5 ms·

I don't understand why the US Attorney is suggesting he be charged with such ridiculously inflated charges. Reviewing the Indictment report, "JSTOR did not per

by keane 15y ago

I don't understand why the US Attorney is suggesting he be charged with such ridiculously inflated charges. Reviewing the Indictment report, "JSTOR did not permit users... to download all of the articles from any particular issue of a journal." Further, "JSTOR notified its users of these rules, and users accepted these rules when they chose to obtain and use JSTOR’s content." So basically JSTOR is claiming Aaron violated their terms of use. Their terms of use are likely an adhesion contract with a passive shrinkwrap notification. (remember ReasonableAgreement.org ?). It is not certain that Aaron did in fact agree to such terms, or what consequences doing so and then violating said terms should have. Regardless, JSTOR proclaiming certain terms may not be sufficient to deny Aaron of his rights as a consumer, citizen, and human. The report goes on to claim that Aaron took action to "avoid MIT’s and JSTOR’s efforts to prevent this massive copying". MIT and JSTOR allowed users to access their network, with no system in place to ensure that a user was a student (by design, as MIT admits) or that they were using their real name (or a single MAC address). A researcher accessing JSTOR is really less of a concern than other potential types of access so perhaps this is not a good system. The report suggests Aaron took action to "elude detection and identification" but courts have held that anonymous speech and action are valid parts of society. They take issue with his using a Mailinator address but such an email address is just as valid as any other and simply allows others to read ones mail. The report whines that the "rapid and massive downloads and download requests impaired computers used by JSTOR to service client research institutions". This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR. MIT acted to ban the IP ranges that they believe were in violation of their rules. Users were to use the network to support MIT’s research, or at least not obstruct it. However, very likely Aaron was conducting research. Any hindrance to other users may have been the responsibility of MIT's infrastructure team.They further request users "maintain the system’s security and conform to applicable laws, including copyright laws" seemingly suggesting Aaron was in violation of copyright. Very importantly, MIT should remember that when it comes to copyright "Reproduction for purposes such as criticism, comment, news reporting, teaching, scholarship, or research, is not an infringement of copyright." The last point of MIT rules is that users "conform with rules imposed by any networks to which users connected through MIT’s system" which makes little practical sense and is certainly selectively enforced. Assuming a JSTOR web server is now a network, so is my personal web server. On all html files on my webserver I link to a ReasonableAgreement-style notification that no user may browse such files between 8am and 11pm EST. Any MIT student, faculty member, or guest who connects during those hours is in violation and should be kicked by MIT, for if a rule is to be fair it should be consistently enforced. This third rule is simply a CYA clause and is its selective enforcement is arrogant. To conclude, the document does suggest that perhaps Aaron did violate the JSTOR terms of use for their website. When a normal business decides to deal with a violation of their terms of use they deactivate that customer's accounts. However, Ithaka Harbors Inc., a “non-profit” organisation (Presidents yearly compensation is over $400,000 – see their 2009 Form 990 at http://www.guidestar.org/FinDocuments/2009/133/857/2009-133857105-06a32823-9.pdf http://www.guidestar.org/FinDocuments/2009/133/857/2009-1338... ) funded by the Mellon Foundation and the Gates Foundation and committed to “the core values of higher education” and to a “deep understanding of technology” (ha), decided to alert the feds. As to MIT's claims that Aaron broke their rules for using their internet connection, it seems he neither obstructed MIT's research nor violate laws or copyright laws. As to their third claim, he may have violated the terms of a "network" but so do a significant portion of MIT’s users everyday. Why is the Obama administration pursuing an investigation in Wire Fraud and Computer Fraud?

GHFigs 15y ago
Frankly, I think most of the claims in your post are bonkers, but this one sticks out: This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR. "During November and December, 2010, Swartz used the "ghost laptop" (i.e., the Acer laptop) at MIT to make over two million downloads from JSTOR. This is more than one hundred times the number of downloads during the same period by all the legitimate MIT JSTOR users combined." So we're entirely clear on this: you are saying this is reasonable and that the majority of the blame for any disruption lies with JSTOR. You are saying that JSTOR should have anticipated that a single legitimate user would have placed a hundred times the demand on the system than the entire population of a major university.
- kragen 15y ago
  Well, it does seem that if JSTOR serves 7000 institutions around the world, having that number effectively jump to 7100 for a couple of months shouldn't be a big drama. Also, it's pretty surprising to me that the average number of downloads at MIT was about 1.4 per person per month. (2 million / 100 / 12000 people / 2 months.) I would have expected at least one order of magnitude higher.
  - GHFigs 15y ago
    if JSTOR serves 7000 institutions around the world, having that number effectively jump to 7100 I understand what you're thinking, but that's not what happened. He downloaded a hundred times MIT, not a hundred times the average institution. You're assuming that MIT is close to average, but there is no reason to think that. I strongly suspect that MIT is a bigger user than (for example) Rye Neck High School or the Scottish Agricultural College. http://about.jstor.org/participate-jstor/participants http://about.jstor.org/participate-jstor/participants
- keane 15y ago
  Basing whether or not Aaron's actions were "wire fraud" based on quantity doesn't really make sense. Saying he downloaded more than other users at MIT is really just saying other people requested less files than he did. I remember when I needed academic papers, I stopped using my institution's access to JSTOR because frequently the same paper could be found (legally) using Google Scholar or similar. As academia switches to things like arXiv, JSTOR will be used less and less. I understand that 2 million is orders-greater than an average individual might request, but basing the legality on quantity is flawed. If one file is accessed illegally, you have broken the law. If 2 million are, you have also broken the law. As to being entirely clear, yes, I would have expected the employees at JSTOR (like the VP of technology making $300k) to have thought of possible ways to rate limit a connection. Just as you can prevent DDOS with something like iptables hashlimit, JSTOR could have done something better than simply refusing all MIT traffic. http://serverfault.com/questions/211135/how-to-prevent-a-loic-ddos-attack http://serverfault.com/questions/211135/how-to-prevent-a-loi... As an analogy, if I host 1 million images of cats on my webserver, and I keep everything open and allow indexes in the Apache configuration, expecting the average person to only download 10 pictures and then you use 'a little WGET magic' to download 1 million jpgs, it seems odd for me to complain when my server crashes and my friend Erica can't download 1 single cat image that she had been wanting to. Yes, your downloads caused the tie up but how angry can I be? Your browser sent a request to my server and my server fulfilled the request. Like David Segal says, the United States government wants to punish someone for an action akin to allegedly checking out too many books from the library. Over the objections of both MIT and JSTOR, presumably. And you're saying I'm bonkers.

by keane 15y ago

GHFigs 15y ago

Frankly, I think most of the claims in your post are bonkers, but this one sticks out: This inconveniencing of other users could have been avoided and the blame for how JSTOR allocates resources lies with the architects of JSTOR. "During November and December, 2010, Swartz used the "ghost laptop" (i.e., the Acer laptop) at MIT to make over two million downloads from JSTOR. This is more than one hundred times the number of downloads during the same period by all the legitimate MIT JSTOR users combined." So we're entirely clear on this: you are saying this is reasonable and that the majority of the blame for any disruption lies with JSTOR. You are saying that JSTOR should have anticipated that a single legitimate user would have placed a hundred times the demand on the system than the entire population of a major university.

kragen 15y ago
Well, it does seem that if JSTOR serves 7000 institutions around the world, having that number effectively jump to 7100 for a couple of months shouldn't be a big drama. Also, it's pretty surprising to me that the average number of downloads at MIT was about 1.4 per person per month. (2 million / 100 / 12000 people / 2 months.) I would have expected at least one order of magnitude higher.
- GHFigs 15y ago
  if JSTOR serves 7000 institutions around the world, having that number effectively jump to 7100 I understand what you're thinking, but that's not what happened. He downloaded a hundred times MIT, not a hundred times the average institution. You're assuming that MIT is close to average, but there is no reason to think that. I strongly suspect that MIT is a bigger user than (for example) Rye Neck High School or the Scottish Agricultural College. http://about.jstor.org/participate-jstor/participants http://about.jstor.org/participate-jstor/participants
keane 15y ago
Basing whether or not Aaron's actions were "wire fraud" based on quantity doesn't really make sense. Saying he downloaded more than other users at MIT is really just saying other people requested less files than he did. I remember when I needed academic papers, I stopped using my institution's access to JSTOR because frequently the same paper could be found (legally) using Google Scholar or similar. As academia switches to things like arXiv, JSTOR will be used less and less. I understand that 2 million is orders-greater than an average individual might request, but basing the legality on quantity is flawed. If one file is accessed illegally, you have broken the law. If 2 million are, you have also broken the law. As to being entirely clear, yes, I would have expected the employees at JSTOR (like the VP of technology making $300k) to have thought of possible ways to rate limit a connection. Just as you can prevent DDOS with something like iptables hashlimit, JSTOR could have done something better than simply refusing all MIT traffic. http://serverfault.com/questions/211135/how-to-prevent-a-loic-ddos-attack http://serverfault.com/questions/211135/how-to-prevent-a-loi... As an analogy, if I host 1 million images of cats on my webserver, and I keep everything open and allow indexes in the Apache configuration, expecting the average person to only download 10 pictures and then you use 'a little WGET magic' to download 1 million jpgs, it seems odd for me to complain when my server crashes and my friend Erica can't download 1 single cat image that she had been wanting to. Yes, your downloads caused the tie up but how angry can I be? Your browser sent a request to my server and my server fulfilled the request. Like David Segal says, the United States government wants to punish someone for an action akin to allegedly checking out too many books from the library. Over the objections of both MIT and JSTOR, presumably. And you're saying I'm bonkers.