9 ms·

Lawsuit filed against GitHub in wake of Capital One data breach

101 points by danso 7y ago

jchw 7y ago
Is the allegation that Github was just supposed to know about this? I am sure it’s plenty busy trying to keep up with reports, less proactively seeking out questionable content. What’s next, should there be lawsuits against Pastebin sites?
- steelframe 7y ago
  When it comes to seeking damages, it's standard procedure to throw everything against the wall and see what sticks. "The wall" being everyone with deep pockets, such as Microsoft. I'm surprised Amazon hasn't been sued over this yet.
- mxcrossb 7y ago
  The law firm seems to claim the compromised data was hosted on github, but in the article it seems like it was only the hacking tools?
  - deathanatos 7y ago
    I don't see where you get the impression that it was hacking tools, from the article, which states, > obviously-hacked data that was displayed, disclosed, and used on or by GitHub and its website, the Personal Information sat on GitHub.com for nearly three months,” the law firm alleged in its complaint against GitHub and Capital One.
- deathanatos 7y ago
  (IANAL) Seems to be that yeah, GitHub should have known. I'd recommend going to the complaint[1] and skipping the news article. So, the complaint states[1], > This outside individual (“the hacker”) posted this Personal Information on GitHub.com, GitHub’s website, which encourages (at least friendly) hacking and which is publicly available. As a result of GitHub’s failure to monitor, remove, or otherwise recognize and act upon obviously-hacked data that was displayed, disclosed, and used on and by GitHub and its website, the Personal Information sat on GitHub.com for nearly three months. First, I do not like that the lawyers are punning between hacker "a person who uses computers to gain unauthorized access to data" ("the hacker") and hacker "an enthusiastic and skillful computer programmer or user" ("GitHub's website, which encourages […] hacking"). They allege it was the actual data posted: > Not surprisingly, therefore, the hacker, a software developer, posted the breached data on GitHub.com This part is interesting: > According to the timestamp on the file containing certain Capital One customers’ breached data, the hacker posted the data on GitHub.com on or about April 21, 2019. Because AFAIK, GitHub does not display upload times on its website, so I'm curious how the plaintiffs came to this conclusion. IIRC, the times that GitHub displays, e.g., in its listing of files are the times in the git data, which do not necessarily reflect the time the data was first uploaded to GitHub. (E.g., compare that a commit has a commit timestamp, but you can commit, wait 2 days, and then upload the commit to GitHub.) > Nevertheless, Capital One did not even begin to investigate the data breach until or around July 17, 2019, when it received an email apparently from a GitHub.com user alerting Capital One that there “appear[ed] to be some leaked” customer data publicly available on GitHub.com. > GitHub, meanwhile, never alerted any victims that their highly sensitive Personal Information—including Social Security numbers—was displayed on its site, GitHub.com. Nor did GitHub timely remove the obviously hacked data. Instead, the hacked data was available on GitHub.com for three months. > 22. GitHub apparently did not even suspend the hacker’s GitHub account or access to the site, even though it knew or should have known that the hacker had breached GitHub’s own Terms of Service, which state that: “GitHub has the right to suspend or terminate [a user’s] access to all or any part of the [GitHub.com] Website at any time, with or without cause, with or without notice, effective immediately.” It seems likely that GitHub wasn't aware. Nowhere in the complaint do I see where GitHub is made aware of this issue prior to it being public. This part is interesting: > 28. GitHub had an obligation, under California law, to keep off (or to remove from) its site Social Security numbers and other Personal Information. > 29. Further, pursuant to established industry standards, GitHub had an obligation to keep off (or to remove from) its site Social Security numbers and other Personal Information. I don't know if "established industry standards" holds up in court, but the 28 there is interesting. Lawyers writing this complaint, y u no cite what part of CA law? CA's law is actually really easy to browse/lookup if you know what code and what section you're looking for. [1]: https://www.dropbox.com/s/cjdflk7rh4z8ery/TZ_GitHub_CapitalOne_FINAL_Complaint_8_1_19.pdf?dl=0 https://www.dropbox.com/s/cjdflk7rh4z8ery/TZ_GitHub_CapitalO...
  - kthejoker2 7y ago
    I assume 28 is a reference to CCPA, which doesn't take effect until Jan 1 2020 (and won't apply to safe harbor content I'm sure)
  - daveFNbuck 7y ago
    > First, I do not like that the lawyers are punning between hacker The term here is equivocating, not punning. It's an informal logical fallacy [1]. People use it a lot when they don't have a good argument. [1] https://en.wikipedia.org/wiki/Equivocation https://en.wikipedia.org/wiki/Equivocation
  - otakucode 7y ago
    If the 'established industry standards' were real, they would hold up in court. Software has no established industry standards. This has been an issue in many court cases. There are many "standards" but none of them are official which results in any claims of negligence when it comes to software, no matter how egregious the behavior was, failing. We saw this with the Toyota 'unintended acceleration' scandal. The court acknowledged that out of 90+ automotive industry 'recommended' and 'suggested' coding practices, Toyota's code only followed 4. They acknowledged that Toyota let software engineers play no role in deciding scheduling. They acknowledged that Toyota software engineers did not have static analysis and other tools, or even a bug tracker. But, the court had to find them not guilty of criminal negligence because there simply aren't any legal standards or regulations which they could be said to be negligent of. If you were building a bridge and you hired unqualified engineers, deprived them of tools they needed, ignored them when it came time to determine scheduling, didn't follow established regulations and standards, etc, the companies executives would be prosecuted for criminal negligence and be sent to prison. If software is involved, however, the situation couldn't be more different. It's an issue that has been debated for well over a decade in the ACM at least. Companies don't want to have to pay more for talent, and most software engineers don't want to raise the barrier to entry. The real danger is that if the software industry waits too long to establish some way of handling these issues, some public tragedy will inspire a kneejerk government response that results in a suffocating set of standards that makes everyone unhappy.
- pmart123 7y ago
  Capital One could have been proactive by running a script to scrape every github account to see if they had data that was compromised. I’m sure a lot of governments, hackers and graduate student researchers knowingly or unknowingly collected this data.
  - jsmeaton 7y ago
    Are you suggesting they should have been doing this as a matter of course, or once they were notified of the breach and the data available on GitHub?
    - JoshTriplett 7y ago
      Wouldn't be a bad idea to throw a few dummy records into the database with unique names and other information, and constantly search for them.
      - jsmeaton 7y ago
        Search for them where? Github? Pastebin? Numerous other known and unknown websites? In what format? Do ToS for each of the sites being scraped support this? Do you stick dummy records in every single data set? That's why I'm asking if the GP was talking about proactively searching or searching once they were aware.
        pmart123 7y ago
        Well, my main point is I think it is somewhat absurd to blame GitHub for this. Sure, they can scan for SSN numbers, etc. but how many hackers are going to post stolen information to their Github account? A second matter though is there might be a business model around a service that scans for sensitive information or proprietary code on Github, Bitbucket, etc. My guess is though it is much easier to detect a breach upon data exfiltration versus scanning the web.
      - eitland 7y ago
        Or, if you use UUIDs: just do a web search for some real ones and scrape for real ones on places you are aware of that aren't indexed. (Don't know how common it is for leaks to be scrubbed before uploading.)
- otakucode 7y ago
  Expect GitHub to be dropped from the case pretty quickly, I presume. They have a Safe Harbor exemption from responsibility for content posted by users on their site. The complaint doesn't even allege that anyone ever warned GitHub about the presence of the data whatsoever. They just baselessly assert that GitHub "should have known" without providing any support. Section 230 of the Communications Decency Act provides the Safe Harbor protection to platforms as long as they do not do things which amount to them having editorial control (things like holding posts for moderation before posting can do this and lose their safe harbor, as happened to LiveJournal years ago, but taking posts down afterwards and responding to flagged content does not).
wrong_variable 7y ago
Most websites and their owners on the internet are broke. Github is flush with cash ( relatively speaking ). Makes sense why they would go after them ( Microsoft ) , not that it will stick.
- rectang 7y ago
  They learned from the Steve Dallas example of suing Nikolta Camera: https://www.gocomics.com/bloomcounty/1986/06/22/ https://www.gocomics.com/bloomcounty/1986/06/22/
jedberg 7y ago
As my lawyer friend said, a good class action is a lawyer’s startup. Litigate one good one and you’re set for life. In a case like this, you have to be the first to file so that everyone else gets merged with yours. It’s sort of sad that they were so quick on this but that’s why.
btown 7y ago
This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence. They also say that GitHub "promotes hacking" without any nuance regarding modern usage of the word, and they claim that GitHub had a "duty" to put processes in place to monitor submitted content, and that by not having such processes they were in violation of their own terms of service. I hope that this gets thrown out. If not, it could have severe consequences for any site hosting user-generated content.
- realusername 7y ago
  > This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence Youtube does not manually moderate content either, they just have some automated bots for their contentid and I would argue that's not working very well. I don't see how Github would imitate that, surely the companies which are not on Github don't want to send their secrets to them to check if it's there, it makes no sense.
  - ma2rten 7y ago
    This is not true. ContentId filters copyrighted content. YouTube also moderates content and demonetizes video with certain content. I am pretty sure at least part of that must be done manually.
    - realusername 7y ago
      You also have automated filters to some extent. Anything featuring 9-11 towers crash for example is automatically demonetized and hidden from the suggestions regardless of the context.
  - killjoywashere 7y ago
    Youtube has content moderators https://www.theverge.com/2018/3/13/17117554/youtube-content-moderators-limit-four-hours-sxsw https://www.theverge.com/2018/3/13/17117554/youtube-content-... And, if anything, github is almost all text, and most of the interesting stuff is structured. That should be relatively straightforward compared to raw video and freetext on Youtube.
deegovee 7y ago
But Why to sue Amazon?
sigzero 7y ago
Frivolous. Throw it out.
mmaunder 7y ago
Why not sue Cisco for transiting the stolen data on routers they made?
- jsty 7y ago
  Don't give the MPAA / RIAA any ideas ...
- zild3d 7y ago
  Intel too while we're at it, someone had to calculate those bits!
deleted 7y ago
[deleted]
kyledrake 7y ago
I believe this is covered by Section 230. Would expect to see this thrown out, but law is crazy so who knows. https://en.wikipedia.org/wiki/Section_230_of_the_Communications_Decency_Act https://en.wikipedia.org/wiki/Section_230_of_the_Communicati...
ldoughty 7y ago
I hope I can claim another $10,000,000/500,000,000 = jack shit from my PII being released again!

101 points by danso 7y ago

jchw 7y ago

Is the allegation that Github was just supposed to know about this? I am sure it’s plenty busy trying to keep up with reports, less proactively seeking out questionable content. What’s next, should there be lawsuits against Pastebin sites?

steelframe 7y ago
When it comes to seeking damages, it's standard procedure to throw everything against the wall and see what sticks. "The wall" being everyone with deep pockets, such as Microsoft. I'm surprised Amazon hasn't been sued over this yet.
mxcrossb 7y ago
The law firm seems to claim the compromised data was hosted on github, but in the article it seems like it was only the hacking tools?
- deathanatos 7y ago
  I don't see where you get the impression that it was hacking tools, from the article, which states, > obviously-hacked data that was displayed, disclosed, and used on or by GitHub and its website, the Personal Information sat on GitHub.com for nearly three months,” the law firm alleged in its complaint against GitHub and Capital One.
deathanatos 7y ago
(IANAL) Seems to be that yeah, GitHub should have known. I'd recommend going to the complaint[1] and skipping the news article. So, the complaint states[1], > This outside individual (“the hacker”) posted this Personal Information on GitHub.com, GitHub’s website, which encourages (at least friendly) hacking and which is publicly available. As a result of GitHub’s failure to monitor, remove, or otherwise recognize and act upon obviously-hacked data that was displayed, disclosed, and used on and by GitHub and its website, the Personal Information sat on GitHub.com for nearly three months. First, I do not like that the lawyers are punning between hacker "a person who uses computers to gain unauthorized access to data" ("the hacker") and hacker "an enthusiastic and skillful computer programmer or user" ("GitHub's website, which encourages […] hacking"). They allege it was the actual data posted: > Not surprisingly, therefore, the hacker, a software developer, posted the breached data on GitHub.com This part is interesting: > According to the timestamp on the file containing certain Capital One customers’ breached data, the hacker posted the data on GitHub.com on or about April 21, 2019. Because AFAIK, GitHub does not display upload times on its website, so I'm curious how the plaintiffs came to this conclusion. IIRC, the times that GitHub displays, e.g., in its listing of files are the times in the git data, which do not necessarily reflect the time the data was first uploaded to GitHub. (E.g., compare that a commit has a commit timestamp, but you can commit, wait 2 days, and then upload the commit to GitHub.) > Nevertheless, Capital One did not even begin to investigate the data breach until or around July 17, 2019, when it received an email apparently from a GitHub.com user alerting Capital One that there “appear[ed] to be some leaked” customer data publicly available on GitHub.com. > GitHub, meanwhile, never alerted any victims that their highly sensitive Personal Information—including Social Security numbers—was displayed on its site, GitHub.com. Nor did GitHub timely remove the obviously hacked data. Instead, the hacked data was available on GitHub.com for three months. > 22. GitHub apparently did not even suspend the hacker’s GitHub account or access to the site, even though it knew or should have known that the hacker had breached GitHub’s own Terms of Service, which state that: “GitHub has the right to suspend or terminate [a user’s] access to all or any part of the [GitHub.com] Website at any time, with or without cause, with or without notice, effective immediately.” It seems likely that GitHub wasn't aware. Nowhere in the complaint do I see where GitHub is made aware of this issue prior to it being public. This part is interesting: > 28. GitHub had an obligation, under California law, to keep off (or to remove from) its site Social Security numbers and other Personal Information. > 29. Further, pursuant to established industry standards, GitHub had an obligation to keep off (or to remove from) its site Social Security numbers and other Personal Information. I don't know if "established industry standards" holds up in court, but the 28 there is interesting. Lawyers writing this complaint, y u no cite what part of CA law? CA's law is actually really easy to browse/lookup if you know what code and what section you're looking for. [1]: https://www.dropbox.com/s/cjdflk7rh4z8ery/TZ_GitHub_CapitalOne_FINAL_Complaint_8_1_19.pdf?dl=0 https://www.dropbox.com/s/cjdflk7rh4z8ery/TZ_GitHub_CapitalO...
- kthejoker2 7y ago
  I assume 28 is a reference to CCPA, which doesn't take effect until Jan 1 2020 (and won't apply to safe harbor content I'm sure)
- daveFNbuck 7y ago
  > First, I do not like that the lawyers are punning between hacker The term here is equivocating, not punning. It's an informal logical fallacy [1]. People use it a lot when they don't have a good argument. [1] https://en.wikipedia.org/wiki/Equivocation https://en.wikipedia.org/wiki/Equivocation
- otakucode 7y ago
  If the 'established industry standards' were real, they would hold up in court. Software has no established industry standards. This has been an issue in many court cases. There are many "standards" but none of them are official which results in any claims of negligence when it comes to software, no matter how egregious the behavior was, failing. We saw this with the Toyota 'unintended acceleration' scandal. The court acknowledged that out of 90+ automotive industry 'recommended' and 'suggested' coding practices, Toyota's code only followed 4. They acknowledged that Toyota let software engineers play no role in deciding scheduling. They acknowledged that Toyota software engineers did not have static analysis and other tools, or even a bug tracker. But, the court had to find them not guilty of criminal negligence because there simply aren't any legal standards or regulations which they could be said to be negligent of. If you were building a bridge and you hired unqualified engineers, deprived them of tools they needed, ignored them when it came time to determine scheduling, didn't follow established regulations and standards, etc, the companies executives would be prosecuted for criminal negligence and be sent to prison. If software is involved, however, the situation couldn't be more different. It's an issue that has been debated for well over a decade in the ACM at least. Companies don't want to have to pay more for talent, and most software engineers don't want to raise the barrier to entry. The real danger is that if the software industry waits too long to establish some way of handling these issues, some public tragedy will inspire a kneejerk government response that results in a suffocating set of standards that makes everyone unhappy.
pmart123 7y ago
Capital One could have been proactive by running a script to scrape every github account to see if they had data that was compromised. I’m sure a lot of governments, hackers and graduate student researchers knowingly or unknowingly collected this data.
- jsmeaton 7y ago
  Are you suggesting they should have been doing this as a matter of course, or once they were notified of the breach and the data available on GitHub?
  - JoshTriplett 7y ago
    Wouldn't be a bad idea to throw a few dummy records into the database with unique names and other information, and constantly search for them.
    - jsmeaton 7y ago
      Search for them where? Github? Pastebin? Numerous other known and unknown websites? In what format? Do ToS for each of the sites being scraped support this? Do you stick dummy records in every single data set? That's why I'm asking if the GP was talking about proactively searching or searching once they were aware.
      - pmart123 7y ago
        Well, my main point is I think it is somewhat absurd to blame GitHub for this. Sure, they can scan for SSN numbers, etc. but how many hackers are going to post stolen information to their Github account? A second matter though is there might be a business model around a service that scans for sensitive information or proprietary code on Github, Bitbucket, etc. My guess is though it is much easier to detect a breach upon data exfiltration versus scanning the web.
    - eitland 7y ago
      Or, if you use UUIDs: just do a web search for some real ones and scrape for real ones on places you are aware of that aren't indexed. (Don't know how common it is for leaks to be scrubbed before uploading.)
otakucode 7y ago
Expect GitHub to be dropped from the case pretty quickly, I presume. They have a Safe Harbor exemption from responsibility for content posted by users on their site. The complaint doesn't even allege that anyone ever warned GitHub about the presence of the data whatsoever. They just baselessly assert that GitHub "should have known" without providing any support. Section 230 of the Communications Decency Act provides the Safe Harbor protection to platforms as long as they do not do things which amount to them having editorial control (things like holding posts for moderation before posting can do this and lose their safe harbor, as happened to LiveJournal years ago, but taking posts down afterwards and responding to flagged content does not).

wrong_variable 7y ago

Most websites and their owners on the internet are broke. Github is flush with cash ( relatively speaking ). Makes sense why they would go after them ( Microsoft ) , not that it will stick.

rectang 7y ago
They learned from the Steve Dallas example of suing Nikolta Camera: https://www.gocomics.com/bloomcounty/1986/06/22/ https://www.gocomics.com/bloomcounty/1986/06/22/

jedberg 7y ago

As my lawyer friend said, a good class action is a lawyer’s startup. Litigate one good one and you’re set for life. In a case like this, you have to be the first to file so that everyone else gets merged with yours. It’s sort of sad that they were so quick on this but that’s why.

btown 7y ago

This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence. They also say that GitHub "promotes hacking" without any nuance regarding modern usage of the word, and they claim that GitHub had a "duty" to put processes in place to monitor submitted content, and that by not having such processes they were in violation of their own terms of service. I hope that this gets thrown out. If not, it could have severe consequences for any site hosting user-generated content.

realusername 7y ago
> This is incredible: they're suggesting that, in the same way that YouTube has content moderators, GitHub should moderate every repository that has a 9-digit sequence Youtube does not manually moderate content either, they just have some automated bots for their contentid and I would argue that's not working very well. I don't see how Github would imitate that, surely the companies which are not on Github don't want to send their secrets to them to check if it's there, it makes no sense.
- ma2rten 7y ago
  This is not true. ContentId filters copyrighted content. YouTube also moderates content and demonetizes video with certain content. I am pretty sure at least part of that must be done manually.
  - realusername 7y ago
    You also have automated filters to some extent. Anything featuring 9-11 towers crash for example is automatically demonetized and hidden from the suggestions regardless of the context.
- killjoywashere 7y ago
  Youtube has content moderators https://www.theverge.com/2018/3/13/17117554/youtube-content-moderators-limit-four-hours-sxsw https://www.theverge.com/2018/3/13/17117554/youtube-content-... And, if anything, github is almost all text, and most of the interesting stuff is structured. That should be relatively straightforward compared to raw video and freetext on Youtube.

deegovee 7y ago

But Why to sue Amazon?

sigzero 7y ago

Frivolous. Throw it out.

mmaunder 7y ago

Why not sue Cisco for transiting the stolen data on routers they made?

jsty 7y ago
Don't give the MPAA / RIAA any ideas ...
zild3d 7y ago
Intel too while we're at it, someone had to calculate those bits!

deleted 7y ago

[deleted]

kyledrake 7y ago

I believe this is covered by Section 230. Would expect to see this thrown out, but law is crazy so who knows. https://en.wikipedia.org/wiki/Section_230_of_the_Communications_Decency_Act https://en.wikipedia.org/wiki/Section_230_of_the_Communicati...

ldoughty 7y ago

I hope I can claim another $10,000,000/500,000,000 = jack shit from my PII being released again!