3 ms·

We have laws like this for computer hackers. No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I a

by Tronno 6y ago

We have laws like this for computer hackers. No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". Why not for the financial system?

wmf 6y ago
The CFAA is a terrible law that has been used to prosecute people over very questionable cases. Let's not bring (any more of) that level of subjectivity to finance.
majormajor 6y ago
> No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". This is a pretty common argument, actually, when it comes to questions of "allowed" API access.
kevin_thibedeau 6y ago
Exploiting loopholes is virtuous for many of the people in the industry. It demonstrates your attentiveness to the rules.
thaumasiotes 6y ago
> No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". People charged with hacking defend themselves this way all the time. And other people defend them in the same terms. Recently a guy was charged for accessing public URLs. Sure, they were specifically made available to the public, but the public wasn't supposed to look at them.
- jessaustin 6y ago
  The weev case was a travesty from start to finish. The failure on ATT's part is legendary. The "secret" information was only ever exposed to a professional journalist, who didn't pass it on to anyone. Nothing happened in New Jersey. And of course, as the appellate court found: ...no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published. [0] [0] http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevrulingvacation.pdf http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevru...
- mannykannot 6y ago
  I think it is pretty clear from the context that a) Tronno is referring to people exploiting vulnerabilities for nefarious purposes, and b) successfully defending themselves with that argument.
toolz 6y ago
but should our legal system prosecute those hackers that didn't break any law on the books? I'd argue they shouldn't - sure some of the bad guys get put away, but so to do good* guys because of the legal precedent being followed *good as being defined as likely a net positive value on society similarly bad as being defined as a net negative for society
YawningAngel 6y ago
No such law is needed, at least in this case. This guy is up to his neck in lawsuits and the only reason he isn't cooling his heels in a Copenhagen jail is that he's on the run in Dubai
Emendo 6y ago
For computer hackers, we have clear laws citing unlawful access to computer systems. Plus, computer hackers don't tend to consult with lawyers before doing their thing. For traders, we don't have all-encompassing laws covering tax avoidance. Plus, traders have money for hiring professional for finding loopholes. That's the difference.
throwaway0a5e 6y ago
>We have laws like this for computer hackers. No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". Why not for the financial system? Because the CFAA is pretty universally hated and makes for bad outcomes.

by Tronno 6y ago

wmf 6y ago

The CFAA is a terrible law that has been used to prosecute people over very questionable cases. Let's not bring (any more of) that level of subjectivity to finance.

majormajor 6y ago

> No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". This is a pretty common argument, actually, when it comes to questions of "allowed" API access.

kevin_thibedeau 6y ago

Exploiting loopholes is virtuous for many of the people in the industry. It demonstrates your attentiveness to the rules.

thaumasiotes 6y ago

> No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". People charged with hacking defend themselves this way all the time. And other people defend them in the same terms. Recently a guy was charged for accessing public URLs. Sure, they were specifically made available to the public, but the public wasn't supposed to look at them.

jessaustin 6y ago
The weev case was a travesty from start to finish. The failure on ATT's part is legendary. The "secret" information was only ever exposed to a professional journalist, who didn't pass it on to anyone. Nothing happened in New Jersey. And of course, as the appellate court found: ...no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published. [0] [0] http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevrulingvacation.pdf http://cdn.arstechnica.net/wp-content/uploads/2014/04/weevru...
mannykannot 6y ago
I think it is pretty clear from the context that a) Tronno is referring to people exploiting vulnerabilities for nefarious purposes, and b) successfully defending themselves with that argument.

toolz 6y ago

but should our legal system prosecute those hackers that didn't break any law on the books? I'd argue they shouldn't - sure some of the bad guys get put away, but so to do good* guys because of the legal precedent being followed *good as being defined as likely a net positive value on society similarly bad as being defined as a net negative for society

YawningAngel 6y ago

No such law is needed, at least in this case. This guy is up to his neck in lawsuits and the only reason he isn't cooling his heels in a Copenhagen jail is that he's on the run in Dubai

Emendo 6y ago

For computer hackers, we have clear laws citing unlawful access to computer systems. Plus, computer hackers don't tend to consult with lawyers before doing their thing. For traders, we don't have all-encompassing laws covering tax avoidance. Plus, traders have money for hiring professional for finding loopholes. That's the difference.

throwaway0a5e 6y ago

>We have laws like this for computer hackers. No-one ever defends themselves by saying "everything I did was enabled by the poorly designed system, therefore I am not a criminal". Why not for the financial system? Because the CFAA is pretty universally hated and makes for bad outcomes.