7 ms·

The article mentions Title 18 Section 1030 - probably (a)(5). He could potentially be prosecuted (a federal felony) for accessing a computer connected to the in

by ja27 15y ago

The article mentions Title 18 Section 1030 - probably (a)(5). He could potentially be prosecuted (a federal felony) for accessing a computer connected to the internet without permission. Since it wasn't a computer owned by the U.S. government or anything special, I think they need to show that he exploited his access for financial gain or that the damages exceeded $5,000. I can't imagine removing his program from a dozen macs would exceed $5,000, but they could try to show that. My guess is that unless there's more to this story, this won't result in a prosecution.

JackStraw 15y ago
(6) knowingly and with intent to defraud traffics (as defined in section1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; - 1029. Fraud and related activity in connection with access ¬devices If section 1030 doesn't fit, 1029 certainly does. How can you honestly think this won’t be prosecuted? He installed spyware on over 100 computers (Apple will have to come down hard to deter future instances of this nature and push for prosecution). The “artist” has also publicly admitted to doing so and provided the prosecution with more than enough evidence to see this through. It wasn't but an hour ago that the supposed “artist” received word from the EFF that he should just shut his mouth.
- fleitz 15y ago
  The computers were setup in mind with visitors being able to access them, he accessed them. The software he wrote would not require elevated privileges. He even asked a security guard whether he had permission to photograph in the store. I fail to see how it's unauthorized, also the recordings were made in a public space where there is no expectation of privacy. Even if privacy could be argued in a public space, I'm sure the Apple stores / malls have the requisite notices that people are being recorded, should they think they are not. There's a decent chance of a good defense. It's going to be difficult for Apple to argue that the computers were not meant to be used this way, infact Apple provides software (Photobooth) to take pictures and upload them to the internet on its computers. Are the feds seriously trying to assert that Apple had no idea how to configure their computers to enforce their access policy? Even if they couldn't figure this out a simple piece of tape over the camera would suffice. If Apple doesn't want people doing this to their computers they should post notices that one should not access their computers until they have read and signed the acceptable use policy.
  - chopsueyar 15y ago
    You're right. As long as the security guard said is was okay. I mean, it is a public space, paid for by our tax dollars, owned and run by the local government.
    - deleted 15y ago
      [deleted]
    - JackStraw 15y ago
      Let’s be clear about the known facts: 1) McDonald claims he received permission from a security guard, but I didn't see any evidence or video proof to support this assertion. 2) McDonald claims he received permission from the security guard, but he fails to provide any information for what he was approved to do. -Clearly, filming from a public space, outside and apple store through a window and into an apple store is not really the central point here (policies of this nature would be the purview of the mall – and that's not even clear!) - McDonald, apparently, was filming within an apple store, which, correct me if I am wrong, is not technically a public space since it is a commercially zoned space, paid for by apple. - McDonald provides no information to suggest that he received authorization to film apple customers, likely a violation of apple store policy and security regulations. Last I checked, I didn't see a sign informing customers that by entering this apple store you waive your right to protest apple’s right to use your image for free. Ya, that’s right cause it doesn't exist. Apple security monitoring of clients in stores seems pretty straight forward and in line with any other retail outlet. Accesses: I would argue it’s not an issue of access but the fact that he installed a program on these computers. Even if the terminals did not require elevated privileges (which you will see apple change in the coming days), it is the unauthorized introduction of a program, which violates the law. Again, access doesn't mean permission to augment settings. Additionally, it is interesting to note “12 states require, under most circumstances, the consent of all parties to a conversation. Those jurisdictions are California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington.” It is conceivable that the spyware in question infringed upon privacy laws in these states. That would be another charge. Photobooth has little to do with this situation as far as I can tell. Did customers agree to the service agreement or terms of service when demoing the computer? Answer, no. Because apple had no intention of allowing those pictures to be uploaded to the Net, right? Did these customers sign or digitally endorse a new kind of privacy policy that was presented by apple in order to use the demo computer? Answer, no. I mean really. Even if they did, would apple have been in a position to inform customers about potential spyware applications that were maliciously added to the demo computers? Answer, no. I mean come on. This is pretty clear, cut and dry. Whether or not McDonald is using art to cover his tracks or whether he is really that ignorant is best left to the courts. I am sure he can plead out, but he definitely gets zero sympathy from me.
- ja27 15y ago
  They have to show intent and damages. Unless I'm misunderstanding, he didn't delete or disrupt any data nor did he capture anything except photos of people in a public place. The computers he accessed were unlocked and on public display (again, unless I'm misunderstanding this). Though he may not have had explicit permission to install anything, I don't think there are any statements posted in Apple stores that tell you not to install anything. (I've personally installed apps on display iOS devices a number of times to try them out.) It could be hard to show the damages. These are display models in a store that I would suspect are regularly wiped clean anyways. If it really is 100 computers, that could approach the $5,000 figure though. But they still need to consider his intent. A judge wouldn't even be able to accept a guilty plea from him if he didn't include his intent to cause damage in his allocution. He's made it pretty clear that his intent was to create some form of art. (Unless there's something more to the story.) It's not a case I'd want to bring before a judge or jury, based on my understanding of the facts. That doesn't mean that they won't push for a plea deal or try the case just for the experience. I think section 1030 cases are still relatively rare.
- wnight 15y ago
  > He installed spyware on over 100 computers Get over yourself. He installed a simple app that takes and emails photos. He put it on computers that don't save state so there's no more clean-up then flicking the switch and rebooting them all. Sony wrote a rootkit, one that caused actual damages, and put it on thousands, if not millions, of home PCs. Why so much outrage at this photo project? Photographer steal your soul?
VladRussian 15y ago
>I can't imagine removing his program from a dozen macs would exceed $5,000, if to use Randal Schwartz's $68K restitution (in mid-90s prices) to Intel for copying a file between hosts as a precedent ...
- JackStraw 15y ago
  Apparently, the spyware was embedded on over 100 macs. That is at least what is known at the present time. Say apple hires a guy to clean those 100 machines and it takes 1 hour at a rate of??? We get above 5k in no time. Plus, do you really think apple is just going to check those 100 machines he admitted to infecting? Wouldnt you run a check on every single machine in that store? It wont take long to go from 5k to 500k.
  - sudonim 15y ago
    The machines are wiped automatically at night. The cost to apple to remove his software is no greater than what they do anyway...
    - JackStraw 15y ago
      Fair point. But if you were the regional manager at Apple, would you take that chance? More to the point if you were an executive at apple with the your PR team breathing down your neck would you tell them argue your point to the press? Or would you hire a bunch of high priced consultants to preform tests to authenticate and verify the security of the machines and stores in question? Yup, you would pay for the security PR umbrella without question and without hesitation. Again, well over $5k. Also, can you add "indirect costs" into the equation? If so, we have gone from +5k to near $1m in a matter of paragraphs. NEXT....
      - wnight 15y ago
        Are you trying to provide an example of the stupid things a lawyer could invent to blow this out of proportion, or are you actually arguing that there are any damages?

by ja27 15y ago

JackStraw 15y ago

(6) knowingly and with intent to defraud traffics (as defined in section1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; - 1029. Fraud and related activity in connection with access ¬devices If section 1030 doesn't fit, 1029 certainly does. How can you honestly think this won’t be prosecuted? He installed spyware on over 100 computers (Apple will have to come down hard to deter future instances of this nature and push for prosecution). The “artist” has also publicly admitted to doing so and provided the prosecution with more than enough evidence to see this through. It wasn't but an hour ago that the supposed “artist” received word from the EFF that he should just shut his mouth.

fleitz 15y ago
The computers were setup in mind with visitors being able to access them, he accessed them. The software he wrote would not require elevated privileges. He even asked a security guard whether he had permission to photograph in the store. I fail to see how it's unauthorized, also the recordings were made in a public space where there is no expectation of privacy. Even if privacy could be argued in a public space, I'm sure the Apple stores / malls have the requisite notices that people are being recorded, should they think they are not. There's a decent chance of a good defense. It's going to be difficult for Apple to argue that the computers were not meant to be used this way, infact Apple provides software (Photobooth) to take pictures and upload them to the internet on its computers. Are the feds seriously trying to assert that Apple had no idea how to configure their computers to enforce their access policy? Even if they couldn't figure this out a simple piece of tape over the camera would suffice. If Apple doesn't want people doing this to their computers they should post notices that one should not access their computers until they have read and signed the acceptable use policy.
- chopsueyar 15y ago
  You're right. As long as the security guard said is was okay. I mean, it is a public space, paid for by our tax dollars, owned and run by the local government.
  - deleted 15y ago
    [deleted]
  - JackStraw 15y ago
    Let’s be clear about the known facts: 1) McDonald claims he received permission from a security guard, but I didn't see any evidence or video proof to support this assertion. 2) McDonald claims he received permission from the security guard, but he fails to provide any information for what he was approved to do. -Clearly, filming from a public space, outside and apple store through a window and into an apple store is not really the central point here (policies of this nature would be the purview of the mall – and that's not even clear!) - McDonald, apparently, was filming within an apple store, which, correct me if I am wrong, is not technically a public space since it is a commercially zoned space, paid for by apple. - McDonald provides no information to suggest that he received authorization to film apple customers, likely a violation of apple store policy and security regulations. Last I checked, I didn't see a sign informing customers that by entering this apple store you waive your right to protest apple’s right to use your image for free. Ya, that’s right cause it doesn't exist. Apple security monitoring of clients in stores seems pretty straight forward and in line with any other retail outlet. Accesses: I would argue it’s not an issue of access but the fact that he installed a program on these computers. Even if the terminals did not require elevated privileges (which you will see apple change in the coming days), it is the unauthorized introduction of a program, which violates the law. Again, access doesn't mean permission to augment settings. Additionally, it is interesting to note “12 states require, under most circumstances, the consent of all parties to a conversation. Those jurisdictions are California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington.” It is conceivable that the spyware in question infringed upon privacy laws in these states. That would be another charge. Photobooth has little to do with this situation as far as I can tell. Did customers agree to the service agreement or terms of service when demoing the computer? Answer, no. Because apple had no intention of allowing those pictures to be uploaded to the Net, right? Did these customers sign or digitally endorse a new kind of privacy policy that was presented by apple in order to use the demo computer? Answer, no. I mean really. Even if they did, would apple have been in a position to inform customers about potential spyware applications that were maliciously added to the demo computers? Answer, no. I mean come on. This is pretty clear, cut and dry. Whether or not McDonald is using art to cover his tracks or whether he is really that ignorant is best left to the courts. I am sure he can plead out, but he definitely gets zero sympathy from me.
ja27 15y ago
They have to show intent and damages. Unless I'm misunderstanding, he didn't delete or disrupt any data nor did he capture anything except photos of people in a public place. The computers he accessed were unlocked and on public display (again, unless I'm misunderstanding this). Though he may not have had explicit permission to install anything, I don't think there are any statements posted in Apple stores that tell you not to install anything. (I've personally installed apps on display iOS devices a number of times to try them out.) It could be hard to show the damages. These are display models in a store that I would suspect are regularly wiped clean anyways. If it really is 100 computers, that could approach the $5,000 figure though. But they still need to consider his intent. A judge wouldn't even be able to accept a guilty plea from him if he didn't include his intent to cause damage in his allocution. He's made it pretty clear that his intent was to create some form of art. (Unless there's something more to the story.) It's not a case I'd want to bring before a judge or jury, based on my understanding of the facts. That doesn't mean that they won't push for a plea deal or try the case just for the experience. I think section 1030 cases are still relatively rare.
wnight 15y ago
> He installed spyware on over 100 computers Get over yourself. He installed a simple app that takes and emails photos. He put it on computers that don't save state so there's no more clean-up then flicking the switch and rebooting them all. Sony wrote a rootkit, one that caused actual damages, and put it on thousands, if not millions, of home PCs. Why so much outrage at this photo project? Photographer steal your soul?

VladRussian 15y ago

>I can't imagine removing his program from a dozen macs would exceed $5,000, if to use Randal Schwartz's $68K restitution (in mid-90s prices) to Intel for copying a file between hosts as a precedent ...

JackStraw 15y ago
Apparently, the spyware was embedded on over 100 macs. That is at least what is known at the present time. Say apple hires a guy to clean those 100 machines and it takes 1 hour at a rate of??? We get above 5k in no time. Plus, do you really think apple is just going to check those 100 machines he admitted to infecting? Wouldnt you run a check on every single machine in that store? It wont take long to go from 5k to 500k.
- sudonim 15y ago
  The machines are wiped automatically at night. The cost to apple to remove his software is no greater than what they do anyway...
  - JackStraw 15y ago
    Fair point. But if you were the regional manager at Apple, would you take that chance? More to the point if you were an executive at apple with the your PR team breathing down your neck would you tell them argue your point to the press? Or would you hire a bunch of high priced consultants to preform tests to authenticate and verify the security of the machines and stores in question? Yup, you would pay for the security PR umbrella without question and without hesitation. Again, well over $5k. Also, can you add "indirect costs" into the equation? If so, we have gone from +5k to near $1m in a matter of paragraphs. NEXT....
    - wnight 15y ago
      Are you trying to provide an example of the stupid things a lawyer could invent to blow this out of proportion, or are you actually arguing that there are any damages?