5 ms·

Student who hacked Bill O'Reilly gets 30 months

19 points by labboy 16y ago

hop 16y ago
2.5 years in jail for a DDoS attack seems disproportionately steep. He made a few websites temporarily inoperable, sounds more on the level of a bad prank than a felony with jail time on par with armed robbery.
- poet 16y ago
  According to the charges that were filed [1], the defendant also played a role in the creation of the botnet used in the attack. In addition to the DDoS attack there is the issue of accessing machines he was not authorized to. He pled guilty [2], so I don't think 2.5 years is that surprising. [1] http://www.justice.gov/usao/ohn/news/2010/Mitchell%20Frost%20Information.pdf http://www.justice.gov/usao/ohn/news/2010/Mitchell%20Frost%2... [2] http://www.ohio.com/news/break_news/95045294.html http://www.ohio.com/news/break_news/95045294.html
  - marcusbooster 16y ago
    Another shining example of our justice system that uses competition to arrive at an equilibrium. Of course most encounters match up an opponent with unlimited resources (the state) versus someone with limited means (in this case a student). The prosecution seeks the max, in this case 15 years, to persuade the defendant to plea the case out. His options are to try and defend himself with no resources (a public defender is worth next to nothing) or make a deal. The prosecutor and judge get to look "tough on computer crime" which will help their resume when looking to advance their careers, and the kid gets to have the end of his 20's. All that is left out is "justice", and by that I mean let the punishment fit the crime. And now society must carry the debt, both economically (housing the kid) and socially - will our streets be safer over the course of his lifetime once he gets churned out of prison.
    - poet 16y ago
      I'm familiar with the general arguments you are presenting but they don't hold up in this situation. This case is clearcut. It is not some poor kid being beat down by the system. It is a computer criminal being sentenced to a punishment that fits his crimes. I suggest you read the references I cited above and take note of the wide array computer crime the defendant was involved in. You're also exaggerating. The defendant does get to have the end of his twenties. He's going to be out of jail when he's 26.
      - marcusbooster 16y ago
        I have read it, and he still has a 3 year probation after his prison term. When they accuse him of "fraudulently obtaining user names and passwords and stealing personal identification and financial information" - does that mean he went after this information, or more likely one of the computers in the botnet happened to have such information residing on it. It's possible he didn't know of any financial information and they would throw the book at him anyway just to get the initial charge and work down from there. We all know there are differences in computer crime, that our legal system isn't able to make a distinction does not make an argument.
        poet 16y ago
        Does that mean he went after this information, or more likely one of the computers in the botnet happened to have such information residing on it. It's possible he didn't know of any financial information... No it is not possible. Had you actually read the above references as you claimed you would know that after executing a search warrant the FBI found credit card numbers and SSNs on computers in his dorm room. It's in Section 12 of the FBI document. Sure, maybe that was a result of a chat room he was logging. Maybe he didn't specifically go after this information himself. But at the very least he still chose to retain that information on his computer and at worst he did indeed go after the information himself.
      - seigenblues 16y ago
        The defendant is also getting more time than the cop in Oakland who shot a restrained, unarmed man. Maybe this punishment fits this crime and its the other that doesn't, but marcusbooster's indictment of the system as a whole having some skewed incentives still has some merit, i think.
- tptacek 16y ago
  That's not what happened, but: why? Why is that disproportionately steep? Because it's so easy to do, it doesn't seem like it should be a crime? Talk to businesses dealing with DDoS attacks sometime. They're tearing their hair out and losing real money because of some sociopath's vanity "attack". Why, exactly, are we supposed to look the other way?
- maukdaddy 16y ago
  If I rob someone of $10k I'm going to jail. If I use a botnet to take their site offline, resulting in a loss of revenue or donations of $10k, I should also go to jail. Just because it is easy or common doesn't make it any less of a crime.
  - InclinedPlane 16y ago
    It's worse than that. Imagine if you robbed several thousand people's houses and stole their mp3 players. Then you started throwing the mp3 players at someone's storefront, breaking glass, breaking dishes, causing a mess, preventing patrons from entering, etc. In what crazy world would you not be harshly punished for such multiple crimes? The reality is even worse than this, as the attacker in question also stole personal financial information (CC#s, SSNs, etc.) from his botnet victims.
mattmaroon 16y ago
Go Zips!
- mattmaroon 16y ago
  Not too many other HNers who went to Akron U I see.
wakeup 16y ago
What the fuck motherfuckers?
da5e 16y ago
It's ridiculous how easy it is to go to jail in the USA. It doesn't really solve anything for lower level non-violent crimes. Surely if they can rehab for drugs, they can rehab for hacking.
privacyguru 16y ago
Old news from last week.
privacyguru 16y ago
The student didn't "hack" O'Reilly's site, he conducted DDoS attacks. Totally Different.
- tptacek 16y ago
  From a botnet that he set up. It's actually worse than "hacking O'Reilly's site".
deleted 16y ago
[deleted]
deleted 16y ago
[deleted]
bugsy 16y ago
It's utterly ridiculous and a waste of resources that these sorts of things are felony criminal prosecutions at all. Putting people in state prison at a cost of $70,000 a year in housing costs, PLUS the loss of income and other tax they would have paid plus the loss of their support of family who then goes on welfare, this should only be reserved for people who are an actual imminent threat and danger to the community. Hacking should be something that gets fines only. Let the hacker pay back the cost of his damage, but there is no reason for taxpayers to bear hundreds of thousands of dollars in costs to warehouse these guys with actual hardened criminals whom they will have to make deals with in order to survive in the pen. Then, when they get out, they owe favors to actual criminal syndicates which they formerly had no relation to. Sheesh.
- tptacek 16y ago
  If you broke into a store, stole a raft of credit card numbers from carbons, and rigged the registers to feed you more of them in the future, common sense would inform us that you're a criminal. Similarly, if some jackass broke into a series of automobiles and drove them to a store's parking lot to inconvenience or cripple its operations, we'd have no trouble conceiving of the criminal charges that might result from that. The only difference between those crime and the crime committed here was the ease with which the Internet allowed it to be committed. No doubt, the person running the botnet collecting credit card numbers and launching DDoS attacks didn't feel like a criminal. He felt like a prankster. But how is that relevant? I say it isn't relevant. At all. The Internet has a knack for making reality feel unreal. But there is a reality, and it does not give a shit about your message board posts.
donspaulding 16y ago
Elsewhere, Bill O' Reilly was overheard saying, "F#$k it, we'll give him life!"

19 points by labboy 16y ago

hop 16y ago

2.5 years in jail for a DDoS attack seems disproportionately steep. He made a few websites temporarily inoperable, sounds more on the level of a bad prank than a felony with jail time on par with armed robbery.

poet 16y ago
According to the charges that were filed [1], the defendant also played a role in the creation of the botnet used in the attack. In addition to the DDoS attack there is the issue of accessing machines he was not authorized to. He pled guilty [2], so I don't think 2.5 years is that surprising. [1] http://www.justice.gov/usao/ohn/news/2010/Mitchell%20Frost%20Information.pdf http://www.justice.gov/usao/ohn/news/2010/Mitchell%20Frost%2... [2] http://www.ohio.com/news/break_news/95045294.html http://www.ohio.com/news/break_news/95045294.html
- marcusbooster 16y ago
  Another shining example of our justice system that uses competition to arrive at an equilibrium. Of course most encounters match up an opponent with unlimited resources (the state) versus someone with limited means (in this case a student). The prosecution seeks the max, in this case 15 years, to persuade the defendant to plea the case out. His options are to try and defend himself with no resources (a public defender is worth next to nothing) or make a deal. The prosecutor and judge get to look "tough on computer crime" which will help their resume when looking to advance their careers, and the kid gets to have the end of his 20's. All that is left out is "justice", and by that I mean let the punishment fit the crime. And now society must carry the debt, both economically (housing the kid) and socially - will our streets be safer over the course of his lifetime once he gets churned out of prison.
  - poet 16y ago
    I'm familiar with the general arguments you are presenting but they don't hold up in this situation. This case is clearcut. It is not some poor kid being beat down by the system. It is a computer criminal being sentenced to a punishment that fits his crimes. I suggest you read the references I cited above and take note of the wide array computer crime the defendant was involved in. You're also exaggerating. The defendant does get to have the end of his twenties. He's going to be out of jail when he's 26.
    - marcusbooster 16y ago
      I have read it, and he still has a 3 year probation after his prison term. When they accuse him of "fraudulently obtaining user names and passwords and stealing personal identification and financial information" - does that mean he went after this information, or more likely one of the computers in the botnet happened to have such information residing on it. It's possible he didn't know of any financial information and they would throw the book at him anyway just to get the initial charge and work down from there. We all know there are differences in computer crime, that our legal system isn't able to make a distinction does not make an argument.
      - poet 16y ago
        Does that mean he went after this information, or more likely one of the computers in the botnet happened to have such information residing on it. It's possible he didn't know of any financial information... No it is not possible. Had you actually read the above references as you claimed you would know that after executing a search warrant the FBI found credit card numbers and SSNs on computers in his dorm room. It's in Section 12 of the FBI document. Sure, maybe that was a result of a chat room he was logging. Maybe he didn't specifically go after this information himself. But at the very least he still chose to retain that information on his computer and at worst he did indeed go after the information himself.
    - seigenblues 16y ago
      The defendant is also getting more time than the cop in Oakland who shot a restrained, unarmed man. Maybe this punishment fits this crime and its the other that doesn't, but marcusbooster's indictment of the system as a whole having some skewed incentives still has some merit, i think.
tptacek 16y ago
That's not what happened, but: why? Why is that disproportionately steep? Because it's so easy to do, it doesn't seem like it should be a crime? Talk to businesses dealing with DDoS attacks sometime. They're tearing their hair out and losing real money because of some sociopath's vanity "attack". Why, exactly, are we supposed to look the other way?
maukdaddy 16y ago
If I rob someone of $10k I'm going to jail. If I use a botnet to take their site offline, resulting in a loss of revenue or donations of $10k, I should also go to jail. Just because it is easy or common doesn't make it any less of a crime.
- InclinedPlane 16y ago
  It's worse than that. Imagine if you robbed several thousand people's houses and stole their mp3 players. Then you started throwing the mp3 players at someone's storefront, breaking glass, breaking dishes, causing a mess, preventing patrons from entering, etc. In what crazy world would you not be harshly punished for such multiple crimes? The reality is even worse than this, as the attacker in question also stole personal financial information (CC#s, SSNs, etc.) from his botnet victims.

mattmaroon 16y ago

Go Zips!

mattmaroon 16y ago
Not too many other HNers who went to Akron U I see.

wakeup 16y ago

What the fuck motherfuckers?

da5e 16y ago

It's ridiculous how easy it is to go to jail in the USA. It doesn't really solve anything for lower level non-violent crimes. Surely if they can rehab for drugs, they can rehab for hacking.

privacyguru 16y ago

Old news from last week.

privacyguru 16y ago

The student didn't "hack" O'Reilly's site, he conducted DDoS attacks. Totally Different.

tptacek 16y ago
From a botnet that he set up. It's actually worse than "hacking O'Reilly's site".

deleted 16y ago

[deleted]

deleted 16y ago

[deleted]

bugsy 16y ago

It's utterly ridiculous and a waste of resources that these sorts of things are felony criminal prosecutions at all. Putting people in state prison at a cost of $70,000 a year in housing costs, PLUS the loss of income and other tax they would have paid plus the loss of their support of family who then goes on welfare, this should only be reserved for people who are an actual imminent threat and danger to the community. Hacking should be something that gets fines only. Let the hacker pay back the cost of his damage, but there is no reason for taxpayers to bear hundreds of thousands of dollars in costs to warehouse these guys with actual hardened criminals whom they will have to make deals with in order to survive in the pen. Then, when they get out, they owe favors to actual criminal syndicates which they formerly had no relation to. Sheesh.

tptacek 16y ago
If you broke into a store, stole a raft of credit card numbers from carbons, and rigged the registers to feed you more of them in the future, common sense would inform us that you're a criminal. Similarly, if some jackass broke into a series of automobiles and drove them to a store's parking lot to inconvenience or cripple its operations, we'd have no trouble conceiving of the criminal charges that might result from that. The only difference between those crime and the crime committed here was the ease with which the Internet allowed it to be committed. No doubt, the person running the botnet collecting credit card numbers and launching DDoS attacks didn't feel like a criminal. He felt like a prankster. But how is that relevant? I say it isn't relevant. At all. The Internet has a knack for making reality feel unreal. But there is a reality, and it does not give a shit about your message board posts.

donspaulding 16y ago

Elsewhere, Bill O' Reilly was overheard saying, "F#$k it, we'll give him life!"