5 ms·

The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still

by harryh 9y ago

The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.

ozzmotik 9y ago
in this context i don't think your metaphor applies. your house isn't a freely accessible entity that has been declared as such which has certain areas of it that are off limits but never clearly defined as just that.
- harryh 9y ago
  So what you are saying is that what matters is the intent of the property owner and the general understanding of the population about what is typically public vs private property?
  - ozzmotik 9y ago
    i would say that those things are certainly relevant, but it would be perhaps very myopic to say they are the only relevant concepts. one should also keep in mind the intent of the individual attempting to access the property, and the perception of what they're doing when they do within their mind as an expression of that intent, for instance. if i have been to led to believe that your property is public through a means that is debatably authoritative, such as a sign indicating it as such, then for all intents and purposes, anything i interact with inside of it in my mind is perfectly acceptable because it falls within the context of pre-established permissions. and if there are parts of your property that for some reason you would prefer private but they are not demarcated as such, am i really in the wrong to interact with them or go inside of them if i have no external information telling me that i should not? in the context of the article and the problem at hand, the teenager downloaded a bunch of things that were supposed to be public access, but also accidentally downloaded some things that were confidential though not clearly marked as such (im assuming based on available information) and so the only real way he would have known they were confidential was if he actually perused the contents of them. that would be like having a room that is private property and off-limits, and it is marked as such, but the marking is inside the room and can only be seen by entering it and as such violating the private nature of said room. but really these are all just my thoughts on it and i certainly don't think i'm right or anything. it's just fun to talk ya know
    - harryh 9y ago
      I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidentally misreads "private" as "public."? These things aren't really mitigating. This is why the law tends to fall back on what a hypothetical "reasonable person" would think. I'm not as much of a hardliner as rayiner on this particular case as I think there are some facts in favor of thinking of these documents as public: - it was a government website - it was specifically set up for the purpose of sharing foia requests - the data in the documents was not easily identifiable as private But when it comes to the general principle where some HNers seem to think "If the webserver responds with a 200 then it's perfectly fine." I have to disagree. Imagine a different scenario in which we were talking about tax returns instead of foia requests. You're looking at yours at http://www.canadataxes.com/return?id=1234 http://www.canadataxes.com/return?id=1234 and you realize that if you inc the ID you get the tax return of some other random Canadian citizen. In that case it would be immediately obvious that someone had made a mistake and you were accessing information you shouldn't. A "reasonable person" would understand that a mistake had been made. It would then be clearly illegal to write a script to scrape down the docs for every ID.
      - EamonnMR 9y ago
        Let's say he picked his first random URL and got someone's tax documents. A reasonable person would probably report it and quit prying. But it sounds like the bad documents where mixed in with good documents that he was downloading programmatically, so a reasonable person probably would not have the time to read every single document to determine if it contained personal information.
        harryh 9y ago
        Yes, that's what I was getting at when I said: "the data in the documents was not easily identifiable as private" as a mitigating factor.
      - c22 9y ago
        But what if someone had just moved to Canada from Norway and didn't realize that tax return information was supposed to be private? I think it's fair to put most of the responsibility on those who have implemented a system that serves private data in response to public http requests. Presumably this is the party that has both been entrusted with the private data and has the technological and legal resources to understand what can and cannot be served publicly and appropriately configure their systems to do so.
ljm 9y ago
You're right, it is. If you keep forgetting to lock your door then the situation changes.
- JoeAltmaier 9y ago
  Its not the lock that makes it illegal. Its the act. Somebody reaches into your pocket to take your wallet, its not 'ok' because you didn't lock your pocket, is it? We're not yet to the point where its the victim's fault when victimized by a criminal. It may seem that way when there are so many active criminals. But some places its still possible to trust your neighbors. I live in one.
- harryh 9y ago
  That's not true at all. I grew up in a relatively small town. Literal years went by where my parents didn't lock the back door. It would have been illegal for someone to enter the house without their permission for that entire time period.
pdonis 9y ago
> If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission. This doesn't seem like an apt analogy for the actual case described in the article, though. That case seems more like: you left a bunch of stuff at the curb with a sign that says "free for the taking", but didn't realize that you left some stuff there that you actually didn't want taken.
tremon 9y ago
Yet if you forget to lock your car doors or leave valuable items in plain sight on the back seat, the insurance company will not honor your claim.
Sean1708 9y ago
I think that's a terrible analogy, a better (albeit not perfect) one in my opinion is: If I request access to your house (send a HTTP request) and you grant me access (give me whatever I was requesting), I don't think I should be arrested for trespassing.
- harryh 9y ago
  If I install a one of those new fancy IoT locks on my door but it has a bug and unlocks for you when it shouldn't, it's still trespassing if you enter my house.

by harryh 9y ago

ozzmotik 9y ago

in this context i don't think your metaphor applies. your house isn't a freely accessible entity that has been declared as such which has certain areas of it that are off limits but never clearly defined as just that.

harryh 9y ago
So what you are saying is that what matters is the intent of the property owner and the general understanding of the population about what is typically public vs private property?
- ozzmotik 9y ago
  i would say that those things are certainly relevant, but it would be perhaps very myopic to say they are the only relevant concepts. one should also keep in mind the intent of the individual attempting to access the property, and the perception of what they're doing when they do within their mind as an expression of that intent, for instance. if i have been to led to believe that your property is public through a means that is debatably authoritative, such as a sign indicating it as such, then for all intents and purposes, anything i interact with inside of it in my mind is perfectly acceptable because it falls within the context of pre-established permissions. and if there are parts of your property that for some reason you would prefer private but they are not demarcated as such, am i really in the wrong to interact with them or go inside of them if i have no external information telling me that i should not? in the context of the article and the problem at hand, the teenager downloaded a bunch of things that were supposed to be public access, but also accidentally downloaded some things that were confidential though not clearly marked as such (im assuming based on available information) and so the only real way he would have known they were confidential was if he actually perused the contents of them. that would be like having a room that is private property and off-limits, and it is marked as such, but the marking is inside the room and can only be seen by entering it and as such violating the private nature of said room. but really these are all just my thoughts on it and i certainly don't think i'm right or anything. it's just fun to talk ya know
  - harryh 9y ago
    I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidentally misreads "private" as "public."? These things aren't really mitigating. This is why the law tends to fall back on what a hypothetical "reasonable person" would think. I'm not as much of a hardliner as rayiner on this particular case as I think there are some facts in favor of thinking of these documents as public: - it was a government website - it was specifically set up for the purpose of sharing foia requests - the data in the documents was not easily identifiable as private But when it comes to the general principle where some HNers seem to think "If the webserver responds with a 200 then it's perfectly fine." I have to disagree. Imagine a different scenario in which we were talking about tax returns instead of foia requests. You're looking at yours at http://www.canadataxes.com/return?id=1234 http://www.canadataxes.com/return?id=1234 and you realize that if you inc the ID you get the tax return of some other random Canadian citizen. In that case it would be immediately obvious that someone had made a mistake and you were accessing information you shouldn't. A "reasonable person" would understand that a mistake had been made. It would then be clearly illegal to write a script to scrape down the docs for every ID.
    - EamonnMR 9y ago
      Let's say he picked his first random URL and got someone's tax documents. A reasonable person would probably report it and quit prying. But it sounds like the bad documents where mixed in with good documents that he was downloading programmatically, so a reasonable person probably would not have the time to read every single document to determine if it contained personal information.
      - harryh 9y ago
        Yes, that's what I was getting at when I said: "the data in the documents was not easily identifiable as private" as a mitigating factor.
    - c22 9y ago
      But what if someone had just moved to Canada from Norway and didn't realize that tax return information was supposed to be private? I think it's fair to put most of the responsibility on those who have implemented a system that serves private data in response to public http requests. Presumably this is the party that has both been entrusted with the private data and has the technological and legal resources to understand what can and cannot be served publicly and appropriately configure their systems to do so.

ljm 9y ago

You're right, it is. If you keep forgetting to lock your door then the situation changes.

JoeAltmaier 9y ago
Its not the lock that makes it illegal. Its the act. Somebody reaches into your pocket to take your wallet, its not 'ok' because you didn't lock your pocket, is it? We're not yet to the point where its the victim's fault when victimized by a criminal. It may seem that way when there are so many active criminals. But some places its still possible to trust your neighbors. I live in one.
harryh 9y ago
That's not true at all. I grew up in a relatively small town. Literal years went by where my parents didn't lock the back door. It would have been illegal for someone to enter the house without their permission for that entire time period.

pdonis 9y ago

> If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission. This doesn't seem like an apt analogy for the actual case described in the article, though. That case seems more like: you left a bunch of stuff at the curb with a sign that says "free for the taking", but didn't realize that you left some stuff there that you actually didn't want taken.

tremon 9y ago

Yet if you forget to lock your car doors or leave valuable items in plain sight on the back seat, the insurance company will not honor your claim.

Sean1708 9y ago

I think that's a terrible analogy, a better (albeit not perfect) one in my opinion is: If I request access to your house (send a HTTP request) and you grant me access (give me whatever I was requesting), I don't think I should be arrested for trespassing.

harryh 9y ago
If I install a one of those new fancy IoT locks on my door but it has a bug and unlocks for you when it shouldn't, it's still trespassing if you enter my house.