3 ms·

What about the part where he walked into an unlocked closet and plugged into an unsecured Ethernet port, using access to the network he had already been granted

by Cushman 14y ago

What about the part where he walked into an unlocked closet and plugged into an unsecured Ethernet port, using access to the network he had already been granted? I'd like to think that if I'm walking by your house and connect to your free open hotspot, I'm not committing a felony because you meant to put a password on it.

raldi 14y ago
Clealrly the core network in the closet and the wifi network outside were not equivalent, or he wouldn't have been in there in the first place. He had permission to access the latter, not the former, and the fact that he was hiding his face when he went in there is evidence that he knew he didn't have permission to plug into that layer. He was escalating his level of privilege by connecting at a deeper level than he had been granted access to.
- Cushman 14y ago
  Anyone who's done networking knows that ethernet and wifi are not equivalent. I'll grant you he was escalating his bandwidth; what is this "privilege" you describe which was neither physical nor technical?
  - raldi 14y ago
    No, I think you're misunderstanding a key part of this: MIT has a layer of defense between their public-access networks (like campus wifi) and their core network. Among other things, that's the layer their antiscraping defenses live in. The closet router was deeper than that -- inside that layer of defense. Aaron didn't just plug in for bandwidth or permanence -- he did it because it was a trusted subnet that would evade the protections and restrictions MIT places on their public access points.
    - Cushman 14y ago
      Ah, noted. Evading rate limiting to a resource you have lawful access to still reads to me as bandwidth, not privilege, but point taken. But still— unlocked closet, unsecured network, all, we are given to understand, because of a very lenient open network policy. If he was not "authorized" access, what is the authority, and when would the authorization have taken place? It seems a terribly tough row to hoe.
      - raldi 14y ago
        > If he was not "authorized" access, what is the authority, and when would the authorization have taken place? http://ist.mit.edu/help http://ist.mit.edu/help > It seems a terribly tough row to hoe. Indeed, I'm finding myself in a strange place in this debate, because I do think that computer crime laws are very vague and extremely harsh, including the ones Aaron was being prosecuted under. But I think Aaron's defenders go too far when they claim he was completely innocent.
        Cushman 14y ago
        Respect; you're a fine devil's advocate. I'll definitely agree what Aaron was doing was cheeky, and anyone could have seen how it could easily get him in trouble with MIT or JSTOR or maybe even the cops. It's just hard to point out what actual part of the law as written was broken, since it looks like he didn't actually circumvent anything that would normally be called security except in the sense of "We didn't think anyone would do that."

by Cushman 14y ago

raldi 14y ago

Clealrly the core network in the closet and the wifi network outside were not equivalent, or he wouldn't have been in there in the first place. He had permission to access the latter, not the former, and the fact that he was hiding his face when he went in there is evidence that he knew he didn't have permission to plug into that layer. He was escalating his level of privilege by connecting at a deeper level than he had been granted access to.

Cushman 14y ago
Anyone who's done networking knows that ethernet and wifi are not equivalent. I'll grant you he was escalating his bandwidth; what is this "privilege" you describe which was neither physical nor technical?
- raldi 14y ago
  No, I think you're misunderstanding a key part of this: MIT has a layer of defense between their public-access networks (like campus wifi) and their core network. Among other things, that's the layer their antiscraping defenses live in. The closet router was deeper than that -- inside that layer of defense. Aaron didn't just plug in for bandwidth or permanence -- he did it because it was a trusted subnet that would evade the protections and restrictions MIT places on their public access points.
  - Cushman 14y ago
    Ah, noted. Evading rate limiting to a resource you have lawful access to still reads to me as bandwidth, not privilege, but point taken. But still— unlocked closet, unsecured network, all, we are given to understand, because of a very lenient open network policy. If he was not "authorized" access, what is the authority, and when would the authorization have taken place? It seems a terribly tough row to hoe.
    - raldi 14y ago
      > If he was not "authorized" access, what is the authority, and when would the authorization have taken place? http://ist.mit.edu/help http://ist.mit.edu/help > It seems a terribly tough row to hoe. Indeed, I'm finding myself in a strange place in this debate, because I do think that computer crime laws are very vague and extremely harsh, including the ones Aaron was being prosecuted under. But I think Aaron's defenders go too far when they claim he was completely innocent.
      - Cushman 14y ago
        Respect; you're a fine devil's advocate. I'll definitely agree what Aaron was doing was cheeky, and anyone could have seen how it could easily get him in trouble with MIT or JSTOR or maybe even the cops. It's just hard to point out what actual part of the law as written was broken, since it looks like he didn't actually circumvent anything that would normally be called security except in the sense of "We didn't think anyone would do that."