They had some unknown person massively exceeding the limits of what they intended to offer to the public. When they used blocking methods that would stop most people, he evaded them. When they continued trying to stop him, he continued evading.
Then he entered an equipment room off limits to the public, wired equipment into the network, and hid it.
He repeatedly trespassed to check his equipment and was grabbing so much data that to stop him JSTOR cut all of MIT off from JSTOR access for a couple days while they tried to figure out what to do next. So at that point he has disrupted research at MIT and possibly put them in violation of their contract with JSTOR.
MIT is a major research center, and that research includes quite a bit of research funded by and for the Department of Defense and other government agencies. Poking that kind of thing tends to get agencies like the Secret Service called in.
The fact that the case was prosecuted federally is notable, but the USSS's involvement isn't.
My opening salvo: The point at which individuals and corporations use of cryptography can be denigrated as, "Making it hard to detect terrorist activity" is the exact point at which it becomes impossible for the individual or the corporation to meaningfully engage with law enforcement. The escalation of the rhetoric surrounding e-crimes blurs and negates our ability not only to judge appropriate penalties, general severity, but also when, how, and to whom to report these crimes.
Its very hard to even tell when and if a crime has been committed.
In such a chaotic environment it is inevitable that money and connections and influence supplant the law.
So what's your suggestion? Ignore the intrusion until it goes away?
I want to know who called in the secret service/electronic crimes division here? MIT (who's only concern was trespass) or JSTOR who might be able to enforce contract terms on MIT or a EULA on Aaron at best?