MIT releases report on its actions in the Aaron Swartz case
web.mit.edu
web.mit.edu
The report appears to find that MIT should not have changed its neutral stance, which is disappointing, and I'm skeptical. Here's a quote (IV.B.3):
Given the lead prosecutor’s comments to MIT’s outside
counsel (see section III.C.3), MIT statements would
seemingly have had little impact, and even risk making
matters worse—although this information was not shared
with Swartz’s advocates.
It does reinforce what we already know: that the public prosecutor was mostly interested in collecting a scalp.Update: Taren Stinebrickner-Kauffman, Aaron's partner at the time of his death, has released a statement. Full disclosure: Taren's a friend, Aaron was a friend, and I'm not exactly a disinterested party here.
http://tarensk.tumblr.com/post/56881327662/mit-report-is-a-w...
The report does not have any findings about what MIT "should" have done, as it states many times, such as in the last paragraph of the Introduction section:
> It was not part of our charge in this review to draw conclusions, but rather to determine facts and to consider what can be learned from this tragedy. Part V accordingly poses questions, not answers.
and again in the 4th paragraph of Section V:
> The Review Panel was not asked to make recommendations in our report, but rather to suggest how MIT might learn from this history.
Your comment misrepresents the report's purpose as well as its content. I think the report deserves a more careful reading.
EDIT: Personally, I recommend reading the Conclusion section (p. 100) and searching for the string "neutral" in that section.
I have a lot of respect for the authors of the report, and I trust their integrity. But if judgement wasn't in their remit, then it was a poor remit.
Note also that MIT's president seems to believe that the report constitutes a free pass:
From studying this review of MIT's role, I am
confident that MIT's decisions were reasonable,
appropriate and made in good faith.Respect and trust are lost much more easily than gained.
Well then what's the point of the report other than allowing MIT to wash its hands? Great timing on the release as well since it will likely be forgotten and hidden due to another big event today.
What is your suggestion on a better time to release? Or what do you think they should have done exactly?
What big event? Is it a holiday in US?
To be clear do you mean that MIT deserves blame for the suicide?
Even if Aaron was still alive, the things MIT did would be no less wrong.
So Aaron had nothing to do with getting himself into the situation that he did?
I also really hate arguments that blame the victim.
He broke the law. Then he committed suicide. I don't think there's much debate to be had about where any blame lies.
> He broke the law.
Was the law that was broken make sense? Was the response to a victimless crime appropriate?
> Then he committed suicide.
You're acting like people dealing with a serious mental illness for years can easily make the same mundane choices that people without mental illness do everyday. It's more complicated than that.
> A sad tale, but the law is the law.
Some laws are unjust, ridiculous, or both. There's also something called "the spirit of the law" as well.
>> Correct me if I'm wrong but they deserve blame for initiating the
>> destruction of someone's life (jail time and fines in the millions)
> So Aaron had nothing to do with getting himself into the situation that
> he did?
There exists such a thing known as a disproportionate response. I assumed
that was the implication here. (Not that Aaron did nothing wrong, but that
the response to his wrong-doing was wildly disproportionate.)
My response is saying that nobody is claiming Aaron doesn't deserve any blame. Only that there was a disproportionate response. Just because X acted wrongly doesn't mean Y had to have acted rightly."AARON SWARTZ, 24, was charged in an indictment with wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer. If convicted on these charges, SWARTZ faces up to 35 years in prison, to be followed by three years of supervised release, restitution, forfeiture and a fine of up to $1 million."
Gee I wonder why someone would contemplate suicide?
Also there are thousands of people every year sentenced to possibly long term jail time who don't kill themselves, therefore I put the blame more on Aaron himself than MIT.
'The thing that galls me is that I told Heymann the kid was a suicide risk,' Good told me. 'His reaction was a standard reaction in that office, not unique to Steve. He said, ‘Fine, we’ll lock him up.’ I’m not saying they made Aaron kill himself. Aaron might have done this anyway. I’m saying they were aware of the risk, and they were heedless.'"
"Marty Weinberg, who took the case over from Good, said he nearly negotiated a plea bargain in which Swartz would not serve any time. He said JSTOR signed off on it, but MIT would not.
'There were subsets of the MIT community who were profoundly in support of Aaron,' Weinberg said. That support did not override institutional interests."
Maybe to outsiders, but Aaron and Aaron's lawyers both knew the six-month plea deal was on the table.
The DOJ publicly said "up to 35 years," and they deserve what they get for saying that --
-- but Aaron's lawyers didn't just fall off the turnip truck. They knew federal sentencing guidelines. Even if guilty on all counts, there were good odds that Aaron would face 0 days in jail, being a first-time non-violent offender. There was a 0.00% chance of Aaron going to jail for 35 years.
On January 6, 2011, Swartz was arrested near the Harvard campus by two MIT police officers and a U.S. Secret Service agent. He was arraigned in Cambridge District Court on two state charges of breaking and entering with intent to commit a felony.
On July 11, 2011, Swartz was indicted in Federal District Court on four felony counts: wire fraud, computer fraud, unlawfully obtaining information from a protected computer and recklessly damaging a protected computer.
On November 17, 2011, Swartz was indicted by a Middlesex County Superior Court grand jury on state charges of breaking and entering with intent, grand larceny and unauthorized access to a computer network.
http://en.wikipedia.org/wiki/United_States_v._Aaron_Swartz#A...
What you posted is a fancy way of saying that Aaron logged into JTSTOR using his own credentials and downloaded publicly funded research papers onto a computer hidden in an MIT supply closet. Who's the victim in his crime?
Huh? This is new.
"Swartz used a Perl computer script running on Amazon cloud servers to download the documents, using credentials belonging to a Sacramento library."
Again, who actually got hurt aside from Aaron?
At the bare minimum, whether or not you believe MIT aided the prosecution over the defense (and I believe they did), it seems clear to me that Aaron and his family (his father is an alumnus, and worked for the MIT Media Lab) deserved better than "neutrality" from the MIT administration, if for no other reason than that I can't think of a single conceivable technical reason to call what Aaron did "felony" hacking.
By standing pat, MIT also contributed to the ongoing prosecutorial weaponization of laws like the CFAA, which makes a felony of a wide range of activities that most hackers would not even categorize as misdemeanors, to say nothing of crimes that bar you from voting or holding most jobs. It is a terrible precedent no matter how you look at it.
Now to be clear: do you believe that MIT deserves no blame?
However, the report says that MIT’s neutrality stance did not consider
factors including “that the defendant was an accomplished and well-known
contributor to Internet technology”; that the law under which he was charged
“is a poorly drafted and questionable criminal law as applied to modern
computing”; and that “the United States was pursuing an overtly aggressive
prosecution.” While MIT’s position “may have been prudent,” the report says,
“it did not duly take into account the wider background” of policy issues
“in which MIT people have traditionally been passionate leaders.”
IMO, the MIT fraternity (particularly the faculty) should have been a bit more proactive in this regard. We note that no one from MIT called the Secret Service.
The MIT Police contacted the Cambridge detective by calling him on his individual cell phone.
The special agent became involved because he accompanied the Cambridge detective.
Things just magically fall together. The MITs neutrality apparently extends so far that they don't even bother with what kind of police forces are strolling around on campus.(Also note that, presumably due to their neutral stance, MIT intervened in court cases asking for the release of documents produced on Swartz and the case)
Inter-agency task forces have become common in American law enforcement since 9/11. Many people have multiple affiliations. For example, I have a friend that is part of the New England Electronic Crimes Task Force. He's a Secret Service agent and does Secret Service details. But, he's a Boston police officer, works out of the Boston police headquarters, and overall is the exact same as any other Boston cop except where the funding line that allows Boston PD to cover his pay check comes from.
Still, you call for a Cambridge detective, the Secret Service also shows up, and that doesn't cause major head scratching? I wish the summary had expanded on that part.
FD: I'm an alum.
Edit: From the report:
For the same reasons, the MIT Police sought forensic assistance from a detective in the Cambridge Police Department who had expertise in computer crime and with whom they had worked repeatedly in the past. The Cambridge detective, who was a member of the New England Electronic Crimes Task Force, responded to the call, accompanied by an agent of the U.S. Secret Service. While the inclusion of the Secret Service agent was not the intention of MIT, it was a recognized possibility. It was not until a few days later, when Aaron Swartz was arrested, that MIT learned the identity of the person involved in the JSTOR downloading. Thus, we find that MIT did not focus on Aaron Swartz at any time during its own investigation of the events that led to his arrest, and that MIT did not intentionally “call in the feds” to take over the investigation.
So it wasn't MIT's intention to "hand it over to the feds" but it was indeed a recognized possibility that the feds would get involved when the request was made.
The summary would be improved if that were included.
No. If something similar happened in Boston and you called BPD, you'd probably get a BPD detective that does burglaries for the break in and a BPD detective that does computer crimes for the laptop - someone like my friend (who is a Boston PD detective that has an "extra" Secret Service credential by way of his assignment to the New England Electronic Crimes Task Force).
The New England Electronic Crimes Task Force is funded and run by the Secret Service. My understanding is that is primarily for jurisdictional reasons. But, it is also because way back in the day (300baud dail-up era) the majority of computer crime was related to the anti-counter fitting mandate that Secret Service has (like fake credit cards, fake vital documents, and fake currency). Computer crime was a new thing and most people didn't have PC's yet (or computer skills) so there wasn't an agency that was a great fit. The FBI didn't want it. So, in many places Secret Service got it.
Any computer crime in Mass is will almost always have Secret Service involved. New Hampshire and Maine are a little different. They have their own state level task forces/labs. So, any computer crime there will almost always have the State Police involved. The Secret Service involvement in Mass. is like the State Police involvement in those states. It's not an escalation. It's just a matter of where the resources (people with comp. forensic training and equipment) were developed and are located.
My very general impression from reading the "key findings" is that the report seems to me to invoke naiveté, an image academic institutions very carefully cultivate. But for the institution as a whole, that's pretense. MIT is a big business, a multi-billion business, and invoking naiveté on its part is wholly disingenuous. And ultimately that's the problem with this report. It's written by a professor, and you can't fault him for invoking that academic naiveté in good faith. Administrative officials assiduously avoid exposing faculty to the dirty realities of the machines that are modern academic institutions. Had the report been issued by the Office of the President itself, the conclusions would have rung hollow and rightly so.
I don't believe universities should have police departments (or really that any private organizations should have police departments, or even quasi-government organizations like transit agencies). University police essentially exist to cover up rapes on campus. In general they're underresourced and get used in a weird "quasi insider" role.
I don't think a competent IS&T would have gone directly to the Cambridge police if there were no MIT police. The "oh no, China!" thing is BS; traffic analysis would show that the china logins were (presumably) ssh portscans and not real connections. Basic network monitoring would show that this was just a badly written scraper and not anything more malicious. Odds would be that it was a MIT student scraping, and calling the cops on a MIT student for scraping a resource like that would have been bogus, too.
I love how MIT tries to pin blame on their budgetary cutbacks and staff furloughs, too.
I also think aaronsw was a moron in several ways (not rate limiting, not treating the box as a throwaway encrypted box, general behavior, and ultimately killing himself), but I'm more willing to cut a 24 year old slack than a multi-billion dollar endowment university which claims to be at the forefront of science.
Today I'm kind of sad I dropped out of MIT to do a startup, because it means I can't burn my diploma and promise to never donate to MIT. Oh well.
Moreover, while all police have, in theory, the ability to enforce the complete city code, most departments have specialized departments: vice, homicide, burglary, etc., because it's simply more efficient to have a police officer who knows their section of enforcement really well (as well as being able to develop sources specific to that beat)
Cutting out a campus police force means that the people who respond to campus infractions would be police force accustomed to dealing with city crime. This isn't such a bad thing when the crime is something like homicide, serious assault, or rape...but assuming that the majority of incidents involve noise/party infractions, curfew violations, and trespassing, I think it's doubtful that the city police would be the ideal officials to take on these calls. If anything, the city police would just end up having another department specialize in campus crime, and these cops would probably be lower tier cops...which, again, is probably not going to make campus life particularly fun.
MIT police seem to have become a lot more "police-like", especially with respect to creative forms of trespassing, during the previous administration.
I'd also argue that having campus police is not mutually exclusive of fostering the creative mischief that you mention...in fact, I'd argue that having campus police is the best way to maintain that creative mischief. Again, a police close to its constituents learns (ideally) the give and take and the pulse of the people it serves. A well-managed MIT police force could handle all the calls that are made by well-intentioned people, but come in knowing a likelihood of how much caution to take...whereas if you leave it to the Boston police force, who knows how familiar that officer is with said kind of call in that particular part of campus. An effectively managed campus police force can help keep things de-escalated.
Whether that's happening at MIT is beyond the scope of this argument, but I'm just pointing out that it's not necessarily either-or
Part of what happened at MIT was Susan Hockfield, who was by far the worst President MIT has ever had (2004-2012) -- pushing a lot of these developments (expansion of bureaucracy/deans, more "conventional" police responses to issues, ...). Vest (1990-2004) was better, and Reif (2012-now) seems pretty good, but I mostly stopped caring.
In the off-case you do need to arrest someone on campus you need sworn police, and while it's possible to detain someone for a "real" cop to come arrest them, you end up that way with situations where someone who just needs to be separated from the campus population for a bit, instead ends up in city lockup with all that implies.
Cops are allowed to use their best judgment when handling civil and criminal complaints (this is, after all, one of the things Arizona was trying to "fix" with their anti-immigration laws, was to make enforcement of those law mandatory on their cops).
Oh come on what kind of statement is that to make?
Universities pay for their own police. The goal of the university is to avoid incidents which would deter parents from sending their children to the school. Rape, particularly date rape/incidents involving alcohol are quite common on campus, if only due to demographics (young, socially connected, etc.)
There are three ways to solve it -- either actually addressing the underlying issues, or full prosecution of every incident, or sweeping it under the rug to the extent possible.
#1 is obviously ideal, but difficult. #2 would end up with both scary stats and large numbers of other students with felony convictions. #3 is the standard university police outcome.
http://www.huffingtonpost.com/bennett-l-gershman/campus-cult... is one article.
Anyone who is a victim of a serious crime in a place with "internal" police should almost certainly report directly to the territorial police instead, or at least in addition to, since they have much fewer conflicts of interest, and probably more expertise in dealing with serious crimes.
("Real" police departments are also (theoretically) much more accountable to voters and the public, too. This is particularly an issue with weird transit or internal-to-agency police like the BART Police (who are tied with East Palo Alto PD as the worst department in the region).)
Then I would expect over time with the Internet that that would not be as effective as it was in years past before the Internet.
Do we have any data on how this has changed now that anyone can broadcast anything and get attention? I would expect that if the primary reason for existence of the police force was to control the information flow as I think you suggest (which it could do quite easily pre internet) that we should see much more of this negative information has come out because it has a path.
Has that been the case? (Serious question).
I'm not saying the only thing the police do is hide rapes, it's that their essential differentiation vs. other LEOs would be to protect their employers from embarrassment which would be detrimental to the organization's mission, which rape would be. So the reason it exists as a distinct force is that, whereas they still spend a large percentage of their effort in duties totally in common with a city police force.
Perhaps it would be better to look for a solution where universities are less motivated to compete for student head count, so that their police forces are less motivated to cover up incidents that would reduce it.
https://www.google.com/search?q=downgrade+crime
I'm not saying that we don't need checks on the system, but to say that university police don't provide any valuable service is ridiculous.
One of the things which was mentioned in the report as a potential policy question to be considered is whether random visitors to the campus should be given some level of consideration as extended members of the MIT community. (If Aaron had been an MIT student or some other member of the MIT community, the situation would have probably been handled quite differently, and it might have gotten escalated to someone higher level inside MIT --- i.e., one of MIT's Deans ---- much more quickly, instead of having the Cambridge police get involved, who then brought in a Secret Service buddy of his, at which point things escalated down a very different path, one which was largely out of MIT's control.)
One important thing to remember is that when people talk about "MIT decided", it's really not MIT as the entire organization, but individuals who happen to be MIT employees making various decisions on the spot. So from the perspective of the institution, if someone makes a decision which is within their scope of their responsibility, and that decision was consistent with the policy in force at that particular point in time, and that person was acting in good faith, MIT the organization has to really protect that person, and not offer that person up as a sacrificial lamb to hordes of ravening Internet denizens screaming for revenge. It might have been the case that if someone like Hal Abelson had been brought in that fateful night, he would have made a different choice at multiple points in the timeline. But until Aaron committed suicide, it seems pretty clear that this whole affair wasn't considered something that required the attention of senior MIT administration officials, or the consideration of senior faculty members such as Prof. Abelson.
In some ways, the way some folks have been complaining about MIT is very similar to how the Republicans have been certain that decisions made by lower level staffers in the IRS must be something where direct blame must be laid at the feet of someone senior in the White House.
You have no evidence of that; you just made it up out of thin air.
Odds would be that it was a MIT student scraping
Every large network, and there's no reason to exclude MIT, gets attacked by non-students on a regular basis. They can't just assume every portscan is innocuous.
It's actually addressed in the report:
"Ultimately, MIT concluded that the communication from the IP address located in China was a — not unusual — “pinging” attempt by someone or some entity in China to determine what computer systems at MIT were available and accessible, and unrelated to the activity of this laptop."
Said like someone who has never been to Hyde Park: http://chicagomaroon.com/2012/05/25/a-brief-history-of-the-u....
The times I've wandered down there, I wouldn't have minded if U Chicago had a private army...
Can you explain this more? INLINE EDIT: I take it you are saying that IS&T would have not gone to the Cambridge Police Department at all if there were no Campus Police. I'm not sure this follows. They wanted to get this person to stop, and they surely could have just confiscated this laptop, but that may have actually been illegal since it wasn't theirs.
Edit: Need some explanation on this, too:
> I love how MIT tries to pin blame on their budgetary cutbacks and staff furloughs, too.
I assume you are referring to page 20, when MIT employees didn't respond until January 3rd to a JSTOR email sent on December 26/27th. How are they "pinning blame" on anything there? It reads as a very straightforward description of the timeline.
The overall opinion I'm left with is that the legal system is incredibly complex, and that MIT's decision to take a position of neutrality and active disinterest in the case while a defensible position made it harder for the administration and others to act. In the end MIT did not identify an outcome it wanted for the process, which is _okay_ but far from world leading, or inspiring. I agree with the sentiment of the report in the conclusion that " Looking back on the Aaron Swartz case, the world didn’t see leadership. As one person involved in the decisions put it: “MIT didn’t do anything wrong; but we didn’t do ourselves proud. "
Here's a statement from Swartz's partner: http://tarensk.tumblr.com/post/56881327662/mit-report-is-a-w...
But they're also members of the MIT community, and Abelson at least is a professor first and investigator second; that's going to affect the investigation process and conclusion.
That's why when there are big investigations in government, they often go hire an outsider as inspector general or independent counsel; there's no substitute for independence, complete access, and an investigator's skills and mindset.
Let's also remember that MIT has filed an objection to the Freedom of Information Act requests.
There's just too many coincidences to belittle it as "conspiracy theory".
How is this an "independent" report when three of the five people named as leaders of the investigative committee work for MIT?
> "Compilation of the report, “MIT and the Prosecution of Aaron Swartz,” was led by Hal Abelson, the Class of 1922 Professor of Computer Science and Engineering, at the request of MIT President L. Rafael Reif in January. In conducting his review, Abelson was joined by MIT economist and Institute Professor emeritus Peter Diamond; attorney Andrew Grosso, a former assistant U.S. attorney; and MIT assistant provost for administration Douglas Pfeiffer"
I feel relieved.
Breaking the law, is breaking the law. However noble your intent.
Librarians want to help people.
It'll be a great shame if MIT is ok with this "not proud", and stops doing more on this case.