5

I might be a bit late on this but I just got to know the story of Aaron Swartz, a phenomenal guy to say the least. The internet is filled with news posts, blogs, and even documentaries stating that "he hacked JSTOR" and downloaded gigabytes of academic journal content from the service. Can someone explain to me how what he did constitutes hacking? What I understood is that he mass downloaded academic journals to which he had authorized access to through his university account.

The only thing I saw that was off the books is that he kept changing his IP address when it was blocked. If this is hacking (the masking of one's IP address) then doesn't that make using any VPN hacking? Constantly changing an IP address is something a pesky bot would do and doesn't seem to me a crime warranting 35 years of jail time even under the CFAA.

I am fully aware of the controversy surrounding his case but that's not what this post is about. I just want to know if what he did constitutes hacking whether under the American CFAA or the definition of the term in computer science or both.

Improve this question
3
  • 2
    There is no such thing as "hacking" in the CFAA. There is merely exceeding unauthorized access. Also, the CFAA is notoriously vague.
    – cpast
    Aug 10, 2015 at 3:19
  • 2
    Unfortunately, the controversy is relevant here. The question you asked is how, or if what he did constitutes hacking under the CFAA, but the controversy in large part is whether or not he did commit a crime under CFAA at all and whether the prosecution stretched the CFAA to meet the circumstances rather than the circumstances meeting the CFAA requirements for defining a crime under that act.
    – HexTitan
    Aug 10, 2015 at 5:00
  • 2
    Also, the 35 years figure was utter BS. It was arrived at by taking the statutory maximum for each individual count and adding them up, which has very little to do with the actual sentence for the actual conduct (in fact, it has nothing to do with the details of the conduct, just the statutes the defendant is charged with). See this blog post or this one by a defense attorney and former federal prosecutor.
    – cpast
    Aug 11, 2015 at 17:31

1 Answer 1

Reset to default
6

On the face of the CFAA:

How does Aaron Swartz's mass download from JSTOR constitute hacking?

He exceeded his authorised access on a protected computer.

If this is hacking (the masking of one's IP address) then doesn't that make using VPN hacking?

Hacking is not a term used in CFAA.

In Aaron's case changing the IP address was a necessity for him to exceed his authorised access; if he stopped when blocked then the unauthorised access would have stopped.

If you are authorised to use a VPN for access then you have not exceeded your authorisation, have you?

Improve this answer
1
  • This is the nutshell. Treatises have been written about the nuances.
    – jqning
    Aug 11, 2015 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .