45 ms·

I don't believe this is accurate or in any way obvious even if this is the stance the courts would ultimately take. These files were downloaded from a publicly

by dcow 6y ago

I don't believe this is accurate or in any way obvious even if this is the stance the courts would ultimately take. These files were downloaded from a publicly available CDN server discovered while browsing the internet. No authorization mechanisms were bypassed, no computer systems were hacked. These files are the result of a GET request to an Akamai server that happened to be hosting the files. Despite how this will be spun in pop culture, Intel did not secure access to these files. I'm not sure how you would prosecute someone for re-sharing a file they were given, under no legal contract, when they asked for it.

zerotolerance 6y ago
Verizon and US courts would disagree with you.
- dcow 6y ago
  Links? I'm curious about existing case law.
  - deleted 6y ago
    [deleted]
  - meowface 6y ago
    Here's one example: https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/ >The two essentially wrote a program to send GET requests to [publicly available pages on] the web site.
    - dcow 6y ago
      Ruling was appealed and deemed incorrect: https://www.wired.com/2014/04/att-hacker-conviction-vacated/ https://www.wired.com/2014/04/att-hacker-conviction-vacated/
      - dleslie 6y ago
        Not quite, it was vacated on the grounds of improper venue. It wasn't reversed or similar; to be vacated is to be voided, as though the case never occurred.
        dcow 6y ago
        I mean yes. I wish it was actually reversed on grounds that the ruling didn't stand. But that was the intention of the appeal. Dismissing it on improper venue is simply tactical. This is the legal system's way of saying, "there was enough contention in this case that we don't feel comfortable with the whole thing in the first place so we'll throw it out on a technicality and avoid inventing any case law here".
        meowface 6y ago
        I'm not a lawyer, but I'm not 100% sure if thats's the best interpretation. It being thrown out on a technicality doesn't necessarily imply anything about their feelings regarding the facts of the case. Basically, I would not be surprised that if the exact same case happened today, the defendants would still get jail time.
deleted 6y ago
[deleted]
rvnx 6y ago
Not sure about US but in France it's considered a quite serious crime
zeroimpl 6y ago
That’s a very weak argument. If I’m walking down the street at night and somebody comes up to me and says “GET /money”, I may respond with an HTTP 200, but that doesn’t mean the person didn’t just steal from me.
- dcow 6y ago
  You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.
  - zeroimpl 6y ago
    It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime. Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
    - dcow 6y ago
      Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a file which anyone is allowed to view?
      - zeroimpl 6y ago
        Were the files listed when going to http://server.com http://server.com? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the server finally responded with some hidden data. While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.
MauranKilom 6y ago
You have a lot of faith in how technically versed the law and courts are on these topics - because they sure haven't kept up with the times. And even if they were willing to split hairs over these technical details: No civilian will agree with you that just because technically you could slip through several doors that happened to be not locked and got helpful advice from a neighbor, it doesn't mean that whatever you found behind those doors was "public" just because you didn't have to pick locks. Or that the photos you took of private company documents by social engineering your way inside must clearly be unsecured and publicly distributable because "they were given to me when I asked for them".
- dcow 6y ago
  This isn't slipping through various open doors. There were no doors. This is literally a public server on the public internet serving files publicly. Intel is grossly negligent in securing their assets if they're hosting what they consider to be confidential trade secrets on public CDN servers. The analog would be if I posted a flyer on a telephone pole with what I considered confidential information and someone else took a picture of it. There's no way you could argue that I had a reasonable expectation that only people for whom the flyer was intended would be able to view the flyer. If someone deliberately bypassed computer security measures to acquire this information I'd agree. But you don't get a free pass to be negligent just because you're a big company. I suspect the EFF would support my viewpoint as they supported Weeve's appeal of a much more contentions and ethically gray scenario (the acquisition of personal information from a server that was negligently "secured" and required someone to imitate the calls an iPad would make).
  - dleslie 6y ago
    > This is literally a public server on the public internet serving files publicly. The flyer analogy does not work because the services were not broadcasting or otherwise advertising their presence. Following the house analogy, the thief tested all the front doors on the street and opened those which were not locked.
    - 6y ago
ummonk 6y ago
If someone leaves their door unlocked and open it doesn't mean I have a right to walk in and take what I want.
- ddingus 6y ago
  This is more like leaving it on the street, mixed in with a lot of other free stuff. Physical analogies break down. Truth is, this info was out there for anyone to copy, and who ever did that is definitely guilty of something and or liable. It will be tough to make passers by into criminals here. They aren't. Keeping secrets is hard. Should be.
  - ddingus 6y ago
    I wrote this poorly. Meant whomever left this data in the clear is guilty of something and or liable.
    - ummonk 6y ago
      It would be like keeping a dropped wallet - the person who keeps it is guilty, not the person who accidentally dropped it.
      - dcow 6y ago
        No it wouldn't. It would be like taking a picture of a dropped wallet on the street. Regardless, under what moral framework are we operating such that obvious guilt is prescribed to anyone who might pick up a wallet in the street, anyway? Of what crime are they guilty?

by dcow 6y ago

zerotolerance 6y ago

Verizon and US courts would disagree with you.

dcow 6y ago
Links? I'm curious about existing case law.
- deleted 6y ago
  [deleted]
- meowface 6y ago
  Here's one example: https://www.wired.com/2013/03/att-hacker-gets-3-years/ https://www.wired.com/2013/03/att-hacker-gets-3-years/ >The two essentially wrote a program to send GET requests to [publicly available pages on] the web site.
  - dcow 6y ago
    Ruling was appealed and deemed incorrect: https://www.wired.com/2014/04/att-hacker-conviction-vacated/ https://www.wired.com/2014/04/att-hacker-conviction-vacated/
    - dleslie 6y ago
      Not quite, it was vacated on the grounds of improper venue. It wasn't reversed or similar; to be vacated is to be voided, as though the case never occurred.
      - dcow 6y ago
        I mean yes. I wish it was actually reversed on grounds that the ruling didn't stand. But that was the intention of the appeal. Dismissing it on improper venue is simply tactical. This is the legal system's way of saying, "there was enough contention in this case that we don't feel comfortable with the whole thing in the first place so we'll throw it out on a technicality and avoid inventing any case law here".
        meowface 6y ago
        I'm not a lawyer, but I'm not 100% sure if thats's the best interpretation. It being thrown out on a technicality doesn't necessarily imply anything about their feelings regarding the facts of the case. Basically, I would not be surprised that if the exact same case happened today, the defendants would still get jail time.

deleted 6y ago

[deleted]

rvnx 6y ago

Not sure about US but in France it's considered a quite serious crime

zeroimpl 6y ago

That’s a very weak argument. If I’m walking down the street at night and somebody comes up to me and says “GET /money”, I may respond with an HTTP 200, but that doesn’t mean the person didn’t just steal from me.

dcow 6y ago
You just gave them money. They didn't coerce you. It would be different if they flashed a weapon.
- zeroimpl 6y ago
  It's a fictitious example. I didn't say there was no weapon, nor said it was definitely theft. The point is that submitting a GET request in a public setting does not mean no crime. Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
  - dcow 6y ago
    Again, I don't believe it's accurate or honest to call this coercion. These files were obtained from a content delivery network by visiting a url in a browser. Nothing deceptive, cunning, crafty, or coercive about it. Let me ask you, what files am I allowed to access on a public network? Must I ask owners permission before visiting their websites? Must I be able to find it with a search engine? What constitutes a file which anyone is allowed to view?
    - zeroimpl 6y ago
      Were the files listed when going to http://server.com http://server.com? No, the user had to: 1. Find the server via nmap 2. Guess at some URLs until the server finally responded with some hidden data. While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.

MauranKilom 6y ago

You have a lot of faith in how technically versed the law and courts are on these topics - because they sure haven't kept up with the times. And even if they were willing to split hairs over these technical details: No civilian will agree with you that just because technically you could slip through several doors that happened to be not locked and got helpful advice from a neighbor, it doesn't mean that whatever you found behind those doors was "public" just because you didn't have to pick locks. Or that the photos you took of private company documents by social engineering your way inside must clearly be unsecured and publicly distributable because "they were given to me when I asked for them".

dcow 6y ago
This isn't slipping through various open doors. There were no doors. This is literally a public server on the public internet serving files publicly. Intel is grossly negligent in securing their assets if they're hosting what they consider to be confidential trade secrets on public CDN servers. The analog would be if I posted a flyer on a telephone pole with what I considered confidential information and someone else took a picture of it. There's no way you could argue that I had a reasonable expectation that only people for whom the flyer was intended would be able to view the flyer. If someone deliberately bypassed computer security measures to acquire this information I'd agree. But you don't get a free pass to be negligent just because you're a big company. I suspect the EFF would support my viewpoint as they supported Weeve's appeal of a much more contentions and ethically gray scenario (the acquisition of personal information from a server that was negligently "secured" and required someone to imitate the calls an iPad would make).
- dleslie 6y ago
  > This is literally a public server on the public internet serving files publicly. The flyer analogy does not work because the services were not broadcasting or otherwise advertising their presence. Following the house analogy, the thief tested all the front doors on the street and opened those which were not locked.
  - 6y ago

ummonk 6y ago

If someone leaves their door unlocked and open it doesn't mean I have a right to walk in and take what I want.

ddingus 6y ago
This is more like leaving it on the street, mixed in with a lot of other free stuff. Physical analogies break down. Truth is, this info was out there for anyone to copy, and who ever did that is definitely guilty of something and or liable. It will be tough to make passers by into criminals here. They aren't. Keeping secrets is hard. Should be.
- ddingus 6y ago
  I wrote this poorly. Meant whomever left this data in the clear is guilty of something and or liable.
  - ummonk 6y ago
    It would be like keeping a dropped wallet - the person who keeps it is guilty, not the person who accidentally dropped it.
    - dcow 6y ago
      No it wouldn't. It would be like taking a picture of a dropped wallet on the street. Regardless, under what moral framework are we operating such that obvious guilt is prescribed to anyone who might pick up a wallet in the street, anyway? Of what crime are they guilty?