7 ms·

Outside of the clear concerns about if this person is falsely accused of creating malware for the purposes of victimizing people one concern I still have not se

by syshum 9y ago

Outside of the clear concerns about if this person is falsely accused of creating malware for the purposes of victimizing people one concern I still have not seen addressed widely is the issue of US enforcing laws on an international level Even if all of the charges are true, these "crimes" would have taken place in the UK or where ever this person is living outside the US, so how then can the US justify charging them with violation of US law. I know this is not the first time this has happened, nor will it be the last time this happens, but it is increasingly concerning that crimes completely committed online are open to US Jurisdiction and sets a TERRIBLE precedent. As a US Citizen I do not want to be held to another nations laws, laws I may not be familiar with, because of my online activities. It is only a matter of time before a EU nation attempts to extradite or arrest a US Citizen traveling abroad for a hate speech law violation or some other violation that occurred online from the US which is not a violation of US law but is a violation of EU Law.

mijoharas 9y ago
> It is only a matter of time before a EU nation attempts to extradite or arrest a US Citizen traveling abroad for a hate speech law violation or some other violation that occurred online from the US which is not a violation of US law but is a violation of EU Law. Fingers crossed that it's Trump. ;)
- bitcharmer 9y ago
  Wasn't it Obama's administration pushing this draconian policy across the globe in the first place?
  - king_phil 9y ago
    Source?
  - TeMPOraL 9y ago
    I think the GP is joking that that first person detained by the EU will hopefully be Trump himself.
kelnage 9y ago
This is exactly why the "the Internet is a different place" arguments (such as [1]) make me sad. Because, without a formal worldwide treaty (seems unlikely), it will never be the case. Whilst you might perceive your actions on the Internet to be either only policeable on the Internet or in the worst case in the location you perform them from, the law (in multiple countries, over and over again) sees your actions as occurring in any place they affect. You may have initiated the activity in country A - but if that action is then caused to happen/repeated/perhaps even observed in country B, you probably shouldn't be surprised that if it breaks country B's laws then they might want to speak to you about it. Guess what - if you (as an example) encourage Chinese dissent online and it gets past the Chinese firewall - you stand a good chance of being picked up by the Chinese authorities should you go there. The only way the Internet is a different place is if you never leave the Internet/your home jurisdiction. The good news for US citizens is an extradition along the lines you mention seems unlikely (unless you also broke US law). In the UK (for example), the situation is far more bleak as their extradition treaties with the US and others are less protective. P.S. this is in no way commentary on MalwareTech's guilt - that is for a judge and/or jury to decide - just discussing a common perception 1. https://en.wikipedia.org/wiki/A_Declaration_of_the_Independence_of_Cyberspace https://en.wikipedia.org/wiki/A_Declaration_of_the_Independe...
chx 9y ago
As a Canadian citizen, open source developer, free minded tinkerer (I don't dare to say hacker in this context) I am fucking scared to enter the USA. The law in question was written largely as an answer to the Wargames movie, it was not a good law then and 30 years later it's downright terrifying. If they think I broke some USA law they better issue a warrant and ask Canada to extradite me. That's a thing. But this sort of ... ambush ... or what do I call it, that's just scary. Let's say I scrape a website whose ToS said, don't scrape me. Is that a felony? Perhaps. Want to crank it to eleven? Let's say I left accidentally a security hole in Drupal (I have 1299 commit mentions in Drupal) which powers, well, certainly more than ten websites in the United States. Is that a felony? Can it be twisted into a felony? Is it likely? No? Possible? Fuck knows. You could say, hey the CFAA is older than my boots, nothing has changed, why are you scared only now? My answer is, you know, the leader of the executive branch is an old man without political experience who certainly shows signs of dementia and while I can't professionally evaluate how it changes the situation I have a bad feeling it makes it worse than it was.
- sago 9y ago
  > Possible? Yes. The legal code is so byzantine that most citizens (and most visitors) are permanently in breach somehow, somewhere: an error in some form you filed, a permit you didn't know you needed, a clause that's very rarely enforced, a law worded vaguely that can be made to fit. This is the origin of the cliche "to throw the book at someone" - to threaten or exact retribution, by hunting for all the ways they are breaking the law, related to the original arrest or not. It is also why the advice is not to speak to police voluntarily. Fortunately for most folks the US is a mostly benign state (which is why exceptions are somewhat notable). But this is not a unique US issue. It is only a change of intent away from the widespread persecution of political opponents. As long as most of us believe a 'political enemy' is our enemy too (like those evil hackers), the state is free to throw the book where it pleases with public indifference or even support.
  - justinjlynn 9y ago
    > It is also why the advice is not to speak to police voluntarily. At all, except through legal counsel or, at the least, with legal counsel present; competent legal counsel at that.
ubernostrum 9y ago
I still have not seen addressed widely is the issue of US enforcing laws on an international level It's simple: if you do something which causes something illegal-in-the-US to happen on computers-located-in-the-US, you can be prosecuted by the US for it. There is nothing new, radical, revolutionary, terrifying, unprecedented, etc. about this idea. There wasn't anything new about it recently when some bitcoin people were busted because they laundered their proceeds through US institutions. There isn't anything new about it when someone in another country hacks a US company's systems. "The internet" is not a magical extra-territorial location which wipes away all concept of countries having jurisdiction. As long as a computer in one country can cause things to happen to/on a computer in another country, there's an opportunity for either country, or both, or others in between them on the network, to have jurisdiction over things that go wrong. And your "only a matter of time" slippery slope has already happened: several EU nations have taken legal action against US-based online retail/auction sites to require compliance with laws against selling Nazi symbols or memorabilia. And I hope you'd understand that no matter how much you might argue "but I wasn't even in Germany", Germany will come after you if you offer to sell and ship items to Germany which are illegal to sell/ship there.
- chx 9y ago
  The problem here, as I wrote above, is arresting a UK citizen in the USA. If they would've issued a warrant and the UK police decides to arrest him and then extradite him, that's fine. But this sort of thing... this could potentially halt international travel. I am not kidding: how do you dare to travel anywhere if you can be arrested for something you did years ago which very well might have been legal in the country you resided in but not in the country you travel to?
  - kelnage 9y ago
    What Malwaretech has been charged with here would likely be illegal under UK law as well as US law (section 37 of the Computer Misuse Act [1] appears to be analogous to the charges being brought against him). And regardless, the UK-US extradition treaty is written in such a way that the US charges do not have to be illegal under UK law for an extradition to take place (although the converse is not true). Now, it may well have been the case that when the inevitable court case to challenge the extradition in the UK took place, it might have gone all Gary McKinnon on them [2], due to public support after WannaCry etc. which I'd suggest is probably why the FBI chose to arrest him in the US rather than put in a formal extradition request or work directly with the UK authorities (AFAIK). But yes, I do agree that with the advent of a worldwide communications network, travel to countries with oppressive, obscure, or stricter legal regimes has become more dangerous for some. The thing I find curious is that others haven't perceived this change in risk. I wouldn't necessarily say this is a bad thing either - note there have been a number of (accused) botnet operators/cyber-criminals originating from Russia who were arrested whilst holidaying in the EU, and then extradited to the US. Since Russia has a reputation for being lax about prosecuting such "crimes" (especially if they only target people outside of Russia), and also tends to refuse to extradite Russian nationals, it doesn't seem that there are many other options. 1. http://www.legislation.gov.uk/ukpga/2006/48/section/37 http://www.legislation.gov.uk/ukpga/2006/48/section/37 2. https://en.wikipedia.org/wiki/Gary_McKinnon https://en.wikipedia.org/wiki/Gary_McKinnon
phyller 9y ago
Your assertion is that the US should not arrest someone on US soil for crimes committed against US citizens by the person while they were in another country. That doesn't make sense to me. If an American was mailing handguns that are legal in the US to people in the UK I think no one would have a problem with them being arrested if they visited the UK. Disagreeing with the laws of another country is reasonable and your home country has the ability to at least try to intervene in your behalf. But when you are traveling to another country you are subject to its judicial system. If this minimum of enforcement is not acceptable how are any of us to defend ourselves against criminals in developing countries that will never enforce their own laws? The concept that we get to take our home legal system waltzing around the world with us as we travel is arrogant. You may be morally and legally free to post a cartoon mocking Mohammed on your Facebook page, but don't be surprised if you get detained on a trip through Saudi Arabia. At least in the US he's innocent until proven guilty and will probably get a fair trial. And he wasn't arrested for posting his opinions on social media or bashing the president. The software in question was designed to steal people's access to their shopping and banking accounts. And the accusation is he conspired to sell it and offer support to criminals to help them abuse their victims. I would have no problem with an American getting arrested under similar circumstances while visiting another country.
- Chris2048 9y ago
  > If an American was mailing handguns that are legal in the US to people in the UK I think no one would have a problem with them being arrested if they visited the UK I would. I would fully expect the UK to engage with the US, not ambush someone.
  - phyller 9y ago
    That's a good point. But there was an article in the BBC that stated at least one agency in the UK was aware of the situation. Given that the guy is temporarily at least a hero, the short time frame since Alphabay was taken down and the evidence discovered, and the fact he was traveling to the US, it was probably better for everybody that it happened in the US. I don't think politicians in the UK would have enjoyed the prospect of extraditing him to the US. My impression is not that they were sitting on this for a couple years, but that the Alphabay operation unveiled a lot of info that they couldn't act on until it was finished. But that's all pure speculation on my part.

by syshum 9y ago

mijoharas 9y ago

> It is only a matter of time before a EU nation attempts to extradite or arrest a US Citizen traveling abroad for a hate speech law violation or some other violation that occurred online from the US which is not a violation of US law but is a violation of EU Law. Fingers crossed that it's Trump. ;)

bitcharmer 9y ago
Wasn't it Obama's administration pushing this draconian policy across the globe in the first place?
- king_phil 9y ago
  Source?
- TeMPOraL 9y ago
  I think the GP is joking that that first person detained by the EU will hopefully be Trump himself.

kelnage 9y ago

This is exactly why the "the Internet is a different place" arguments (such as [1]) make me sad. Because, without a formal worldwide treaty (seems unlikely), it will never be the case. Whilst you might perceive your actions on the Internet to be either only policeable on the Internet or in the worst case in the location you perform them from, the law (in multiple countries, over and over again) sees your actions as occurring in any place they affect. You may have initiated the activity in country A - but if that action is then caused to happen/repeated/perhaps even observed in country B, you probably shouldn't be surprised that if it breaks country B's laws then they might want to speak to you about it. Guess what - if you (as an example) encourage Chinese dissent online and it gets past the Chinese firewall - you stand a good chance of being picked up by the Chinese authorities should you go there. The only way the Internet is a different place is if you never leave the Internet/your home jurisdiction. The good news for US citizens is an extradition along the lines you mention seems unlikely (unless you also broke US law). In the UK (for example), the situation is far more bleak as their extradition treaties with the US and others are less protective. P.S. this is in no way commentary on MalwareTech's guilt - that is for a judge and/or jury to decide - just discussing a common perception 1. https://en.wikipedia.org/wiki/A_Declaration_of_the_Independence_of_Cyberspace https://en.wikipedia.org/wiki/A_Declaration_of_the_Independe...

chx 9y ago

As a Canadian citizen, open source developer, free minded tinkerer (I don't dare to say hacker in this context) I am fucking scared to enter the USA. The law in question was written largely as an answer to the Wargames movie, it was not a good law then and 30 years later it's downright terrifying. If they think I broke some USA law they better issue a warrant and ask Canada to extradite me. That's a thing. But this sort of ... ambush ... or what do I call it, that's just scary. Let's say I scrape a website whose ToS said, don't scrape me. Is that a felony? Perhaps. Want to crank it to eleven? Let's say I left accidentally a security hole in Drupal (I have 1299 commit mentions in Drupal) which powers, well, certainly more than ten websites in the United States. Is that a felony? Can it be twisted into a felony? Is it likely? No? Possible? Fuck knows. You could say, hey the CFAA is older than my boots, nothing has changed, why are you scared only now? My answer is, you know, the leader of the executive branch is an old man without political experience who certainly shows signs of dementia and while I can't professionally evaluate how it changes the situation I have a bad feeling it makes it worse than it was.

sago 9y ago
> Possible? Yes. The legal code is so byzantine that most citizens (and most visitors) are permanently in breach somehow, somewhere: an error in some form you filed, a permit you didn't know you needed, a clause that's very rarely enforced, a law worded vaguely that can be made to fit. This is the origin of the cliche "to throw the book at someone" - to threaten or exact retribution, by hunting for all the ways they are breaking the law, related to the original arrest or not. It is also why the advice is not to speak to police voluntarily. Fortunately for most folks the US is a mostly benign state (which is why exceptions are somewhat notable). But this is not a unique US issue. It is only a change of intent away from the widespread persecution of political opponents. As long as most of us believe a 'political enemy' is our enemy too (like those evil hackers), the state is free to throw the book where it pleases with public indifference or even support.
- justinjlynn 9y ago
  > It is also why the advice is not to speak to police voluntarily. At all, except through legal counsel or, at the least, with legal counsel present; competent legal counsel at that.

ubernostrum 9y ago

I still have not seen addressed widely is the issue of US enforcing laws on an international level It's simple: if you do something which causes something illegal-in-the-US to happen on computers-located-in-the-US, you can be prosecuted by the US for it. There is nothing new, radical, revolutionary, terrifying, unprecedented, etc. about this idea. There wasn't anything new about it recently when some bitcoin people were busted because they laundered their proceeds through US institutions. There isn't anything new about it when someone in another country hacks a US company's systems. "The internet" is not a magical extra-territorial location which wipes away all concept of countries having jurisdiction. As long as a computer in one country can cause things to happen to/on a computer in another country, there's an opportunity for either country, or both, or others in between them on the network, to have jurisdiction over things that go wrong. And your "only a matter of time" slippery slope has already happened: several EU nations have taken legal action against US-based online retail/auction sites to require compliance with laws against selling Nazi symbols or memorabilia. And I hope you'd understand that no matter how much you might argue "but I wasn't even in Germany", Germany will come after you if you offer to sell and ship items to Germany which are illegal to sell/ship there.

chx 9y ago
The problem here, as I wrote above, is arresting a UK citizen in the USA. If they would've issued a warrant and the UK police decides to arrest him and then extradite him, that's fine. But this sort of thing... this could potentially halt international travel. I am not kidding: how do you dare to travel anywhere if you can be arrested for something you did years ago which very well might have been legal in the country you resided in but not in the country you travel to?
- kelnage 9y ago
  What Malwaretech has been charged with here would likely be illegal under UK law as well as US law (section 37 of the Computer Misuse Act [1] appears to be analogous to the charges being brought against him). And regardless, the UK-US extradition treaty is written in such a way that the US charges do not have to be illegal under UK law for an extradition to take place (although the converse is not true). Now, it may well have been the case that when the inevitable court case to challenge the extradition in the UK took place, it might have gone all Gary McKinnon on them [2], due to public support after WannaCry etc. which I'd suggest is probably why the FBI chose to arrest him in the US rather than put in a formal extradition request or work directly with the UK authorities (AFAIK). But yes, I do agree that with the advent of a worldwide communications network, travel to countries with oppressive, obscure, or stricter legal regimes has become more dangerous for some. The thing I find curious is that others haven't perceived this change in risk. I wouldn't necessarily say this is a bad thing either - note there have been a number of (accused) botnet operators/cyber-criminals originating from Russia who were arrested whilst holidaying in the EU, and then extradited to the US. Since Russia has a reputation for being lax about prosecuting such "crimes" (especially if they only target people outside of Russia), and also tends to refuse to extradite Russian nationals, it doesn't seem that there are many other options. 1. http://www.legislation.gov.uk/ukpga/2006/48/section/37 http://www.legislation.gov.uk/ukpga/2006/48/section/37 2. https://en.wikipedia.org/wiki/Gary_McKinnon https://en.wikipedia.org/wiki/Gary_McKinnon

phyller 9y ago

Your assertion is that the US should not arrest someone on US soil for crimes committed against US citizens by the person while they were in another country. That doesn't make sense to me. If an American was mailing handguns that are legal in the US to people in the UK I think no one would have a problem with them being arrested if they visited the UK. Disagreeing with the laws of another country is reasonable and your home country has the ability to at least try to intervene in your behalf. But when you are traveling to another country you are subject to its judicial system. If this minimum of enforcement is not acceptable how are any of us to defend ourselves against criminals in developing countries that will never enforce their own laws? The concept that we get to take our home legal system waltzing around the world with us as we travel is arrogant. You may be morally and legally free to post a cartoon mocking Mohammed on your Facebook page, but don't be surprised if you get detained on a trip through Saudi Arabia. At least in the US he's innocent until proven guilty and will probably get a fair trial. And he wasn't arrested for posting his opinions on social media or bashing the president. The software in question was designed to steal people's access to their shopping and banking accounts. And the accusation is he conspired to sell it and offer support to criminals to help them abuse their victims. I would have no problem with an American getting arrested under similar circumstances while visiting another country.

Chris2048 9y ago
> If an American was mailing handguns that are legal in the US to people in the UK I think no one would have a problem with them being arrested if they visited the UK I would. I would fully expect the UK to engage with the US, not ambush someone.
- phyller 9y ago
  That's a good point. But there was an article in the BBC that stated at least one agency in the UK was aware of the situation. Given that the guy is temporarily at least a hero, the short time frame since Alphabay was taken down and the evidence discovered, and the fact he was traveling to the US, it was probably better for everybody that it happened in the US. I don't think politicians in the UK would have enjoyed the prospect of extraditing him to the US. My impression is not that they were sitting on this for a couple years, but that the Alphabay operation unveiled a lot of info that they couldn't act on until it was finished. But that's all pure speculation on my part.