AntiOnline Agreement Crumbles, Student Defies Ban

The Net-security Web site will be put back online despite a bungled attempt by the University of Pittsburgh to compromise with its student creators.

It sounded like a happy ending. On 5 December, the University of Pittsburgh sent out a press release announcing the "resolution" of its conflict with the student programmers who had been physically barred from all on-campus computing facilities and denied Net access in their dorm rooms, following a face-off about AntiOnline, a Web site run by the students devoted to examination of Net security issues. As first reported in Wired News on 21 November, university officials had charged that the creators of AntiOnline, John Vranesevich and Rob Dailey, were in violation of restrictions on the use of computing facilities by Pitt students.

The university's statement on 5 December said that the students' computing privileges had been restored, and all judicial charges against them had been dropped, following an agreement with the students to address concerns that the university "cannot allow the operation of a site designated as commercial (i.e. with an address labelled .com) to use University computer resources."

AntiOnline was never a commercial site, the students claim, but a free resource for those interested in protecting their computing systems from hackers and other security threats.

Now Vranesevich charges that the university has reneged on its agreement to allow him to run the site without using the .com domain at "antionline.org." Vranesevich says that the offer to host the site at antionline.org was made by provost James Maher, but claims that the Pitt official assigned to work with him - Jinx Walton - denied that such an offer had ever been made. Vranesevich also claims that he was asked to sign a "gag order" prohibiting him from discussing the issue further in the press following the signing of the agreement. (The story was picked up by the Associated Press, USA Today, and The New York Times' Web site.) He refused.

Vranesevich has vowed to put the site online at antionline.org on Thursday night, in defiance of Walton's insistence that he give the well-established Web resource a standard student Net address, like jpust7.j.resnet.pitt.edu. "That was the agreement," he says. "That's why I signed it. If the University wants to back out of their half of the agreement now, they can."

University spokesman Ken Service expressed surprise and disappointment that the case was not settled. "We'd be happy to reimburse John for the $100 he paid to InterNIC for antionline.org," Service said, claiming that university officials "had really made a genuine effort to assist him in running the site within the policies and restrictions of the university."

Vranesevich also claims that university staffers had "offered" to keep logs of all the email, FTP activity, and Web pages accessed through AntiOnline, saying that such logs would constitute "proof" that hacker activity - such as denial of service attacks - were not originating on the site. Vranesevich says there has never been a DNS attack launched from the site, though hackers have subjected AntiOnline to such attacks in the past.

Vranesevich also refused to sign a press release that included the statement, "The students expressed appreciation for the university's comments about their Web site and for the university's willingness to resolve the matter in a non-confrontational manner. They added that they now clearly understand that the university's actions were not initiated in any way because of the content of the site."

Service stressed that the University of Pittsburgh encourages "intellectual exploration by our students." Vranesevich says that he has been approached by several other academic institutions eager to host the site.