As I understand it, the problem was that he continued to connect to the network after being kicked off. It's unauthorized access.
I don't really know how to explain how I feel about it, but that's my understanding.
I don't really know how to explain how I feel about it, but that's my understanding.
Maybe they could make it illegal if they got a restraining order, but AFAIK MIT did not do that.
What you're getting at is the scope of implied license and how it can be revoked. Here is a pretty good, non-legal take on it: http://news.domain.com.au/domain/real-estate-news/how-privat...
Basically, the implied license has a scope defined by the rationale for the implication. If you invite a plumber to fix your toilet, they don't have license to use your jacuzzi (though a dinner guest might!) A license can be revoked in any manner that reasonably conveys the revocation to the licensee.
The law of property isn't directly applicable to computer networks, but is a source of guiding principles and analogy. If you're on an open network and the administrator bans your MAC address, I think a normal person would conclude that the message that you are no longer welcome has been reasonably conveyed. Moreover, MIT Net does have terms of use, and one of those terms (#4 of 6) is: "Don't misuse the intellectual property of others." You can also argue that these terms of use define the scope of the implied license to use MIT's open network.
Had they notified him with a web page that his mac address wasn't welcome it would have been a different matter altogether.
What Aaron did was the equivalent of trying a different laptop to see if things resumed working.
But Aaron kept on evading every single countermeasure MIT was putting in his place. By the time you get to going into a wiring closet, you have well passed the point where you know you are no longer welcome on the network.
The law cares very little about what tools you use, and they care a lot more about the actions you do and why you do them.
Aaron wasn't an idiot. He knew MIT was trying to keep him off. It wasn't just a network error.
As for whether banning they MAC address conveys revocation of the license. The precise form of the communication is irrelevant, it's about whether it can be expected to get the message across in context. Do you think Aaron didn't know, after the various measures MIT took, that he was no longer welcome on the network? If he did know, then the message was conveyed.
You're basically attacking a straw man. You're acting like he was charged for trying to access the publicly-available MIT home page, getting a 404, and trying again with a different laptop to see if the problem was on his end. That's what would be analogous to your "calling someone who isn't answering then trying a different phone" example.
Let's say Aaron's laptop gets its MAC address banned for doing whatever it is he did initially. Aaron then walks over to one of the available library computers and looks up directions to the train station. In your opinion, has he just committed a federal crime?
The example you give is an edge case, but I think technically the "get off my lawn" revokes your right to cut across it as other people do. I don't think this is a pretty common sense definition.
I would say it's safe to assume that if your MAC address gets banned, it was for a reason. It means you're not welcome on the network anymore.
Because Aaron is not an idiot, he knew exactly the reason he was being booted from the network: because he kept on abusing it to access JSTOR.
Courts, for good reason, have very little sympathy for the "duuuhhhhhh, they didn't explicitly tell me not to do that" defense for adults.
The argument of "well I didn't know why you kept banning me" doesn't fly. After the first MAC filter, you should know you're no longer welcome, for whatever reason.
Running open networks without explicitly communicating and agreeing terms of use with your users really does muddy the water in these cases.
The article (which I tend to agree with) tends to argue that a MAC address is exactly NOT that, especially in a technical sense (thus a technical user may indeed have more reason for the intent not to be "clear").
I think a better description in plain english is : A MAC address is an address that a particular interface on a particular machine asks to be identified by in a particular session.
I.E. it's not an identity of a machine, its an identity of an interface. Its not an identity assigned by the network, its an identity offered by the machine/interface itself. Its not guaranteed to be unique, or stable beyond a session.
If it was meant to be a specific identifier for a machine, we would have many technical problems on the "legitimate" side of things, think multiple network cards and virtualised machines.
There was no agreement between Arron and MIT that arron would use a particular MAC address as an indentifier on their network. Its a downside of running an open network.
A lot of the US legal system is based on reasonable belief and reasonable assumption. If an average, reasonable person would believe X, then X is the interpretation the law is likely going to take. It doesn't matter if the rule was actually supposed to be Y, X is what is being communicated and a reasonable assumption would be that X is correct.
I agree that it is clear enough that Aaron Swartz was intentionally circumventing their attempts to keep him off the network. Where I have trouble is that any notional security mechanism is apparently enough to make the circumvention a serious crime.
I suppose where I am going is that severe penalties should be for circumventing security features, and easily altered implementation details of network hardware should not qualify as security features.
Actually that makes me like the analogy again! If all you do is put on a mustache or change your shirt and the bouncer lets you in, then you don't really know what the purpose of the bouncing is.
I thought it meant, that specific MAC address is not welcome anymore. Otherwise, why would you allow that person to reconnect again just because they changed their MAC address?
There is really no way to tell just from a MAC ban what the intent is.
Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforward to tell why your MAC address got banned. The most obvious is by looking back at your history on the network. You know if you've done something questionable. Another way is to call the helpdesk and ask why you've been banned.
At no point is "I didn't know why" going to be a valid reason for spoofing a MAC address to get around a network ban. If you have the know-how to spoof your MAC address, you have the know-how to understand why it's necessary.
If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time.
Of course that might be the only means to remove someone from layer2 of your network. I don't disagree. I think there are reasons for spoofing MAC addresses (like having it randomized on startup) are complete legitimate and indicate nothing about intent.
> If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time.
Absolutely. I just don't think wire fraud should be tacked on to their other crimes on your network just because their MAC address changed.
He knew that MIT was trying to stop him from being on their network, and he continued to evade their countermeasures and get back on the network.
How do I know this? Because I know Aaron was not an idiot.
Imagine I have a land that is for pissing. I.e. people are free to piss on my land. You piss. I don't like the smell of your piss. So I put some boxes where you piss and so I try to block you from peeing. Are you in the wrong to pee on a different part of my land?
Wouldn't a better recourse be to require people to sign up before they pee? Or to find you when you're peeing and tell you in person that you can't any more (then if you do it again, it's trespassing)?
It was crystal clear that MIT did not want Aaron on their network doing what he was doing. (This doesn't mean, of course, he should be in jail for 7 years.)
Really, a MAC address is a unique name. Now your pissing land requires people give their name. I find my name has been banned, so I make up a new name. I think it is clear I know yo don't want me there, but I give a new name to get in.
With enough resources it's practically impossible to provide reliably unforgeable credentials without strong crypto, and strong crypto goes against the whole point of MIT's open network.
The law, for good reason, doesn't follow a "whatever you can get away with is legal" stance. For one, because then we don't have law anymore.
So the problem is that there is room to argue that the notion of unauthorized access exists on a network that doesn't do anything to identify or authenticate users.
They were intentionally not installing a security system at their "mall" while catering to a bunch of high risk consumers (i.e. high level of knowledge addiction, know track record of MIT "hackers", etc). Since they were having identification systems for other clients in place, one could even suggest, that they had given up restricting the access towards this specific crowd.
How many years in prison would I get for it?
I guess I'll need to put the "Ob: I'm not saying Aaron's crimes were worth 7 years in prison" on every comment again. Thanks.
So the problem I have is with the structure and application of the CFAA, not so much with people having the right to keep out unwanted parties.
I did not put it clearly above, but I specifically meant unauthorized access where the CFAA would apply (in my world view, for circumvention to be a felony, the network operator needs to have some expectation the security mechanism will effectively prevent access).
If all we were talking about was just getting onto their network, then I'd agree. Just walking into a store where I'm not allowed should be a misdemeanor. Charges could increase, possibly to the felony level, depending on what I do after I'm in the store.
If MIT were tracking down someone who kept on using the network to send out shitloads of spam, and that person kept on bypassing all of MIT's countermeasures, and that person dropped a physical box into a wiring closet at MIT, no one would be confused about this.
in my world view
I disagree with your world view, but for now we can leave it at us disagreeing.