PENTESTY · EDITORIAL ANALYSIS · · 4 min read
The Mabna case: following academic accounts into digital libraries
An academic account can reach services administered by different organizations. Assessment needs to follow that path and identify where each permission ends.
By Pentesty
What the announcements say
On October 1, 2026, Montenegrin police announced the extradition to the US of a citizen identified as A.B. In the Mabna case, the DOJ included Amir Barati in an August 2026 indictment alleging that the campaign stole more than 31 TB of data. These are allegations; extradition does not establish guilt or attribute the entire volume to one person.
Map entitlement rather than the login screen alone
Choose a resource and describe its path through the institutional directory, authentication, any intermediary and library. At each stage, identify who decides permission and demonstrates enforcement. The name on a page does not identify who administers authorization.
Confirm which affiliations qualify for access and for how long. Faculty, visitors, grant holders and partners may need different conditions. The analysis of accounts and third-party services in Denmark helps check whether an identity accepted by one service remains limited to its intended resources.
Use your own material to test the boundary
Use test accounts with different profiles and recognizable synthetic documents. Obtain authorization from every organization involved. Permission to assess your portal does not authorize active testing against the provider or collection of other people’s copyrighted work.
Compare a permitted query with an attempt that should be denied in the agreed environment. Record the resource, identity and observed outcome. Do not accept an interface message alone: where scope permits, confirm whether the test content was actually delivered and which system recorded the decision.
- Eligibility: which affiliation justifies each access profile.
- Resource: which collections and functions the profile should reach.
- Duration: when permission starts, changes and ends.
- Evidence: which team maintains the record at each stage.
Check affiliation changes and existing sessions
Choose a realistic transition, such as the end of a visit or departure from a project. Define beforehand which permissions should end and which may remain for another reason. The team should explain those distinctions before running the scenario rather than inventing a rule during the test.
Check the account and previously established access according to the architecture and authorized scope. If a decision depends on an external platform, record who requests the change, who confirms it and the deadline. A ticket closed by the university alone does not demonstrate the access state in the digital library.
Connect records without exposing research
Agree identifiers, timestamps and time zones that can reconstruct a test query across systems. The evidence should show where the identity was accepted, what authorization applied and which resource was delivered. The review of vendor-managed access provides an approach to separating direct observation, external statements and evidence gaps.
Protect collected records and limit access to what is necessary for validating the control. A review need not circulate unpublished findings, researchers’ documents or licensed content. A missing event supports a conclusion only if its source had coverage to record that action during the period examined.
Close with a decision about coverage
Prioritize a gap according to what it permits and for how long. Excess permission for one test document and a weakness reaching entire collections require different decisions. Describe the sample without extending its result to every service operated by the institution or assuming all integrations behave identically.
After remediation, repeat the authorized scenario and preserve both legitimate access and the expected denial. Identify who accepts the result and which changes require review. The objective is demonstrable entitlement, including when identity and content are administered by different organizations with separate procedures.
Frequently asked questions
Are the 31 TB proven against one individual?
The DOJ announcement presents that volume within allegations about the campaign. It should not become a finding of individual guilt or an independent measurement of damage.
Should testing use real articles and library documents?
Prefer owned or synthetic content and explicit authorization from the parties involved. Testing permissions does not require copying copyrighted works or third-party research.
Does closing an institutional account end every access path?
That depends on architecture and integrations. Define the expected behavior and check relevant accounts, sessions and permissions within the approved scenario and scope.
What should the handover demonstrate?
Tested identities and resources, permitted and denied behavior, available records, limitations and the acceptance owner. Explain what the sample supports and what remains unknown.
Sources and references
- Montenegrin police: extradition announcement, October 1, 2026
- DOJ: Mabna indictment announcement, August 18, 2026
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.