4 ms·

I have an unrealistic idea (more of a thought experiment) that companies should face equal culpability to criminal hackers in attacks. After all, technically th

I have an unrealistic idea (more of a thought experiment) that companies should face equal culpability to criminal hackers in attacks. After all, technically the way the hackers use systems /is/ authorized in a sense, even if the method of obtaining authorization is unconventional. Maybe this would get companies to pay more attention to securing their systems. From a certain perspective, Twitter is an accomplice to fraud by providing the platform and the access to the fraudsters (although I'm fuzzy on whether knowledge of one's aiding of a crime is necessary for an entity to be legally considered an accomplice - probably is). And yes, the charge count is insane but the US loves holding a bit of life-ruining theater when they catch hackers threatening commercial interests. e.g. Aaron Swartz's conviction: https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosecution https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosec...

paulpauper 6y ago
accomplice means they knowingly aided in the fraud or profited from it. Being caught off guard is not a crime. The culpability is the reputation damage from being hacked.
- tantalor 6y ago
  >Being caught off guard is not a crime It can be. Twitter could be found criminally negligent if they knew the risk of this type of attack (or it was obvious) but chose to ignore it.
SparkyMcUnicorn 6y ago
I'm not sure I would call this "authorized in a sense" since social engineering, in order to gain access to an internal tool, was the method. Social engineering most often involves impersonation, so the person getting access was not really the intended party.
ChrisLomont 6y ago
Should we make homeowners equally criminally liable when burglars break in? Certainly if the homeowner had been less lax or obtained more security, that burglary could have been prevented.
- sneak 6y ago
  Breaking and entering requires breaking. Sending packets is peaceful speech.
  - nickff 6y ago
    Sending these particular packets was more akin to fraud. Should fraud be legalized?
    - deleted 6y ago
      [deleted]
- tantalor 6y ago
  Bad analogy: the only victim of a home invasion is the home owner. In the Twitter case, the victim were the users.
  - Consultant32452 6y ago
    Your comment just sparked an weird thought for me. We're all familiar with the adage that if a product is free, you're not the customer you're the product. In this Twitter breach, Twitter's customers were not harmed. However, the product was harmed.
- Sebb767 6y ago
  > Should we make homeowners equally criminally liable when burglars break in? Aren't they? I've seen a lot of insurance cases being denied due to negligence. This might even happen if you let your bag lie around openly in your locked car. Also, burglar victims tend not to cause further damage. And, if they do, the victims will be in trouble as well. At least in Germany, a stolen gun will cause you a lot of problems, unless you can prove that you stored it securely according to the national guidelines.
- nkrisc 6y ago
  Like most things in life: it depends. Your home was broken into and your jewelry stolen? No, you're not criminally liable for anything, you were the only victim. Your home was broken into and they stole the stack of personal records for your small business' employees that you left sitting on the dining room table? Yes, you should be liable for that because you were not the only victim and those others were victimized due to your own negligence. The documents were not properly secured, was your home properly secured as well given the sensitive material you were housing there? It doesn't have to be a binary thing either, there's nuance to it. A hacker steals unencrypted personal information off a server you didn't even password protect? You're more liable than a company that lost personal information that was strongly encrypted.
dahfizz 6y ago
> companies should face equal culpability to criminal hackers in attacks. That's an interesting idea, and I think I agree with you in spirit. But don't most hacking-related criminal charges boil down to "unauthorized access to a computer"? It would be hard to argue that the company that owns the computers has unauthorized access. Maybe a better phraseology would be to say that the company is an accomplice to the hacker. For that to really hold up, I think you would need to show that the company was negligent or not keeping up with security best practices.
- indigochill 6y ago
  > It would be hard to argue that the company that owns the computers has unauthorized access. That's not the way I'd argue. I'd say the company has authorized access and they then gave access to fraudsters who should not have been given access to the system, which is where they were aiding the fraud. So they aren't the principal offender, but they did aid in the offence which is what I'm suggesting makes them an accomplice (although as another paulpauper points out, an accomplice has to be aware they're aiding a crime - being duped isn't a crime).
bioipbiop 6y ago
I disagree, no system created by humans is going it be without flaws. I think it should be possible to sue a company if a victim can show that the company was negligent in its actions. Damages should be apportioned between the scammers and the company on the basis of their contributions to the act.

paulpauper 6y ago

accomplice means they knowingly aided in the fraud or profited from it. Being caught off guard is not a crime. The culpability is the reputation damage from being hacked.

tantalor 6y ago
>Being caught off guard is not a crime It can be. Twitter could be found criminally negligent if they knew the risk of this type of attack (or it was obvious) but chose to ignore it.

SparkyMcUnicorn 6y ago

I'm not sure I would call this "authorized in a sense" since social engineering, in order to gain access to an internal tool, was the method. Social engineering most often involves impersonation, so the person getting access was not really the intended party.

ChrisLomont 6y ago

Should we make homeowners equally criminally liable when burglars break in? Certainly if the homeowner had been less lax or obtained more security, that burglary could have been prevented.

sneak 6y ago
Breaking and entering requires breaking. Sending packets is peaceful speech.
- nickff 6y ago
  Sending these particular packets was more akin to fraud. Should fraud be legalized?
  - deleted 6y ago
    [deleted]
tantalor 6y ago
Bad analogy: the only victim of a home invasion is the home owner. In the Twitter case, the victim were the users.
- Consultant32452 6y ago
  Your comment just sparked an weird thought for me. We're all familiar with the adage that if a product is free, you're not the customer you're the product. In this Twitter breach, Twitter's customers were not harmed. However, the product was harmed.
Sebb767 6y ago
> Should we make homeowners equally criminally liable when burglars break in? Aren't they? I've seen a lot of insurance cases being denied due to negligence. This might even happen if you let your bag lie around openly in your locked car. Also, burglar victims tend not to cause further damage. And, if they do, the victims will be in trouble as well. At least in Germany, a stolen gun will cause you a lot of problems, unless you can prove that you stored it securely according to the national guidelines.
nkrisc 6y ago
Like most things in life: it depends. Your home was broken into and your jewelry stolen? No, you're not criminally liable for anything, you were the only victim. Your home was broken into and they stole the stack of personal records for your small business' employees that you left sitting on the dining room table? Yes, you should be liable for that because you were not the only victim and those others were victimized due to your own negligence. The documents were not properly secured, was your home properly secured as well given the sensitive material you were housing there? It doesn't have to be a binary thing either, there's nuance to it. A hacker steals unencrypted personal information off a server you didn't even password protect? You're more liable than a company that lost personal information that was strongly encrypted.

dahfizz 6y ago

> companies should face equal culpability to criminal hackers in attacks. That's an interesting idea, and I think I agree with you in spirit. But don't most hacking-related criminal charges boil down to "unauthorized access to a computer"? It would be hard to argue that the company that owns the computers has unauthorized access. Maybe a better phraseology would be to say that the company is an accomplice to the hacker. For that to really hold up, I think you would need to show that the company was negligent or not keeping up with security best practices.

indigochill 6y ago
> It would be hard to argue that the company that owns the computers has unauthorized access. That's not the way I'd argue. I'd say the company has authorized access and they then gave access to fraudsters who should not have been given access to the system, which is where they were aiding the fraud. So they aren't the principal offender, but they did aid in the offence which is what I'm suggesting makes them an accomplice (although as another paulpauper points out, an accomplice has to be aware they're aiding a crime - being duped isn't a crime).

bioipbiop 6y ago

I disagree, no system created by humans is going it be without flaws. I think it should be possible to sue a company if a victim can show that the company was negligent in its actions. Damages should be apportioned between the scammers and the company on the basis of their contributions to the act.