3 ms·

oh god I hope their legal defense is 'we thought this was a feature not a bug'. computer law will get so much clearer if we stop blaming people for using syste

oh god I hope their legal defense is 'we thought this was a feature not a bug'. computer law will get so much clearer if we stop blaming people for using systems as they're built.

wpietri 11y ago
Unlikely. Many kinds of cheating are basically using systems as they're built. Social systems, accounting systems, computer systems. Those systems are just a (fallible) embodiment of the relationships we choose to create between one another. If somebody abuses a system to shift a relationship to one that's parasitic or harmful, they shouldn't expect the rest of society to blame the system rather than the system's abuser.
- awinter-py 11y ago
  Are you saying that the original 'relationship' of the lottery isn't parasitic or harmful? I take your point that it's useful to have a definition of cheating that goes beyond 'what the system seems to permit'. On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal.
  - wpietri 11y ago
    > Are you saying that the original 'relationship' of the lottery isn't parasitic or harmful? I agree that it is, but that doesn't matter for the moral analysis of the people who got arrested. If they had been screwing the lottery and donating the money to gambling addiction programs, I'd applaud them. But this was just thievery. > On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal. I don't think there's a fixed quantity of moral responsibility that you have to allocate between criminal and victim. If you don't install a very good lock on your door, that does not lessen the criminal's liability, moral or legal, for breaking in.
    - awinter-py 11y ago
      It does lessen liability. Breaking & entering is a crime; tresspassing is a lesser crime. 'Just wandering in' is hard to prosecute.
      - wpietri 11y ago
        Sorry if I was unclear, I was suggesting that the quality of a lock doesn't matter. I agree that the existence of a lock matters. Which I think should have been obvious from the phrase "criminal breaking in", in that as you point out, mere trespassing is a different crime from breaking in.
        awinter-py 11y ago
        Rewinding to the original question: the sys devs for the lotto system didn't install a lock.
        wpietri 11y ago
        I doubt they, the prosecutors, the judge, or a jury will agree with you on this. I certainly don't. It wasn't very good security, easily jimmied. But that was true with early vending machine security as well, and with a surprising number of home door locks. The defendants here went beyond normal operation of the machine, which is all that it will take to qualify it for "rigging a game" and the computer crimes.
        awinter-py 11y ago
        Most state lottos describe their product as a 'game' and by the common definition, games can be won if you know how to play them. Also, it's illegal in many states to operate a gambling establishment -- therefore we can assume that gambling is harmful to society. Given those definitions, these guys can defend themselves by saying (a) I was playing the game, (b) the mere fact that I turned a gamble into a sure win isn't evidence of ill intent -- as we all know, gambling is immoral, and (c) this use was not proscribed by the instructions. I wouldn't be surprised if there are rules against playing the lotto at your own store; that would be a contractual breach requiring the merchants to return their winnings. You can stretch that contractual breach to claim 'unauthorized use' for a CFAA charge, though if you lose it sets a tough precedent that hurts other CFAA prosecutions. But the mere act of using the machine in an alternative (but not prohibited) way isn't a crime.

oh god I hope their legal defense is 'we thought this was a feature not a bug'. computer law will get so much clearer if we stop blaming people for using systems as they're built.

wpietri 11y ago

Unlikely. Many kinds of cheating are basically using systems as they're built. Social systems, accounting systems, computer systems. Those systems are just a (fallible) embodiment of the relationships we choose to create between one another. If somebody abuses a system to shift a relationship to one that's parasitic or harmful, they shouldn't expect the rest of society to blame the system rather than the system's abuser.

awinter-py 11y ago
Are you saying that the original 'relationship' of the lottery isn't parasitic or harmful? I take your point that it's useful to have a definition of cheating that goes beyond 'what the system seems to permit'. On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal.
- wpietri 11y ago
  > Are you saying that the original 'relationship' of the lottery isn't parasitic or harmful? I agree that it is, but that doesn't matter for the moral analysis of the people who got arrested. If they had been screwing the lottery and donating the money to gambling addiction programs, I'd applaud them. But this was just thievery. > On the other hand, there's a point at which you release software that's so vulnerable that the liability is as much on the coder as the criminal. I don't think there's a fixed quantity of moral responsibility that you have to allocate between criminal and victim. If you don't install a very good lock on your door, that does not lessen the criminal's liability, moral or legal, for breaking in.
  - awinter-py 11y ago
    It does lessen liability. Breaking & entering is a crime; tresspassing is a lesser crime. 'Just wandering in' is hard to prosecute.
    - wpietri 11y ago
      Sorry if I was unclear, I was suggesting that the quality of a lock doesn't matter. I agree that the existence of a lock matters. Which I think should have been obvious from the phrase "criminal breaking in", in that as you point out, mere trespassing is a different crime from breaking in.
      - awinter-py 11y ago
        Rewinding to the original question: the sys devs for the lotto system didn't install a lock.
        wpietri 11y ago
        I doubt they, the prosecutors, the judge, or a jury will agree with you on this. I certainly don't. It wasn't very good security, easily jimmied. But that was true with early vending machine security as well, and with a surprising number of home door locks. The defendants here went beyond normal operation of the machine, which is all that it will take to qualify it for "rigging a game" and the computer crimes.
        awinter-py 11y ago
        Most state lottos describe their product as a 'game' and by the common definition, games can be won if you know how to play them. Also, it's illegal in many states to operate a gambling establishment -- therefore we can assume that gambling is harmful to society. Given those definitions, these guys can defend themselves by saying (a) I was playing the game, (b) the mere fact that I turned a gamble into a sure win isn't evidence of ill intent -- as we all know, gambling is immoral, and (c) this use was not proscribed by the instructions. I wouldn't be surprised if there are rules against playing the lotto at your own store; that would be a contractual breach requiring the merchants to return their winnings. You can stretch that contractual breach to claim 'unauthorized use' for a CFAA charge, though if you lose it sets a tough precedent that hurts other CFAA prosecutions. But the mere act of using the machine in an alternative (but not prohibited) way isn't a crime.