3 ms·

> In the spirit of the MIT ethos, the Institute runs this open, unmonitored and unrestricted network on purpose. Their head of network security admitted as much

by andylei 14y ago

> In the spirit of the MIT ethos, the Institute runs this open, unmonitored and unrestricted network on purpose. Their head of network security admitted as much to us. irrelevant. the computers aaron gained unlawful access to were JSTOR's, not MIT's furthermore, dishonest. MIT tried banning his computer from the network multiple times > Aaron did not "hack" the JSTOR website for all reasonable definitions of "hack". Aaron wrote a handful of basic python scripts that first discovered the URLs of journal articles and then used curl to request them just because JSTOR's website sucks doesn't mean its okay to abuse it. JSTOR's terms of service limit the amount of downloads individuals can make. if you forget to lock your door, does it make it okay for someone to take things from your house? > Aaron did nothing to cover his tracks or hide his activity just not true. they put a security camera in the closet where his computer was. when he came in to grab his laptop, he used his bike helmet as a mask so he couldn't be identified. also, they banned his computer multiple times from the network.

jasonzemos 14y ago
It's dishonest to apply the word 'unlawful' with the implication that statutory law (federal penal code) was violated. Service abuse is a civil matter, it doesn't concern the state.
- mpyne 14y ago
  This depends highly on where you live. In the U.S. service abuse that is judged as a denial-of-service attack is illegal under the Computer Fraud and Abuse Act in some situations (I'm not sure if Aaron was charged under those sections or not though).
- andylei 14y ago
  except its not dishonest. one of the charges was wire fraud. from the article: > Wire Fraud. The Wire Fraud statute, 18 U.S.C. 1343, prohibits a scheme to gain “property” by false pretenses. This strikes me as a pretty strong charge here. The false pretenses are provided by the false identification and spoofing of Swartz’ IP address and MAC address. Swartz was trying to trick JSTOR into giving him access to their database after they had specifically tried their best to ban him from doing so. And the “property” was the contents of the JSTOR database itself. do people on HN even read the articles anymore?
  - jasonzemos 14y ago
    Except that MIT runs an open network, so Swartz didn't have to "spoof" anything. Rotating your IP or MAC address on an open network is simply not a violation of the statutory penal system. MIT can sue him for damages and abuse at most, the state is a non-party to the matter.
    - andylei 14y ago
      The federal charges are with respect to unlawful access to JSTOR's computers, not MIT's computers. Furthermore, Aaron didn't have to "spoof" anything. JSTOR tried to ban him from their computers for activities against their terms of service. Orin Kerr's argument is that attempting to circumvent those bans to gain property is wire fraud, which there is a federal law against. So the actually the state is a party.
      - jasonzemos 14y ago
        It seems the problem with interpreting wire fraud with his cited precedent comes down to an IP address versus an identity. The cited case contained two employees with specific usernames to denote their identities. When one uses the other's identity it's an impersonation -- or a false pretense. This case contains publicly available IP addresses and network-wide access and with that comes access to JSTOR. Rotating the IP to gain continued access might be immoral or tortious conduct at best, but as long as he didn't impersonate another user (possibly by spoofing an active IP address even) the court wouldn't be right in interpreting with the cited precedent. If the court decided this way: Say my dhcp-obtained cable IP becomes banned from JSTOR, when it changes and I simply check if I can access JSTOR again, I'd be in violation. Furthermore, a reasonable person wouldn't know that an IP address could be an identity similar to a username and that changing it would be a crime.

by andylei 14y ago

jasonzemos 14y ago

It's dishonest to apply the word 'unlawful' with the implication that statutory law (federal penal code) was violated. Service abuse is a civil matter, it doesn't concern the state.

mpyne 14y ago
This depends highly on where you live. In the U.S. service abuse that is judged as a denial-of-service attack is illegal under the Computer Fraud and Abuse Act in some situations (I'm not sure if Aaron was charged under those sections or not though).
andylei 14y ago
except its not dishonest. one of the charges was wire fraud. from the article: > Wire Fraud. The Wire Fraud statute, 18 U.S.C. 1343, prohibits a scheme to gain “property” by false pretenses. This strikes me as a pretty strong charge here. The false pretenses are provided by the false identification and spoofing of Swartz’ IP address and MAC address. Swartz was trying to trick JSTOR into giving him access to their database after they had specifically tried their best to ban him from doing so. And the “property” was the contents of the JSTOR database itself. do people on HN even read the articles anymore?
- jasonzemos 14y ago
  Except that MIT runs an open network, so Swartz didn't have to "spoof" anything. Rotating your IP or MAC address on an open network is simply not a violation of the statutory penal system. MIT can sue him for damages and abuse at most, the state is a non-party to the matter.
  - andylei 14y ago
    The federal charges are with respect to unlawful access to JSTOR's computers, not MIT's computers. Furthermore, Aaron didn't have to "spoof" anything. JSTOR tried to ban him from their computers for activities against their terms of service. Orin Kerr's argument is that attempting to circumvent those bans to gain property is wire fraud, which there is a federal law against. So the actually the state is a party.
    - jasonzemos 14y ago
      It seems the problem with interpreting wire fraud with his cited precedent comes down to an IP address versus an identity. The cited case contained two employees with specific usernames to denote their identities. When one uses the other's identity it's an impersonation -- or a false pretense. This case contains publicly available IP addresses and network-wide access and with that comes access to JSTOR. Rotating the IP to gain continued access might be immoral or tortious conduct at best, but as long as he didn't impersonate another user (possibly by spoofing an active IP address even) the court wouldn't be right in interpreting with the cited precedent. If the court decided this way: Say my dhcp-obtained cable IP becomes banned from JSTOR, when it changes and I simply check if I can access JSTOR again, I'd be in violation. Furthermore, a reasonable person wouldn't know that an IP address could be an identity similar to a username and that changing it would be a crime.