Cambridge man accused of hacking MIT computers to steal 4m scientific papers

By Milton J. Valencia, Globe Staff

A Cambridge man who was a fellow at Harvard University’s Edmond J. Safra Center for Ethics is now facing federal charges that he hacked into a Massachusetts Institute of Technology computer archive system to steal more than 4 million articles from scientific journals and academic work.

Aaron Swartz, 24, was charged with wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer. He faces up to 35 years in prison and a $1 million fine.

Swartz, accompanied by his parents, made an initial appearance in US District Court today where unsecured bail was set at $100,000 cash and he was released. Swartz knew he had been under investigation for the alleged hacking, which took place between September and this January, and turned himself into authorities today, officials said.

US Attorney Carmen Ortiz said in a statement announcing the indictments that Swartz’s actions warranted his being treated like a criminal.

“Stealing is stealing, whether you use a computer command or a crowbar, and whether you take documents, data, or dollars,” Ortiz said in a statement. “It is equally harmful to the victim whether you sell what you have stolen or give it away.”

Swartz has advocated for the elimination of barriers to the distribution of information over the Internet, and for the widest public distribution of information in libraries. He is also a co-founder of reddit.com.

Swartz is the founder of Demand Progress, a non-profit political action group, who opposes what he has described as the “corrupting influence on big institutions.’’ In a statement released after his arrest, his colleagues at Demand Progress both denounced and ridiculed the government’s actions.

“This makes no sense,” David Segal, executive director of Demand Progress said in a statement. “It’s like trying to put someone in jail for allegedly checking too many books out of the library.”

Segal also said MIT and Swartz have settled the matter between themselves before the government stepped in and moved to prosecute Swartz.

“It’s even more strange because the alleged victim has settled any claims against Aaron, explained they’ve suffered no loss or damage, and asked the government not to prosecute,” Segal added.

Prosecutors said Swartz allegedly broke into a computer wiring closet in a basement at MIT to access MIT’s network without authorization from a computer switch within that closet. The access allowed him to download materials from JSTOR, a non-profit archive of scientific journals and academic work.

Authorities allege Swartz hacked into the system to distribute JSTOR’s archives through file-sharing sites. The indictment also alleges that Swartz’s illegal downloads also impaired JSTOR’s computers and servers, depriving regular customers access to the archives.

Even after security officials blocked Swartz’s access, he hacked into the system again, according to prosecutors.

The articles and journals listed under the JSTOR system are available through a paid subscription, with some subscriptions costing as much as $50,000. A portion of the fee is in turn paid over to copyright holders.

In a statement released today, the non-profit JSTOR said it experienced a significant misuse of its database in the Swartz incident. In the unsigned statement, JSTOR said it has been subpoenaed by federal authorities so the firm would not discuss the Swartz case in detail.

However, the organization said that “a substantial portion of our publisher partners’ content was downloaded in an unauthorized fashion using the network at the Massachusetts Institute of Technology, one of our participating institutions.  The content taken was systematically downloaded using an approach designed to avoid detection by our monitoring systems,” the statement said.

JSTOR stated the downloaded content included more than 4 million articles, book reviews, and other content from our publisher partners’ academic journals and other publications; it did not include any personally identifying information about JSTOR users. 

“We stopped this downloading activity, and the individual responsible, Mr. Swartz, was identified. We secured from Mr. Swartz the content that was taken, and received confirmation that the content was not and would not be used, copied, transferred, or distributed,” the statement said. 

Swartz allies claim the prosecution was launched over the objections of JSTOR.

“That is not the case,’’ said Heide McGregor, vice president of marketing and communications for JSTOR. “We were interested always in making sure the data was secure and the data was not disseminated. So we were happy we got to that result.”

Harvard University spokesman Kevin Galvin said in a statement that Swartz was a fellow at the Edmond J. Safra Center for Ethics until the university learned about the federal investigation.

“Aaron Swartz had a ten month fellowship at a University center,’’ the statement said. “After the University was notified of the investigation, Swartz was placed on leave. His fellowship ended last month.’’

Harvard has fully cooperated with the investigation, the university said.

Separately, Steven D. Ricciardi, special agent in charges of the United States Secret Service in New England, said in a statement that the Swartz case was part of the continuing law enforcement attack on cyber crime.

“The New England Electronics Crimes Task Force has taken an aggressive stance in the investigation of computer intrusions and other cyber crimes,” Ricciardi said.

He added, “through this task force, the Secret Service and our partners on the Cambridge and MIT police departments demonstrate the importance of cooperation among law enforcement to focus resources and respond effectively to investigate and prevent this type of fraud.’’