What was happening at MIT was hardly equivalent to someone leaving their Facebook page open at the library.
They had some unknown person massively exceeding the limits of what they intended to offer to the public. When they used blocking methods that would stop most people, he evaded them. When they continued trying to stop him, he continued evading.
Then he entered an equipment room off limits to the public, wired equipment into the network, and hid it.
He repeatedly trespassed to check his equipment and was grabbing so much data that to stop him JSTOR cut all of MIT off from JSTOR access for a couple days while they tried to figure out what to do next. So at that point he has disrupted research at MIT and possibly put them in violation of their contract with JSTOR.
MIT is a major research center, and that research includes quite a bit of research funded by and for the Department of Defense and other government agencies. Poking that kind of thing tends to get agencies like the Secret Service called in.
The Secret Service is routinely called in for complicated computer crime cases; they are historically the federal government's computer crimes expertise center.
The fact that the case was prosecuted federally is notable, but the USSS's involvement isn't.
My opening salvo: The point at which individuals and corporations use of cryptography can be denigrated as, "Making it hard to detect terrorist activity" is the exact point at which it becomes impossible for the individual or the corporation to meaningfully engage with law enforcement. The escalation of the rhetoric surrounding e-crimes blurs and negates our ability not only to judge appropriate penalties, general severity, but also when, how, and to whom to report these crimes.
Its very hard to even tell when and if a crime has been committed.
In such a chaotic environment it is inevitable that money and connections and influence supplant the law.
If I had the ear of middle management in America's security service I'd suggest a different approach to evangelizing at a grassroots level. Let's stop pretending startups can ignore the law and make knowledge of the law a distinguishing mark in the pedigree of a startup hacker.
