Perhaps its different for me since I work in information security, but if there's someone connected to our guest network (where we have no identity information) and their computer is misbehaving, the only recourse we have to demonstrate that they are not welcome anymore is to terminate their session and block their MAC address. There's literally no other way to get in contact with them.
I would say it's safe to assume that if your MAC address gets banned, it was for a reason. It means you're not welcome on the network anymore.
The retort would be : If you want to be able to address me, you don't have to have an open network, you can require registration and/or other physical verification first. You have chosen to run a network where you can't identify or talk to me, you should therefore know that I won't necessarily know what you're wanting. Some places have a policy that older versions of OSes aren't permitted on the network, and you'll get booted for that. Doesn't mean that you aren't welcome after you've updated your system or changed to another PC. But you haven't told me why you booted me, so I can't know for sure that I'm not welcome again.
The courts can and do, particularly when a particular crime specifies that you violate a specific placed prohibition. In Arrons case (without knowing precisely what went on), it may very well be possible to argue that he thought the banning of the mac address was e.g. a warning, an automated trip/response that the administration may not agree with in his deserving case, related to a period of overload on the system (i.e. temporary ban) etc. And the court would need to believe "beyond reasonable doubt" that none of those were the case.
The courts (usually) take a common sense approach like you suggest when your argument of "duuuhhhhhh, they didn't explicitly tell me not to do that" has very little to back it (i.e. no plausible explanation of why you thought it necessary for them to explicitly say it). But backed by a reasonable, or at least feasible, alternative, the courts often side with the defendant.
If you were able to access the network before, then you did something questionable, and now you're not able to access the network, I'd say that's a pretty good sign. At the very least, you should be able to guess why you were able to access the network again once your spoofed your MAC address. There are many layers of security on networks like these, and to be banned from an open network you have to be doing something you really know is questionable (even if you don't believe it's illegal or immoral).
The argument of "well I didn't know why you kept banning me" doesn't fly. After the first MAC filter, you should know you're no longer welcome, for whatever reason.
I like this idea, but there's a problem with it. His MAC address, which is meant to be specific to a machine, was banned. The intent is clear-- "your machine is no longer welcome on our network."
"His MAC address, which is meant to be specific to a machine"
The article (which I tend to agree with) tends to argue that a MAC address is exactly NOT that, especially in a technical sense (thus a technical user may indeed have more reason for the intent not to be "clear").
I think a better description in plain english is :
A MAC address is an address that a particular interface on a particular machine asks to be identified by in a particular session.
I.E. it's not an identity of a machine, its an identity of an interface. Its not an identity assigned by the network, its an identity offered by the machine/interface itself. Its not guaranteed to be unique, or stable beyond a session.
If it was meant to be a specific identifier for a machine, we would have many technical problems on the "legitimate" side of things, think multiple network cards and virtualised machines.
There was no agreement between Arron and MIT that arron would use a particular MAC address as an indentifier on their network. Its a downside of running an open network.
The meat of the question is how much legal weight a MAC filter should carry. To me the answer is not much. Attach the MAC filter to a simple advertisement of the network rules and it goes way up. This business about safe to assume is scary stuff.
I wouldn't say it's scary. Imagine you're in a club and you start a fight. The bouncer takes you outside. Every time you try to get back in, he's standing in your way. You can come back with a disguise and get in, but without the disguise you're banned. It's safe to assume that you got thrown out because you were fighting.
A lot of the US legal system is based on reasonable belief and reasonable assumption. If an average, reasonable person would believe X, then X is the interpretation the law is likely going to take. It doesn't matter if the rule was actually supposed to be Y, X is what is being communicated and a reasonable assumption would be that X is correct.
I don't like the bouncer analogy. The network people surely know that the MAC filter is ineffective and no bouncer would be fooled by a fake mustache.
I agree that it is clear enough that Aaron Swartz was intentionally circumventing their attempts to keep him off the network. Where I have trouble is that any notional security mechanism is apparently enough to make the circumvention a serious crime.
I suppose where I am going is that severe penalties should be for circumventing security features, and easily altered implementation details of network hardware should not qualify as security features.
Well I wasn't intending this as a debate of secure network practices. I was intending to voice my opinion that having your MAC address banned sends a very clear signal that you are no longer welcome. A signal that could be successfully argued in court. If you are banned from a network and you gain access back by changing your MAC address, no matter how trivial this exercise is you have to understand at some level that your machine address was purposefully blocked from the network.
Actually that makes me like the analogy again! If all you do is put on a mustache or change your shirt and the bouncer lets you in, then you don't really know what the purpose of the bouncing is.
> It means you're not welcome on the network anymore.
I thought it meant, that specific MAC address is not welcome anymore. Otherwise, why would you allow that person to reconnect again just because they changed their MAC address?
No it's not. What if they blocked the MAC because they detected botnet activity? There is absolutely no desire in this case to ban the person, or even to ban the entire computer if it has multiple OSs.
There is really no way to tell just from a MAC ban what the intent is.
>"Otherwise, why would you allow that person to reconnect again just because they changed their MAC address?"
Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforward to tell why your MAC address got banned. The most obvious is by looking back at your history on the network. You know if you've done something questionable. Another way is to call the helpdesk and ask why you've been banned.
At no point is "I didn't know why" going to be a valid reason for spoofing a MAC address to get around a network ban. If you have the know-how to spoof your MAC address, you have the know-how to understand why it's necessary.
If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time.
> Because in some situations, this is literally the only means you have to get someone off your network. I'm arguing that it is possible and fairly straightforward to tell why your MAC address got banned
Of course that might be the only means to remove someone from layer2 of your network. I don't disagree. I think there are reasons for spoofing MAC addresses (like having it randomized on startup) are complete legitimate and indicate nothing about intent.
> If this happened on my company's network, the next step would be tracking the person down with physical security and letting them know the police would be enforcing the ban next time.
Absolutely. I just don't think wire fraud should be tacked on to their other crimes on your network just because their MAC address changed.
I would say it's safe to assume that if your MAC address gets banned, it was for a reason. It means you're not welcome on the network anymore.