5 ms·

The title is inaccurate. It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered

by mukyu 15y ago

The title is inaccurate. It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered if the IP he was using was blocked (by JSTOR) or cut off of the network (by MIT), and finally connected a laptop in a basement networking closet. I guess you could say that is 'hacking' in the unauthorized access sense, but not in any meaningful sense. It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection.

SpikeGronim 15y ago
IANAL, but legally speaking unauthorized access is a crime regardless of how easy it was to gain access.
- pyre 15y ago
  This was struck down by the courts by the way. Why? If unauthorized access is a federal offense, and unauthorized access can be determined by (e.g.) a EULA, then it basically allows a business to dictate criminal law. For example: 1. This would allow all of those 'You agree that you are not a law enforcement official' B.S. 'terms of use' on warez servers to actually have teeth. 2. "If you are a {black,hispanic,gay,etc} person, you are not allowed to access my website." Do any of these sound reasonable? I should hope not.
  - tedunangst 15y ago
    That's because those restrictions are illegal themselves. "Don't download the whole database" is not an illegal restriction.
    - pyre 15y ago
      * How about "You are not allowed to hyperlink to this page?" * How about that 'MySpace Hacking' case? From Wikipedia: Judge Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals." For these reasons, Judge Wu granted Drew's motion for acquittal. Government eventually decided not to appeal [16]. http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew
      - tedunangst 15y ago
        I don't think hyperlinking is the crime in question for this case.
        deleted 15y ago
        [deleted]
        pyre 15y ago
        My post wasn't very clear. I was making two separate points.
        tedunangst 15y ago
        There are two separate issues as well, whether or not a restriction is valid and the ease with which it is circumvented. Lots of EULA/TOS terms are unreasonably broad. But let's say the TOS says "use of service without a password is unauthorized". Seems reasonable. Somebody runs a program to guess passwords until they find one that works. "Ah ha," they say, "I have a password, so my usage is now authorized." I don't think a judge or jury will buy that. Even if the password was easy to guess. I believe that was SpikeGronim's point. Assuming the definition of unauthorized is legit, there's no such "it was too easy" defense. Or "I could do it, therefore I must have been allowed to do it."
- carbonica 15y ago
  I think the parent was just disappointed at using "hacking" to refer to something as mundane as getting guest accounts to the network.
- jrockway 15y ago
  This is a very frightening belief. How long until posting a negative comment to a blog is "unautorized access" to that blog? Gaining access was easy: all you had to do was type a comment and hit submit. But some Powers That Be decided they didn't really want you to post that, so now it's a federal computer crime. Land of the free.
  - _delirium 15y ago
    That's currently unsettled, and yes a lot of computer-crime experts (even typically law-and-order-leaning ones) consider it a huge problem--- it might actually be a federal crime to post a comment on a blog in violation of the blog's Terms of Service. This case is currently winding its way through the courts, and will hopefully be overturned: http://volokh.com/2011/06/14/petition-for-rehearing-filed-in-united-states-v-nosal-ninth-circuit-case-on-criminalizing-violations-of-computer-use-policies/ http://volokh.com/2011/06/14/petition-for-rehearing-filed-in...
  - kronusaturn 15y ago
    This problem extends way beyond hacking laws—the average person in the US probably commits several felonies a day: http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx
    - jrockway 15y ago
      I read this book and think that federal crimes are punished too harshly, but the people profiled seem far from average.
  - tptacek 15y ago
    Speaking of "TV drama levels of understanding of criminal justice"... :) With only a few exceptions, persons accused of crimes are not presumed to have mens rea. Statutory rape, for instance, has "strict liability"; even if you don't know you're committing a crime, you're liable. Most criminal offenses are not like this. The state is required to establish mens rea. A prosecutor could say that a ToS-infringing blog comment is a criminal violation, but unless that prosecutor can establish that the comment was made in purposeful, knowing, or reckless violation of the ToS, they'd be wasting their time.
yid 15y ago
It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection. It might not be breaking & entering, but it's still trespassing, which is a crime.
- kbutler 15y ago
  > It might not be breaking & entering, but it's still trespassing, which is a crime. Jaywalking is murder! Well, it's still a crime...
  - yid 15y ago
    I'm not sure what you're appealing to. Real-world analogies don't always transfer readily to digital law. Even in the words of the ageing CFAA, "exceeding authorization" to steal commercial information is most certainly a punishable crime. You don't have to pull out nmap and zero days to be convicted of hacking.
scott_s 15y ago
He found ways to get around the (minor) protections put in place using a computer. That fits the colloquial definition of hacking. We don't own the term anymore - if we ever did.
gwern 15y ago
The indictment mentions only one laptop, BTW. No indication he signed up with "different laptops".
- mukyu 15y ago
  22. On October 8, 2010, Swartz connected a second computer to MIT’s network and registered as a guest, using similar naming conventions: the computer was registered under the name "Grace Host," the computer client name "ghost macbook," and the throw-away e-mail address “ghost42@mailinator.com." 23. The next day, October 9, 2010, Swartz used both the “ghost laptop” and the “ghost macbook” to systematically and rapidly access and download an extraordinary volume of articles from JSTOR. The pace was so fast that it brought down some of JSTOR’s computer servers.
  - gwern 15y ago
    Huh; my bad. Also mentioned is that Swartz used the network closet to take 2 IP addresses. Are we to infer he hooked up both laptops with an IP each? Or is the real scenario that he was using one laptop under 2 identities? (Not that impossible.)
jancona 15y ago
How is this not "unauthorized access" "in any meaningful sense"? They blocked his IP, they blocked his MAC, and he hid a machine in a wiring closet to get on MIT's network. What would he have to do to make it "meaningful"?
- wisty 15y ago
  Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that. He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents. This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent of "checking out too many library books whilst wearing a false mustache".
  - jancona 15y ago
    So it should only be illegal if a hacker wouldn't think it's lame? Got it.
    - comex 15y ago
      As a hacker, I think this would solve a lot of problems in the world. ;p
    - wisty 15y ago
      Nah. It should only be illegal if normal people can't do it. Most of what Aaron did is stuff lots of people do. There's a difference between wearing a dummy badge that says "I am Gary Host", a badge that incorrectly says "I am Bill Gates" (as that would be some kind of identity theft) and forging a passport in "Gary Host"'s name. What aaronsw did was far closer to the first. Now, you could argue that scripts are power tools, and using them requires a higher standard of behavior. If you are driving a plane, giving dummy credentials over the radio is a lot more serious than a kid with a toy CV radio. Even then, the dummy credentials didn't really cause any damage. The damage was done by the script itself. Even if he used his real name, the damage would have been done.

by mukyu 15y ago

SpikeGronim 15y ago

IANAL, but legally speaking unauthorized access is a crime regardless of how easy it was to gain access.

pyre 15y ago
This was struck down by the courts by the way. Why? If unauthorized access is a federal offense, and unauthorized access can be determined by (e.g.) a EULA, then it basically allows a business to dictate criminal law. For example: 1. This would allow all of those 'You agree that you are not a law enforcement official' B.S. 'terms of use' on warez servers to actually have teeth. 2. "If you are a {black,hispanic,gay,etc} person, you are not allowed to access my website." Do any of these sound reasonable? I should hope not.
- tedunangst 15y ago
  That's because those restrictions are illegal themselves. "Don't download the whole database" is not an illegal restriction.
  - pyre 15y ago
    * How about "You are not allowed to hyperlink to this page?" * How about that 'MySpace Hacking' case? From Wikipedia: Judge Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals." For these reasons, Judge Wu granted Drew's motion for acquittal. Government eventually decided not to appeal [16]. http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew
    - tedunangst 15y ago
      I don't think hyperlinking is the crime in question for this case.
      - deleted 15y ago
        [deleted]
      - pyre 15y ago
        My post wasn't very clear. I was making two separate points.
        tedunangst 15y ago
        There are two separate issues as well, whether or not a restriction is valid and the ease with which it is circumvented. Lots of EULA/TOS terms are unreasonably broad. But let's say the TOS says "use of service without a password is unauthorized". Seems reasonable. Somebody runs a program to guess passwords until they find one that works. "Ah ha," they say, "I have a password, so my usage is now authorized." I don't think a judge or jury will buy that. Even if the password was easy to guess. I believe that was SpikeGronim's point. Assuming the definition of unauthorized is legit, there's no such "it was too easy" defense. Or "I could do it, therefore I must have been allowed to do it."
carbonica 15y ago
I think the parent was just disappointed at using "hacking" to refer to something as mundane as getting guest accounts to the network.
jrockway 15y ago
This is a very frightening belief. How long until posting a negative comment to a blog is "unautorized access" to that blog? Gaining access was easy: all you had to do was type a comment and hit submit. But some Powers That Be decided they didn't really want you to post that, so now it's a federal computer crime. Land of the free.
- _delirium 15y ago
  That's currently unsettled, and yes a lot of computer-crime experts (even typically law-and-order-leaning ones) consider it a huge problem--- it might actually be a federal crime to post a comment on a blog in violation of the blog's Terms of Service. This case is currently winding its way through the courts, and will hopefully be overturned: http://volokh.com/2011/06/14/petition-for-rehearing-filed-in-united-states-v-nosal-ninth-circuit-case-on-criminalizing-violations-of-computer-use-policies/ http://volokh.com/2011/06/14/petition-for-rehearing-filed-in...
- kronusaturn 15y ago
  This problem extends way beyond hacking laws—the average person in the US probably commits several felonies a day: http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx
  - jrockway 15y ago
    I read this book and think that federal crimes are punished too harshly, but the people profiled seem far from average.
- tptacek 15y ago
  Speaking of "TV drama levels of understanding of criminal justice"... :) With only a few exceptions, persons accused of crimes are not presumed to have mens rea. Statutory rape, for instance, has "strict liability"; even if you don't know you're committing a crime, you're liable. Most criminal offenses are not like this. The state is required to establish mens rea. A prosecutor could say that a ToS-infringing blog comment is a criminal violation, but unless that prosecutor can establish that the comment was made in purposeful, knowing, or reckless violation of the ToS, they'd be wasting their time.

yid 15y ago

It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection. It might not be breaking & entering, but it's still trespassing, which is a crime.

kbutler 15y ago
> It might not be breaking & entering, but it's still trespassing, which is a crime. Jaywalking is murder! Well, it's still a crime...
- yid 15y ago
  I'm not sure what you're appealing to. Real-world analogies don't always transfer readily to digital law. Even in the words of the ageing CFAA, "exceeding authorization" to steal commercial information is most certainly a punishable crime. You don't have to pull out nmap and zero days to be convicted of hacking.

scott_s 15y ago

He found ways to get around the (minor) protections put in place using a computer. That fits the colloquial definition of hacking. We don't own the term anymore - if we ever did.

gwern 15y ago

The indictment mentions only one laptop, BTW. No indication he signed up with "different laptops".

mukyu 15y ago
22. On October 8, 2010, Swartz connected a second computer to MIT’s network and registered as a guest, using similar naming conventions: the computer was registered under the name "Grace Host," the computer client name "ghost macbook," and the throw-away e-mail address “ghost42@mailinator.com." 23. The next day, October 9, 2010, Swartz used both the “ghost laptop” and the “ghost macbook” to systematically and rapidly access and download an extraordinary volume of articles from JSTOR. The pace was so fast that it brought down some of JSTOR’s computer servers.
- gwern 15y ago
  Huh; my bad. Also mentioned is that Swartz used the network closet to take 2 IP addresses. Are we to infer he hooked up both laptops with an IP each? Or is the real scenario that he was using one laptop under 2 identities? (Not that impossible.)

jancona 15y ago

How is this not "unauthorized access" "in any meaningful sense"? They blocked his IP, they blocked his MAC, and he hid a machine in a wiring closet to get on MIT's network. What would he have to do to make it "meaningful"?

wisty 15y ago
Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that. He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents. This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent of "checking out too many library books whilst wearing a false mustache".
- jancona 15y ago
  So it should only be illegal if a hacker wouldn't think it's lame? Got it.
  - comex 15y ago
    As a hacker, I think this would solve a lot of problems in the world. ;p
  - wisty 15y ago
    Nah. It should only be illegal if normal people can't do it. Most of what Aaron did is stuff lots of people do. There's a difference between wearing a dummy badge that says "I am Gary Host", a badge that incorrectly says "I am Bill Gates" (as that would be some kind of identity theft) and forging a passport in "Gary Host"'s name. What aaronsw did was far closer to the first. Now, you could argue that scripts are power tools, and using them requires a higher standard of behavior. If you are driving a plane, giving dummy credentials over the radio is a lot more serious than a kid with a toy CV radio. Even then, the dummy credentials didn't really cause any damage. The damage was done by the script itself. Even if he used his real name, the damage would have been done.