12 ms·

Alleged hacker Lauri Love to be extradited to US

92 points by dharma1 10y ago

dharma1 10y ago
It looks like BBC has updated the title to say he is being extradited. Why did the UK not veto this, as we did with Gary McKinnon?
- hood_syntax 10y ago
  Possibly because of Brexit, the UK wants to keep its ties with the US as strong as possible by bowing to demands like this
  - arethuza 10y ago
    Charlie Stross put it nicely: "But the UK was the head of an empire in long-term decline. In 1956 the political elite in both the UK and France faced a crisis after the Suez crisis effectively slammed on the brakes on British imperial influence east of the Nile; the USA had asserted the primacy of its own interests. What to do? To paint with a very broad brush, the French response was, "we cannot rely on the perfidious Americans to back us up: we need to preserve the capability to act independently at all costs". The British response was, "we can no longer act alone without American support, so we need to preserve a good relationship with the Americans at all costs." http://www.antipope.org/charlie/blog-static/2013/04/on-the-uk-and-nuclear-disarmam.html http://www.antipope.org/charlie/blog-static/2013/04/on-the-u... Mind you - we sometimes did refuse requests from the US (e.g. to get involved in Vietnam) but I think overall this goal does apply - in general we will do whatever it takes to keep in with the US, and the lack of what we would regard as fair treatment for one individual "hacker" is probably seen as a cheap price to pay.
  - mindslight 10y ago
    This situation shows why, unfortunately, movements like Brexit are inherently legless. Here we have a case of a British citizen breaking a British law on British soil, yet being abducted by a foreign justice system under treaties that have destroyed national sovereignty. Yet because the UK is currently pushing back against one such agglomeration of power, it will actually supplicate harder to a different power rather than simply acting as its own country! (And I say this as a USian who is actually concerned with the disastrous effects that exercising world jurisdiction is having on our own society. Why bother spending the effort to secure computers when you can just assuredly throw the witches into cages for decades?)
    - foldr 10y ago
      US citizens get extradited to Britain too. It works both ways. In this instance we have someone who's pretty clearly committed a serious crime (stealing credit card info, for example), being extradited to the country which has jurisdiction with respect to the offense committed. It's a completely normal and proper instance of extradition. I'm surprised to see people here falling for the guy's rather overwrought sob story.
      - mindslight 10y ago
        It's only "normal and proper" if one believes such treaties are reasonable. Clearly I do not, and just insisting it is does not form an argument. I reject the idea that merely communicating with some place creates a legal nexus giving that place jurisdiction over you - it contradicts the general concept of freedom of speech. By such reasoning, holocaust denial is effectively criminalized in the US because such speech will reach Germany and possibly change people's minds there.
        foldr 10y ago
        Lauri Love wasn't merely communicating, he was hacking into US government computer systems and stealing credit card info. If you are just opposed to all instances of extraposition, then ok, but that has nothing to do with this specific case.
        mindslight 10y ago
        The specific crimes you list are generally accomplished completely through communication, and this seems to be true in this case. (I assume you meant to type 'extradition'). I'm not opposed to all instances of extradition. It seems perfectly reasonable that if someone commits a crime on US soil and flees, that their destination isn't a a safe haven and they be brought back to the jurisdiction they were in. But that's not what happened here - the alleged crime was committed while on British soil, and I don't think he's ever visited the US. So "extraditing" him is actually exporting him to a completely foreign jurisdiction!
- anexprogrammer 10y ago
  McKinnon's hearing was during the coalition, now the Tories have a straight majority. Wasn;t he thought to be a high suicide risk? Not quite the same as this case, but Aspergers - depending on degree - should be reason enough. I suspect McKinnon would also have been extradited under the current administration.
  - k-mcgrady 10y ago
    Isn't Love thought to be a suicide risk too? At least that's what they were arguing. Would the coalition have effected the McKinnon decision? It was May who stopped it after all and introduced the forum bar to make it easier to stop extradition in certain cases.
    - anexprogrammer 10y ago
      I believe so, and with his conditions it seems a reasonable suggestion. The judge seems to think he can go on suicide watch. We'll have to wait for appeal. McKinnon had wide support in parliament and media, and seemed to get a much higher profile than this case has. May's politics are complex - she's a liberal tory, but very right on some issues. The forum bar is probably window dressing - it looks designed to change little, and adds a prosecution certificate that can negate it (not sure how they get that certificate). Love just failed the forum bar. She also removed, in the same act, the ability of the Home Secretary to intervene on human rights grounds - passing that to the High Court. IANAL but that would see McKinnon extradited under current rules. So, coalition or May? Can never be sure, but I think the coalition will have moderated.
      - k-mcgrady 10y ago
        >> "in the same act, the ability of the Home Secretary to intervene on human rights grounds - passing that to the High Court" It seems like that's how it should be. Having politicians override the law willy nilly could be very dangerous. Worrying to think that preventing McKinnon's extradition required that though.
- throwawayReply 10y ago
  This is still pending appeal, no point in bringing in politics with a veto until (if) appeal fails?
- retallicka 10y ago
  Hopefully it will be. Back then it was blocked by Teresa May (now PM)
- dahdum 10y ago
  IIRC they switched to having judges decide instead of politicians recently.
k-mcgrady 10y ago
Seems like his mental conditions (psychosis, Asperger syndrome and depression according a psychologist who testified on his behalf) should have been enough to have the request denied. Edit: Apparently he's facing 99 years for the charges (yes I know he might get much less). I wonder if he can appeal to the European Court of Human Rights. I know in the past they've said whole-life sentences are ok but I can't see how such a sentence wouldn't be considered inhumane for computer hacking.
- tptacek 10y ago
  No. He will get "much less". If he's given a custodial sentence at all (he could plausibly be given probation, given his cognitive issues and the fact that his crime was non-remunerative), it'll almost certainly be low single-digits. These "99 year" sentences are conjured by taking every charged count of an offense, assuming the maximum possible sentence for that class of offense, and then adding all the charges together. But that's not how federal sentencing works. Like: at all. What happens in reality is that "like" charges group, and you're sentenced only according to the most severe count in the group of charges. The federal sentencing guidelines are freely available. You can read through them to get a ballpark of where this case will land. There's a reason most convicted hackers who aren't running giant credit card rings spend single digit years in prison: the sentencing guidelines won't allow for a different sentence.
  - celticninja 10y ago
    Single digits is still excessive, we are talking 5 or 6 years in jail for crimes which were void of any financial gain. I'm thinking g of weev and swartz who are both dealt with in the article. https://www.eff.org/deeplinks/2013/03/41-months-weev-understanding-how-sentencing-guidelines-work-cfaa-cases-0 https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...
    - tptacek 10y ago
      I agree†. Sentences in general are too long. I don't think there's a corrective goal that a 5 year sentence for a non-financial computer crime that isn't served just as well in 1. † With the nit that I don't believe a 5 year sentence would be in the cards for this particular offender.
Kazamai 10y ago
The US should give him a job hacking China
- brian_herman 10y ago
  Like they did with https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale
- contingencies 10y ago
  China should give him a job hacking the US.
gramstrong 10y ago
Says Lauri Love's lawyer.
spdustin 10y ago
It's stories like this that make me, as the parent of a high-functioning child with autism spectrum disorder, scared shitless. My son, as he gets older, shows over and over again that he has an amazing aptitude for pretty much anything he decides to learn. He's not even a teenager, and can: * Play the trombone better than peers two years older than he is, all because he inherited a trombone from his late grandfather, and wanted to honor his memory * Compose music in GarageBand on his iPhone or Mac, and arrange covers of songs from memory, as well as play them on the trombone or piano/keyboard * Write properly-formatted screenplays, direct and produce (with iMovie) and create VFX (with Apple Motion) for his own creations * Write automation scripts for various Mac tasks with JavaScript He has an amazing ability to understand advanced math and science concepts, and recently started positing theories about dark matter (!) during our nightly reading and chatting time. And he's proven that he'll effectively learn (and put into practice) anything he wants to, given the resources to do so. He's expressed more and more interest in computer programming, and I've indulged that interest by teaching him JavaScript (his first request) and now Swift. And one day, he's going to frighten someone with his skills, and he won't understand why; for all his genius and talent, he's still on the autism spectrum, and one common disadvantage for those on the spectrum is an inability to put themselves in someone else's shoes. He cannot understand why others don't think exactly the way he does, or understand the intentions behind his actions. It is completely alien to him that subterfuge is employed by others, that words and deeds should be taken by anything but their literal or face value. He can't begin to comprehend why his stated intentions behind his words or deeds would not be completely and unconditionally believed by everyone else. It simply does not compute. He gets services in school to help with his pragmatic communication, and I do everything I can to guide him as well. Once he's out of school, I can only hope we've made enough of a difference for him to live productively and happily in a world that vilifies people with above-average intelligence but below-average pragmatic or social communication skills.
- balabaster 10y ago
  Would there be an opportunity to take advantage of his ability to learn anything he puts his mind to in the sense of understanding everyone else's motivations for why they do and say what they do some kind of fascinating project - treat it like a game. Perhaps spinning social function around like this will help him to grasp that empathy and understanding of others motivations(?) I ask this rather than put it out there as a solution mostly because my only understanding of autistics that have come and gone in my life have all had this thread of bottomless abilities to absorb information on topics that fascinate them as well as loving things they can game. Would turning understanding emotions into a game assist his learning here?
dv_dt 10y ago
The US seems like it has a very undeveloped policy on digital defense. It seems like with this issue and the large breaches in security in the past, and the FBI pushing for even more weakening of encryption that the US government lacks a strong internal advocate to promote the development and installation defensive infrastructure for both in gov't and the US tech infrastructure.
- tptacek 10y ago
  Every country in the world has underdeveloped digital defense. There is no secure country anywhere. It has nothing whatsoever to do with encryption policy (one of the rare tech policy issues that I agree wholeheartedly with the HN conventional wisdom on). It's that software security is simply an unsolved problem, but the world is plowing full speed ahead into deploying more and more of it, and will continue to do so.
  - willtim 10y ago
    I think it is more correct to say that software security is not a priority. Another issue is why the US connect highly sensitive systems into the internet in the first place.
  - dv_dt 10y ago
    I guess I'm thinking less about the state of the technology deployment (which will always be in some sort of play), and more about the political/bureaucratic organizations within the government and their focus. It feels, from a very, very outside position, that the gov't (NSA, et al) used to put more resources on systematically figuring out how to move defensive side work forward. Maybe the orgs that used to be tasked with that were reorged or demphasized, I don't really know.
- nickpsecurity 10y ago
  The US had one... even invented INFOSEC developing it... that mandated a combo of features, assurance, and pentesting by NSA hackers. Under Computer Security Initiative, DOD combined clear standards for how to do it with financial incentives for market to produce it. The result were quite a few systems produced that survived 2-5 years of pentesting with none at least admitting a hack in the field around 20 years. Standards evolved into EAL6/7 of Common Criteria but red tape and handwaiving dominates. That's because Congress changed acquisition policy to force them to buy more COTS garbage to benefit campaign contributors plus NSA started competing with market under MISSI. High-assurance mostly collapsed. So, it can be done but politicians are preventing it. Market is bigger problem, though. Burroughs B5000 was first, high-security system nearly immune to code injection in 1961. They did good in market but IBM had better price/performance. That plus more feature improvements is all market will really buy. Something uglier, slower, a few less features, and cost double for the security? Most wont go for that. They usually dont do it even if the software is free and easy to use like a few in FOSS with strong security. So, suppliers are right to keep giving them the garbage they demand until they'll pay for something better. Note: Companies and CompSci people continue developing higher, security stuff anyway. Just very few of them with commercial stuff costing big $$$ due to low volume/demand and academic stuff delivered in prototype form since FOSS people dont put time in them. Hard to see how it will get better on a large scale.
zelon88 10y ago
What's scary to me is that the crime doesn't fit the punishment. We're going to take a genius away from civilization where he could use his potential in constructive ways, and lock him up for something that, realistically, isn't as bad as when bankers launder many millions of dollars, or when identity thieves steal. So we will probably give this guy a life sentence for being smarter than 90% of the American workforce and almost uncovering secrets that shouldn't be being kept anyway. Why can't we throw the book at corrupt politicians and businessmen this hard?
- tptacek 10y ago
  He's a genius? I thought the US was embarrassed by how dumb the vulnerabilities he exploited were. Which is it?
  - lvs 10y ago
    Lame astroturf rhetoric. The poster has a legitimate point and didn't write the BBC article.
    - tptacek 10y ago
      What's "astroturf rhetoric"?
      - throwanem 10y ago
        You being called an NSA shill again.
      - justratsinacoat 10y ago
        I assume he's referring to your intentional conflation of two different peoples' claims (namely, 'zelon88 ("[w]e're going to take a genius away from civilization" [0]) and the writer of the article ("Earlier, his lawyer said his alleged hacking had "embarrassed" US authorities")): >He's a genius? I thought the US was embarrassed by how dumb the vulnerabilities he exploited were. Which is it? [0] Probably assumed you were an astroturfer and/or troll, because, hey, that's pretty shitty behaviour. [0] https://news.ycombinator.com/item?id=12515199 https://news.ycombinator.com/item?id=12515199 [1] https://news.ycombinator.com/item?id=12515231 https://news.ycombinator.com/item?id=12515231
kalsk 10y ago
Is Asperger's really a valid excuse for this sort of thing? People on the autism spectrum aren't incapable of understanding that actions can lead to consequences and that some things are wrong. Otherwise there would be an epidemic of autistic bank-robbers and murderers. I will agree that it is bullshit thaw you can get extradited to a country you've never even been to and tried under their laws for committing a cyber-crime, though. He should remain in Britain for that reason alone. It's also pretty disgusting how if he had committed the exact same crime under the employment of the government they wouldn't have even filed charges.
jpgvm 10y ago
Sometimes I wonder how US prosecutors live with themselves.
- ashark 10y ago
  For the ones with the best intentions they probably think that, on average if not in every particular case, they're pulling the switch to make the trolley hit one person instead of five (so to speak), and that not doing so would make the world a worse place. For the ones with the worst intentions, it's likely something to do with chasing material and/or social rewards. (edit) And they don't much care about how much it hurts others.

92 points by dharma1 10y ago

It looks like BBC has updated the title to say he is being extradited. Why did the UK not veto this, as we did with Gary McKinnon?

hood_syntax 10y ago
Possibly because of Brexit, the UK wants to keep its ties with the US as strong as possible by bowing to demands like this
- arethuza 10y ago
  Charlie Stross put it nicely: "But the UK was the head of an empire in long-term decline. In 1956 the political elite in both the UK and France faced a crisis after the Suez crisis effectively slammed on the brakes on British imperial influence east of the Nile; the USA had asserted the primacy of its own interests. What to do? To paint with a very broad brush, the French response was, "we cannot rely on the perfidious Americans to back us up: we need to preserve the capability to act independently at all costs". The British response was, "we can no longer act alone without American support, so we need to preserve a good relationship with the Americans at all costs." http://www.antipope.org/charlie/blog-static/2013/04/on-the-uk-and-nuclear-disarmam.html http://www.antipope.org/charlie/blog-static/2013/04/on-the-u... Mind you - we sometimes did refuse requests from the US (e.g. to get involved in Vietnam) but I think overall this goal does apply - in general we will do whatever it takes to keep in with the US, and the lack of what we would regard as fair treatment for one individual "hacker" is probably seen as a cheap price to pay.
- mindslight 10y ago
  This situation shows why, unfortunately, movements like Brexit are inherently legless. Here we have a case of a British citizen breaking a British law on British soil, yet being abducted by a foreign justice system under treaties that have destroyed national sovereignty. Yet because the UK is currently pushing back against one such agglomeration of power, it will actually supplicate harder to a different power rather than simply acting as its own country! (And I say this as a USian who is actually concerned with the disastrous effects that exercising world jurisdiction is having on our own society. Why bother spending the effort to secure computers when you can just assuredly throw the witches into cages for decades?)
  - foldr 10y ago
    US citizens get extradited to Britain too. It works both ways. In this instance we have someone who's pretty clearly committed a serious crime (stealing credit card info, for example), being extradited to the country which has jurisdiction with respect to the offense committed. It's a completely normal and proper instance of extradition. I'm surprised to see people here falling for the guy's rather overwrought sob story.
    - mindslight 10y ago
      It's only "normal and proper" if one believes such treaties are reasonable. Clearly I do not, and just insisting it is does not form an argument. I reject the idea that merely communicating with some place creates a legal nexus giving that place jurisdiction over you - it contradicts the general concept of freedom of speech. By such reasoning, holocaust denial is effectively criminalized in the US because such speech will reach Germany and possibly change people's minds there.
      - foldr 10y ago
        Lauri Love wasn't merely communicating, he was hacking into US government computer systems and stealing credit card info. If you are just opposed to all instances of extraposition, then ok, but that has nothing to do with this specific case.
        mindslight 10y ago
        The specific crimes you list are generally accomplished completely through communication, and this seems to be true in this case. (I assume you meant to type 'extradition'). I'm not opposed to all instances of extradition. It seems perfectly reasonable that if someone commits a crime on US soil and flees, that their destination isn't a a safe haven and they be brought back to the jurisdiction they were in. But that's not what happened here - the alleged crime was committed while on British soil, and I don't think he's ever visited the US. So "extraditing" him is actually exporting him to a completely foreign jurisdiction!
anexprogrammer 10y ago
McKinnon's hearing was during the coalition, now the Tories have a straight majority. Wasn;t he thought to be a high suicide risk? Not quite the same as this case, but Aspergers - depending on degree - should be reason enough. I suspect McKinnon would also have been extradited under the current administration.
- k-mcgrady 10y ago
  Isn't Love thought to be a suicide risk too? At least that's what they were arguing. Would the coalition have effected the McKinnon decision? It was May who stopped it after all and introduced the forum bar to make it easier to stop extradition in certain cases.
  - anexprogrammer 10y ago
    I believe so, and with his conditions it seems a reasonable suggestion. The judge seems to think he can go on suicide watch. We'll have to wait for appeal. McKinnon had wide support in parliament and media, and seemed to get a much higher profile than this case has. May's politics are complex - she's a liberal tory, but very right on some issues. The forum bar is probably window dressing - it looks designed to change little, and adds a prosecution certificate that can negate it (not sure how they get that certificate). Love just failed the forum bar. She also removed, in the same act, the ability of the Home Secretary to intervene on human rights grounds - passing that to the High Court. IANAL but that would see McKinnon extradited under current rules. So, coalition or May? Can never be sure, but I think the coalition will have moderated.
    - k-mcgrady 10y ago
      >> "in the same act, the ability of the Home Secretary to intervene on human rights grounds - passing that to the High Court" It seems like that's how it should be. Having politicians override the law willy nilly could be very dangerous. Worrying to think that preventing McKinnon's extradition required that though.
throwawayReply 10y ago
This is still pending appeal, no point in bringing in politics with a veto until (if) appeal fails?
retallicka 10y ago
Hopefully it will be. Back then it was blocked by Teresa May (now PM)
dahdum 10y ago
IIRC they switched to having judges decide instead of politicians recently.

k-mcgrady 10y ago

Seems like his mental conditions (psychosis, Asperger syndrome and depression according a psychologist who testified on his behalf) should have been enough to have the request denied. Edit: Apparently he's facing 99 years for the charges (yes I know he might get much less). I wonder if he can appeal to the European Court of Human Rights. I know in the past they've said whole-life sentences are ok but I can't see how such a sentence wouldn't be considered inhumane for computer hacking.

tptacek 10y ago
No. He will get "much less". If he's given a custodial sentence at all (he could plausibly be given probation, given his cognitive issues and the fact that his crime was non-remunerative), it'll almost certainly be low single-digits. These "99 year" sentences are conjured by taking every charged count of an offense, assuming the maximum possible sentence for that class of offense, and then adding all the charges together. But that's not how federal sentencing works. Like: at all. What happens in reality is that "like" charges group, and you're sentenced only according to the most severe count in the group of charges. The federal sentencing guidelines are freely available. You can read through them to get a ballpark of where this case will land. There's a reason most convicted hackers who aren't running giant credit card rings spend single digit years in prison: the sentencing guidelines won't allow for a different sentence.
- celticninja 10y ago
  Single digits is still excessive, we are talking 5 or 6 years in jail for crimes which were void of any financial gain. I'm thinking g of weev and swartz who are both dealt with in the article. https://www.eff.org/deeplinks/2013/03/41-months-weev-understanding-how-sentencing-guidelines-work-cfaa-cases-0 https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...
  - tptacek 10y ago
    I agree†. Sentences in general are too long. I don't think there's a corrective goal that a 5 year sentence for a non-financial computer crime that isn't served just as well in 1. † With the nit that I don't believe a 5 year sentence would be in the cards for this particular offender.

Kazamai 10y ago

The US should give him a job hacking China

brian_herman 10y ago
Like they did with https://en.wikipedia.org/wiki/Frank_Abagnale https://en.wikipedia.org/wiki/Frank_Abagnale
contingencies 10y ago
China should give him a job hacking the US.

gramstrong 10y ago

Says Lauri Love's lawyer.

spdustin 10y ago

It's stories like this that make me, as the parent of a high-functioning child with autism spectrum disorder, scared shitless. My son, as he gets older, shows over and over again that he has an amazing aptitude for pretty much anything he decides to learn. He's not even a teenager, and can: * Play the trombone better than peers two years older than he is, all because he inherited a trombone from his late grandfather, and wanted to honor his memory * Compose music in GarageBand on his iPhone or Mac, and arrange covers of songs from memory, as well as play them on the trombone or piano/keyboard * Write properly-formatted screenplays, direct and produce (with iMovie) and create VFX (with Apple Motion) for his own creations * Write automation scripts for various Mac tasks with JavaScript He has an amazing ability to understand advanced math and science concepts, and recently started positing theories about dark matter (!) during our nightly reading and chatting time. And he's proven that he'll effectively learn (and put into practice) anything he wants to, given the resources to do so. He's expressed more and more interest in computer programming, and I've indulged that interest by teaching him JavaScript (his first request) and now Swift. And one day, he's going to frighten someone with his skills, and he won't understand why; for all his genius and talent, he's still on the autism spectrum, and one common disadvantage for those on the spectrum is an inability to put themselves in someone else's shoes. He cannot understand why others don't think exactly the way he does, or understand the intentions behind his actions. It is completely alien to him that subterfuge is employed by others, that words and deeds should be taken by anything but their literal or face value. He can't begin to comprehend why his stated intentions behind his words or deeds would not be completely and unconditionally believed by everyone else. It simply does not compute. He gets services in school to help with his pragmatic communication, and I do everything I can to guide him as well. Once he's out of school, I can only hope we've made enough of a difference for him to live productively and happily in a world that vilifies people with above-average intelligence but below-average pragmatic or social communication skills.

balabaster 10y ago
Would there be an opportunity to take advantage of his ability to learn anything he puts his mind to in the sense of understanding everyone else's motivations for why they do and say what they do some kind of fascinating project - treat it like a game. Perhaps spinning social function around like this will help him to grasp that empathy and understanding of others motivations(?) I ask this rather than put it out there as a solution mostly because my only understanding of autistics that have come and gone in my life have all had this thread of bottomless abilities to absorb information on topics that fascinate them as well as loving things they can game. Would turning understanding emotions into a game assist his learning here?

dv_dt 10y ago

The US seems like it has a very undeveloped policy on digital defense. It seems like with this issue and the large breaches in security in the past, and the FBI pushing for even more weakening of encryption that the US government lacks a strong internal advocate to promote the development and installation defensive infrastructure for both in gov't and the US tech infrastructure.

tptacek 10y ago
Every country in the world has underdeveloped digital defense. There is no secure country anywhere. It has nothing whatsoever to do with encryption policy (one of the rare tech policy issues that I agree wholeheartedly with the HN conventional wisdom on). It's that software security is simply an unsolved problem, but the world is plowing full speed ahead into deploying more and more of it, and will continue to do so.
- willtim 10y ago
  I think it is more correct to say that software security is not a priority. Another issue is why the US connect highly sensitive systems into the internet in the first place.
- dv_dt 10y ago
  I guess I'm thinking less about the state of the technology deployment (which will always be in some sort of play), and more about the political/bureaucratic organizations within the government and their focus. It feels, from a very, very outside position, that the gov't (NSA, et al) used to put more resources on systematically figuring out how to move defensive side work forward. Maybe the orgs that used to be tasked with that were reorged or demphasized, I don't really know.
nickpsecurity 10y ago
The US had one... even invented INFOSEC developing it... that mandated a combo of features, assurance, and pentesting by NSA hackers. Under Computer Security Initiative, DOD combined clear standards for how to do it with financial incentives for market to produce it. The result were quite a few systems produced that survived 2-5 years of pentesting with none at least admitting a hack in the field around 20 years. Standards evolved into EAL6/7 of Common Criteria but red tape and handwaiving dominates. That's because Congress changed acquisition policy to force them to buy more COTS garbage to benefit campaign contributors plus NSA started competing with market under MISSI. High-assurance mostly collapsed. So, it can be done but politicians are preventing it. Market is bigger problem, though. Burroughs B5000 was first, high-security system nearly immune to code injection in 1961. They did good in market but IBM had better price/performance. That plus more feature improvements is all market will really buy. Something uglier, slower, a few less features, and cost double for the security? Most wont go for that. They usually dont do it even if the software is free and easy to use like a few in FOSS with strong security. So, suppliers are right to keep giving them the garbage they demand until they'll pay for something better. Note: Companies and CompSci people continue developing higher, security stuff anyway. Just very few of them with commercial stuff costing big $$$ due to low volume/demand and academic stuff delivered in prototype form since FOSS people dont put time in them. Hard to see how it will get better on a large scale.

zelon88 10y ago

What's scary to me is that the crime doesn't fit the punishment. We're going to take a genius away from civilization where he could use his potential in constructive ways, and lock him up for something that, realistically, isn't as bad as when bankers launder many millions of dollars, or when identity thieves steal. So we will probably give this guy a life sentence for being smarter than 90% of the American workforce and almost uncovering secrets that shouldn't be being kept anyway. Why can't we throw the book at corrupt politicians and businessmen this hard?

tptacek 10y ago
He's a genius? I thought the US was embarrassed by how dumb the vulnerabilities he exploited were. Which is it?
- lvs 10y ago
  Lame astroturf rhetoric. The poster has a legitimate point and didn't write the BBC article.
  - tptacek 10y ago
    What's "astroturf rhetoric"?
    - throwanem 10y ago
      You being called an NSA shill again.
    - justratsinacoat 10y ago
      I assume he's referring to your intentional conflation of two different peoples' claims (namely, 'zelon88 ("[w]e're going to take a genius away from civilization" [0]) and the writer of the article ("Earlier, his lawyer said his alleged hacking had "embarrassed" US authorities")): >He's a genius? I thought the US was embarrassed by how dumb the vulnerabilities he exploited were. Which is it? [0] Probably assumed you were an astroturfer and/or troll, because, hey, that's pretty shitty behaviour. [0] https://news.ycombinator.com/item?id=12515199 https://news.ycombinator.com/item?id=12515199 [1] https://news.ycombinator.com/item?id=12515231 https://news.ycombinator.com/item?id=12515231

kalsk 10y ago

Is Asperger's really a valid excuse for this sort of thing? People on the autism spectrum aren't incapable of understanding that actions can lead to consequences and that some things are wrong. Otherwise there would be an epidemic of autistic bank-robbers and murderers. I will agree that it is bullshit thaw you can get extradited to a country you've never even been to and tried under their laws for committing a cyber-crime, though. He should remain in Britain for that reason alone. It's also pretty disgusting how if he had committed the exact same crime under the employment of the government they wouldn't have even filed charges.

jpgvm 10y ago

Sometimes I wonder how US prosecutors live with themselves.

ashark 10y ago
For the ones with the best intentions they probably think that, on average if not in every particular case, they're pulling the switch to make the trolley hit one person instead of five (so to speak), and that not doing so would make the world a worse place. For the ones with the worst intentions, it's likely something to do with chasing material and/or social rewards. (edit) And they don't much care about how much it hurts others.