From

Sent

/OITHAKA/OUFIRST
GROUIP/CNRECIPIENT
Sunday
October

S/CN
PM

ADMINISTRATIVE

10 2010 137

To Cc
Subject

ithaka.org ithaka.org ithaka.org

RE MIT

is

currently

denied

JSTOR

Access

Thanks

for this

background

few thoughts

for

all

of

us

Id

like

us to

think
in

about

ramping

up

how we

deal

with piracy-as-industrial-theft and

it

on
is

case-by-case reaching
to

basis

is

doing fyi
activity

its

job
et

monitoring and should be

modifying
as

thresholds as needed
it

out to librarians
learn that that

al

alerted
is

well But
that

some

instances

may not be not enough

the
its

has

stopped

Where

the content
will

was downloaded
In

living

Has the institution ensured

not on

someones

hard drive with us

in

that

go

back

to say China
of

our agreement with institutions

they commit to

being cooperative
If

dealing of

with matters
articles
in

abuse

and

we may want
reasonable
--

to

pursue this more aggressively

someone

is

downloading
us or

bOOs

what seems
collaboration

like

threshold for us to take action the cyber-crimes

try to division of

whats wrong with

enforcement
that

the university an etc

investigation

with us search

alerting

law

and

initiating

having
is

cop

dorm room and

and

retrieve

any

hard drive
of

contains

our content but can be

Our content
by savvy
in

extraordinarily

valuable

hard to replicate they want

university to

by the sweat

ones

brow

duplicated

hackers
pirating think

and

who knows what

from
step senior at

do

with the content

in

weve
touch

already

witnessed

an interested Id luck and

our content
this

officials

China....
like

So
to

beginning

with this instance

officials

us to

about
or

One

time

realize

but

would

be law

in

with university

with this group

others as needed think

about

initiating

some form

of

enforcement Are

investigation to

we

prepared
Its

create an
deal as

alt

method
to

for

MIT

users

to

make

use of the database

while this

is

being have
or

resolved

big

we know
Can

shut down
limited
will

whole
password

university

and

do

we know why theyd

for

only

one OP address vs
other mechanisms
Is

range
so that notice

we

offer

access

heavy

duty admin work

us

some

we dont

lose

good

here
the MIT
library
site

there
of

way

for

to go out or be

posted on the MIT

making
users

it

clear

that

we
this

are

down
will

as

result

extreme

hacking

by someone

in

community

Otherwise

wont know

and

think

were

unreliable

From
Sent Sunday
October

10

2010

1052 AM

To Cc
Subject

RE MiT

is

currently

denied JSTOR

Access

Thanks

Just

to

clarify

at

the outset

the

1st

incident

that

happened
2nd incident

weeks ago
started

9/25

9/26

was the same

It

incident

they

reported

visiting scholar

responsible

for the

yesterday

was mistaken

was not

weeks ago

it

was

weeks

The

1st

incident

was excessive
institution

but seen

as

one
and

off

and

part

of

the normal had taken

abuse
of
it

protocols

Robot

being used
of

IP

access

being denied

being responsive

asserting

they

care

We

have

any number

these on

weekly

basis but to the tune of

few hundred

PDF5

per case

This

was

to

the tune

of several

thousand

from

what

understand

recognize

that

this

is

not an ordinary case and

so

should

have

looped you

in

on

it

at

the time that

was poor judgment on

as

my

part

Ill

be

sure to do
It

going forward At the time

as

was

satisfied

with the response

was

and
to

the

activity fantastic

did

not recur

was seen

an

efficient

robot

but not special

of denial

just using

new

patter

and

with access

bandwidth

through

MIT

Definitely

not any

kind

of service

attack

Basically

when
to

you

apply limits based

on

session

as

we have

the natural

progression

is

to

adjust

the pattern

one

of

which

is

simply start

new

sessions

more frequently

and
against
it

discussed this very pattern based on the pattern

is

last

year when
of

abuse

protocols requiring

were

first

put

in

place

The only weapon

of

we

have and

some

version This
is

CAPTCHA

entry for the

kind of

1st

download

every session on
that

once
if

again

randomly every
isolated

downloads
barrier

would prevent
for

this particular

scripting

My

opinion

is

that

these are

incidents that
special efficiency

too high
of

the regular
of scripting that

user

may
have seen on any

not feel that

scale

way From my
first

perspective the
live site

MIT
with

is

case and

the
will

first

this kind

we

and

the

to

threaten

its

They

likely

be embarrassed

this

has recurred

It

is

also

not clear
are

to

me

if

they were scraping

tools

the
to

site

heavily

for

metadata
but

stable

URL5

downloading data ask monitoring

in

PDF5 order to

or

all

of

the

above
prevent provide

We

adjusting of of

the abuse
pattern

down

try and

auto-prevent use elsewhere

it

we

need end

precise
will

both
to

this kind

abuse

and

not disrupt

normal

To that
hit

and
rules

recap have

the incident

and

the numbers

surrounding

as

they never

our abuse

the

1st

or

time

no

window

into

the numbers

themselves

The second

occurrence

as
will

it

stands
us

started

at

some

point

yesterday

but

am

unclear

as to

when

that

was The

summary

give

that

As for the timeline range

to

this

point

began

communicating
chain

broadly from

about

it

shortly

before

pm

yesterday

and

the

IP

was denied around

645

pm
and

first

saw the email

around

round 830 pm and

and the
IPs

began

communicating blocked
until

to

MIT
they

pm

MIT has not responded

will

remain

do made

will

be

sure to keep

you

both

looped

in

as

progress

is

against

both resolving

this issue

and

providing

summary

report

From
Sent Sunday
October

10

2010

933 AM
Access

To
Subject

Re MIT

is

currently

denied JSTOR

Thanks

Very troubling

Also
to

this

is

the

first

lye heard

of this

needs

to

be
This

involved
is

earlier of

in

these types of matters

to

ensure
activity

we

adhere
is

contract

terms and and

pursue appropriate
call

remedies

part

the protocol the

local

we

established

The

noted

outright

theft

may merit
--

with university

counsel
left
--

and
isnt

even
leaving

police to ensure hard drive

not only that

the activity

has stopped

but that

e.g the visiting scholar

who

with

containing

our database

please
in

clarify

the history

of

this activity

What

happened

weeks

ago How

did

we respond What

has happened

the intervening

time
three weeks
as

And what
lye heard

is

the

last

time

incident

with the visiting scholar

to

Is

this

the one from

of

ago

Again

this

is

the

first

of this
is

Going

forward we need
are

make sure
that

is

aware
need

these cases be pursued

they are emerging The

component

critical

here but there

other avenues

often

to

concurrently

From
Sent
Saturday October

09

2010

1118 PM
Access

To
Subject

Fw
to

MiT

is

currently

denied JSTOR

Just

want

be

sure

is

aware

of

the situation

From
Sent
Saturday October

09

2010

1030 PM

To Cc
Subject MIT
is

currently

denied JSTOR

Access

Good

Evening

want

to

make
at

you

aware

that Half

the MIT
of

abuse

case that

showed up
this

weeks ago
afternoon

came
to

back

today

forcing that

to

deny
up

18.0.0.0/8

the firewall have

Manchester

needed
at

restarting

address servers

got

jammed

due

to

this activity

emailed

our contacts

MIT and

informed

them

of

the situation

Just

for clarity

thats and

the whole range the largest

that
it

we

have

ever denied had

left

Last

time they reported

that

visiting

scholar

was responsible

should not recur

as

the scholar

am
when
pages

in

conversation

with
block

and
of their

is
range

reporting

that

this scraping

is

very intensive
control

and

threatening

the website
getting

unblocked The
and

has brought

the incident

under

and

they are currently

deny

not threatening

the website

The

pattern

is

simple..

they start

session and

download

pdf

start

new

session

download

pdf on

and

on

can

comment

on

the specific

volume

duration

Also
in

after

the

last

incident

at

MIT we implemented

Literatums

of

sessions

per hour
is

IP

blocking
is

rule to applied

5000

sessions

60

minutes

It

did

not fire

We

are

digging

deeper but the

to adjust

earliest

speculation

that

this rule

per server
this incident

which and

we

did

not anticipate

meaning well need

the number

down

based

on

data gathered

from

elsewhere

dont

know
as

if

this

will

cause

any
to

negative sure

reaction

in

the public on

and

havent heard
page and
that

anything

through

our feedback

channels extreme

yet
to

but wanted

make

we were

all

the same

there are no

surprises

here

This

is

an

block

combat

an extreme

attack

More

as

the situation

gets

resolved

Best

JSTOR

Portico

@ithaka.org