"Our mission at JSTOR is supporting scholarly work and access to knowledge around the world. Faculty, teachers, and students at more than 7,000 institutions in 153 countries rely upon us for affordable and in some cases free access to content on JSTOR. Since our founding in 1995, we have digitized the complete back runs of nearly 1,400 academic journals from over 800 publishers. Our ultimate objective is to provide affordable access to scholarly content to anyone who needs it."

AHAHAHAHAHAHAHA, at 50K a year? When they won't even sell it to institutions they don't consider proper schools? Somebody needs to re-evaluate their mission statement...

50k is cheap as hell. UMass Boston had 125,000 JSTOR downloads last year. Let's assume we pay $50k (close enough), that's 40 cents an article. This is cheap as hell compared to other databases that charge more than that for a single search!

It's further harming the possibilities of being an independent scholar or even reading academic literature outside academia, though, which I think is a significant detriment to academia. I'm not as worried about the $50k a university library has to pay, but if you're an independent scholar for even one year, it becomes clear how harmful to the research community JSTOR is.

Journals that used to sell archive access to individuals for, say, $50 or $100 annually, now won't sell you a membership at all, because to save money on hosting they've moved their subscription infrastructure to JSTOR, and JSTOR refuses to sell individual subscriptions. So you end up "stealing" your access; at various times I've gotten my JSTOR access via ssh -D proxies to a friendly grad student. Now I try to return the favor by providing such access to independent scholars where needed. This sort of gaming shouldn't be necessary with a non-profit organization that is supposed to be working in the public interest, though. Hell, public domain journals from the 18th century that were scanned using public grant money are locked up behind a JSTOR paywall!

Many university libraries allow to you join as a "friend" of the library, which typically costs ~$100/year and gives you full access to all library resources.

Most such libraries will restrict your use in some serious way (compared to what proper campus members get.)

For example, the University of Maryland will let you check out books and no more.

I see your point, but you could just as easily walk into your local university, use their network as a guest, and access millions of dollars worth of content for free. Most databases allow you to download PDFs so you can download a bunch of articles and take them home, legally. Proxying through your grad student friends is breaking the law.

Even among state universities access to electronic journals for guests is becoming increasingly rare (usually prohibited in the license agreement). Also if you look to much into how scholarly communications works, the idea of charging 50k is insane since that vast majority of the cost of journals are actually paid for by universities in the first place.

edit: although I do agree with your point that in with the current state of things the cost per usage of JSTOR is significantly less than most other electronic journal collections

I would be impressed if it's an actual trend that guests were being blocked from accessing licensed content.

I work in this field and I can say that almost all databases and journals have IP authentication, generally with the entire campus IP range white listed. If the vendors don't implement that, they generally use password protected accounts. There are some alternatives such as uploading a list of barcodes, Referring URLs (I'm not kidding ProQuest for example allows this), Athens, Shibboleth, and a few others. These, however, are not commonly implemented by libraries because they are not widely adopted by vendors and require additional IT support that libraries simply don't have.

Therefore, unless libraries proxy all their users through their proxy servers (They don't for on-campus users. Usually, all links will go through the proxy, but if on campus the proxy will redirect you directly to the database to avoid the overhead), it would be near impossible to enforce the restriction of guests. I would wager that in many of these scenarios, it's all smoke and mirrors, and that access is really there if you know what you're doing (e.g. just visit the vendor site while on-campus without going through the library links).

I've been at at least one university (a smallish liberal-arts college) that used a separate foo_guest wifi network for guests, which dumped people into an IP range that wasn't in the database-access whitelist (enrolled students and faculty would connect to a different wifi network, using their username/password, that was whitelisted). I agree that that isn't usual practice, though, despite being technically required by some database agreements.

The configuration I've seen is to have not only guest accounts but also to have guest computers which are on a separate IP range, same with the guest wireless network. The important issue is actually what do the details of your license agreement say regarding guest users. Some state universities will actually request for this to specifically allowed since in many states it's considered, even if unofficially, a right of tax payers to have access if they need it

But many state schools let you join the library even if you're not a student. e.g. http://www.lib.iastate.edu/info/6197 - $20/year for a non-affiliated member.

ISU's extramural borrower card doesn't allow holders remote access to (paid) academic databases.

"It's further harming the possibilities of being an independent scholar or even reading academic literature outside academia,"

And giving it away for free harms the possibilities of being an independent scholar as well. Do you seriously not understand that?

They are probably bound by contracts with the actual content owners which limits who they can give access to. Not saying it's right but even the price is probably not all their doing.

This seems contrary to Demand Progress's statement:

“It’s even more strange because the alleged victim has settled any claims against Aaron, explained they’ve suffered no loss or damage, and asked the government not to prosecute,” Segal added.

I got the impression Demand Progress was referring in that sentence to MIT as the "alleged victim", which seems slightly disingenuous to me. It also seems plausible that MIT would behave in the manner described. However I have not yet seen a statement from MIT that would corroborate this, either.

And even if it were true, the "alleged victims" don't get to decide whether the government prosecutes. The only cases where the victim can force the prosecution to abandon their case are those crimes such as spousal abuse where the only hard evidence is the testimony of the victim themselves. In other cases, the government can get all of the evidence it needs through subpoena.

That sentence may have been updated to clarify: “It’s even more strange because JSTOR has settled any claims against Aaron, explained they’ve suffered no loss or damage, and asked the government not to prosecute,” Segal added.

Yeah, I haven't seen anything that backs up Demand Progress's position.

There's a horrible misuse of the word "taken", when "copied" is so much more accurate.

Will this be sufficient to ward off a hackstorm against JSTOR?

This sounds very hypocritical. If their "Mission and Work" is to support scholarly work and academic usage, and encourage usage of large sets of data, why are they suing Aaron's ass instead of working with him to further understand what were his needs that their system was lacking and how they could reduce that gap? Why else would Aaron hack their system if not for research?

Sounds like instead of spending money in improving their system and security, they found a more beneficial (to their eyes) approach: charging Aaron will instead set the example.

Edit: see @mbreese's correction.

Edit 2: looks like my comment missed some important pieces of the puzzle. See further down the thread.

Here's what's supposed to happen: A student on campus wants to do a research project analyzing a large number of journal articles, or even just the metadata around a large number of journal articles. They approach their librarian, the librarian approaches the journal vendor (JSTOR or someone else), and everyone works together to find a way to get the student their data. Maybe the vendor hands over a special dataset. Maybe they give them back-end access to their database. Maybe they allow the student to run a Python script against their website, but only in the middle of the night so as not to slow down service for other users.

Here's what sometimes happens instead: The student writes and runs a clever script, the vendor notices that their servers have slowed due to automated script activity on their webpages, shuts down access from that IP address, and lets the school know. University IT staff and librarians drop what they're doing and try to track down the party responsible. Once they've been identified, the nice librarian has to have a talk with the student about what's permitted under the university's license agreement with the publisher, and together they go to the data vendor to ask forgiveness and permission. They usually get it.

Here's what Aaron did: He walked onto the MIT campus, set up a script not to analyze metadata but to actually download large numbers of documents, and when his IP was blocked, he used traditional hacking as well as Johnny Long-style "no-tech hacking" to get around it. http://video.google.com/videoplay?docid=-2160824376898701015

Publishers, rightly or wrongly, assume that someone systematically downloading entire journal runs is intending to set up a shadow database to give away their content for free. The feds seem to agree, in this case.

The thing that gets me is that JSTOR was more than reasonable in this case. They didn't immediately shut down the whole campus (like some overly-aggressive publishers do), but started with the IP addresses involved. When it didn't stop, they had to cut off access completely. Aaron, who isn't even a student at MIT, managed to kick the whole campus off JSTOR for weeks, and as soon as they restored access, he went at it again. If I were a librarian at MIT, I'd want the book thrown at him.

It's outright sociopathic to suggest that justice for a few weeks inconvenience is 35 years in prison and a million dollar fine.

It's excessive, and I don't think that's what he'll serve. But he was warned multiple times that MIT and JSTOR didn't want him doing what he was doing, and he continued doing it, so as far as I can tell he's getting exactly what he asked for. He probably thinks he's the Rosa Parks of scholarly communication. I think he's reckless and grandiose.

They aren't suing him... this is a criminal case:

The criminal investigation and today’s indictment of Mr. Swartz has been directed by the United States Attorney’s Office

You're right, thanks. Replace suing by charging and strike make them a little richer and. The rest of the point still stands.

Swartz's organization seems to pretty clearly claim that both MIT and JSTOR asked the feds not to charge him. While JSTOR's statement doesn't actually say thatº, it certainly seems plausible to me since they very clearly say that they privately engaged and dealt with the matter with Swartz. You simply don't do that if you're pursuing criminal charges.

º I would probably be hesitant to say that publicly as well, considering the feds came down with a monster 35-year indictment against a juicy target. The "victim" announcing on Day 1 that they don't support the charges would not be accepted very charitably by federal prosecutors.

Unless JSTOR is itself at risk of prosecution for something, it doesn't make a whole lot of sense to me that they'd care how Federal prosecutors felt about their public statements.

Everybody is at risk for federal prosecution. Everybody.

http://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp/... http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx

I immediately thought of that book as well. As Silverglate frequently points out, the federal attorney is using extreme penalties to force a plea deal in this case. It's de facto denial of a fair trial when the Sword of Damocles (i.e. 35 years in prison) is hanging over your head.

Oh well we can't be upsetting the government. Carry on.

That does shed a new light to their statement. Seems like both parties made some lousy calls which led to a very ugly situation.

I don't understand the legal mechanisms that could lead to JSTOR not showing any public support for Aaron, and if those exist, but I hope they will show some support during the process (as well as the MIT). Gov shouldn't put digital theft in the same basket as physical theft.

There are no legal mechanisms, but showing support for someone that intended to destroy the value of their publisher's copyright would probably displease their partners...

Err, I should have said "someone who is accused of intending..."

I don't think it's "them" at all. They sound as if they'd be happier if the incident was already closed, as they thought it was.

Victims don't charge.

Why did Aaron hack their system instead of working with them to further understand what were his needs that their system was lacking and how they could reduce that gap?