[pdonis]

to diagnose a mass download via curl

It wasn't the downloading that was hard to diagnose; they figured out pretty quickly what was being downloaded. What caused the difficulty was the tactics that were used to circumvent the normal controls on downloading and usage of the network. I do find it plausible (though very disappointing) that the MIT administration did not have in-house expertise in the low-level diagnosis necessary to deal with that. How familiar are you with MIT?