9 ms·
Regarding Marcus Hutchins aka MalwareTech
- deleted 9y ago[deleted]
- afarrell 9y agoIt seems to me that the broader issue is one where HN readers individually writing their senators would have an impact for the time invested. 1) Legislators do not have the time to come to this situation with insight into how the cybersecurity community works. There are simply too many fields of human endeavour and people have to specialize to get things done. 2) This is not an issue like Abortion or the 2nd amendment. Senators can and do change their minds based on input from experts. See Sen. Lindsey Graham's approach to encryption[1] 3) Harm to the US ability to collaborate with its allies is a thing that senators will care about, especially hawks. Right now, they likely have two threats top-of-mind: ISIS and the Iran-Russia-Assad alliance.
- ubernostrum 9y agoWhat exactly do you want members of the US Congress to do? Pass a bill declaring him innocent? The quick change in tone in the post is telling, by the way -- it goes from being skeptical that he was involved in a crime at all, to quibbling that not much money was stolen anyway, and if you're going to prosecute over such a tiny thing you should do it in a different country than the one where it was stolen.
- snarfy 9y agoEven if that country was North Korea and the crime was punishable by execution? 40 years in prison is extreme for $2000. They might as well execute him. And yes, I compared the US to North Korea, but when it comes to cyber security laws they really aren't that much different. The punishments are way out of proportion to the crimes. You'd be better of killing someone than hacking them.
- _Codemonkeyism 9y agoI guess he has a different opinion on "They might as well execute him." But it's nevertheless interesting how easy people are with other peoples lives. And yes if you go to a different country, be aware of their laws. "The punishments are way out of proportion to the crimes." Don't go to the US. http://kottke.org/13/06/you-commit-three-felonies-a-day http://kottke.org/13/06/you-commit-three-felonies-a-day Also Dr. Ferris.
- Fnoord 9y ago> Don't go to the US. Yup, or rather, try to stay within your own jurisdiction. Right now, SHA2017 [1] is going on in The Netherlands. There's also the CCC, Chaos Computer Congress in Germany. Besides that, there's also a Camp called CCC every other few years. Someone from the UK could've stayed in the EU, but didn't. [1] https://sha2017.org https://sha2017.org
- awinder 9y agoHe’s going to go through a trial by his peers, he’s not likely going to receive the max sentence, and even then he likely wouldn’t serve the max sentence for a nonviolent crime (he’d be paroled). Compare that to being convicted without a fair trial, being sent to a labor camp, and running the risk of being sent home in a body bag. I understand hyperbole but let’s not kid ourselves, NK is one of the worst places in the world to draw government ire.
- 9y ago
- awinder 9y agoSenators and congressmen lobby on behalf of their voters interests all the time. What one AG does with 0 attention is radically different than what that AG does when powerful people simply ask — “what is it that you’re spending taxpayer funds on here?”
- cosarara97 9y ago40 years in prison is way out of proportion, guilty or not. Are there black hats in the US currently serving this kind of sentences?
- kyrre 9y agohttps://en.m.wikipedia.org/wiki/Albert_Gonzalez https://en.m.wikipedia.org/wiki/Albert_Gonzalez This guy is doing 20 years.
- tryingagainbro 9y agoUSA is famous for "You face 65248 years in jail, unless you plead guilty and agree to time served and 18 months probation." But if he wrote the trojan and if a lot of people had their life turned upside down (identity theft and credit report issues aren't fun) I don't see why he shouldn't go to jail, for quite a while.
- Shivetya 9y agoAaron Swartz all over again.
- azm1 9y agoOh my, please no...
- deleted 9y ago[deleted]
- josh2600 9y ago.
- zitterbewegung 9y agoSo, if I paid someone $1 to commit murder then it wouldn't be egregious? People are judged on the crime they committed not how they benefitted off of it. EDIT: Note the parent used to claim that $2000 for Malware isn't worth going to Jail for 40 years because its only $2000.
- eatitraw 9y ago> So, if I paid someone $1 to commit murder then it wouldn't be egregious? A straw man. Stealing $1 is certainly isn't as serious than stealing $100k. And creating malware is closer to theft rather than murdering people.
- _Codemonkeyism 9y agoWhy do people in discussions base the punishment on the $2000 he is accused of having earned not on the act of selling a cyberweapon? If I sell someone Anthrax for $1, my punishment should be based on the $1 amount?
- nowo 9y agoThe "facing 40 years" is a quirk of the US justice system. While still often out of proportion he's not going to get 40 years. https://www.eff.org/deeplinks/2013/03/41-months-weev-understanding-how-sentencing-guidelines-work-cfaa-cases-0 https://www.eff.org/deeplinks/2013/03/41-months-weev-underst...
- cm2187 9y ago$2000 is what he sold the malware for from what the post says, not the damages that the malware caused.
- deleted 9y ago[deleted]
- 9y ago
- armitron 9y agoHis arguments hold no water (I would characterize them as clownish) and amount to little more than self-promotion and mob signaling. He made my fool list.
- throwme_1980 9y agoPlease let the law inforcement agencies deal with this. Have faith in the system
- fergbrain 9y agoThe issue I have with this is that our legal system is adversarial (by design) and as such the police have no incentive to either help you or keep your best interests in mind. The government (as a whole) has also shown a disconcerting lack of technology prowess.
- syshum 9y agoWhere in the history of the US Legal system has it given me any reason to have "faith" in it? The US Legal system is rife with abuse, corruption, and unethical actions, there is zero reason anyone should have faith in it
- JshWright 9y ago"The system" seems to have handled this pretty poorly so far. Why do you suspect their competence will increase (or, if you prefer to frame it differently, their malevolence will decrease)?
- tehwebguy 9y agoTell that to Davino Watson, US citizen, held by ICE (immigration "police") for 3 years by mistake, gets literally zero compensation: http://www.npr.org/2017/08/01/540903038/u-s-citizen-held-by-immigration-for-3-years-denied-compensation-by-appeals-court http://www.npr.org/2017/08/01/540903038/u-s-citizen-held-by-...
- barking 9y agoFrom afar, America always seems to adopt the sledgehammer to crack a nut approach.
- madez 9y agoI think this is so because they are based on the archaic principle of guilt and redemption, and not an ethical system that considers the well-being of everybody involved.
- humanrebar 9y agoI don't see how those two are contradictory.
- escapetech 9y agoA guilt and redemption system focuses almost exclusively on the transgressions of the accused for the well being of society. An ethical system takes into account the well-being of everybody including the accused.
- humanrebar 9y agoI'm confused if you're referring to the American judicial system in particular or some part of Western ethics in general. In either case, I'm not clear what alternative is being proposed.
- ad_hominem 9y agoRight, if only America were as "ethical" as other countries like the one that gives a person who murders 80 children a little 3-room apartment with a Playstation 2, personal PC, kitchen, exercise area, etc. where they can write their memoirs
- madez 9y agoThat might sound unfair, but that doesn't make it necessarily wrong. There are also things that are intuitive, but wrong. We can reason and overrule our intuition.
- maaaats 9y agoGuilty or not, this seems more like a kidnapping than an arrest. Can they really ignore all rights as they see fit?
- lucaspiller 9y agoAnd he is a non-US citizen, being detained by the US, what rights does he actually have?
- pyvpx 9y agothe idea is the US is ruled by laws. when you're in US territory, you are subject to those laws. not being a citizen doesn't mean you have no rights. then again this is the same government who says the Constitution doesn't apply 100 miles in from the border (where a significant percentage of the populace lives...)
- deleted 9y ago[deleted]
- tehwebguy 9y agoMaybe FBI thought it would just be cheaper to lock him up than pay for his research
- celticninja 9y agoIf you are not a US citizen you have fewer rights if you are arrested in the US. Even fewer if it's via extraordinary rendition.
- marcoperaza 9y agoThis is simply not true. Everyone on US soil has the same rights when accused of a crime. Incidentally, the rights of the accused are stronger in the US than in any other jurisdiction in the world. He has the unqualified right to remain silent and to a jury trial in which illegally gathered evidence is excluded. He would have neither of those in the UK.
- notwhiteknight 9y agoThe case seems to stem from the takedown of a website called AlphaBay, where a large amount of new cases are now entering the US justice system. Can someone explain what this means? Is there a news article somewhere explaining the flood of cases created by AlphaBay? Why haven't I heard of other's being prosecuted?
- TazeTSchnitzel 9y agoAlphaBay was a darknet market. As you might expect, it trafficked in illegal goods. Since authorities seized it and shut it down, they've been able to read the site's data, and can now prosecute all sorts of illegal actions that happened there.
- dogma1138 9y agoThey didn't shut it down immediately, they run it for a few weeks collecting information. It's quite likely that they've used it to either directly compromise or unmask real world assets of it's users beyond what would be possible from just reading some logs.
- TazeTSchnitzel 9y agoQuite likely, though the logs would be immensely valuable on their own.
- Fnoord 9y agoIts larger than AlphaBay. See Operation Bayonet, which became public on july 20 2017: https://www.europol.europa.eu/newsroom/news/massive-blow-to-criminal-dark-web-activities-after-globally-coordinated-operation https://www.europol.europa.eu/newsroom/news/massive-blow-to-... Wikipedia might have more information as well. Regarding AlphaBay: https://en.wikipedia.org/wiki/AlphaBay#Seizure_and_shutdown https://en.wikipedia.org/wiki/AlphaBay#Seizure_and_shutdown What I personally found interesting about the whole story (which was widely covered in Dutch media, since the police is (rightfully, IMO) proud of their accomplishment) is how the Dutch police were able to keep a darknet site called Hansa running for nearly a month after the servers were seized. The German police arrested the administrators, while the Dutch police moved the servers to Dutch territory, and made them operational again. They then tried to keep the site running, so they could analyse the logs, traffic, and visitors. Interestingly, the Canadian AlphaBay administrator was residing in Thailand and was logged in at that moment to keep the site running because there were some (artificial) technical difficulties. I'm curious how those were started. If you don't want to confiscate the server, but know where it is, it should be doable to -for example- do massive traffic shaping on the link to make it seem like there's a DoS attack.
- thieving_magpie 9y agoStill waiting for actual details related to the charges to come out before rushing forward with my opinion on the matter.
- hysan 9y agoI'm not and here's why. 1. If evidence proves afterwards that the handling of the arrest was just and for good reason, then I'll admit my fault and apologize. My error in overreaction will mean nothing in the long run. 2. However, if my overreaction is correct but I withheld it, it would be far too late to point out errors by the government later on. News moves too quickly in this age to call out bad actors later. Now is the appropriate time to make as much noise about the potential abuse of power by the government. 3. The government's handing so far shows that they too understand this principle. They are acting in a way that best suits them and are using the fact that reasonable people are going to say exactly what you said to drag this out. At the very least, this practice of theirs without statement is worth calling out. So my question for all of those who side with your stance is, will you be willing and able to drum up news in major outlets if he government turns out to have acted unjustly?
- thieving_magpie 9y agoThat seems like you're just perpetuating the reactionary news cycles. No - I am not willing to try and hold news outlets accountable. I'm not even sure how I'd do that except doing what I already am (not participating). I am willing to ignore reactionary news outlets, that's how I do my part.
- taneq 9y agoNevermind your silly opinion, the bike shed should definitely be a lighter shade of grey.
- icpmacdo 9y agoWe can still point you the bullshit things the US is doing like trying to say he was breaking felony gun laws going to the shooting ranges on the strip and using that as a reason to stop his bail https://twitter.com/ChristyNews3LV/status/893603855266492416 https://twitter.com/ChristyNews3LV/status/893603855266492416
- calafrax 9y agoThese "white hat" people are really amusing. They sell weapons to criminals and then sell the defense to the victims and then act all indignant when they get arrested.
- 0x0 9y agoWonder if anything similar could have happened to the author of cURL had he not been denied boarding on a US flight - https://news.ycombinator.com/item?id=14643467 https://news.ycombinator.com/item?id=14643467
- masklinn 9y agoProbably not? Daniel Stenberg is a network protocols geek and software author, not a security researcher.
- jacquesm 9y agoYes, but his software has wide applications including being used in DDOS attacks, downloading copyrighted content and so on. I find it hard to get my head wrapped around the argument that gun manufacturers are somehow exempt from being at least at some level involved in the crimes perpetrated with the stuff they make but that for software we're going to have a completely different standard where simply making something and selling it rather than using it is the bar to clear. Especially since so much software is 'dual use'.
- masklinn 9y ago> Yes, but his software has wide applications including being used in DDOS attacks, downloading copyrighted content and so on. I guess that's technically true, but practically no more so than the PSF or the GCC team. > I find it hard to get my head wrapped around the argument that gun manufacturers are somehow exempt from being at least at some level involved in the crimes perpetrated with the stuff they make but that for software we're going to have a completely different standard where simply making something and selling it rather than using it is the bar to clear. There isn't really any argument, just politics (lobbying groups/companies/whatever) and familiarity (of lawmakers and judges, which is why people like Judge Posner are so important to our field).
- 0x0 9y agoLots of people seem to be confused about curl's role in other systems: https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ Maybe a similar confusion caused his boarding to be denied - but what if this is a case of similar confusion acted upon after the person arrived in the US? Or what if the cURL author was allowed to enter the US but whatever cause for denying him was flagged before he was to leave for home?
- rurban 9y agoCall me very sceptical. Where did he all has the money from, which he spent in Vegas? It looks very suspicious to me. http://www.dailymail.co.uk/news/article-4762608/Marcus-Hutchins-admits-malware-code-Las-Vegas.html http://www.dailymail.co.uk/news/article-4762608/Marcus-Hutch... * Rented a Lamborghini, and wanted to rent a helicopter flight to the Grand Canyon. * Stayed at a £1,950-a-night mansion rented with seven friends with Vegas' largest private pool. Who paid for this? * Didn't attend the 2 conferences there. * Admitted in a police interview that he created the code of a malware that harvests bank details, a prosecutor said in a Las Vegas court.
- trollied 9y agoThe Daily Mail is so shit that most wouldn’t even use it as toilet paper.
- deleted 9y ago[deleted]
- mrtksn 9y agoUK is a high-income country so these things listed as lavish can be done on bus driver level of income. 1950gbp for 7 people is like 280gbp per night, which is less than any luxurious accommodation in London. An employed UK citizen doesn't have to rob a bank to stay in Las Vegas for few days and rent an exotic car. Oh and I would not take a Daily Mail article as a facts source. What it could have actually happened is that he created a proof of concept code that can do these things, not actually creating a malware to steal bank details.
- sasas 9y agoAccording to Andrew Mabbitt - "He stayed in our villa for free. He didn't pay for the car. He didn't pay for a helicopter ride. He didn't pay for concert tickets..." [1] He takes home a 6 figure salary [2] [1] https://twitter.com/mabbssec/status/893617953530273792 https://twitter.com/mabbssec/status/893617953530273792 [2] https://twitter.com/mabbssec/status/893624617142759425 https://twitter.com/mabbssec/status/893624617142759425
- marcoperaza 9y agoThe tech community's reaction to this is frankly laughable and embarrassing. The man has been accused of a crime. A grand jury has seen enough evidence to indict him. This is the United States of America, where as someone accused of a crime he will have more rights than he would in just about any other jurisdiction in the world.[1] Yet so many in this forum and elsewhere are spreading ridiculous conspiracy theories and accusing law enforcement of malfeasance, without any evidence whatsoever. [1] For example, the unqualified rights to remain silent and to a jury trial in which illegally gathered evidence is excluded, neither of which he would have in the UK.
- teuobk 9y agoRegarding grand jury indictments, it's very, very rare for a grand jury to refuse to indict somebody, so that isn't necessarily a good measure of the quality of the case against the accused. Of roughly 162,000 federal cases brought before grand juries in 2010, indictments were returned for all but 11 of them. https://fivethirtyeight.com/datalab/ferguson-michael-brown-indictment-darren-wilson/ https://fivethirtyeight.com/datalab/ferguson-michael-brown-i...
- dijit 9y agoDevils Advocate here. Could that be that law enforcement do not bring cases to the grand jury unless there is significant evidence already? If they have clear requirements it could just be that they're being selective about what they submit.
- mannykannot 9y agoI would hope that were the case, but evidence, e.g. from convictions reversed on account of DNA evidence, show that it is not always so. While the grand jury system may appear to protect innocent defendants, I wonder if it does the opposite. A grand jury might have a disposition to allow a case to proceed when in doubt, on the grounds that the matter will be sorted out in a trial, while the fact that a grand jury has made a decision may bias the trial jury towards conviction. Another practice that has demonstrably been abused is the offer of something approaching immunity in exchange for testimony. We know there is a co-defendant, but nothing else so far in that regard. The swatting of as respected a character as Brian Krebs shows that law enforcement can be manipulated into a precipitate action, especially when there is a deadline, and in this case, Hutchins was about to leave their jurisdiction. I have no opinion as to whether Hutchins is guilty of anything, but I hope his case is dealt with quickly, and above all, justly.
- deleted 9y ago[deleted]