On September 25, 2010, the IP address   18.55.6.215, part of the MIT network, began   sending hundreds of PDF download requests per minute to the JSTOR website, enough to slow the site's performance.[81] This prompted a block of the IP address. In the morning, another IP address, also from within the MIT network, began sending more PDF download requests, resulting in a temporary block on the firewall level of all MIT computers in the entire 18.0.0.0/8 range. A JSTOR employee emailed MIT on September 29, 2010:

  Note that this was an extreme case. We typically suspend just one individual IP at a time and do that relatively infrequently (perhaps 6 on a busy day, from 7000+ institutional subscribers). In this case, we saw a performance hit on the live site, which I have only seen about 3 or 4 times in my 5 years here. The pattern used was to create a new session for each PDF download or every few, which was terribly efficient, but not terribly subtle. In the end, we saw over 200K sessions in one hour's time during the peak.[82]

  According to authorities, Swartz downloaded the documents through a laptop connected to a networking switch in a controlled-access wiring closet at MIT.[15][16][83][84][85] The closet's door was kept unlocked, according to press reports.[80][86][87] When it was discovered, a video camera was placed in the room to record Swartz; his computer was left untouched. The recording was stopped once Swartz was identified, but rather than pursue a civil lawsuit against him, JSTOR settled with him in June 2011; under the terms of the settlement, he surrendered the downloaded data.[88][89]