy do the charges all end with "and aided and abetted the same"?
- tibbon 15y agoIf all academic papers were released under a Creative Commons license, would this even be an issue? Aside from the allegations about breaking into various physical hardware infrastructure at MIT, wouldn't that be like being charged with downloading too many Jonathan Coulton albums?
- teyc 15y agoThis is beyond belief. If the prosecutor tries enough charges, some of them will stick, especially before a jury who may think this is a hacking case or a file sharing case. He'd do well to avoid the "hacktivist" label in court.
- acak 15y agoAaron's Twitter page which has been active today. http://twitter.com/#!/aaronsw http://twitter.com/#!/aaronsw
- mian2zi3 15y ago> Aaron Swartz lived in the District of Massachusetts and was a fellow at Harvard University’s Center for Ethics. Oh, the irony.
- donpark 15y agoAs the saying goes, the end does not justify the means, more so if selection of means was driven by impatience.
- queensnake 15y agoI'm probably Advocating Crime but, couldn't a bunch of people coordinate and do what he was doing, over a year or two, distributed, from several universities? You totally could. The more, the less noticeable, and punishable. edit: it wouldn't surprise me if something like that showed up; the problem has been highlighted, the legal issues made clearer, and JSTOR bloodied. Go Aaron.
- kragen 15y agoJSTOR might watermark PDFs to prevent this, as some other similar services do.
- _delirium 15y agoThere's a loosely-organized project at Wikimedia Commons to liberate at least the public-domain works locked up in JSTOR. This almost certainly violates JSTOR access policies, but once downloaded and stripped of their JSTOR title page, it's probably not illegal for the Wikimedia Foundation to host the result, since the result is in the public domain, even if ToS were violated in the document's acquisition. See: http://commons.wikimedia.org/wiki/Category:Scanned_English_texts http://commons.wikimedia.org/wiki/Category:Scanned_English_t...
- Aloisius 15y agoThere is a riser closet in my office with various internet service providers wiring in it feeding the entire building. If I were to enter this riser closet and plug into my laptop into one of these lines, I would be charged with theft of service and deservedly be sent to jail. It doesn't matter if the door is locked or not. It doesn't matter what kind of security they put in place or not. It doesn't matter if I only sent a few bytes of data on their network and didn't harm anyone elses' service. It is still theft of service.
- pbreit 15y agoThere were some poor judgment on display and I generally don't condone breaking the law but it would be a shame to lose Aaron's epic productivity and ingenuity for any period of time.
- flocial 15y agoIt's hard to trivialize downloading 4 million articles using a web scraper's bag of tricks and then some. If the information was publicly accessible these charges wouldn't stand unless he tried to distribute it. If it was something so commendable, why would you cloak your activities or go to a different university to do your dirt instead of Harvard (where your a fellow of some sort) or Stanford (where you attended). Regardless of the motives and ideals or the excess of the charges, this isn't one of those hapless grandma versus the RIAA stories. He must have known what he was doing. The pricing and restrictions on the dissemination of academic papers is by any rational evaluation nothing short of ridiculous and contradicts the academic ideal of free exchange of ideas for the advancement of knowledge. However, history of scholarship is also a history of patronage, academic politics and in-fighting for greater prestige. It's sad that someone like Aaron has to be treated like a domestic terrorist. It's sad that we have a vindictive justice system willing to flaunt the Constitution in this day and age with what effectively amounts to cruel and unusual punishment so they can "make an example" out of someone. However, it's no one's fault that Aaron was so emboldened to take this initiative without sufficiently ensuring that he would be free from criminal prosecution. Am I alone in thinking that these "hacktivists" will only prompt government to push more frivolous data theft laws and heavier punishment for offenses that may one day victimize hapless, innocent people? It's going to get a lot worse before it gets better.
- jacquesm 15y ago> However, it's no one's fault that Aaron was so emboldened to take this initiative without sufficiently ensuring that he would be free from criminal prosecution. Maybe he did it knowing full well what the consequences might be. He seems to be a pretty principled guy.
- dreamdu5t 15y agoWhat's interesting in these threads is the obvious dichotomy of values. You can't have it both ways. If people want to make money from research itself, then intellectual property must be enforced. Many hackers seem to hold the belief that making money from research is wrong. Or at least anybody else but themselves.