Tuesday, July 19, 2011

Aaron Swartz v. JSTOR

So the big noise on G+ today (at least in my circles) is all about Aaron Swartz' arrest for hacking into MIT's network and downloading over 4 million journal articles from JSTOR. Demand Progress, the nonprofit that Aaron is connected to, in a masterful bit of spin, is alleging that he has been "bizarrely" charged with "downloading too many journal articles". This would be true insofar as "too many" in the circumstances in which he did it would have been zero, if you are to believe the indictment. The problem isn't so much that he downloaded "too many" articles, but instead that (as alleged in the indictment) he used several different false IDs in his attempts to do so, did so as such a rate that it created problems for JSTOR's service, took several affirmative steps to evade MIT's and JSTOR's attempts to stop him (at which point he knew, or should have known, he had exceeded his access), and eventually resorted to sneaking into restricted areas at MIT in order to facilitate the process further before finally being caught in the act by MIT police.

Of course, many of the people on Google+ are insisting that this is about copyright (it's not) and that Aaron's actions strike a great blow for the freedom of information (they don't) and that this might even take down JSTOR (it won't).  It is fairly clear that Aaron's actions are for one of two purposes: either he was collecting data for the same sort of mass analysis of journal articles that he did back in 2008 (which purportedly involved some 400,000 journal articles), or else he was planning to release the downloaded articles onto the Internet through a file sharing service (as is alleged in the indictment). Both of these would be fairly noble causes; I find it rather unlikely that Aaron's intent here was venal. 

However, if his intent was noble, that doesn't explain the spin from Demand Progress. If this is civil disobedience, then they should be doing what other protest organizations have done in similar situations: admit what they did, say why they did it, and demand a public outcry against whatever was so wrong that it justified breaking the law, while at the same time standing prepared to accept the consequences of having broken the law. However, DP's PR statement doesn't do that. It instead calls the prosecution "bizarre" and clearly intends to whitewash Aaron's use of falsified identity information, increasingly determined attempts to evade MIT's and JSTOR's security, and eventually repeated criminal trespasses to MIT's grounds, in order to accomplish his goals. That, to me, is not mindset of civil disobedience, but instead the mindset of the criminal attempting to avoid responsibility for his crime.

So, to Aaron: dude, boner move. There are better ways to do this sort thing that don't involve skulking around in MIT's basement peering through the ventholes of your bike helmet. To Aaron's supporters: please don't make this about copyright. It's about Aaron not thinking clearly about his goals and means. I'd have a comment for JSTOR, too, but I really don't know what to say. Someone has to collate, digitize, and store these documents, and to expect them to do it for free seems silly. Someone has to pay for it. (But see also JSTOR's comment on the indictment.)

Information may want to be free, but data centers are not free. Theft of computing services is not a "victimless crime", and fundamentally that's what Aaron did here. If his access really was for "research", then I'd like to know if he attempted to negotiate with JSTOR for the access that he needed, or if he merely assumed that they wouldn't let him have it. I'd be a lot more sympathetic if he made an effort and was rebuffed.

In any case, I imagine Aaron will end up like poor ol' Mitnick: barred from using computers for some time, barred from the MIT campus forever, and slapped with a huge fine and a felony conviction or two. And he's not even 25 yet.

Also, if anybody finds the security camera images of him sneaking around using his bike helmet to hide his face, please let me know.