6 ms·

Post from "weev" (AT&T/ipad data hacker) on his arrest and treatment

176 points by robk 16y ago

phreeza 16y ago
Unfortunate domain name. Almost didn't click it. But it is legit.
- daten 16y ago
  Unfortunate site logo as well. Between his writing style, the content of some of his posts, and the choice of name and logo, I'm finding it very difficult to take this author seriously.
  - rdl 16y ago
    The whole "goatse" thing is part of the performance art. Hacker groups have a long history of over the top stuff like that -- look at the Cult of the Dead Cow (cDc), Phone Losers of America, Legion of Doom, etc. weev is a troll (in the 4chan sense), and a performance artist, but on this issue, he's actually being pretty straight up. He got some information about a security vulnerability, was asked to publicize it, did so, and is now being unlawfully screwed for it. Was what he did prudent, especially for someone already on the FBI shitlist? No. Was it lawful? Yes. And, it certainly brought the security vulnerability, which was an incompetent decision by ATT, to public attention.
    - mbateman 16y ago
      There's also a long history of cranks falsely claiming that their rights are being violated and that due process in their case is being trampled. I'm not saying that that cranks shouldn't be defended when their rights are violated or that his claims are false. But he's certainly not helping his credibility with his disorganized, rambling writing, and his juvenile website, etc. It makes it so that my immediate inclination reading this is to suspect that most of it is wildly exaggerated.
      - ttol 16y ago
        Don't know why you're being downvoted (I upvoted you), but I had the same thought and impression as you did. weev talking about "this is not the first time" -- that whole section should have been left out. That makes it very conspiracy theory-like, and really has no bearing on what's going on now.
      - rdl 16y ago
        I agree -- he has definitely not helped his credibility in defending himself from some "fruit of the poisonous tree" drug charges resulting from an illegal search warrant. There is a reason why test cases usually find really unambiguously "safe" people for the test case -- e.g. the elderly, unambiguously law abiding and moral, African American gentleman in Chicago used for the recent 2A case McDonald vs. Chicago, or the same with Heller vs. DC. I am pretty sure no one expected search warrants when this all started. If it was expected that the FBI and local law enforcement would get involved, an academic security researcher would have been a far better spokesman.
  - Robin_Message 16y ago
    Civil rights are actually not dependent on domain name, writing style, content of writing, name, logo, or in general any damm thing at all. They are called "unalienable rights" for a reason. As Americans declared in a few days ago in 1776, "But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security." If what he says is true, then it is our right, and our duty, to stand up for weev. If the government is this far in the wrong, then that is more important than any single individual's actions. Give him some cash (http://security.goatse.fr/help http://security.goatse.fr/help); write to the EFF; call your congressman; ask an America you know to do the same; but please, find another thread for discussing logos, e.g. http://news.ycombinator.com/item?id=1493603 http://news.ycombinator.com/item?id=1493603 If he is lying, then we need evidence he is lying, not that he has bad taste in logos. EDIT: I clarified the above to add the "If what he says is true... // If he is lying..." without marking the edit, which I am now doing. I apologise if I edited after the children had posted.
    - mbateman 16y ago
      Of course civil rights aren't dependent on anything. But whether we believe his story that his civil rights are being violated is partially dependent on his credibility, which seems at first glance to be pretty close to zero. He claims that his civil rights are being violated in the same breath that he claims that it happens to him all the time and that anti-semitism is okay. Why should we believe any of this, exactly? EDIT: Okay you edited your post to be conditional on him telling the truth and requesting of evidence that he's lying. My point is just that crankishness is typically evidence that someone is lying, or at least good reason to not take things that people are saying at face value and to wait for independent confirmation for whoever cares to look for it. There's a burden of proof issue here.
      - Robin_Message 16y ago
        Kindly retract that he said "anti-semitism is okay." Screenshot 1 and 2 of the threatened indictment seemed believable and imply he is in legal trouble over a security disclosure. A quick search online implies the disclosure was responsible, proportionate and AT&T are pissed about it (e.g. http://bits.blogs.nytimes.com/2010/06/13/att-explains-ipad-security-breach/ http://bits.blogs.nytimes.com/2010/06/13/att-explains-ipad-s...). So, from those two things, coupled with the fact legal aid is being denied to him, implies he is serious about needing help with a lawyer. Is he already on some kind of FBI shitlist? Maybe, maybe not, it's irrelevant. Would it have been better not to mention it? Probably. Is he credible? I don't see why not given the corroborating evidence.
dlytle 16y ago
If his claims are accurate, and only minimally influenced by hyperbole, it appears he's at the center of a massive miscarriage of justice. I'd be interested to see an analysis by someone who knows more about the law than I do.
rdl 16y ago
I think it's shameful that no one has stepped up to provide him with free, top notch legal assistance. I'm relatively familiar with the case (I know weev personally, too), and he is actually not exaggerating. This is exactly the kind of case the EFF exists to defend. Yes, weev is a troll and a media whore, but that doesn't automatically make him wrong. Goatse behaved in the industry accepted standard way in popularizing a security vulnerability -- full disclosure. I personally would have done the same (although I would not have kept illegal drugs at my residence after doing so, but I also would probably ventilate anyone breaking into my home without clearly announcing a warrant...) Free weev!
- iambvk 16y ago
  Lets hope Apple will step-in and to stand by his civil liberties. I heard they took some moves for the same for Chinese workers :P
- ErrantX 16y ago
  > Goatse behaved in the industry accepted standard way in popularizing a security vulnerability Well, as someone working in the security industry I take slight issue with this. They appear to have cashed in on the media coverage as much as possible rather than focus on proper disclosure practices. I (and a lot of people in my job, I think) would consider it just on the wrong side of unethical.
  - rdl 16y ago
    Non-disclosure, vs. Responsible disclosure, vs. Full disclosure (with various levels of warning to the vendor), vs. Aggressive full disclosure is certainly an open point of debate within the security industry. It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however. My personal position varies based on the kind of vulnerability, actual risk to end users, etc. For something which causes minimal harm to the end users (publishing email addresses? really?), which was the result of utter incompetence on the part of a single vendor, and where the vendor can trivially fix it, I think aggressive full disclosure is the right course of action. If it were something like a flaw in cisco bgp, I would support responsible disclosure, on a very long timescale; give the vendor enough time to fix it, and get the patch deployed to as many users as possible. If it were a flaw in a no-longer-maintained system which were critical to life safety, I could be convinced to not disclose at all, provided there were something put in place to transition users off of the system.
Sujan 16y ago
I don't know anything about the story, but right now, it somehow looks like he's quite a nutjob. Writing shorter, more precise and in a chronological order of the events would really help the text to be more understandable and get the point across. The situation is probably quite stressful for him, but he somebody should really help him work on the text so others understand what it's all about.
- deleted 16y ago
  [deleted]
- datasink 16y ago
  His personal blog is worth a read for some context: http://weev.livejournal.com http://weev.livejournal.com He has some posts which suggest the FBI was bugging his apartment and covertly following him around town. This was months prior to the release of the iPad accounts. So, yes, I suspect he is dealing with some mental issues.
mikecane 16y ago
Just because you don't "like" someone is no reason to violate the hell out of his rights. If they do it to him, they will do it to you. And your being "liked" won't help you one damned bit.
- ttol 16y ago
  I'm still not convinced that his rights were violated. He says they are, but this is a guy who wrote a giant essay about his case, and then published it on the net, and ended it with a plea for donations/money. If I were in his shoes, I'd have spent the time calling the EFF to see if they can help, and asking for referrals. It almost seems like he is seeking attention. Also, he seems to be able to obtain documents and requests from the gov to print online, yet also claims he can't get access to them but mentions some deadline. If you're not able to read the request/denied access to it, no judge will hold the deadline over you. That's just conspiracy/crazy talk.
  - mikecane 16y ago
    Of course he's seeking attention. So would you if you were being handled as he says he is. And who says the EFF has the manpower right now to handle his case? This is like people who turn to Legal Aid at the last minute and are shocked to find out they have limited resources, if not an outright waiting list. And given the behavior of both the government post-9/11 and Apple several years ago suing a rumor site out of existence, I'd rather bet on him than either of them.
    - ttol 16y ago
      Disagree. He's not being "handled". It's essentially all in his head. And no, I wouldn't seek attention like this. There is no upside. You fight the case in court. That's where the battle is. His essay only hurts him. To be clear, he's just being asked to serve as a witness and hasn't been charged with anything related to the iPad security. He just doesn't understand the legal process and is requesting things he is not entitled to yet, such as a public defender, and spinning conspiracy theories when they are denied. As of this moment, he is only facing a misdemeanor related to the drugs the police found. It's not clear whether or not the EFF has the manpower to help him. The essay he wrote doesn't seem like he even tried. However, the EFF is usually very helpful with referrals or pointers. This is from personal experience. If you want to bet on him over the government or Apple, that's your choice. Based on his actions so far (black hat approach to security disclosure; writing a long, ranting essay filled with conspiracy theories about the case and the way he is being "handled" and publishing it on the net), I'd most certainly call your bet and laugh all the way to the bank.
st3fan 16y ago
This whole article is not good for his case. I stopped reading halfway because it looks like the typical crazy person rant. What he needs to do is get proper legal counsel.
- furyg3 16y ago
  You didn't read far enough, because he's being denied legal counsel.
  - rdl 16y ago
    He's being denied legal counsel for the drugs charges -- according to the letter, they are all minor misdemeanors, although originally he was alleged to have felony weight on him. That's actually a victory for him, so far. The problem is there are potential actual felony charges under discussion, related to the original computer crime warrant. While he hasn't been charged, he doesn't get a public defender. If he's charged, he gets a public defender. If I were in his shoes, I would absolutely be getting a lawyer (and I sent him $100 toward that, and asked some friends who are lawyers to consider it). Honestly, not getting an Arkansas Public Defender is probably a victory for him, too. I would rather represent myself than rely on AR PD to defend me in a case like this.
    - ttol 16y ago
      I upvoted you for bringing clarity to why he was denied a public defender. The fact that he can't get a public defender because no charges higher than the misdemeanors were filed against him is, like you said, a good thing. He misunderstood, and creates a conspiracy theory around it. This is likely the case with most of his other points in the essay as well.
- altano 16y ago
  Yeah really. Has he contacted the EFF or other similar organizations? What's with all this defense of anti-semetism? Someone needs to proofread this. What's the call to action? If the domain name's not going to change, fine, but get rid of the giant anus illustration for such a plea. Yeesh.
st3fan 16y ago
Full Disclosure != Free Speech. You cannot just publish personal data and then call it 'free speech' and 'industry standard practice' of a 'journalist'. Seriously .. where is the ethics in that? How about actually trying to work with AT&T to get this fixed behind the scenes? Oh no, of course not, because that would not result in the right kind of exposure for these 'security experts'. These things are all about ego and status. Hidden behind a thin shell of 'full disclosure'.
- furyg3 16y ago
  Well, it depends. Testing/Evaluating/Disclosing an exploit isn't immoral in my mind, nor should it be illegal (in a perfect world). Disclosing private details of third paries is certainly immoral in my mind, and should be illegal. According to this logic publishing the exploit, so long as you're censoring output, is fine. If someone uses your exploit to download personal data, it's AT&T who is doing the immoral/hopefully-illegal disclosure. If that someone uses your exploit and then publishes the data or does some other naughty thing with it, book 'em. You get moral brownie points under this logic if you notify the target after you discover the exploit. It's not required, because disclosure is notification. Nefarious-types aren't going to call up a bank to say "hey, we're stealing all your customer records", nor will they disclose this hole to the world. Unpopular statement ahead: if you collect personal details, it's your job to secure your systems, and it's your fault if your systems leak them. Of course there's no such thing as 100% secure, but you're the one doing the risk analysis and design.
  - ErrantX 16y ago
    > It's not required, because disclosure is notification. In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive) Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days). It is also very definitely not ethical to hand the data you got to the media. :)
  - mfukar 16y ago
    Evaluating an exploit, unless sanctioned by a bilateral agreement between both parties (like in pentesting), is in fact illegal in most countries. Disclosure without proper notification of the affected parties can also lead (and sometimes does) in a lawsuit against you. I don't completely agree, but it's the prevailing point of view (and/or law) at the moment.
openfly 16y ago
Dude is nuttier than a baby ruth. He even somehow managed to pull the "zionists" card.
ttol 16y ago
He definitely needs to get an attorney to prevent him from writing future statements/positions in public. Now whomever represents him will have a much harder time defending him since he's written an entire essay on the matter. Each and every word, sentence, statement, and position can and will be used against him.
mfukar 16y ago
"Big law firm did it but didn't get punished, yet I did it and got raided." Really? Are you really going for this elementary school argument? Doesn't help when you distort the concept of 'full disclosure' and related practices, either. No sympathy vote from me.
ErrantX 16y ago
I am highly suspicious of the fact that this deals a lot with other cases and his past run ins with the government and very little with the actual case (at times it even seems to deliberately skip details). As always; this is one side of the story and (thought I hate to say this) from a somewhat troublesome person. I think it is reasonable to treat this as a serious matter, but there needs to be a lot more objective insight before I'd send him some money :)
boredguy8 16y ago
and found is in quotes for a good reason, as the drugs “found” near me were “found” in the execution of a warrant for computers only For what it's worth, the Fourth Amendment protects against 'unreasonable' searches and seizures. Anything found in the reasonable execution of a search warrant is admissible. I don't know where the myth came from that only evidence related to the probable cause of the warrant is admissible. This is an on-face absurd interpretation: by that logic, if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer. There is plenty of case law establishing limits on reasonability. For instance, in the execution of a lawful search of an apartment looking for weapons, officers saw a stereo that 'didn't fit the furnishings'. They lifted up the bottom of the stereo to take down serial numbers, and the person was arrested for having stolen the stereo. The problem, of course, is that weapons aren't stored under the bottom of a flat-bottomed stereo, and certainly the serial numbers weren't a reasonable part of the search for weapons. But having drugs out in the middle of the room in 'plain view' is clearly reasonable. Even from weev's own post, the drug evidence passes the Horton test.
- cschep 16y ago
  If you don't know what a Horton test is, like I didn't. http://en.wikipedia.org/wiki/Plain_view_doctrine http://en.wikipedia.org/wiki/Plain_view_doctrine
- sp332 16y ago
  His point is that the original warrant had no probable cause. So any evidence collected in its execution should be inadmissible.
  - edanm 16y ago
    Is that really the case? If the police is executing an illegal warrant, but comes across someone, say, murdering someone else, is that not considered evidence? (This might very well be the case, considering the "Fruit of the Poisonous tree" doctrine).
stcredzero 16y ago
He seems to be an unabashed anarchist when things are going his way. Now that they aren't he's crying out about his rights.
illumin8 16y ago
He seems to be unfamiliar with the legal process, and really needs to get a lawyer. From the partial scans of the US attorney's letter, it sounds like a federal grand jury would like to subpoena him as a witness to testify about the gathering of AT&T subscriber email addresses and "electronic chip IDs" (I think the letter is technically incorrect). The letter informed him that if he failed to appear he might also have criminal charges filed against him. This is a normal part of the process of a federal criminal investigation. What happens first is that a grand jury is formed. The jury investigates evidence, calls witnesses, and tries to determine if a crime has been committed, and if so, who committed the crime. Then, the grand jury might issue a federal indictment, or it might just determine that no crime was committed and drop the case completely. If he or someone else is federally indicted, then he would be formally arrested and have to go to federal court to stand trial as a criminal defendent. It sounds like it has not gotten close to this point yet. Edit: I also wanted to mention that you have no right to an attorney as a witness of a grand jury. You may choose to have an attorney represent you and be present, however, the financial burden is in no way the federal governments to provide one for you. IF you are charged, then you may receive a public defender if you have insufficient financial means to pay for your own defense. Federal cases take months and years to prosecute. By refusing to participate with the grand jury, he might be opening himself up to the fact that another witness could implicate him and he might be indicted. Of course, there is also the saying "if nobody talks, everybody walks." He really needs to get good legal counsel and decide if he wants to testify in front of the grand jury, and decide what he wants to say. Also, he's not helping his cause any by speaking out on the web. Mentioning his past anti-semite ramblings is also probably not the best way to gather sympathy. I also think he does a disservice to the security community as a whole to advocate black hat ideology at hacker conferences, and then talk about "responsible disclosure" and how he was just trying to protect the poor customers of AT&T. This seems to be rewriting history.
eplanit 16y ago
There is no doubt some ego-based confusion in his mind. It's evident from the first sentences: "...I’m sure you’re all familiar with from my previous excellent blog posts"
jeb 16y ago
A goatse symbol as his logo, makes anti-israel videos, has drugs lying around his apartment, describes his own blog posts as excellent, and apparently publicized some type of private information. This is not a housewife being attacked by a SWAT team, it's someone who is likely to drift in and out of such problems who happens to have drifted in.
skn 16y ago
Link to cached copy http://webcache.googleusercontent.com/search?q=cache:http://security.goatse.fr/hypocrites-and-pharisees http://webcache.googleusercontent.com/search?q=cache:http://...
superk 16y ago
I feel sorry for the dude. He is asking for our help via cash or writing to our local, state and national representatives. That's a rock and hard place.

176 points by robk 16y ago

phreeza 16y ago

Unfortunate domain name. Almost didn't click it. But it is legit.

daten 16y ago
Unfortunate site logo as well. Between his writing style, the content of some of his posts, and the choice of name and logo, I'm finding it very difficult to take this author seriously.
- rdl 16y ago
  The whole "goatse" thing is part of the performance art. Hacker groups have a long history of over the top stuff like that -- look at the Cult of the Dead Cow (cDc), Phone Losers of America, Legion of Doom, etc. weev is a troll (in the 4chan sense), and a performance artist, but on this issue, he's actually being pretty straight up. He got some information about a security vulnerability, was asked to publicize it, did so, and is now being unlawfully screwed for it. Was what he did prudent, especially for someone already on the FBI shitlist? No. Was it lawful? Yes. And, it certainly brought the security vulnerability, which was an incompetent decision by ATT, to public attention.
  - mbateman 16y ago
    There's also a long history of cranks falsely claiming that their rights are being violated and that due process in their case is being trampled. I'm not saying that that cranks shouldn't be defended when their rights are violated or that his claims are false. But he's certainly not helping his credibility with his disorganized, rambling writing, and his juvenile website, etc. It makes it so that my immediate inclination reading this is to suspect that most of it is wildly exaggerated.
    - ttol 16y ago
      Don't know why you're being downvoted (I upvoted you), but I had the same thought and impression as you did. weev talking about "this is not the first time" -- that whole section should have been left out. That makes it very conspiracy theory-like, and really has no bearing on what's going on now.
    - rdl 16y ago
      I agree -- he has definitely not helped his credibility in defending himself from some "fruit of the poisonous tree" drug charges resulting from an illegal search warrant. There is a reason why test cases usually find really unambiguously "safe" people for the test case -- e.g. the elderly, unambiguously law abiding and moral, African American gentleman in Chicago used for the recent 2A case McDonald vs. Chicago, or the same with Heller vs. DC. I am pretty sure no one expected search warrants when this all started. If it was expected that the FBI and local law enforcement would get involved, an academic security researcher would have been a far better spokesman.
- Robin_Message 16y ago
  Civil rights are actually not dependent on domain name, writing style, content of writing, name, logo, or in general any damm thing at all. They are called "unalienable rights" for a reason. As Americans declared in a few days ago in 1776, "But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security." If what he says is true, then it is our right, and our duty, to stand up for weev. If the government is this far in the wrong, then that is more important than any single individual's actions. Give him some cash (http://security.goatse.fr/help http://security.goatse.fr/help); write to the EFF; call your congressman; ask an America you know to do the same; but please, find another thread for discussing logos, e.g. http://news.ycombinator.com/item?id=1493603 http://news.ycombinator.com/item?id=1493603 If he is lying, then we need evidence he is lying, not that he has bad taste in logos. EDIT: I clarified the above to add the "If what he says is true... // If he is lying..." without marking the edit, which I am now doing. I apologise if I edited after the children had posted.
  - mbateman 16y ago
    Of course civil rights aren't dependent on anything. But whether we believe his story that his civil rights are being violated is partially dependent on his credibility, which seems at first glance to be pretty close to zero. He claims that his civil rights are being violated in the same breath that he claims that it happens to him all the time and that anti-semitism is okay. Why should we believe any of this, exactly? EDIT: Okay you edited your post to be conditional on him telling the truth and requesting of evidence that he's lying. My point is just that crankishness is typically evidence that someone is lying, or at least good reason to not take things that people are saying at face value and to wait for independent confirmation for whoever cares to look for it. There's a burden of proof issue here.
    - Robin_Message 16y ago
      Kindly retract that he said "anti-semitism is okay." Screenshot 1 and 2 of the threatened indictment seemed believable and imply he is in legal trouble over a security disclosure. A quick search online implies the disclosure was responsible, proportionate and AT&T are pissed about it (e.g. http://bits.blogs.nytimes.com/2010/06/13/att-explains-ipad-security-breach/ http://bits.blogs.nytimes.com/2010/06/13/att-explains-ipad-s...). So, from those two things, coupled with the fact legal aid is being denied to him, implies he is serious about needing help with a lawyer. Is he already on some kind of FBI shitlist? Maybe, maybe not, it's irrelevant. Would it have been better not to mention it? Probably. Is he credible? I don't see why not given the corroborating evidence.

dlytle 16y ago

If his claims are accurate, and only minimally influenced by hyperbole, it appears he's at the center of a massive miscarriage of justice. I'd be interested to see an analysis by someone who knows more about the law than I do.

rdl 16y ago

I think it's shameful that no one has stepped up to provide him with free, top notch legal assistance. I'm relatively familiar with the case (I know weev personally, too), and he is actually not exaggerating. This is exactly the kind of case the EFF exists to defend. Yes, weev is a troll and a media whore, but that doesn't automatically make him wrong. Goatse behaved in the industry accepted standard way in popularizing a security vulnerability -- full disclosure. I personally would have done the same (although I would not have kept illegal drugs at my residence after doing so, but I also would probably ventilate anyone breaking into my home without clearly announcing a warrant...) Free weev!

iambvk 16y ago
Lets hope Apple will step-in and to stand by his civil liberties. I heard they took some moves for the same for Chinese workers :P
ErrantX 16y ago
> Goatse behaved in the industry accepted standard way in popularizing a security vulnerability Well, as someone working in the security industry I take slight issue with this. They appear to have cashed in on the media coverage as much as possible rather than focus on proper disclosure practices. I (and a lot of people in my job, I think) would consider it just on the wrong side of unethical.
- rdl 16y ago
  Non-disclosure, vs. Responsible disclosure, vs. Full disclosure (with various levels of warning to the vendor), vs. Aggressive full disclosure is certainly an open point of debate within the security industry. It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however. My personal position varies based on the kind of vulnerability, actual risk to end users, etc. For something which causes minimal harm to the end users (publishing email addresses? really?), which was the result of utter incompetence on the part of a single vendor, and where the vendor can trivially fix it, I think aggressive full disclosure is the right course of action. If it were something like a flaw in cisco bgp, I would support responsible disclosure, on a very long timescale; give the vendor enough time to fix it, and get the patch deployed to as many users as possible. If it were a flaw in a no-longer-maintained system which were critical to life safety, I could be convinced to not disclose at all, provided there were something put in place to transition users off of the system.

Sujan 16y ago

I don't know anything about the story, but right now, it somehow looks like he's quite a nutjob. Writing shorter, more precise and in a chronological order of the events would really help the text to be more understandable and get the point across. The situation is probably quite stressful for him, but he somebody should really help him work on the text so others understand what it's all about.

deleted 16y ago
[deleted]
datasink 16y ago
His personal blog is worth a read for some context: http://weev.livejournal.com http://weev.livejournal.com He has some posts which suggest the FBI was bugging his apartment and covertly following him around town. This was months prior to the release of the iPad accounts. So, yes, I suspect he is dealing with some mental issues.

mikecane 16y ago

Just because you don't "like" someone is no reason to violate the hell out of his rights. If they do it to him, they will do it to you. And your being "liked" won't help you one damned bit.

ttol 16y ago
I'm still not convinced that his rights were violated. He says they are, but this is a guy who wrote a giant essay about his case, and then published it on the net, and ended it with a plea for donations/money. If I were in his shoes, I'd have spent the time calling the EFF to see if they can help, and asking for referrals. It almost seems like he is seeking attention. Also, he seems to be able to obtain documents and requests from the gov to print online, yet also claims he can't get access to them but mentions some deadline. If you're not able to read the request/denied access to it, no judge will hold the deadline over you. That's just conspiracy/crazy talk.
- mikecane 16y ago
  Of course he's seeking attention. So would you if you were being handled as he says he is. And who says the EFF has the manpower right now to handle his case? This is like people who turn to Legal Aid at the last minute and are shocked to find out they have limited resources, if not an outright waiting list. And given the behavior of both the government post-9/11 and Apple several years ago suing a rumor site out of existence, I'd rather bet on him than either of them.
  - ttol 16y ago
    Disagree. He's not being "handled". It's essentially all in his head. And no, I wouldn't seek attention like this. There is no upside. You fight the case in court. That's where the battle is. His essay only hurts him. To be clear, he's just being asked to serve as a witness and hasn't been charged with anything related to the iPad security. He just doesn't understand the legal process and is requesting things he is not entitled to yet, such as a public defender, and spinning conspiracy theories when they are denied. As of this moment, he is only facing a misdemeanor related to the drugs the police found. It's not clear whether or not the EFF has the manpower to help him. The essay he wrote doesn't seem like he even tried. However, the EFF is usually very helpful with referrals or pointers. This is from personal experience. If you want to bet on him over the government or Apple, that's your choice. Based on his actions so far (black hat approach to security disclosure; writing a long, ranting essay filled with conspiracy theories about the case and the way he is being "handled" and publishing it on the net), I'd most certainly call your bet and laugh all the way to the bank.

st3fan 16y ago

This whole article is not good for his case. I stopped reading halfway because it looks like the typical crazy person rant. What he needs to do is get proper legal counsel.

furyg3 16y ago
You didn't read far enough, because he's being denied legal counsel.
- rdl 16y ago
  He's being denied legal counsel for the drugs charges -- according to the letter, they are all minor misdemeanors, although originally he was alleged to have felony weight on him. That's actually a victory for him, so far. The problem is there are potential actual felony charges under discussion, related to the original computer crime warrant. While he hasn't been charged, he doesn't get a public defender. If he's charged, he gets a public defender. If I were in his shoes, I would absolutely be getting a lawyer (and I sent him $100 toward that, and asked some friends who are lawyers to consider it). Honestly, not getting an Arkansas Public Defender is probably a victory for him, too. I would rather represent myself than rely on AR PD to defend me in a case like this.
  - ttol 16y ago
    I upvoted you for bringing clarity to why he was denied a public defender. The fact that he can't get a public defender because no charges higher than the misdemeanors were filed against him is, like you said, a good thing. He misunderstood, and creates a conspiracy theory around it. This is likely the case with most of his other points in the essay as well.
altano 16y ago
Yeah really. Has he contacted the EFF or other similar organizations? What's with all this defense of anti-semetism? Someone needs to proofread this. What's the call to action? If the domain name's not going to change, fine, but get rid of the giant anus illustration for such a plea. Yeesh.

st3fan 16y ago

Full Disclosure != Free Speech. You cannot just publish personal data and then call it 'free speech' and 'industry standard practice' of a 'journalist'. Seriously .. where is the ethics in that? How about actually trying to work with AT&T to get this fixed behind the scenes? Oh no, of course not, because that would not result in the right kind of exposure for these 'security experts'. These things are all about ego and status. Hidden behind a thin shell of 'full disclosure'.

furyg3 16y ago
Well, it depends. Testing/Evaluating/Disclosing an exploit isn't immoral in my mind, nor should it be illegal (in a perfect world). Disclosing private details of third paries is certainly immoral in my mind, and should be illegal. According to this logic publishing the exploit, so long as you're censoring output, is fine. If someone uses your exploit to download personal data, it's AT&T who is doing the immoral/hopefully-illegal disclosure. If that someone uses your exploit and then publishes the data or does some other naughty thing with it, book 'em. You get moral brownie points under this logic if you notify the target after you discover the exploit. It's not required, because disclosure is notification. Nefarious-types aren't going to call up a bank to say "hey, we're stealing all your customer records", nor will they disclose this hole to the world. Unpopular statement ahead: if you collect personal details, it's your job to secure your systems, and it's your fault if your systems leak them. Of course there's no such thing as 100% secure, but you're the one doing the risk analysis and design.
- ErrantX 16y ago
  > It's not required, because disclosure is notification. In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive) Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days). It is also very definitely not ethical to hand the data you got to the media. :)
- mfukar 16y ago
  Evaluating an exploit, unless sanctioned by a bilateral agreement between both parties (like in pentesting), is in fact illegal in most countries. Disclosure without proper notification of the affected parties can also lead (and sometimes does) in a lawsuit against you. I don't completely agree, but it's the prevailing point of view (and/or law) at the moment.

openfly 16y ago

Dude is nuttier than a baby ruth. He even somehow managed to pull the "zionists" card.

ttol 16y ago

He definitely needs to get an attorney to prevent him from writing future statements/positions in public. Now whomever represents him will have a much harder time defending him since he's written an entire essay on the matter. Each and every word, sentence, statement, and position can and will be used against him.

mfukar 16y ago

"Big law firm did it but didn't get punished, yet I did it and got raided." Really? Are you really going for this elementary school argument? Doesn't help when you distort the concept of 'full disclosure' and related practices, either. No sympathy vote from me.

ErrantX 16y ago

I am highly suspicious of the fact that this deals a lot with other cases and his past run ins with the government and very little with the actual case (at times it even seems to deliberately skip details). As always; this is one side of the story and (thought I hate to say this) from a somewhat troublesome person. I think it is reasonable to treat this as a serious matter, but there needs to be a lot more objective insight before I'd send him some money :)

boredguy8 16y ago

and found is in quotes for a good reason, as the drugs “found” near me were “found” in the execution of a warrant for computers only For what it's worth, the Fourth Amendment protects against 'unreasonable' searches and seizures. Anything found in the reasonable execution of a search warrant is admissible. I don't know where the myth came from that only evidence related to the probable cause of the warrant is admissible. This is an on-face absurd interpretation: by that logic, if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer. There is plenty of case law establishing limits on reasonability. For instance, in the execution of a lawful search of an apartment looking for weapons, officers saw a stereo that 'didn't fit the furnishings'. They lifted up the bottom of the stereo to take down serial numbers, and the person was arrested for having stolen the stereo. The problem, of course, is that weapons aren't stored under the bottom of a flat-bottomed stereo, and certainly the serial numbers weren't a reasonable part of the search for weapons. But having drugs out in the middle of the room in 'plain view' is clearly reasonable. Even from weev's own post, the drug evidence passes the Horton test.

cschep 16y ago
If you don't know what a Horton test is, like I didn't. http://en.wikipedia.org/wiki/Plain_view_doctrine http://en.wikipedia.org/wiki/Plain_view_doctrine
sp332 16y ago
His point is that the original warrant had no probable cause. So any evidence collected in its execution should be inadmissible.
- edanm 16y ago
  Is that really the case? If the police is executing an illegal warrant, but comes across someone, say, murdering someone else, is that not considered evidence? (This might very well be the case, considering the "Fruit of the Poisonous tree" doctrine).

stcredzero 16y ago

He seems to be an unabashed anarchist when things are going his way. Now that they aren't he's crying out about his rights.

illumin8 16y ago

He seems to be unfamiliar with the legal process, and really needs to get a lawyer. From the partial scans of the US attorney's letter, it sounds like a federal grand jury would like to subpoena him as a witness to testify about the gathering of AT&T subscriber email addresses and "electronic chip IDs" (I think the letter is technically incorrect). The letter informed him that if he failed to appear he might also have criminal charges filed against him. This is a normal part of the process of a federal criminal investigation. What happens first is that a grand jury is formed. The jury investigates evidence, calls witnesses, and tries to determine if a crime has been committed, and if so, who committed the crime. Then, the grand jury might issue a federal indictment, or it might just determine that no crime was committed and drop the case completely. If he or someone else is federally indicted, then he would be formally arrested and have to go to federal court to stand trial as a criminal defendent. It sounds like it has not gotten close to this point yet. Edit: I also wanted to mention that you have no right to an attorney as a witness of a grand jury. You may choose to have an attorney represent you and be present, however, the financial burden is in no way the federal governments to provide one for you. IF you are charged, then you may receive a public defender if you have insufficient financial means to pay for your own defense. Federal cases take months and years to prosecute. By refusing to participate with the grand jury, he might be opening himself up to the fact that another witness could implicate him and he might be indicted. Of course, there is also the saying "if nobody talks, everybody walks." He really needs to get good legal counsel and decide if he wants to testify in front of the grand jury, and decide what he wants to say. Also, he's not helping his cause any by speaking out on the web. Mentioning his past anti-semite ramblings is also probably not the best way to gather sympathy. I also think he does a disservice to the security community as a whole to advocate black hat ideology at hacker conferences, and then talk about "responsible disclosure" and how he was just trying to protect the poor customers of AT&T. This seems to be rewriting history.

eplanit 16y ago

There is no doubt some ego-based confusion in his mind. It's evident from the first sentences: "...I’m sure you’re all familiar with from my previous excellent blog posts"

jeb 16y ago

A goatse symbol as his logo, makes anti-israel videos, has drugs lying around his apartment, describes his own blog posts as excellent, and apparently publicized some type of private information. This is not a housewife being attacked by a SWAT team, it's someone who is likely to drift in and out of such problems who happens to have drifted in.

skn 16y ago

Link to cached copy http://webcache.googleusercontent.com/search?q=cache:http://security.goatse.fr/hypocrites-and-pharisees http://webcache.googleusercontent.com/search?q=cache:http://...

superk 16y ago

I feel sorry for the dude. He is asking for our help via cash or writing to our local, state and national representatives. That's a rock and hard place.