20 ms·

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it

by sbarre 9y ago

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorly secured site, but even more for trying to railroad a curious kid who made them look stupid.

freshmint 9y ago
I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.
- gowld 9y ago
  Googlebot has the resources to fight back against government attacks.
- rayiner 9y ago
  > I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.
  - samatman 9y ago
    It... it is accessible from a link That's what a url with an id in it is a link
    - rayiner 9y ago
      A "link" is a DOM element in a web page which references a URL, but a URL is not itself a link. To point a finer point on it: the fact that a URL is referenced in a link means that a user is supposed to see and access it.
      - doomtop 9y ago
        Sounds like you might be thinking of an anchor element. People ask for the "link" when they mean the URI all the time.
        rayiner 9y ago
        Wikipedia disagrees: > In computing, a hyperlink, or simply a link, is a reference to data that the reader can directly follow either by clicking, tapping, or hovering. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text with hyperlinks. The text that is linked from is called anchor text. A software system that is used for viewing and creating hypertext is a hypertext system, and to create a hyperlink is to hyperlink (or simply to link). A user following hyperlinks is said to navigate or browse the hypertext. The URL in the abstract is not a "link." A link is an element in hypertext.
        always_good 9y ago
        You're just being stubborn. Link is used to mean a URL by the layperson. For example, I don't think I've ever heard my family say "URL" in their life.
        ozzmotik 9y ago
        a "link" is something that connects two entities together in some arbitrary way. a chain link for instance connects the constituent entities of a chain (other links) together. a link in a linked list connects different nodes together. and a hypertext link connects two hypertext resources together. what you're doing is picking one specific definition and applying it liberally to all potential interpretations and contexts of said word. this is why i tend to espouse the virtues of generality over specificity; when you get too specific, you start eliminating the actual utility and flexibility of language. a link in terms of computing is most certainly NOT just a hypertext link, that is only one very specific interpretation of the concept at hand that you're falling back on to try and further your argument. liberally ignoring all the other possible interpretations is quite intellectually dishonest imo. still, you're entitled to perceive things how you want and argue it whatever way you desire. just know that the majority of reasonable and educated individuals will disagree with you. you're up shit creek and you keep denying every paddle that's offered to ya m8
  - BadThink6655321 9y ago
    If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early. The kid got documents on a public facing server. He did nothing wrong.
    - systematical 9y ago
      A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They should be glad a seemingly benign teenager discovered their flaw and not some more nefarious actor.
      - maddyboo 9y ago
        Violating Terms of Use is not a crime [1]. 1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-service-not-crime-bypassing https://www.eff.org/deeplinks/2010/07/court-violating-terms-...
        brailsafe 9y ago
        I agree, however it is worth noting that this link probably only falls within the jurisdiction of the U.S.
        jessaustin 9y ago
        ...for now. It's pretty clear which direction the legal profession wants to go.
        gnode 9y ago
        This example is not entirely equivalent. My understanding is that the opinion of the court was that authorisation (for the definition of "without permission") cannot be decided based on method of access. I.e. if you have granted a user access to data, you can't later say they accessed it without permission because they used a proxy or bot to access it (in violation of your TOS). A terms of service can not define law, but it can make explicit what data a provider is authorising a user to access.
  - hug 9y ago
    Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files. Turns out some of them were mislabeled, and were private information in the public information filing cabinet. Not so weird, not so antisocial, not his fault, shouldn't be his problem.
    - rayiner 9y ago
      If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.
      - prophesi 9y ago
        Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out. Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.
        munk-a 9y ago
        Also, the library was called the "Free Information" library. IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.
      - corny 9y ago
        It's not just a single file that you have been invited to access. This 'someone' has told the world that all of their public documents are in this filing cabinet. And here is how to find a few specific files. It's not a stretch to think the every other file in the (unlocked) cabinet is also public.
  - noonespecial 9y ago
    Its more like a bunch of books on a shelf at the library with one 'special' book, unmarked, in the middle where they charge you with theft if you grab it.
  - brailsafe 9y ago
    Door handles should be actively jiggled on the regs. If anything it's social behavior. Maybe you'll walk in on an orgy and get to join in!
    - jessaustin 9y ago
      That's what I'm going to tell the next inhabitant I meet while jiggling knobs!
      - brailsafe 9y ago
        That you were just hoping to find an orgy? I fully support this endeavor.
  - framtk 9y ago
    Let's say you are reading a free manual online and every page is stored as a different webpage with a common URL and only the last number changing (E.G. page 1 is book/1 page 2 is book/2 and so on). The only way to go to a certain page is with a "next page" link from the previous one. You read the index at page 1 and see that you cant find the information you need but page 500 is missing, a printing error in the index perhaps. Instead of clicking 499 times on the page links to see if the information you need is on page 500 you simply change book/1 to book/500. OH NO, the link on page 499 brings you to page 501 and it's not in the index because page 500 contains the truth about aliens so now you read it and are going to prison. That's in a nutshell what happened
  - msla 9y ago
    Imagine a government information bureau. The employees who work there have access to all information. Why wouldn't they? They work at the information bureau. They also answer all questions. Why wouldn't they? They work at the information bureau. You walk up and ask questions. You get answers. Three days later, you're arrested for knowing state secrets. Do you see a possible problem with this arrangement?
winthrowe 9y ago
Information accessible here was SUPPOSED to be all public, with sensitive information located elsewhere, however a handful of improperly redacted documents were also published to the site. Here's a more technical article: https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...
- munk-a 9y ago
  So this is a classic case of a subcontractor doing substandard work, leaving a security hole big enough to drive a truck through, and then trying to sue someone to save face... Sigh. If some of those documents weren't appropriate to be viewed by the general populace then the company was criminally negligent in their handling of the data, the "hacker" saw an open door with a sign reading "free information" on it and didn't know any better before running a crawler over the documents to grab them.
  - cnniris393 9y ago
    And the cries by old geezers in charge, yet clueless of what it is they’re “in-charge of”, that he stole it are eye rolling It’s ageism but at this point I’m pretty convinced old people should be term limited from office The problems we seem to be facing are almost entirely due to their inability to move on Youth shouldn’t spend their lives kowtowing to geezers that quit thinking and are simply peddling what’s become etched in their neurons and “the rules”
    - jinfiesto 9y ago
      I'm not sure about age-limiting old people, but I'm starting to think a basic technological literacy test might not be out of place.
      - Sean1708 9y ago
        If there's two things people in tech seem to vastly underestimate it's how many old people are technologically literate and how many young people are technologically illiterate. I wouldn't be surprised if there are correlations but you're right, age itself isn't the issue.
pasbesoin 9y ago
Instead of effectively designing and administrating their systems, "the powers that be" are taking the "rubber hose, lead pipe" approach. Creating in "law", what they are too distracted and incompetent and egotistical and tight-fisted (tech is a "cost center") to create in fact and systems. They are, in essence, trying to redesign the nature of the Internet by fiat. Historically, accessible resources are accessible. Public by their very nature. If you don't want them publicly accessible, implement (effective) authentication. But this is far too much "trouble" for self-important, "do it my way" lawyers and executives. So, they "define", or redefine -- in a pure fiction of language -- what is "public" and "private". Aside from all else, these... "errors in the system" should be routed around. Denied use of the system. Unfortunately, in this regard, tech has ended up in the position of working for them, rather than vise versa. Personally, I won't work for them, anymore. Every thing I do for them, is against my own interests and, I've come to believe, the common good.
- itronitron 9y ago
  ^^^^^^^ [edit] clarifying to point out that I fully agree and have nothing more to add
- mistermann 9y ago
  Don't forget to mention: the absolutely do not have a democratic mandate from the Canadian public to behave in this manner. Our government in many ways is getting to the point where it can legitimately be considered a rogue, adversarial actor in our country, and unlike in America, we don't have a second amendment as a last resort to protect us.
dv_dt 9y ago
Is there a Canadian version of the EFF, or does the EFF have an Canadian branch?
- nathancahill 9y ago
  Possibly https://cippic.ca/ https://cippic.ca/ They helped Geocoder.ca with their 4 year lawsuit: https://geocoder.ca/?sued=1 https://geocoder.ca/?sued=1
- deleted 9y ago
  [deleted]
- astrodust 9y ago
  It really needs one. Cory Doctorow went to work for the EFF despite being Canadian probably because the Canadian analogues are pretty weak and disorganized by comparison.
  - ExactoKnight 9y ago
    Open Media is pretty good at social media and pressure campaigns. The BCCLA is top notch if you actually need to win a court case. When they take on a case they don't fuck around, and they have high powered lawyers working pro-bono for them.
    - astrodust 9y ago
      The great thing about the EFF is they're not as narrowly focused. Open Media is pretty good, but they pick their fights more carefully and don't tackle social or ethical issues the same was the EFF does.
- slavik81 9y ago
  A couple years ago, I asked Michael Geist[1] a similar question. Me: I am a Canadian citizen and am rather concerned by what appears to be increasing online censorship and erosion of privacy rights in Australia and the UK. If it can happen there, it can happen here. I'd like to do my part to ensure that we can effectively oppose bad public policy when it's proposed in Canada. I deeply respect both the EFF and the ACLU for their work in the United States, but I'm not familiar with equivalent organizations for Canada. Do you have any suggestions as to where should I be sending my holiday donations? Michael Geist: Thanks for your note. There are several groups in Canada that do great work on these issues: 1. CIPPIC - the Canadian Internet Policy and Public Interest Clinic (cippic.ca). I founded this tech law clinic at the University of Ottawa, the only one of its kind in Canada. 2. Open Media - based in Vancouver 3. CCLA - the Canadian Civil Liberties Association 4. CJFE - Canadian Journalists for Freedom of Expression 5. BCCLA - BC Civil Liberties Association All do great work with limited resources. [1]: http://www.michaelgeist.ca/ http://www.michaelgeist.ca/
dustingetz 9y ago
i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?
- mcgarnagle 9y ago
  Yeah except it's a public space – So more like the library doors were unlocked.
- eboyjr 9y ago
  Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.
  - cookingrobot 9y ago
    How about looking into the display window of a shop? If they wanted to keep something secret, it should have been out of sight.
  - losteric 9y ago
    I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.
    - rayiner 9y ago
      That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.
rayiner 9y ago
This seems more like a failure to develop proper social norms with regard to Internet information. > If the information is not supposed to be public, it should not be reachable without authorization or authentication. I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property. It is obvious what parts you're supposed to see and what parts you're not supposed to see. You should be able to prosecute snoops as an alternative to locking things down, as you would with any other private property.
- EpicEng 9y ago
  >I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property Here's a better analogy; you put up a "yard sale" sign in your front yard, fill the driveway with property, and then call the police on the first person who shows up claiming they are trespassing.
  - rayiner 9y ago
    When you put up a "yard sale" sign, you're conveying what is called an "implied license" to access the property. The scope of a trespasser's right to access a property is limited to what a reasonable person would consider to be granted by the license. A reasonable person would assume that a "yard sale" sign grants a license to access the yard on which the sign is posted, but not to go around to the back yard and peek into the basement windows. A public web page is no different. A reasonable person would not assume that content you can only get to by editing a URL manually is supposed to be accessible to the public. A typical person would not even know that you can do that. Those typical people are the ones that get to set the rules, not hackers.
    - gowld 9y ago
      You are old enough to remember a world before Google, yes? I typed http://DeltaAirlines.com http://DeltaAirlines.com into my browser's address bar, looking for info about Delta Airlines. I didn't click a link from another website or copy it from a brochure. Why is that trespassing?
downandout 9y ago
If anyone deserves to go to jail in this case, it's the contractor that took government money to implement a system that relies on security through obscurity when they knew that sensitive documents may be stored in it, and then screwed that up further by allowing documents to be accessed through nothing more than incremented IDs. It should be a basic premise of the law at this point in all civilized countries that if you can access a document by submitting a normal HTTP request with no authorization headers or cookies, then the server's owners intended that document to be public.
- ecocentrik 9y ago
  Or the low paid government employee who didn't bother to read security documentation and uploaded private documents to a system intended only for public documents. "It’s very clear that the software is intended to serve as a public repository of documents. It’s also very clear that there at least 250 documents improperly stored there by the province. Documents that the province had a responsibility to protect, and failed." https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...
walrus01 9y ago
For those who haven't read it, The Hacker Crackdown was released by Sterling as freeware: http://www.mit.edu/hacker/hacker.html http://www.mit.edu/hacker/hacker.html there are also PDF and epub versions if you google for it.
Beltiras 9y ago
I found the most disturbing aspect of it that the defendant is barred from using the internet. This was perhaps a valid sanction to use 20 years ago but today this is tantamount to removing a citizen from society. I understand that you might want to bar vandals from computer access. This seems to be the wrong case to employ such a heavy handed measure.

by sbarre 9y ago

freshmint 9y ago

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.

gowld 9y ago
Googlebot has the resources to fight back against government attacks.
rayiner 9y ago
> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.
- samatman 9y ago
  It... it is accessible from a link That's what a url with an id in it is a link
  - rayiner 9y ago
    A "link" is a DOM element in a web page which references a URL, but a URL is not itself a link. To point a finer point on it: the fact that a URL is referenced in a link means that a user is supposed to see and access it.
    - doomtop 9y ago
      Sounds like you might be thinking of an anchor element. People ask for the "link" when they mean the URI all the time.
      - rayiner 9y ago
        Wikipedia disagrees: > In computing, a hyperlink, or simply a link, is a reference to data that the reader can directly follow either by clicking, tapping, or hovering. A hyperlink points to a whole document or to a specific element within a document. Hypertext is text with hyperlinks. The text that is linked from is called anchor text. A software system that is used for viewing and creating hypertext is a hypertext system, and to create a hyperlink is to hyperlink (or simply to link). A user following hyperlinks is said to navigate or browse the hypertext. The URL in the abstract is not a "link." A link is an element in hypertext.
        always_good 9y ago
        You're just being stubborn. Link is used to mean a URL by the layperson. For example, I don't think I've ever heard my family say "URL" in their life.
        ozzmotik 9y ago
        a "link" is something that connects two entities together in some arbitrary way. a chain link for instance connects the constituent entities of a chain (other links) together. a link in a linked list connects different nodes together. and a hypertext link connects two hypertext resources together. what you're doing is picking one specific definition and applying it liberally to all potential interpretations and contexts of said word. this is why i tend to espouse the virtues of generality over specificity; when you get too specific, you start eliminating the actual utility and flexibility of language. a link in terms of computing is most certainly NOT just a hypertext link, that is only one very specific interpretation of the concept at hand that you're falling back on to try and further your argument. liberally ignoring all the other possible interpretations is quite intellectually dishonest imo. still, you're entitled to perceive things how you want and argue it whatever way you desire. just know that the majority of reasonable and educated individuals will disagree with you. you're up shit creek and you keep denying every paddle that's offered to ya m8
- BadThink6655321 9y ago
  If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early. The kid got documents on a public facing server. He did nothing wrong.
  - systematical 9y ago
    A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They should be glad a seemingly benign teenager discovered their flaw and not some more nefarious actor.
    - maddyboo 9y ago
      Violating Terms of Use is not a crime [1]. 1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-service-not-crime-bypassing https://www.eff.org/deeplinks/2010/07/court-violating-terms-...
      - brailsafe 9y ago
        I agree, however it is worth noting that this link probably only falls within the jurisdiction of the U.S.
      - jessaustin 9y ago
        ...for now. It's pretty clear which direction the legal profession wants to go.
      - gnode 9y ago
        This example is not entirely equivalent. My understanding is that the opinion of the court was that authorisation (for the definition of "without permission") cannot be decided based on method of access. I.e. if you have granted a user access to data, you can't later say they accessed it without permission because they used a proxy or bot to access it (in violation of your TOS). A terms of service can not define law, but it can make explicit what data a provider is authorising a user to access.
- hug 9y ago
  Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files. Turns out some of them were mislabeled, and were private information in the public information filing cabinet. Not so weird, not so antisocial, not his fault, shouldn't be his problem.
  - rayiner 9y ago
    If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.
    - prophesi 9y ago
      Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out. Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful skill to learn how to grep large amounts of text.
      - munk-a 9y ago
        Also, the library was called the "Free Information" library. IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.
    - corny 9y ago
      It's not just a single file that you have been invited to access. This 'someone' has told the world that all of their public documents are in this filing cabinet. And here is how to find a few specific files. It's not a stretch to think the every other file in the (unlocked) cabinet is also public.
- noonespecial 9y ago
  Its more like a bunch of books on a shelf at the library with one 'special' book, unmarked, in the middle where they charge you with theft if you grab it.
- brailsafe 9y ago
  Door handles should be actively jiggled on the regs. If anything it's social behavior. Maybe you'll walk in on an orgy and get to join in!
  - jessaustin 9y ago
    That's what I'm going to tell the next inhabitant I meet while jiggling knobs!
    - brailsafe 9y ago
      That you were just hoping to find an orgy? I fully support this endeavor.
- framtk 9y ago
  Let's say you are reading a free manual online and every page is stored as a different webpage with a common URL and only the last number changing (E.G. page 1 is book/1 page 2 is book/2 and so on). The only way to go to a certain page is with a "next page" link from the previous one. You read the index at page 1 and see that you cant find the information you need but page 500 is missing, a printing error in the index perhaps. Instead of clicking 499 times on the page links to see if the information you need is on page 500 you simply change book/1 to book/500. OH NO, the link on page 499 brings you to page 501 and it's not in the index because page 500 contains the truth about aliens so now you read it and are going to prison. That's in a nutshell what happened
- msla 9y ago
  Imagine a government information bureau. The employees who work there have access to all information. Why wouldn't they? They work at the information bureau. They also answer all questions. Why wouldn't they? They work at the information bureau. You walk up and ask questions. You get answers. Three days later, you're arrested for knowing state secrets. Do you see a possible problem with this arrangement?

winthrowe 9y ago

Information accessible here was SUPPOSED to be all public, with sensitive information located elsewhere, however a handful of improperly redacted documents were also published to the site. Here's a more technical article: https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...

munk-a 9y ago
So this is a classic case of a subcontractor doing substandard work, leaving a security hole big enough to drive a truck through, and then trying to sue someone to save face... Sigh. If some of those documents weren't appropriate to be viewed by the general populace then the company was criminally negligent in their handling of the data, the "hacker" saw an open door with a sign reading "free information" on it and didn't know any better before running a crawler over the documents to grab them.
- cnniris393 9y ago
  And the cries by old geezers in charge, yet clueless of what it is they’re “in-charge of”, that he stole it are eye rolling It’s ageism but at this point I’m pretty convinced old people should be term limited from office The problems we seem to be facing are almost entirely due to their inability to move on Youth shouldn’t spend their lives kowtowing to geezers that quit thinking and are simply peddling what’s become etched in their neurons and “the rules”
  - jinfiesto 9y ago
    I'm not sure about age-limiting old people, but I'm starting to think a basic technological literacy test might not be out of place.
    - Sean1708 9y ago
      If there's two things people in tech seem to vastly underestimate it's how many old people are technologically literate and how many young people are technologically illiterate. I wouldn't be surprised if there are correlations but you're right, age itself isn't the issue.

pasbesoin 9y ago

Instead of effectively designing and administrating their systems, "the powers that be" are taking the "rubber hose, lead pipe" approach. Creating in "law", what they are too distracted and incompetent and egotistical and tight-fisted (tech is a "cost center") to create in fact and systems. They are, in essence, trying to redesign the nature of the Internet by fiat. Historically, accessible resources are accessible. Public by their very nature. If you don't want them publicly accessible, implement (effective) authentication. But this is far too much "trouble" for self-important, "do it my way" lawyers and executives. So, they "define", or redefine -- in a pure fiction of language -- what is "public" and "private". Aside from all else, these... "errors in the system" should be routed around. Denied use of the system. Unfortunately, in this regard, tech has ended up in the position of working for them, rather than vise versa. Personally, I won't work for them, anymore. Every thing I do for them, is against my own interests and, I've come to believe, the common good.

itronitron 9y ago
^^^^^^^ [edit] clarifying to point out that I fully agree and have nothing more to add
mistermann 9y ago
Don't forget to mention: the absolutely do not have a democratic mandate from the Canadian public to behave in this manner. Our government in many ways is getting to the point where it can legitimately be considered a rogue, adversarial actor in our country, and unlike in America, we don't have a second amendment as a last resort to protect us.

dv_dt 9y ago

Is there a Canadian version of the EFF, or does the EFF have an Canadian branch?

nathancahill 9y ago
Possibly https://cippic.ca/ https://cippic.ca/ They helped Geocoder.ca with their 4 year lawsuit: https://geocoder.ca/?sued=1 https://geocoder.ca/?sued=1
deleted 9y ago
[deleted]
astrodust 9y ago
It really needs one. Cory Doctorow went to work for the EFF despite being Canadian probably because the Canadian analogues are pretty weak and disorganized by comparison.
- ExactoKnight 9y ago
  Open Media is pretty good at social media and pressure campaigns. The BCCLA is top notch if you actually need to win a court case. When they take on a case they don't fuck around, and they have high powered lawyers working pro-bono for them.
  - astrodust 9y ago
    The great thing about the EFF is they're not as narrowly focused. Open Media is pretty good, but they pick their fights more carefully and don't tackle social or ethical issues the same was the EFF does.
slavik81 9y ago
A couple years ago, I asked Michael Geist[1] a similar question. Me: I am a Canadian citizen and am rather concerned by what appears to be increasing online censorship and erosion of privacy rights in Australia and the UK. If it can happen there, it can happen here. I'd like to do my part to ensure that we can effectively oppose bad public policy when it's proposed in Canada. I deeply respect both the EFF and the ACLU for their work in the United States, but I'm not familiar with equivalent organizations for Canada. Do you have any suggestions as to where should I be sending my holiday donations? Michael Geist: Thanks for your note. There are several groups in Canada that do great work on these issues: 1. CIPPIC - the Canadian Internet Policy and Public Interest Clinic (cippic.ca). I founded this tech law clinic at the University of Ottawa, the only one of its kind in Canada. 2. Open Media - based in Vancouver 3. CCLA - the Canadian Civil Liberties Association 4. CJFE - Canadian Journalists for Freedom of Expression 5. BCCLA - BC Civil Liberties Association All do great work with limited resources. [1]: http://www.michaelgeist.ca/ http://www.michaelgeist.ca/

dustingetz 9y ago

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

mcgarnagle 9y ago
Yeah except it's a public space – So more like the library doors were unlocked.
eboyjr 9y ago
Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.
- cookingrobot 9y ago
  How about looking into the display window of a shop? If they wanted to keep something secret, it should have been out of sight.
- losteric 9y ago
  I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.
  - rayiner 9y ago
    That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

rayiner 9y ago

This seems more like a failure to develop proper social norms with regard to Internet information. > If the information is not supposed to be public, it should not be reachable without authorization or authentication. I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property. It is obvious what parts you're supposed to see and what parts you're not supposed to see. You should be able to prosecute snoops as an alternative to locking things down, as you would with any other private property.

EpicEng 9y ago
>I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property Here's a better analogy; you put up a "yard sale" sign in your front yard, fill the driveway with property, and then call the police on the first person who shows up claiming they are trespassing.
- rayiner 9y ago
  When you put up a "yard sale" sign, you're conveying what is called an "implied license" to access the property. The scope of a trespasser's right to access a property is limited to what a reasonable person would consider to be granted by the license. A reasonable person would assume that a "yard sale" sign grants a license to access the yard on which the sign is posted, but not to go around to the back yard and peek into the basement windows. A public web page is no different. A reasonable person would not assume that content you can only get to by editing a URL manually is supposed to be accessible to the public. A typical person would not even know that you can do that. Those typical people are the ones that get to set the rules, not hackers.
  - gowld 9y ago
    You are old enough to remember a world before Google, yes? I typed http://DeltaAirlines.com http://DeltaAirlines.com into my browser's address bar, looking for info about Delta Airlines. I didn't click a link from another website or copy it from a brochure. Why is that trespassing?

downandout 9y ago

If anyone deserves to go to jail in this case, it's the contractor that took government money to implement a system that relies on security through obscurity when they knew that sensitive documents may be stored in it, and then screwed that up further by allowing documents to be accessed through nothing more than incremented IDs. It should be a basic premise of the law at this point in all civilized countries that if you can access a document by submitting a normal HTTP request with no authorization headers or cookies, then the server's owners intended that document to be public.

ecocentrik 9y ago
Or the low paid government employee who didn't bother to read security documentation and uploaded private documents to a system intended only for public documents. "It’s very clear that the software is intended to serve as a public repository of documents. It’s also very clear that there at least 250 documents improperly stored there by the province. Documents that the province had a responsibility to protect, and failed." https://evandentremont.com/some-information-on-the-freedom-of-information-hack/ https://evandentremont.com/some-information-on-the-freedom-o...

walrus01 9y ago

For those who haven't read it, The Hacker Crackdown was released by Sterling as freeware: http://www.mit.edu/hacker/hacker.html http://www.mit.edu/hacker/hacker.html there are also PDF and epub versions if you google for it.

Beltiras 9y ago

I found the most disturbing aspect of it that the defendant is barred from using the internet. This was perhaps a valid sanction to use 20 years ago but today this is tantamount to removing a citizen from society. I understand that you might want to bar vandals from computer access. This seems to be the wrong case to employ such a heavy handed measure.