8 ms·

This is obfuscating the law. It’s not illegal to disclose anything, it’s illegal to hack (in certain circumstances). Nobody is getting prosecuted for disclosure

by ikeboy 8y ago

This is obfuscating the law. It’s not illegal to disclose anything, it’s illegal to hack (in certain circumstances). Nobody is getting prosecuted for disclosure, they’re getting prosecuted for hacking. Now, maybe those forms of hacking should be legal. I’m sympathetic to their cause. But it’s disingenuous to frame this as disclosure being illegal. As a side note, the post implies companies are using criminal sanctions as a threat to prevent disclosure - this is itself illegal extortion.

Drakim 8y ago
If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?
- ikeboy 8y ago
  Probably, it isn't trying to protect anything copyrighted. Ask a lawyer to be sure
  - Drakim 8y ago
    Wouldn't the software inside the lock be copyrighted?
    - delinka 8y ago
      But you're not trying to access the software, you're trying to unlock the lock. DMCA concerns itself with copyrighted works behind some protection mechanism: technically, if you're accessing the lock's firmware, discover it's encrypted, then attempt to decrypt it, you're violating the DMCA. In addition, if you publish the decrypted software, you're infringing copyright. In either case, these are probably not CFAA violations.
- Meist1 8y ago
  Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]" A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet] Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA. NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY
- tptacek 8y ago
  Almost certainly not (if the lock somehow phones home to a central server and your research involves subverting the server, you could have problems, but no lock I know of works that way). While it might not be illegal to mess with a lock you've purchased, it could be unlawful, in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting arrested for doing that work, I wouldn't bet against you getting sued, which is a far more common occurrence. Researchers getting arrested: rare. Researchers getting sued: a little less rare (still pretty rare).
  - PurpleBoxDragon 8y ago
    Such one sided contracts where there was never a possibility of negotiation need to be tossed out. This applies to the EULA of a smart lock to a lease agreement with some super corporation located in a different state. Such contracts can only be consensual when involving two entities of similar power.
    - tptacek 8y ago
      This is pretty silly. All sorts of valid contracts are non-negotiable. You have an option: return the device for a refund.
      - marcosdumay 8y ago
        In a Democracy, one can not resign fundamental rights in a contract. Not in one you get to read before signing, and definitively not in one you can only read after signing. You can agree to some punishment (like in an NDA). But if it's in a level that would destroy your life, it ought to be illegal again. And every time you agree for some punishment for exercising a fundamental right, you must gain something proportional to the right taken, otherwise it ought to be illegal again. It's impossible to have a democracy if most of the population is slave due to some contractual clause.
  - delinka 8y ago
    And further, if you're doing this on your own and never publish anything, it's not like Bluetooth Locks, Inc knows what you're up to and just magically serves you with a lawsuit.
iokanuon 8y ago
You don't really need to "hack" to find vulnerabilities. As an extreme point, spotting your own username and password in a URL would not be considered hacking.
- ikeboy 8y ago
  Exactly my point. These are 2 distinct things that the EFF is conflating
  - emeraldd 8y ago
    You may know that, but does the average person who might find themselves in a jury pool know that? Would they understand the distinction? To the average lady person, this would be like saying alizeran crimson is more than just a red paint.
rayiner 8y ago
It’s impressive how the article manages to conflate the two ideas the whole way through, without acknowledging the difference.
Meist1 8y ago
As far as the CFAA, you may have a point. However, the EFF is spot on when it comes to the DMCA, which does in fact allow for speech to be restricted even when no identifiable 'hack' under the CFAA is alleged. The MBTA case is probably the most famous - https://www.wired.com/2008/08/eff-to-appeal-r/ https://www.wired.com/2008/08/eff-to-appeal-r/ Also, while not approving of 'weev' or his methods, I think most on HN and elsewhere would agree that merely visiting a website should not be considered a hack - https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/ - adding an additional layer to this mess.
- crankylinuxuser 8y ago
  Ive always wanted to know, using CFAA logic, how does one know if someone is offering a service to be used online? Is there a standard service that announces available services? If not, how do I know if I'm 'allowed' to use Google.com:80 ? Where is that fact delineated?
  - snowwrestler 8y ago
    In the terms of service. For Google, that's: https://policies.google.com/terms https://policies.google.com/terms
    - crankylinuxuser 8y ago
      That's fine you gave me a link and a path... How do I know I'm allowed to go there?
      - snowwrestler 8y ago
        How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
        lscharen 8y ago
Retric 8y ago
Hacking when you own the device in question is hardly what most people mean when they use the term hacking.
- arminiusreturns 8y ago
  It's like everyone has forgotten the principle of first sale... and it really annoys me how much HN users allow the Overton window to be moved on topics of freedom like this.
- 3pt14159 8y ago
  The problem is that we're in a society where increasingly important things are behind APIs and we're supposed to just trust that they won't fuck it up unless they have a bug bounty program. I don't give a shit about the bug bounty program for the bounty per-se, I want them to exist because I want it to be legal to attempt to hack things (without breaking working systems on purpose) because blackhats do it anyway.
saint_abroad 8y ago
> It’s not illegal to disclose anything When it comes to the DCMA, that's debatable. In a court of law. Unless, of course, you don't have the money to match their lawyers. http://www.cs.cmu.edu/~dst/GeoHot/ http://www.cs.cmu.edu/~dst/GeoHot/
jackhack 8y ago
>>It’s not illegal to disclose anything, it’s illegal to hack So it's not illegal to disclose, just illegal to discover? No offense intended, but this sort of wordsmithing doesn't reassure me at all.
Kalium 8y ago
In a world where "illegal hacking" can mean "making a document you legally own on a device you legally own usable with other software", there is most definitely a problem. Further, how does one discover weaknesses without doing things? Are any and all discussions of security to be confined to the purely hypothetical?

by ikeboy 8y ago

Drakim 8y ago

If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?

ikeboy 8y ago
Probably, it isn't trying to protect anything copyrighted. Ask a lawyer to be sure
- Drakim 8y ago
  Wouldn't the software inside the lock be copyrighted?
  - delinka 8y ago
    But you're not trying to access the software, you're trying to unlock the lock. DMCA concerns itself with copyrighted works behind some protection mechanism: technically, if you're accessing the lock's firmware, discover it's encrypted, then attempt to decrypt it, you're violating the DMCA. In addition, if you publish the decrypted software, you're infringing copyright. In either case, these are probably not CFAA violations.
Meist1 8y ago
Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]" A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet] Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA. NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY
tptacek 8y ago
Almost certainly not (if the lock somehow phones home to a central server and your research involves subverting the server, you could have problems, but no lock I know of works that way). While it might not be illegal to mess with a lock you've purchased, it could be unlawful, in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting arrested for doing that work, I wouldn't bet against you getting sued, which is a far more common occurrence. Researchers getting arrested: rare. Researchers getting sued: a little less rare (still pretty rare).
- PurpleBoxDragon 8y ago
  Such one sided contracts where there was never a possibility of negotiation need to be tossed out. This applies to the EULA of a smart lock to a lease agreement with some super corporation located in a different state. Such contracts can only be consensual when involving two entities of similar power.
  - tptacek 8y ago
    This is pretty silly. All sorts of valid contracts are non-negotiable. You have an option: return the device for a refund.
    - marcosdumay 8y ago
      In a Democracy, one can not resign fundamental rights in a contract. Not in one you get to read before signing, and definitively not in one you can only read after signing. You can agree to some punishment (like in an NDA). But if it's in a level that would destroy your life, it ought to be illegal again. And every time you agree for some punishment for exercising a fundamental right, you must gain something proportional to the right taken, otherwise it ought to be illegal again. It's impossible to have a democracy if most of the population is slave due to some contractual clause.
- delinka 8y ago
  And further, if you're doing this on your own and never publish anything, it's not like Bluetooth Locks, Inc knows what you're up to and just magically serves you with a lawsuit.

iokanuon 8y ago

You don't really need to "hack" to find vulnerabilities. As an extreme point, spotting your own username and password in a URL would not be considered hacking.

ikeboy 8y ago
Exactly my point. These are 2 distinct things that the EFF is conflating
- emeraldd 8y ago
  You may know that, but does the average person who might find themselves in a jury pool know that? Would they understand the distinction? To the average lady person, this would be like saying alizeran crimson is more than just a red paint.

rayiner 8y ago

It’s impressive how the article manages to conflate the two ideas the whole way through, without acknowledging the difference.

Meist1 8y ago

As far as the CFAA, you may have a point. However, the EFF is spot on when it comes to the DMCA, which does in fact allow for speech to be restricted even when no identifiable 'hack' under the CFAA is alleged. The MBTA case is probably the most famous - https://www.wired.com/2008/08/eff-to-appeal-r/ https://www.wired.com/2008/08/eff-to-appeal-r/ Also, while not approving of 'weev' or his methods, I think most on HN and elsewhere would agree that merely visiting a website should not be considered a hack - https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/ - adding an additional layer to this mess.

crankylinuxuser 8y ago
Ive always wanted to know, using CFAA logic, how does one know if someone is offering a service to be used online? Is there a standard service that announces available services? If not, how do I know if I'm 'allowed' to use Google.com:80 ? Where is that fact delineated?
- snowwrestler 8y ago
  In the terms of service. For Google, that's: https://policies.google.com/terms https://policies.google.com/terms
  - crankylinuxuser 8y ago
    That's fine you gave me a link and a path... How do I know I'm allowed to go there?
    - snowwrestler 8y ago
      How did you know that you're allowed to come here? And yet, here you are. I don't think you actually believe what you're trying to argue here.
      - lscharen 8y ago

Retric 8y ago

Hacking when you own the device in question is hardly what most people mean when they use the term hacking.

arminiusreturns 8y ago
It's like everyone has forgotten the principle of first sale... and it really annoys me how much HN users allow the Overton window to be moved on topics of freedom like this.
3pt14159 8y ago
The problem is that we're in a society where increasingly important things are behind APIs and we're supposed to just trust that they won't fuck it up unless they have a bug bounty program. I don't give a shit about the bug bounty program for the bounty per-se, I want them to exist because I want it to be legal to attempt to hack things (without breaking working systems on purpose) because blackhats do it anyway.

saint_abroad 8y ago

> It’s not illegal to disclose anything When it comes to the DCMA, that's debatable. In a court of law. Unless, of course, you don't have the money to match their lawyers. http://www.cs.cmu.edu/~dst/GeoHot/ http://www.cs.cmu.edu/~dst/GeoHot/

jackhack 8y ago

>>It’s not illegal to disclose anything, it’s illegal to hack So it's not illegal to disclose, just illegal to discover? No offense intended, but this sort of wordsmithing doesn't reassure me at all.

Kalium 8y ago

In a world where "illegal hacking" can mean "making a document you legally own on a device you legally own usable with other software", there is most definitely a problem. Further, how does one discover weaknesses without doing things? Are any and all discussions of security to be confined to the purely hypothetical?