4 ms·

he sure took it to a whole other level by accessing third party sites and accounts using the hacked credentials.

tekacs 8y ago
They didn't actually access those accounts, they only verified that they could. Definitely more likely to get peoples' hackles up, but worth bearing in mind. Quote: > As for all other services, we did not complete the final step of the password resets for privacy reasons meaning we did not log into or take over the user accounts, or access any information stored in online services, although we could have.
- cormacrelf 8y ago
  >> We did not complete the final step ... for privacy reasons But they did read a ton of email they knew was private? Censoring it for public consumption doesn't change the fact that they accessed it. Anybody doing this kind of thing in Australia should be familiar with the 'Cybercrime Act 2001' model. In NSW it is implemented in Part 6 of the Crimes Act 1900, and other states also mirror the Cth legislation with various modifications. Some of these (eg Criminal Code 1995 (Cth) s 478.1 / Crimes Act 1900 s 308H) are absolute liability offences, so it is not necessary to prove anything about your intent. Read the definitions in, eg, Criminal Code 1995 s 476.1 for how broad they go ('guided or unguided electromagnetic energy'). The federal offences have to be within the constitutional limits on Cth legislative power, so they 'only' apply to Cth computers/data or when 'the access to, or modification of, the restricted data is caused by means of a carriage service', i.e. The Internet. So they can usually be applied. These provisions are extremely broad, so there's a lot resting on prosecutorial discretion. Nobody can say for sure whether these things breach the act, but there are plenty of ways to interpret the provisions and cast the actions within them. For example, they might have impaired the electronic communication to or from a computer per s 477.3, and it's not like they were asking anyone first. Also 'here are some private emails we received' is just so plausibly within 'unauthorised access to restricted data'. Probably talk to a lawyer before hitting the big Publish button on Medium Dot Com, and maybe refrain from actually deliberately receiving people's emails, especially when everyone already knows that email compromise = everything and there's nothing to prove. https://www.legislation.gov.au/Details/C2018C00298/Html/Volume_2#_Toc520809589 https://www.legislation.gov.au/Details/C2018C00298/Html/Volu... http://www6.austlii.edu.au/cgi-bin/viewdb/au/legis/nsw/consol_act/ca190082/#s308 http://www6.austlii.edu.au/cgi-bin/viewdb/au/legis/nsw/conso...

They didn't actually access those accounts, they only verified that they could. Definitely more likely to get peoples' hackles up, but worth bearing in mind. Quote: > As for all other services, we did not complete the final step of the password resets for privacy reasons meaning we did not log into or take over the user accounts, or access any information stored in online services, although we could have.

cormacrelf 8y ago
>> We did not complete the final step ... for privacy reasons But they did read a ton of email they knew was private? Censoring it for public consumption doesn't change the fact that they accessed it. Anybody doing this kind of thing in Australia should be familiar with the 'Cybercrime Act 2001' model. In NSW it is implemented in Part 6 of the Crimes Act 1900, and other states also mirror the Cth legislation with various modifications. Some of these (eg Criminal Code 1995 (Cth) s 478.1 / Crimes Act 1900 s 308H) are absolute liability offences, so it is not necessary to prove anything about your intent. Read the definitions in, eg, Criminal Code 1995 s 476.1 for how broad they go ('guided or unguided electromagnetic energy'). The federal offences have to be within the constitutional limits on Cth legislative power, so they 'only' apply to Cth computers/data or when 'the access to, or modification of, the restricted data is caused by means of a carriage service', i.e. The Internet. So they can usually be applied. These provisions are extremely broad, so there's a lot resting on prosecutorial discretion. Nobody can say for sure whether these things breach the act, but there are plenty of ways to interpret the provisions and cast the actions within them. For example, they might have impaired the electronic communication to or from a computer per s 477.3, and it's not like they were asking anyone first. Also 'here are some private emails we received' is just so plausibly within 'unauthorised access to restricted data'. Probably talk to a lawyer before hitting the big Publish button on Medium Dot Com, and maybe refrain from actually deliberately receiving people's emails, especially when everyone already knows that email compromise = everything and there's nothing to prove. https://www.legislation.gov.au/Details/C2018C00298/Html/Volume_2#_Toc520809589 https://www.legislation.gov.au/Details/C2018C00298/Html/Volu... http://www6.austlii.edu.au/cgi-bin/viewdb/au/legis/nsw/consol_act/ca190082/#s308 http://www6.austlii.edu.au/cgi-bin/viewdb/au/legis/nsw/conso...