20 ms·

Hitting a 17yo with 30 felony charges feels a bit steep to me. Also should any repercussions be considered against Twitter that a 17yo was able to gain access

• tedunangst 6y ago
  Previous settlement regarding twitter security: https://www.ftc.gov/news-events/press-releases/2011/03/ftc-accepts-final-settlement-twitter-failure-safeguard-personal-0 https://www.ftc.gov/news-events/press-releases/2011/03/ftc-a...
• ponker 6y ago
  What does the 17yo have to do with it? Would it be different for an 18yo?
  • dboreham 6y ago
    As a society we generally make some allowance for a perpetrator's mental capacity. One aspect to that is we generally accept that teenage brains are not quite the same as adults.
  • zenta 6y ago
    Conversely, would it be different for a 16yo? What about 15yo? Or 12yo?
  • wil421 6y ago
    I believe most states will charge a 17yo as and adult. Not sure what the feds would do.
    • paulpauper 6y ago
      i could see this possibly be challenged by courts , possibly up to the supreme court
      • wil421 6y ago
        I looked it up and it’s only 3 states that do it. My state, Georgia, is trying to end it.
    • mikeshank 6y ago
      First they need to determine his political leanings, then they'll have a good idea of how to move forward.
  • trimbo 6y ago
    In the United States, we generally consider minors who commit crimes to be a different class of criminal than people above 18. We do this because (AFAICT), there's a sort of societal agreement that wisdom/maturity is a logarithmic curve that begins to flatten in the late teens and 18 was picked as a legal threshold. So if a 2 year old, 8 year old and 18 year old all shoot and kill someone, we prescribe much different levels of punishment based on their relative maturity. Sometimes, prosecutors decide to charge minors "as an adult" based on their behavior (Google for "X year old charged as adult" for examples). I assume that's what they're doing here.
    • shadowgovt 6y ago
      FWIW, don't imagine that there was anything as elegant as "logarithmic curve analysis" used to decide that the age of majority is 18. It's an age that was settled upon by common-sense consensus over a grand function of "Well, most Americans (descended from Europeans) thought it should be around 21," and that's probably because 21 is a nice, round number. Then the draft age got pushed to 18 because we needed more bodies for the meat-grinder in World War II, and the voting age followed around Vietnam when too many people asked "Wait, in what way is it just or fair we can force people to fight and die in a war who can't even vote?" There isn't a lot of hard science (beyond the most ancient human science of all: observation across millions of data-points loosely confederated into "common sense") underpinning the age of majority.
      • gus_massa 6y ago
        But they still can not drink alcohol...
        • shadowgovt 6y ago
          It's true. Apparently, that's because mothers against drunk driving campaigned hard to have the drinking age re-raised to 21 after they got their hands on some evidence suggesting that it cut down on deaths due to car accidents.
• libraryatnight 6y ago
  I felt a sting reading that too. He hit the idiot computer kid jackpot and did idiot computer kid things with it. Not saying no consequences, but damn.
  • tedunangst 6y ago
    Idiot kid things would be having Obama tweet "I think @Kelly2003 should go to the prom with Clark". If you're old enough to run a send back scam, you should know it's wrong.
    • maerF0x0 6y ago
      One thing I think we ought to give credit to is that as Infosec becomes higher profile and more public, the sophistification of kids will rise with it. For example many of the techniques that are basically public info on youtube[1] nowadays was hidden in some "darkweb" forum not many years back. [1]: https://www.youtube.com/c/STOKfredrik/videos https://www.youtube.com/c/STOKfredrik/videos
    • unethical_ban 6y ago
      I think the friction of an act contributes to the analysis. It isn't hard to get a bitcoin account. It's a number. With other fake numbers assigned to it. Get people to send fake numbers to your fake number. Should a 17 year old lose prime years of his life? Is there a better way to educate/reform the person? If you say "Well in this other instance, the book got thrown at so-and-so". To this, I would ask, does that make it right?
• slg 6y ago
  The age of the attacker is irrelevant to Twitter's role in this story. However your underlying point still stands. If we want these types of attacks to stop, we can't just let all these companies off with a public embarrassment being the primary punishment. At a certain point we have to start calling it negligence when companies fall for these attacks and fail to have proper precautions in place to prevent them.
  • nickff 6y ago
    From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.
    • qppo 6y ago
      Isn't that how they got Stuxnet into the Iranian nuclear facilities?
      • boogies 6y ago
        Something like that (USB exploit of Windows zero days, breaching an airgap). (Edit: though not by leaving flash drives outside of the facilities, by infecting some with a virus that spread from Windows PC to Windows PC around the world.)
    • Swizec 6y ago
      I remember an article a few years ago saying that large % of office employees would trade their password for chocolate. Ah yes here we go, large scale study, 43% of participants gave away their password when bribed with a chocolate bar. People just don't realize how valuable passwords are. https://www.sciencedaily.com/releases/2016/05/160512085123.htm https://www.sciencedaily.com/releases/2016/05/160512085123.h...
      • 6y ago
• nmarks122 6y ago
  Governments are touchy about propaganda channels, even (or especially?) when they are lower in quality than the Sun or the Daily Mirror.
• tptacek 6y ago
  Does it really change much about the sentence he'll face? Felony charges usually group.
• nordsieck 6y ago
  > Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? 200 Million Americans could drive a car into a crowd. That doesn't make it any less bad for someone to do.
  • gregschlom 6y ago
    That is not the point that the parent comment is making, though. It's not whether it's bad for someone to commit this crime, it's whether Twitter should be held liable for such poor security practices that a 17 year old can hack them.
    • nordsieck 6y ago
      > It's not whether it's bad for someone to commit this crime, it's whether Twitter should be held liable for such poor security practices that a 17 year old can hack them. That is exactly my point. There are tons of crimes that basically anyone can do. If you said instead: people whose houses are set on fire by an arsonist should be liable for poor security, at the very least you'd not be taken very seriously. There is a duty to not commit crime. There is no duty to avoid being the victim of a crime. On top of that, there is broad industry consensus that it is largely impossible to write bug free software - certainly at the scale of Twitter. To suggest that they have the duty perform the impossible strikes me as deeply irresponsible if not simply malicious.
      • etrabroline 6y ago
        >There is no duty to avoid being the victim of a crime If you entrust a bank with 10 thousand dollars, and the bank puts your money in a paper bag and leaves it in the lobby, they are going to be held liable if someone walks away with it. Twitter letting teenagers steal people's data is approaching that level of negligence for a mutli-billion dollar company.
        • Google234 6y ago
• ibejoeb 6y ago
  Nothing in the complaint (well, for the two others, since his is sealed) says that a state-level actor wasn't involved. Could be the tip of the iceberg. I find it hard to believe that this was prank hacking for about $150,000. You could sell Obama's handle for more, surely.
  • shadowgovt 6y ago
    Personally, I find "it was a prank" extremely easy to believe. It's the simplest answer to the question "Wait, if someone compromised Twitter so badly they could tweet anything from any account, why didn't they try to move the whole stock market or start World War III?" "Because they're young punks and didn't think of that" is a reasonable answer.
    • Nasrudith 6y ago
      Prank hacking would fit with the monetization when combined with statements of "who would be dumb enough" that underestimates stupidity like the whole charge your iPhone in the microwave or Soupy Sales' "send in all of the green paper in your parents wallets" not thinking people would actually do it. Plenty of precedent but easy to see why they would feel no responsibility for anyone mindbogglingly stupid enough to do so.
    • DudeInBasement 6y ago
      I guess he gets a hard lesson on how dumb people are on Twitter
  • brokencode 6y ago
    Do you know anybody willing to pay over $150,000 for temporary access to Obama’s twitter account? I find this type of comment kind of naive and poorly thought out. Just because you’re a hacker doesn’t mean you know how to sell secrets to Russia, and trying to establish lines of communication like that are probably going to raise red flags with law enforcement. To be fair, the strategy of scamming for bitcoin was crazily simplistic and destined to fail, due to how easy it is to track bitcoin. I am not at all surprised that some of the people allegedly involved have already been caught.
• SahAssar 6y ago
  Having bad security is not criminal. If it was we wouldn't have a voting village at defcon cracked by pre-teens and there would be a lot more irresponsible CEO's in prison (so probably a better world).
  • shadowgovt 6y ago
    Usually, the counterweight to bad security is the extremely-practical "Pests, assholes, or criminals ownz you." Which works on average.
    • SahAssar 6y ago
      I disagree. For every Mossack Fonseca, Mernis, Equifax, Twitter, LinkedIn, Ashley Madison we get public hacks from I think we have many more that see it as "the cost of doing business" and keep bad practices around. In many types of businesses the cost of a security breach is "priced in" or not considered at all and they are gambling on it happening to their competitors (or not at all) instead of to them.
      • shadowgovt 6y ago
        I think we are in agreement on mechanism. I meant "works on average" in the sense of "Keeps fraud and breaches to a level consumers are comfortable with." Nobody imagines breaches can be driven to zero; we seem to be comfortable as a society with the overall rate and severity of breaches (demonstrably, since people keep signing up for these rando online services willy-nilly with nary a care to who holds their data).
  • pps43 6y ago
    Is bad security ok for, say, a bank or a nuclear power plant?
    • SahAssar 6y ago
      No, and that's why we (basically all nations that have banks or nuclear power plants) have specific laws governing them. Look, if you want to pass a law saying all internet business having X personal data needs to prove Y security, then I'd probably be for it (depending on X and Y). We already have PCI-DSS and similar today for payment providers. I'm just saying that there is nothing like that today, and if there was we'd have a lot more irresponsible people in prison.
• vsareto 6y ago
  > Hitting a 17yo with 30 felony charges feels a bit steep to me. Someone's gonna talk if they haven't already?
• threatofrain 6y ago
  > Also should any repercussions be considered against Twitter that a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world? Is the suggestion that if your security is weak, at least some of the blame goes to the hacked? If your home security is weak, should we grant more leniency to a burglar? The insurance company should be the one to punish the riskiness of homeowner security.
  • TallGuyShort 6y ago
    Not home security, but I'm of the opinion this should apply for businesses and public places in some case. For instance, I usually carry a gun on me. If I go into the court house or a concert venue I'm prohibited from doing that. IMO they have now assumed a level of liability to provide a reasonable level of effective security and they're negligent if they don't and I'm injured or kill because of a mass shooting anyway because they didn't enforce their own policies. Speaking of guns, it's actually also not unheard of for people to be partly responsible for crimes committed with guns that were stolen from them, even in their home. You have something dangerous, like a network that has become a de facto platform for government officials, then yeah: you have a responsibility to take reasonable preventative measures too.
    • nicoburns 6y ago
      I find it odd that you think a gun protects you in public. Its always seemed to me like you are more likely to be shot if you're carrying a gun, because an armed criminal now has to shoot you first if they want to ensure that they are not shot themselves. If you are unarmed they can simply threaten to shoot you and need not actually shoot. I guess in the US thee are so many guns that perhaps criminals will just assume that you're armed anyway. But IMO that only makes the case for gun control stronger. Because the most effective way to change that attitude would be to dramtically decrease the number of guns in circulation.
      • TallGuyShort 6y ago
        The gun is well concealed and I'm an accomplished competitive shooter - no I'm not concerned about that.
• onetimemanytime 6y ago
  >>* Hitting a 17yo with 30 felony charges feels a bit steep to me.* what charge should they leave out? Also he will not serve, say 15 years X 30 charges, if found guilty. Now they are dealing with him, what happens to Twitter, if anything, is a different story. 17 years old or 19...he knew what he did
• deleted 6y ago
  [deleted]
• kolbe 6y ago
  I agree this bothers me to my core. Even the 22 year old hasn't developed a fully functional neocortex. I know it seems a little hypocritical of me for getting sad when this happens to a young programmer and not an inner city gang member, but it does. To pull off a hack like this is indicative of these kids being intelligent, risky and bold. Yeah, they went where they shouldn't, but I personally think these are the types of people we need leading us into the future of science. It does us no good to keep rewarding sycophants with 4.0s and fellowships and tenure, but removing the "trouble makers" from the system.
  • newacct583 6y ago
    > To pull off a hack like this is indicative of these kids being intelligent, risky and bold. Yeah, they went where they shouldn't They engaged in straight up fraud! It's not like they just pranked some folks, they tried to fool the world into sending them money. It's true the fraud didn't work that well (or rather, not in relation to the severity of the Twitter hack), but they still stole some $100kUS or whatever. You want those people LEADING us "into the future of science"?
    • shadowgovt 6y ago
      > they tried to fool the world into sending them money Their mistake was they failed to call it a "series A funding round."
  • camjohnson26 6y ago
    That attitude is exactly the problem though. These kids getting hit with a 30 year sentence bothers those of us who relate, when the same thing happens to young black inner city kids every day. Plenty of them are just as intelligent, risky, and bold as these kids but we throw them in prison for the best parts of their life without a second thought.
    • lopmotr 6y ago
      That's violent crime though, which is more obviously bad, even to a teenager. If you're 17 and intentionally kill someone then your brain is broken and you should be kept away from innocent people forever unless you really have some delayed development that comes later.
• snarf21 6y ago
  Since the President makes all his official statements via Twitter, one could argue this is a matter of national security. Also, Twitter is just a collection of people and a single person is trivial to exploit.
• Jabbles 6y ago
  Standard disclaimer for headline sentence lengths: https://www.popehat.com/2013/02/05/crime-whale-sushi-sentence-eleventy-million-years/ https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...
• pyuser583 6y ago
  He’s being treated a lot better than the adult defendants. He’s being charged in state court - specifically the state he resides in. The charges are being brought in San Francisco - which is thousands of miles from the where the other suspects live. Relative to the other defendants, he’s getting it easy. Yes, he’s technically facing life in prison. But it’s a prison near his home. He probably won’t get life in prison, but at least he’ll be able to get family visits, etc.
  • dragonwriter 6y ago
    > He’s being charged in state court The release doesn't say that either thar he is being charged in state court or that he is not being charged in federal court. First it says why they won't tell you details of any federal charges—“With exceptions that do not apply to this case, juvenile proceedings in federal court are sealed to protect the identity of the juvenile”—then it says that the federal authorities have referred the juvenile to state authorities (without saying anything about action taken by the state authorities.)
    • pyuser583 6y ago
      Sorry I was incorporating information from another HN linked article: https://www.wfla.com/news/hillsborough-county/tampa-teen-accused-of-being-mastermind-behind-twitter-hack-that-targeted-high-profile-accounts/ https://www.wfla.com/news/hillsborough-county/tampa-teen-acc... It’s much clearer as to what’s happening at the state level. It’s also clearer that, for now anyway, he’s being held near his family.
• JKCalhoun 6y ago
  I think the fact that "a 17yo was able to gain access to the private messages of potentially some of the most important individuals in the world" does pretty serious damage to their reputation — that is in itself a repercussion.
  • Sebb767 6y ago
    You'd think so, but the history shows that this will only be a footnote in Twitters history. See Equifax; they have lost the personal finance data of basically everyone in the US and they're doing fine. Twitter is not going to suffer anything other than a few bad jokes at its expense.
• stefap2 6y ago
  A year or two and return the money. It's not like he tried to break into a nuclear plant. It is a messaging app, mostly nonsense.
  • ChrisLomont 6y ago
    ... with the ability to move trillion dollar markets and potentially start riots or wars.
    • BlahGod420 6y ago
      Their intentions will matter a lot. Are they just collecting accounts or was there intention to move trillion dollar markets/start riots or wars/etc.
    • cutemonster 6y ago
      Lots of people have the ability to do bad things. Seems you believe they should therefore all go to prison, also if they didn't actually do those particular things
    • unethical_ban 6y ago
      Then we should regulate Twitter's security controls like we do banks? A breach like this at a bank would get them investigated and fined by multiple state and federal agencies.
• Nasrudith 6y ago
  Adding repercussions to the targets would be a mistake in my opinion - that would be very antitransparency as they would be encouraged to be willfully blind to cover their own asses. "Look it is clearly just the fault that these dumbass rich people didn't secure their passwords properly. Password reset logs? Why on earth would we keep those?" Personally I suspect the security of the systems could be improved best over time by a radical measure of legalizing hacking and social engineering. Going after hackers is a bandaid measure. It would be unapologetically darwinistic but this domain doesn't behave the same as meatspace and imposing its assumptions on it is a mistake just as much as putting closing times on websites.
  • dividedbyzero 6y ago
    I kind of like that idea, but defining the rules and boundaries would be really hard, and I'm not sure if the cure wouldn't be much worse than the disease, overall, for just blanket legalizing hacking. Like, how far am I allowed to go? Deface somecompany.com? Deface it to say "We're going out of business"? Deface it to show the rotten.com best-of? Can I just delete somecompany.com's customer database? Can I dump and download before I delete? Can I delete backups? Can I tamper with backup mechanisms, set a time bomb for in seven days when all rotating online backups are corrupted, destroy everything? How nefarious exactly am I allowed to be? After all, anyone without regular offline backups deserves to get hit, don't they? Can I sell that database dump, or at least show it to others? Can I take a peek at blueprints I find on some network share? Can I have look into that User\ List.xslx file I find? Can I access users' private data? May I keep Beyonce's nudes? Can I use the information I find for personal gain, or even to gain an upper hand over a competitor? Can I play with industrial automation software if I get in that far (you definitely would, sometimes)? What if I don't even realize this super outdated Windows box is controlling some kind of machinery and people get harmed when I inadvertently break something? Can I attack healthcare providers? Can I attack banks? Can I use any minutes-old zero-day disclosed by some hackfluencer on his Youtube channel, even if noone reasonably could have reacted to that so quickly? I guess we'd also see the hacking-for-prestige (or hacking for likes, nowadays?) sector to get much, much more sophisticated; that was happening already before it got outlawed where I live (not in the US), I'd expect that to surge. That might lead to everyone below big corporation level virtually having to migrate everyting they can to cloud and serverless products, since I'd expect it to get increasingly harder and expensive to run your own bespoke infrastructure in a secure way and not get pwned 15 times a week by some Twitch hackfluencer. AWS may be able to have a fix for a zero day deployed in within the hour, but how many small companies (or individuals running services) could do the same?
• rwbhn 6y ago
  Source for those charges? Article this currently points to says "The third defendant is a juvenile. With exceptions that do not apply to this case, juvenile proceedings in federal court are sealed to protect the identity of the juvenile. "
• DubiousPusher 6y ago
  Overcharging has become the norm. Not just in high profile cases but in everyday ones as well. It's an effective leveraging tool used to get the accused to accept the actual charge in a plea bargain. Generally the American criminal justice system has bent all of its pressure upon convictions without trial. The system is designed to make your life a nightmare upon accusation in the hopes you cannot afford or dare to resist.
  • deleted 6y ago
    [deleted]
  • 29083011397778 6y ago
    > Overcharging has become the norm With regard to "has become", this is completely false. Overcharging is not "new" in any way, shape, or form, as I hope the recent post commemorating Aaron Swartz's death would have reminded all of us.
    • BoorishBears 6y ago
      What does this pointless nitpicking even supposed mean? Modern legal frameworks have roots hundreds of years old, this habit is a recent development of the last few decades. So why are you trying to browbeat this person over correctly referring to it as a recent trend, using a recent example to do so? Reminder that every field is tech, churning through the framework of the week like it's going out of fashion...
    • DubiousPusher 6y ago
      Yes, my apologies. I have become so ensured to history lately. I mean in the last 40-60 years or so. Essentially since defendants have made themselves peaky with the consequences of Gideon v. Wainwright the legal recourse has been to combine several tools to prevent trials. Justice is expensive and Americans just don't have a taste for it.
• robomartin 6y ago
  This is a tough topic. If we take the approach of effectively turning this kind of crime into job interviews and a way to enter life-long careers we would create a positive feedback loop. Punishment, on the other hand, creates a negative feedback loop. We can discuss the degree of punishment, but it is clear that humans, for the most part, only tend to self regulate if they understand that the consequences of their actions are negative enough. The seriousness of this incursion has to be put into context as well. There's the money, of course. Yet, I don't believe this is the most serious aspect of the breach. This was a case of mass momentary identity theft and fraud. This kid temporarily stole the online identities of a number of people and committed fraud against everyone watching. He could have triggered a massively negative event that would have led to the loss of one to thousands of lives. Think George Wells' War of the Worlds and imagine someone playing puppeteer with the accounts of a range of prominent and less prominent people on social media. The outcome could be horrific.
  • nicoburns 6y ago
    > humans, for the most part, only tend to self regulate if they understand that the consequences of their actions are negative enough. I agree with this. But I don't think it necessarily needs to be consequences to themselves that they understand. Coming to understand the consequences their actions have had on others can also effectively chnage behaviour, and can often turn past offenders into very effective advocates against the crime they committed. That isn't necessarily to say that I don't think there should be consequences for the perpetrator. Just that I don't think it's the only way to prevent crime.
• bravoetch 6y ago
  > some of the most important individuals in the world I have bad news, there are no important individuals. Sorry.
• VWWHFSfQ 6y ago
  > Hitting a 17yo with 30 felony charges feels a bit steep to me. Hitting them with 30 felony charges is perfectly reasonable/correct. Those are what the charges are for the crimes. But the punishment for those 30 felonies should/will be adjusted down. I think at most this person will lose 5 years of their life. Not like the 25 year old girl in Seattle that set a bunch of Seattle Police cars on fire during the protests. She's going to do 4 years for each carbombing. 4 * 5 = 20 years. 25 year old girl... and now here life is basically over. And for what?
  • reitzensteinm 6y ago
    The sentences should run concurrently. 4 years for setting a car on fire is not unreasonable, although maybe a little harsh depending on priors. It's a dangerous thing to do. But setting five cars on fire is not particularly worse than setting one car on fire.
    • VWWHFSfQ 6y ago
      Setting five police cars on fire is an act of domestic terrorism. That's not in any way a normal protest action.. That's what the prosecutor will argue.
      • reitzensteinm 6y ago
        I agree the crime is serious. But that she did it more than once doesn't make it proportionally more serious, and certainly should not make the sentence proportionally longer.
        • bobmaxup 6y ago
          Why doesn't it make it proportionally more serious?
          • riquito 6y ago
            Ehm, seriously? 10 machine 40 years? 20 machine 80 years? There's no correlation with the concept of reforming that person after a while
• badrabbit 6y ago
  It's not steep, this is one of the many cruelties and abhorrent failures of the US justice system. They do this to force you to enter a plea bargain deal even if you are innocent.
• m463 6y ago
  A nation state would more likely facilitate a 17yo doing it. Do you really think Lee Harvey Oswald acted alone? :)
• clairity 6y ago
  that makes me so mad, not just for 17 year olds, but everyone subject to the whims of the criminal justice system. for this young man, it should be 1 charge, maybe 1-2 weeks in jail (to deomonstrate the seriousness of the offense, not so much for retribution), and then a whole bunch of community service as restitution and rehabilitation. we destroy lives gone astray rather than nudge them back onto the happier path(s). mischievousness like this is rarely an expression of malice, but more likely curiosity, rebelliousness, perhaps boredom, etc. the punishment should reflect that.
• 29athrowaway 6y ago
  He pissed off the wrong people.
• jamisteven 6y ago
  Just because he is 17 doesnt mean he didnt understand the repurcutions of his actions. That said, Twitter should be facing fines as well for not protecting their platform. I mean seriously what if someone gets hold of a say, Putin or Trump's account and starts stating they are launching strikes on XYZ country within the hour, what happens then? With great power comes great responsibility and these platforms of communication are no exception.