4 ms·

That is not the point that the parent comment is making, though. It's not whether it's bad for someone to commit this crime, it's whether Twitter should be hel

That is not the point that the parent comment is making, though. It's not whether it's bad for someone to commit this crime, it's whether Twitter should be held liable for such poor security practices that a 17 year old can hack them.

nordsieck 6y ago
> It's not whether it's bad for someone to commit this crime, it's whether Twitter should be held liable for such poor security practices that a 17 year old can hack them. That is exactly my point. There are tons of crimes that basically anyone can do. If you said instead: people whose houses are set on fire by an arsonist should be liable for poor security, at the very least you'd not be taken very seriously. There is a duty to not commit crime. There is no duty to avoid being the victim of a crime. On top of that, there is broad industry consensus that it is largely impossible to write bug free software - certainly at the scale of Twitter. To suggest that they have the duty perform the impossible strikes me as deeply irresponsible if not simply malicious.
- etrabroline 6y ago
  >There is no duty to avoid being the victim of a crime If you entrust a bank with 10 thousand dollars, and the bank puts your money in a paper bag and leaves it in the lobby, they are going to be held liable if someone walks away with it. Twitter letting teenagers steal people's data is approaching that level of negligence for a mutli-billion dollar company.
  - Google234 6y ago
    The only thing between the inside of a home and the outside is a thin layer of glass. Should we hold home owners responsible for people breaking in and stealing? Lots of things are fragile, we have a laws to act as a deterrent to violations
    - tgsovlerkhgsel 6y ago
      We do in some cases. Someone breaks in and steals your stuff? We generally don't care, because its solely your problem. Someone breaks in and steals other people's stuff that you held, or stuff that's dangerous to others? Depending on what it was, you may be held liable if you didn't take appropriate measures. If the stolen stuff was, for example, sensitive private information, and you didn't have it in at least a locked cabinet, you may be liable. If it was a gun, in many jurisdictions, you're liable. Your car gets stolen _because you didn't secure it correctly?_ In Germany, you're liable for the damage caused with it!
  - bobmaxup 6y ago
    I don't think the fact that the person is a teenager really bears any significance as to how negligent a company is. Historically teenagers have done massive damage as sole actors in numerous roles.
- unethical_ban 6y ago
  You are incorrect - there is a legal concept known as strict liability that defines an instance where one party is completely liable for damages to a party, regardless of the negligence of any other party. I am sure Twitter didn't run afoul of that concept here, but the question is, "should they?" Presumably, a skilled person with only a few years' experience was able to find a flaw in their system so severe, that multiple political and business leaders' accounts were manipulated. It's a dangerous embarrassment.
- tgsovlerkhgsel 6y ago
  > There is no duty to avoid being the victim of a crime. In Germany (and likely also other jurisdictions), if your car gets stolen because you left the door open and the keys in the ignition, you will be held liable for it to some extent: As the owner of a dangerous machine, you're responsible to reasonably secure it even against illegal acts. [1] I don't see why this would be different if your machine is a lot bigger, and as a result arguably a lot more dangerous than a single car (imagine tweets trying to trigger violent mobs). [1] https://dejure.org/gesetze/StVG/7.html https://dejure.org/gesetze/StVG/7.html subsection 3
deleted 6y ago
[deleted]
user5994461 6y ago
The same point stands with the car, any 17 year old could borrow their parents car and drive into a crowd. It's not the fault of the car owner for not securing their car. Security is not preventing people from doing things, it's having some limitations so it's not too easily too quickly (cars are protected by keys, accounts by passwords). Anybody motivated can and will bypass security easily.
- mehrdadn 6y ago
  > It's not the fault of the car owner for not securing their car. Securing their car against... their children? Or distributing the car's keys to 2,000 people?
shadowgovt 6y ago
We generally handle that liability free-market style, i.e. "Why the hell would I sign up for a Twitter account? Their security is so lousy some 17-year-old could be speaking as me."
baddox 6y ago
That was the other commenter's point: a 17 year old can hurt people with a car just as easily as a 40 year old. The age of the attacker has no relevance on how liable the recipient of the attack is for their security practices.
kodt 6y ago
Is a 17 year old hacking them really proof of worse security than say a 30 year old?
- Nasrudith 6y ago
  Well the age implicitly assumes potential levels of education and sophistication. Few would be surprised to hear a 30 year old engineer designed a novel world class chip - they could easily have a PhD at that point to have the sophistication capable. For a 17 year old that would be pretty damn extraordinary. Now hacking is less than thar even to laymen who don't know how simple some holes are but 17 implies a lack of great sophistication. The whole thing is an ageist rough proxy anyway - a developmentally disabled 30 year old hacking it would be more shameful than a 17 year old college graduate.
refurb 6y ago
I put a cheap lock on my door and someone breaks in and steals everything. Should I be held liable for my poor security practices?
- 7786655 6y ago
  If you were responsible for securing my stuff, and you put a cheap lock on your door protecting my stuff, and someone breaks in and steals all my stuff, then yes, you should be held liable for your poor security practices.
  - refurb 6y ago
    But that's not actually the law, is it? You could certainly bring a civil lawsuit (and so could Twitter users), but I haven't committed a crime.
    - MisterPea 6y ago
      True, but I think this case opens up doors on regulation of tech companies for security, or at least new laws for security negligence. The power that Twitter has due to its highest-profile users is immense, however, this hack made them look incredibly stupid.
      - refurb 6y ago
        I don't disagree, it's pretty damn embarrassing someone can get the keys to the kingdom through some social engineering. My only concern is what happened with Equifax - some punishment is put on the company and it's only a token amount and nothing changes.

nordsieck 6y ago

> It's not whether it's bad for someone to commit this crime, it's whether Twitter should be held liable for such poor security practices that a 17 year old can hack them. That is exactly my point. There are tons of crimes that basically anyone can do. If you said instead: people whose houses are set on fire by an arsonist should be liable for poor security, at the very least you'd not be taken very seriously. There is a duty to not commit crime. There is no duty to avoid being the victim of a crime. On top of that, there is broad industry consensus that it is largely impossible to write bug free software - certainly at the scale of Twitter. To suggest that they have the duty perform the impossible strikes me as deeply irresponsible if not simply malicious.

etrabroline 6y ago
>There is no duty to avoid being the victim of a crime If you entrust a bank with 10 thousand dollars, and the bank puts your money in a paper bag and leaves it in the lobby, they are going to be held liable if someone walks away with it. Twitter letting teenagers steal people's data is approaching that level of negligence for a mutli-billion dollar company.
- Google234 6y ago
  The only thing between the inside of a home and the outside is a thin layer of glass. Should we hold home owners responsible for people breaking in and stealing? Lots of things are fragile, we have a laws to act as a deterrent to violations
  - tgsovlerkhgsel 6y ago
    We do in some cases. Someone breaks in and steals your stuff? We generally don't care, because its solely your problem. Someone breaks in and steals other people's stuff that you held, or stuff that's dangerous to others? Depending on what it was, you may be held liable if you didn't take appropriate measures. If the stolen stuff was, for example, sensitive private information, and you didn't have it in at least a locked cabinet, you may be liable. If it was a gun, in many jurisdictions, you're liable. Your car gets stolen _because you didn't secure it correctly?_ In Germany, you're liable for the damage caused with it!
- bobmaxup 6y ago
  I don't think the fact that the person is a teenager really bears any significance as to how negligent a company is. Historically teenagers have done massive damage as sole actors in numerous roles.
unethical_ban 6y ago
You are incorrect - there is a legal concept known as strict liability that defines an instance where one party is completely liable for damages to a party, regardless of the negligence of any other party. I am sure Twitter didn't run afoul of that concept here, but the question is, "should they?" Presumably, a skilled person with only a few years' experience was able to find a flaw in their system so severe, that multiple political and business leaders' accounts were manipulated. It's a dangerous embarrassment.
tgsovlerkhgsel 6y ago
> There is no duty to avoid being the victim of a crime. In Germany (and likely also other jurisdictions), if your car gets stolen because you left the door open and the keys in the ignition, you will be held liable for it to some extent: As the owner of a dangerous machine, you're responsible to reasonably secure it even against illegal acts. [1] I don't see why this would be different if your machine is a lot bigger, and as a result arguably a lot more dangerous than a single car (imagine tweets trying to trigger violent mobs). [1] https://dejure.org/gesetze/StVG/7.html https://dejure.org/gesetze/StVG/7.html subsection 3

deleted 6y ago

[deleted]

user5994461 6y ago

The same point stands with the car, any 17 year old could borrow their parents car and drive into a crowd. It's not the fault of the car owner for not securing their car. Security is not preventing people from doing things, it's having some limitations so it's not too easily too quickly (cars are protected by keys, accounts by passwords). Anybody motivated can and will bypass security easily.

mehrdadn 6y ago
> It's not the fault of the car owner for not securing their car. Securing their car against... their children? Or distributing the car's keys to 2,000 people?

shadowgovt 6y ago

We generally handle that liability free-market style, i.e. "Why the hell would I sign up for a Twitter account? Their security is so lousy some 17-year-old could be speaking as me."

baddox 6y ago

That was the other commenter's point: a 17 year old can hurt people with a car just as easily as a 40 year old. The age of the attacker has no relevance on how liable the recipient of the attack is for their security practices.

kodt 6y ago

Is a 17 year old hacking them really proof of worse security than say a 30 year old?

Nasrudith 6y ago
Well the age implicitly assumes potential levels of education and sophistication. Few would be surprised to hear a 30 year old engineer designed a novel world class chip - they could easily have a PhD at that point to have the sophistication capable. For a 17 year old that would be pretty damn extraordinary. Now hacking is less than thar even to laymen who don't know how simple some holes are but 17 implies a lack of great sophistication. The whole thing is an ageist rough proxy anyway - a developmentally disabled 30 year old hacking it would be more shameful than a 17 year old college graduate.

refurb 6y ago

I put a cheap lock on my door and someone breaks in and steals everything. Should I be held liable for my poor security practices?

7786655 6y ago
If you were responsible for securing my stuff, and you put a cheap lock on your door protecting my stuff, and someone breaks in and steals all my stuff, then yes, you should be held liable for your poor security practices.
- refurb 6y ago
  But that's not actually the law, is it? You could certainly bring a civil lawsuit (and so could Twitter users), but I haven't committed a crime.
  - MisterPea 6y ago
    True, but I think this case opens up doors on regulation of tech companies for security, or at least new laws for security negligence. The power that Twitter has due to its highest-profile users is immense, however, this hack made them look incredibly stupid.
    - refurb 6y ago
      I don't disagree, it's pretty damn embarrassing someone can get the keys to the kingdom through some social engineering. My only concern is what happened with Equifax - some punishment is put on the company and it's only a token amount and nothing changes.