3 ms·

This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowl

by lambda 16y ago

This isn't a wave knocking over a sandcastle or a dog shitting in the house. These are 16 year old kids, old enough to know right from wrong, and with the knowledge and skills to exploit the system. And once the exploit worked, they didn't then responsibly disclose the problem to PHPFog; they started vandalizing, changing passwords, and the works. This is like someone finding an unlocked door to the apartment building's maintenance office, taking the master keys from there, rifling through a bunch of people's personal belongings, sticking signs in the windows saying "this building's landlords suck," and changing the locks on some of the doors to make it hard to clean up the whole mess. They absolutely are the responsible party; you should never blame the victim of a crime just because the victim didn't take adequate steps to defend themselves. If I accidentally leave my door unlocked one day, that does not make it suddenly OK to come in and take my stuff and it's my fault for not having locked my door, instead of yours for taking my stuff. Now, in this case PHPFog does bear some responsibility, because they have a duty to protect their customers as well as possible, and from reading about how this happened, it sounds like they were amazingly sloppy and irresponsible about it (passwords stored in the clear on the server, passwords shared between various accounts, leaving unsecured shared systems running after beta launch, etc). But that doesn't reduce the culpability of the attackers; they acted maliciously, with full knowledge of what they were doing, vandalized systems, changed passwords, and bragged about it.

Confusion 16y ago
These are 16 year old kids, old enough to know right from wrong [..] These kids were being assholes, but that does not warrant federal charges. The problem is that we can choose between unsatisfactory public shaming or thoroughly ruining their lives. There is no middle way, where they get an appropriate punishment, fitting the damage done. If harsh punishments were a deterrent, these kids would already have been deterred, because there are plenty of examples of teenagers harshly punished for relatively minor computerrelated crimes. I'd rather see them grow up to become, probably average, members of society. Also, whether they know right from wrong is a question whose answer definitely isn't as clear-cut as you make it out to be. There's a reason we don't consider them adults yet.
Prisen 16y ago
If the landlord leaves the master keys unprotected, he most definitely shares some of the blame when the apartments of his building are broken into.
hendi_ 16y ago
This is like someone finding an unlocked door to the apartment building's maintenance office, taking the master keys from there, [...] Yes, in theory, it is. But in practice, it's not. Especially if you're still a kid. It's easy to miss that there's something going on in the real world when you're doing damage "just online". (I know I sound like the "You wouldn't steal a TV! Why do you download movies?" crap-ad, but I hope you get my point.) I've been a 16 year old idiot myself. After doing some stupid things to a website I was threatened with some trouble. I could avoid it by having extensive talks with the site's owner, and paying for their losses, but still, I learned my lesson: everything you do on the internet, in the virtual world, has an effect in the real word. Also it was an urgently needed wake-up call for me; I learned to think twice and since then haven't done any nasty stuff without considering its impact. So in my opinion some sort of punishment is needed for the kids to learn their lesson. The FBI or other federal institutions shouldn't be involved. Talk to them, I'll guess they're nervous as shit right now! Just bill them the time you needed to tidy up the mess they left (or a fraction thereof), and I think both sides are good.
PostOnce 16y ago
I'm now nearly 25, and the amount I have changed since I was 16 borders on the immeasurable. Teenagers are glorified children. We seem to forget how little reflective capacity we all had when we were teenagers. If I were 16 and hacking some stupid website, I would think, sure this is "wrong", and I might get in trouble, but I probably wouldn't think that it would matter 5 years from then, or 20. Truth is, a criminal infraction can fuck your life up worse than is deserved. You could be forbidden to immigrate to your wife's home country, denied any worthwhile job you can find, or spend a sizable portion of your life in a smaller cage than they house animals in. There's a reason juvenile law exists, but we forget it. We charge 12 year olds as adults. This isn't that different. Hell, where I live, a lot of employers will check the sheriff's website for public arrest records. These aren't convictions, they're arrests. People are being denied jobs based on accusations. I've never gotten so much as a speeding ticket, but even I realize what a load of shit this all is.
- dspillett 16y ago
  I see your point, but not all teenages would do this even if they thought they would not get caught. While I agree that the full force of adult law is probably inappropriate, some punishment should be exacted. Perhaps some sort of injunction regarding limited access to the Internet for a time (to be enforced by their parents, and to include replaying any fancy 'net capable phones with a good old not-even-got-GRPS mini-brick phone for the duration). If I left my front door open and some kids came in, raided the fridge, broke the TV and ran up a huge phone bill, I would not expect them to get away completely unpunished. I'd not want them put away, and I wouldn't want it on their permanent record unless something particularly immoral was done (harming the cat, for instance), but I would want something to be seen to be done to educate them on right/wrong and act as a deterrent to others. I would also expect to be laughed at for being daft enough to leave my front door open!
- billybob 16y ago
  So when they turn 21, a "be responsible" switch will magically flip in their minds? The job of parents and society is to teach children responsibility. That means having consequences for your actions. And the closer you get to adulthood, the more adult those consequences should get. When I was a teen, some real estate developers tore down a bunch of woods where I had always played and started building a house. I was ticked and I vandalized the construction site. But my crime was discovered, and I had to work carrying lumber in the hot sun and scraping glue off windows to pay back the damage. Why did I have to do this? Because the developer talked to my parents. And my parents made me do it. This was light punishment - I wasn't taken to court, and I didn't get a criminal record. But parents are to children as legal system is to adults: they set the rules and enact the punishments. If they don't, someday the legal system will have to address their failure to do so by locking up their grown children who never learned right from wrong. I'm not sure what the consequences here should be, but the argument "they're kids, they can't be held responsible" is silly. If they're not expected to be responsible, they won't learn to be responsible.
AlexandrB 16y ago
While there's a lot of emotional appeal to seeking justice in this case, my inner pragmatists says that this should really be looked at as free penetration testing for PhPFog. If this kind of hacking had stiff penalties (as you desire), only those with truly malicious intent (and probably financial motive) would do it. Likewise, the consequences wouldn't be some petty vandalism, but serious financial damage. The fact remains that the site was insecure enough for a 16-year-old to find his way in. And the contributing factors to this insecurity might not have been identified had he not performed the attack in the first place.
Jun8 16y ago
"you should never blame the victim of a crime just because the victim didn't take adequate steps to defend themselves." This reasoning is not applicable when the victim is a corporation who gives implicit or explicit guarantees to their customers about security. Your example should be: if you stored your stuff at a paid storage facility and someone there accidentally left the door yo your unit open. I wouldn't care if it's a bunch of teenagers or Chinese cyber-warfare team who breaks into my Gmail account, I'd be mad as hell with Google for letting this happen. Pressing charges against the proprietors of the crime will not change the fact that this host acted in a very irresponsible and sloppy way, and is in short untrustworthy.
bradleyland 16y ago
I really like the unlocked door analogy, but there seems to be some kind of disconnect in everyone's mind when it comes to "online" crimes. Door locks are extremely "exploitable", but if a 16 year old were to use a bump key to gain access to PHPFog's corporate office and vandalize the place, all of the sudden it's a much bigger deal. I have a theory that it has to do with familiarity and empathy. Door locks are a pretty standard solution. We all have them on our homes, and we think to ourselves, "I've done a reasonable job of securing my home." When someone's home/office is broken in to, we can easily identify with them. We look at the scenario and realize that we could easily suffer the same. We empathize with them. Move the playing field to the Internet and all of the sudden everyone is expected to have Fort Knox level security. When someone's infrastructure is compromised, everyone stands atop the high hill, looking down on the drowning masses as the tide comes in, but the reality is that we're all vulnerable at some point. A startup could easily spend as much on security as they do developing their core product. Why? As a startup, I'm not going to invest in double-reinforced steel doors, bullet proof glass windows, armed guards, and a centralized vault. That's wasted money in my view, because I have a reasonable expectation that people will act with civility. If someone does break in, I'm insured, and I will report the crime to authorities who will investigate. If the criminal is caught, there are real penalties, and they'll carry the stigma of having to check "YES" next to the "Have you ever been convicted of a felony" on their job applications. I'm not saying we should try these kids as adults, but when I was 14, some kids who shared a bus stop with me broke in to a house near our bus stop and trashed the place. They got caught and suffered some severe penalties. It was a valuable lesson for everyone involved. A couple of the kids were from really bad homes and suffered from greater influences than the threat of the law, but the other two turned their act around really quickly. Had they gotten away with it, or had the attitude been "they're just kids", I'm not sure they would have realized the impact of the crimes they committed. I think we need more of this balance in our views of internet crimes.
colanderman 16y ago
I work with 16 year olds on a daily basis. Many, if not most, of them have a severely underdeveloped sense of morality, and know "right" from "wrong" no more than adults dictate to them.

by lambda 16y ago

Confusion 16y ago

These are 16 year old kids, old enough to know right from wrong [..] These kids were being assholes, but that does not warrant federal charges. The problem is that we can choose between unsatisfactory public shaming or thoroughly ruining their lives. There is no middle way, where they get an appropriate punishment, fitting the damage done. If harsh punishments were a deterrent, these kids would already have been deterred, because there are plenty of examples of teenagers harshly punished for relatively minor computerrelated crimes. I'd rather see them grow up to become, probably average, members of society. Also, whether they know right from wrong is a question whose answer definitely isn't as clear-cut as you make it out to be. There's a reason we don't consider them adults yet.

Prisen 16y ago

If the landlord leaves the master keys unprotected, he most definitely shares some of the blame when the apartments of his building are broken into.

hendi_ 16y ago

This is like someone finding an unlocked door to the apartment building's maintenance office, taking the master keys from there, [...] Yes, in theory, it is. But in practice, it's not. Especially if you're still a kid. It's easy to miss that there's something going on in the real world when you're doing damage "just online". (I know I sound like the "You wouldn't steal a TV! Why do you download movies?" crap-ad, but I hope you get my point.) I've been a 16 year old idiot myself. After doing some stupid things to a website I was threatened with some trouble. I could avoid it by having extensive talks with the site's owner, and paying for their losses, but still, I learned my lesson: everything you do on the internet, in the virtual world, has an effect in the real word. Also it was an urgently needed wake-up call for me; I learned to think twice and since then haven't done any nasty stuff without considering its impact. So in my opinion some sort of punishment is needed for the kids to learn their lesson. The FBI or other federal institutions shouldn't be involved. Talk to them, I'll guess they're nervous as shit right now! Just bill them the time you needed to tidy up the mess they left (or a fraction thereof), and I think both sides are good.

PostOnce 16y ago

I'm now nearly 25, and the amount I have changed since I was 16 borders on the immeasurable. Teenagers are glorified children. We seem to forget how little reflective capacity we all had when we were teenagers. If I were 16 and hacking some stupid website, I would think, sure this is "wrong", and I might get in trouble, but I probably wouldn't think that it would matter 5 years from then, or 20. Truth is, a criminal infraction can fuck your life up worse than is deserved. You could be forbidden to immigrate to your wife's home country, denied any worthwhile job you can find, or spend a sizable portion of your life in a smaller cage than they house animals in. There's a reason juvenile law exists, but we forget it. We charge 12 year olds as adults. This isn't that different. Hell, where I live, a lot of employers will check the sheriff's website for public arrest records. These aren't convictions, they're arrests. People are being denied jobs based on accusations. I've never gotten so much as a speeding ticket, but even I realize what a load of shit this all is.

dspillett 16y ago
I see your point, but not all teenages would do this even if they thought they would not get caught. While I agree that the full force of adult law is probably inappropriate, some punishment should be exacted. Perhaps some sort of injunction regarding limited access to the Internet for a time (to be enforced by their parents, and to include replaying any fancy 'net capable phones with a good old not-even-got-GRPS mini-brick phone for the duration). If I left my front door open and some kids came in, raided the fridge, broke the TV and ran up a huge phone bill, I would not expect them to get away completely unpunished. I'd not want them put away, and I wouldn't want it on their permanent record unless something particularly immoral was done (harming the cat, for instance), but I would want something to be seen to be done to educate them on right/wrong and act as a deterrent to others. I would also expect to be laughed at for being daft enough to leave my front door open!
billybob 16y ago
So when they turn 21, a "be responsible" switch will magically flip in their minds? The job of parents and society is to teach children responsibility. That means having consequences for your actions. And the closer you get to adulthood, the more adult those consequences should get. When I was a teen, some real estate developers tore down a bunch of woods where I had always played and started building a house. I was ticked and I vandalized the construction site. But my crime was discovered, and I had to work carrying lumber in the hot sun and scraping glue off windows to pay back the damage. Why did I have to do this? Because the developer talked to my parents. And my parents made me do it. This was light punishment - I wasn't taken to court, and I didn't get a criminal record. But parents are to children as legal system is to adults: they set the rules and enact the punishments. If they don't, someday the legal system will have to address their failure to do so by locking up their grown children who never learned right from wrong. I'm not sure what the consequences here should be, but the argument "they're kids, they can't be held responsible" is silly. If they're not expected to be responsible, they won't learn to be responsible.

AlexandrB 16y ago

While there's a lot of emotional appeal to seeking justice in this case, my inner pragmatists says that this should really be looked at as free penetration testing for PhPFog. If this kind of hacking had stiff penalties (as you desire), only those with truly malicious intent (and probably financial motive) would do it. Likewise, the consequences wouldn't be some petty vandalism, but serious financial damage. The fact remains that the site was insecure enough for a 16-year-old to find his way in. And the contributing factors to this insecurity might not have been identified had he not performed the attack in the first place.

Jun8 16y ago

"you should never blame the victim of a crime just because the victim didn't take adequate steps to defend themselves." This reasoning is not applicable when the victim is a corporation who gives implicit or explicit guarantees to their customers about security. Your example should be: if you stored your stuff at a paid storage facility and someone there accidentally left the door yo your unit open. I wouldn't care if it's a bunch of teenagers or Chinese cyber-warfare team who breaks into my Gmail account, I'd be mad as hell with Google for letting this happen. Pressing charges against the proprietors of the crime will not change the fact that this host acted in a very irresponsible and sloppy way, and is in short untrustworthy.

bradleyland 16y ago

I really like the unlocked door analogy, but there seems to be some kind of disconnect in everyone's mind when it comes to "online" crimes. Door locks are extremely "exploitable", but if a 16 year old were to use a bump key to gain access to PHPFog's corporate office and vandalize the place, all of the sudden it's a much bigger deal. I have a theory that it has to do with familiarity and empathy. Door locks are a pretty standard solution. We all have them on our homes, and we think to ourselves, "I've done a reasonable job of securing my home." When someone's home/office is broken in to, we can easily identify with them. We look at the scenario and realize that we could easily suffer the same. We empathize with them. Move the playing field to the Internet and all of the sudden everyone is expected to have Fort Knox level security. When someone's infrastructure is compromised, everyone stands atop the high hill, looking down on the drowning masses as the tide comes in, but the reality is that we're all vulnerable at some point. A startup could easily spend as much on security as they do developing their core product. Why? As a startup, I'm not going to invest in double-reinforced steel doors, bullet proof glass windows, armed guards, and a centralized vault. That's wasted money in my view, because I have a reasonable expectation that people will act with civility. If someone does break in, I'm insured, and I will report the crime to authorities who will investigate. If the criminal is caught, there are real penalties, and they'll carry the stigma of having to check "YES" next to the "Have you ever been convicted of a felony" on their job applications. I'm not saying we should try these kids as adults, but when I was 14, some kids who shared a bus stop with me broke in to a house near our bus stop and trashed the place. They got caught and suffered some severe penalties. It was a valuable lesson for everyone involved. A couple of the kids were from really bad homes and suffered from greater influences than the threat of the law, but the other two turned their act around really quickly. Had they gotten away with it, or had the attitude been "they're just kids", I'm not sure they would have realized the impact of the crimes they committed. I think we need more of this balance in our views of internet crimes.

colanderman 16y ago

I work with 16 year olds on a daily basis. Many, if not most, of them have a severely underdeveloped sense of morality, and know "right" from "wrong" no more than adults dictate to them.