Hacker News Reader

Comment by sadfaceunread | Hacker News Reader

As a member of the MIT community, I honestly do not feel very bad about how MIT (Administration) handled this situation. MIT's tradition of careful and thoughtful rule breaking clearly recognizes that rules will be enforced and that the police may be involved in criminal matters.

MIT does not and should not decide prosecution strategy. This was not a civil case, but a criminal prosecution in the American tradition of criminal justice. The victim is not the one prosecuting the crime but rather the government prosecutes on behalf of all people, not on behalf of the victim exclusively.

View on HN

MIT involved the feds in the first place. That was a decision made by authorities on campus, one which was not inevitable. So yes, they do decide prosecution strategy, by deciding when there should be prosecution at all.

Yes, involving the USSS was the first seriously questionable decision MIT made. I hope Prof Abelson's report includes who made that decision, when, on what evidence, and why.

I'd be fine with invoking the USSS if there were serious crime going on -- someone using MIT to host cp, or compromising research integrity, or planning violence or financial crime, etc.

If it's someone using your network resources in excess of terms of service, to download another freely available resource in excess of service.

I'd give a technically lesser party (say, a small business, or an individual, or a local government office) a pass if they called the USSS in on something, since they might not be competent to figure out what is going on. However, MIT is clearly in a position to know exactly what was happening.

I'd be inclined to wait for Abelson's report, but from what I've seen so far, MIT Libraries, MIT IS&T, MIT Police, and the MIT Office of General Counsel are all to blame to some extent.

The lion's share of the blame falls on USA Carmen M. Ortiz, AUSA Stephen P. Heymann, and AUSA Scott L. Garland, however, and on Congress for passing unreasonable computer crime and copyright laws with such absurdly excessive criminal penalties.

Let me get this straight: You blame MIT for notifying the Federal Government that federal laws may have been broken by someone using MIT's computer network?

Is that what you're saying?

Yes. They had no duty to report in general or for these specific crimes. The specific crime was "gaining access to MIT's ethernet network in violation of policy" -- if your neighbor cracks your wireless password to get free Internet, it's reasonable to ask him to stop, rather than calling the SS. If your neighbor is using your hacked wireless to host child porn, you call the SS.

In the ideal world, the SS/USAO would be trusted to have some level of discretion in prosecution, but they don't, so as soon as you involve the feds, you've exercised the nuclear option.

I'm personally waiting on the Abelson report before going much deeper into assigning specific blame. For now, Ortiz, Heymann, and Garland are the enemy to be addressed.

Note that Swartz was trying to evade MIT as much as possible: they couldn't communicate with him because he was running from them. At that point, they didn't know who they were dealing with. All they know was that their systems had been infiltrated by someone who had managed for months to evade all their efforts to block his access or identify him. I'm not sure you can fault them for bringing in the big guns at that point....Were they supposed to just shrug it off?

I'm not sure if involving USSS helps in apprehending someone if you can't identify him. They have legal powers (although, MIT once it started acting as agents of the federal government lost some of their ability to act on their own private infrastructure...), and can do wiretaps on other networks, subpoenas, search warrants, etc., but if the crime is going on in your own facility, and you own the network, you are probably in a better position to observe what is going on than the USSS is.

Once you identify a person, USSS is certainly more capable of investigating him and apprehending, but at the sage of network cat and mouse, I'd put a decent sysadmin above the SS.

I think it can be very helpful. MIT had no idea they were dealing with a single individual or if they were dealing with an entity who was only targeting them. Pooling information from other potential victims through law enforcement seems like an obvious win.

Moreover, once they discovered the hardware Swartz had left, law enforcement could be extremely helpful by running fingerprints; MIT does not have access to the FBI's fingerprint database.

I agree it could help at that stage, and if this had been a sensitive private network, I'd err on the side of overkill. A university network, especially one as historically open as MIT, is different. Nothing he did was that out of the range of normal user behavior -- changing your dhcp reg, manually assigning an IP in the right range, etc. are all things people do when airport/hotel/etc. networks don't work. Leaving a hidden laptop plugged in is actually something I did a couple times (as a student) to download linux ISOs, mailing list archives, etc. (since we only had a T1 at the house, and the on-campus network was faster).

I'll wait until Abelson's report, though.

> Yes, involving the USSS was the first seriously questionable decision MIT made.

The unknown intruder evaded several attempts to cut him off. The volume of downloads was so high that it was causing problems for JSTOR's servers, and JSTOR finally blocked ALL of MIT for several days.

MIT was suffering serious harm. Calling in the Feds for help doesn't seem all that questionable to me under the circumstances.

Blocked all of MIT? I thought they just blocked the single /24 he was using. MIT has a /8.

According to the information in the indictment[1], they first blocked a single IP, then a bigger block, and then finally all of MIT.

[1] http://web.mit.edu/bitbucket/Swartz,%20Aaron%20Indictment.pd...

Ah, thanks (I didn't read it that closely). Having your entire netblock blocked from an important service definitely is more justification to bring in the SS, since it's actual ongoing harm to you.

That was a decision made by authorities on campus

Which authorities? That does not seem to be clear. From what I've seen so far, that decision could have been made at a pretty low level. Also, when that decision was made, it seems clear that MIT had no idea what was actually going on; it wasn't until much later that the reason behind the anomalous network traffic was known, after the feds were already involved and it was too late to un-involve them.

Reply on news.ycombinator.com