If you leave the door to your house unlocked, am I welcome to come in, pop on into your utility closet, plug into a switch port and take everything your machines allow me to fetch?

I don't disagree with what he was doing from a moral standpoint or a hacker standpoint, but it's very easy to convict him.

This discussion typically devolves into an argument about what is "publicly accessible." No reasonable person (i.e. those who serve on juries - not autistic software engineers) would agree that someone who isn't even a student at a school is legally entitled to enter a building (unlocked or not), venture into their utility room and access protected computer resources.

Everyone loves to make this about JSTOR: they weren't the only victim. MIT was far more aggrieved; JSTOR blocking his Harvard account access and him proceeding to breach their TOS ("clickwrap agreements aren't law!!!") and circumvent their defenses isn't required to convict him of CFAA violations.

Why can't I go into a bank, sit down at a personal banker's desk who is away on vacation, plug into a switch port and do whatever I want? There's no lock on his cubicle, the door was open! This is the legal equivalent of "neener neener, I'm not touching you."

Mens rea is an important thing people love to sweep under the rug with this case:

• First and foremost: Why did he have to go to into a closet at MIT to fetch documents? Why not do it at home or a public library?

  • Because of rate limits and/or authentication requirements. He *knew* he could not obtain the access he needed through other means, so he had to trespass to do it.

• Why did he cover his face with his bicycle helmet... just when passing by cameras?

  • He wasn't some weirdo who liked to wear his helmet that way: he stopped immediately when he believed he didn't need to conceal his identity any further. He *knew* he shouldn't be there.

• He registered his guest account using false credentials: "Gary Host" and "Grace Host" - "Ghost"

  • Why wouldn't he just use his real name if he believed what he was doing was legitimate?

• When MIT blocked his IP, he released/renewed and fetched a new one. Fine, no problem on its own, hard to prove intent there. When MIT subsequently blocked his MAC address, he proceeded to change one character and kept on downloading.

  • Computer people will try to reduce this to "MAC addresses aren't legal identifiers blah blah blah." The beliefs of zealous third parties are completely irrelevant: direct measures were taken to prevent his access, he recognized and immediately circumvented them. He *knew* what he was doing. That's what matters.

• Why hide his hardware under boxes? In absence of all of the other facts, sure, one could argue that he didn't want students at this ultra-prestigious Ivy League school to steal his shit, but to a reasonable person weighing the totality of the circumstances: he was again concealing his actions because he knew they were wrong.