4 ms·

So this is a CFAA violation, right? When will we finally hold someone accountable for blatant security issues like this?

warent 9y ago
Has a government organization used Savitech audio drivers? If not, then there will be no charges
- da_chicken 9y ago
  If so, there will be a long drawn out investigation at taxpayer expense which results in a fine which is both a) too small to impact the revenue of the company, and b) immediately waived on the condition that they stop doing what they already can't do by law.
somebodynew 9y ago
In this specific case (installing a root certificate) I would say it's not actually a CFAA violation because they're not "obtaining information", "defrauding", or "intentionally causing damage". You might be able to argue that installing the driver on a "government computer" produces a violation of 18 USC 1030 (a) (3), but the rules for a mere "protected computer" which covers most internet-connected personal computers are actually not strict enough to cover this. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
- nkw 9y ago
  "Whoever [...] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [...] shall be punished as provided in subsection (c) of this section." "[T]he term 'protected computer' means a computer [...] which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States" "[T]he term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information"
  - justinjlynn 9y ago
    Law is a different language. While it may read like computer code; it isn't. Well, it is but it's as if "goto" and ";" had different meanings depending not only on the last keyword used, but also on the mood of the computer. I wish a straightforward reading was possible but it's often not.
    - nkw 9y ago
      Some parts of the law are easier to appreciate if one considers vagueness and ambiguity can be features instead of bugs.
      - rocqua 9y ago
        Those exact ambiguous laws are the ones that are abused most easily. There is a hard balance between being general enough to cover bad things, without being so general as to allow authorities to prosecute anyone on some charge.
  - somebodynew 9y ago
    That charge would depend entirely on whether or not installing a root certificate can be considered "intentional" "impairment to integrity". I can't find any case law that would provide the interpretation for this, but I think it's safe to say you probably won't be able to overcome the burden of proving that they caused the damage intentionally if it even qualifies as damage (which I find unlikely).
swiley 9y ago
I'm pretty sure most users actually want the driver installed. The correct solution would be for microsoft to allow unsigned drivers (perhaps with a warning.)

warent 9y ago

Has a government organization used Savitech audio drivers? If not, then there will be no charges

da_chicken 9y ago
If so, there will be a long drawn out investigation at taxpayer expense which results in a fine which is both a) too small to impact the revenue of the company, and b) immediately waived on the condition that they stop doing what they already can't do by law.

somebodynew 9y ago

In this specific case (installing a root certificate) I would say it's not actually a CFAA violation because they're not "obtaining information", "defrauding", or "intentionally causing damage". You might be able to argue that installing the driver on a "government computer" produces a violation of 18 USC 1030 (a) (3), but the rules for a mere "protected computer" which covers most internet-connected personal computers are actually not strict enough to cover this. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

nkw 9y ago
"Whoever [...] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [...] shall be punished as provided in subsection (c) of this section." "[T]he term 'protected computer' means a computer [...] which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States" "[T]he term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information"
- justinjlynn 9y ago
  Law is a different language. While it may read like computer code; it isn't. Well, it is but it's as if "goto" and ";" had different meanings depending not only on the last keyword used, but also on the mood of the computer. I wish a straightforward reading was possible but it's often not.
  - nkw 9y ago
    Some parts of the law are easier to appreciate if one considers vagueness and ambiguity can be features instead of bugs.
    - rocqua 9y ago
      Those exact ambiguous laws are the ones that are abused most easily. There is a hard balance between being general enough to cover bad things, without being so general as to allow authorities to prosecute anyone on some charge.
- somebodynew 9y ago
  That charge would depend entirely on whether or not installing a root certificate can be considered "intentional" "impairment to integrity". I can't find any case law that would provide the interpretation for this, but I think it's safe to say you probably won't be able to overcome the burden of proving that they caused the damage intentionally if it even qualifies as damage (which I find unlikely).

swiley 9y ago

I'm pretty sure most users actually want the driver installed. The correct solution would be for microsoft to allow unsigned drivers (perhaps with a warning.)