9 ms·

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years prob

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any responsible disclosure process. Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you'll be seen as an adorable Matthew Broderick type Wargames character. I can't overemphasize how far this is from the truth in 2021. Absolutely do not access systems you are not allowed to. If you do want to do penetration testing, you need permission from the systems owner and a clearly defined scope. And when you do find issues, you don't exploit them, you responsibly disclose them within a clearly defined framework. If you want to end up with a criminal record that will profoundly effect the rest of your life, including your career prospects and ability to travel internationally, then by all means, do what this guy did. I wish it wasn't so. It never used to be. But this is how it is now. Overzealous prosecutors have been given a huge amount of power, and all you need is one embarrassed systems administrator, school board or management team to trigger a disastrous outcome in stories like this.

baybal2 5y ago
This is ridiculous
jjoonathan 5y ago
Gross but true. The administration has every incentive and opportunity to spin this into a self-serving story about taking down evil sinister hackers -- and maybe scapegoat a few unrelated problems while they are at it. I am delighted that these admins had the character to resist the perverse incentives of the system.
jdkee 5y ago
This post is 100% spot on. While the local school district may treat it as a prank, in the U.S. the federal authorities may not. To see how seriously the government takes this act, look at the penalties section of the relevant U.S. code. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
- dakna 5y ago
  And yet, there is overwhelming demand for what the government calls "cyber security". As a developer it is easy to get good at your craft by practicing and learning, how in the world is a security specialist able to practice without asking for permission or already having a job? A home lab setup? A college degree and formal education? I'm curious how people actually evaluate this career choice.
  - ActorNightly 5y ago
    In my personal experience with working in government related cyber security, the positions are for dudes that type bash commands to run tools that are all developed by 3p companies, which end up hiring people regardless of criminal history.
  - aerostable_slug 5y ago
    Capture The Flag challenges. You don't need much more than a terminal.
    - rhexs 5y ago
      The leetcode of the security world! Thankfully not that bad...yet.
- collegeburner 5y ago
  Yeah, go to them about ransomware gangs or nation state actors and you basically get told "lol we cant do shit". Complain about a kid prank and theyll go apeshit and make a, uhh, federal case of it to make themselves feel needed.
Faaak 5y ago
I agree, that feels wrong to me... When I was younger (~15) I also did some "fun" (aka stupid) stuff with the school computer network and in the end they got me and I received a "formal warning" (it was in France). In the end I'm glad for it because that scared me off and I never tried again on stuff that I don't own. But putting a kid in jail/having a criminal record seems way to excessive to me. Kids are dumb. And by punishing them that hard they won't become a better person. hell, they won't be able to have a job !
- WarOnPrivacy 5y ago
  > But putting a kid in jail/having a criminal record seems way to excessive to me. It absolutely is. Society is clearly harmed by laws like the CFAA. LEO do like overly broad laws though. There's nothing better to ruin the lives of people that cops don't like.
donatj 5y ago
When I was in High School in 2003 I discovered you could pretty easily get around the tool that blocked running installers by launching them by entering the full path to the installer in the address bar of Internet Explorer. This was before Windows and IE were decoupled. I installed VNC server on a couple friends computers and used it for some light hearted pranks, but didn't do anything else with it. One of my friends who I did this to went crazy with it and used it to mess with his teachers computers. Ended up in huge trouble, cops knocking on his door, and I believe probation. This was the year after I graduated. On the one hand, I kind of feel responsible for showing him, on the other hand, it's his fault he had to go off and be an idiot with something I just thought was fun.
bellyfullofbac 5y ago
Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...
- whimsicalism 5y ago
  > I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. If you read TFA, that is effectively what happened. Even with the guarantee, only one of them revealed themselves.
  - paxys 5y ago
    No point in pulling off a complicated prank without enjoying the notoriety gained from it.
- nucleardog 5y ago
  > I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money... Criminal charges are generally filed by the prosecutor. They'll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases). There is absolutely zero the school can do to guarantee that you won't be charged if the prosecutor does catch wind of the incident and decides to make an example of you.
  - noodlesUK 5y ago
    This is generally true, but the CFAA is obviously not violated by access which is authorised. In this case, you could simply draw up a pentest agreement and get them to say any such activity would be authorised.
usmannk 5y ago
> Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK Maybe a bit overzealous with the reaction here. OK, sure, the OP could have been even more serious about this but literally the first labeled section is "DISCLAIMER" and says: > With that said, what we did was very illegal, and other administrations may have pressed charges. We are grateful that the D214 administration was so understanding.
CobrastanJorji 5y ago
I remember back in high school we had this computer lab that was all locked down. Didn't allow opening the CD-ROM drives, only allowed certain educational websites, etc. I put a little remote access app on my share drive as a way to open my own CD drive, mostly just to see if I could do it. The school's computer guy came and found me and was like "hey, a file pinged as malware, what's up with that" and we had a fun discussion about it and I deleted it and we moved on with our lives. I didn't think about it again. Years later, I looked back with horror at how badly that could have gone for me.
- aspenmayer 5y ago
  Your school didn’t have paperclips?
  - klyrs 5y ago
    Can't get 'em through the metal detector. Gotta grind down a toothbrush on concrete these days...
    - aspenmayer 5y ago
      Oh, I meant to imply that you would procure and assemble your tools once on-site. What you don’t pack-in, you may not need to pack-out, etc.
- jfk13 5y ago
  Ah, you young whippersnappers with your labs and networks and CDs... my high school just got one Commodore PET, that was "the school computer" in my day. Fortunately, I got on well with the math teacher who had charge of it, and he'd let me take it home over the weekends. Those were the days...
  - edoceo 5y ago
    Apple IIe gang over here. Don't bend my floppy!
Mizza 5y ago
I know somebody - I think they post here, hi! - who ended up in "weekend jail" with a conviction for sharing a school's WiFi password without permission. I also once got reprimanded for writing a blog post not too dissimilar to this one at a less sympathetic school. I also remember the joy of hiding a server in the ceiling of our school so we could play UT2K3 on the library computers before that exploded similarly. Adults are so boring.
- mdip 5y ago
  Every district is different, heck -- every school within a district can be different in extreme discipline like this. Frankly, the size of his district represented a lot of risk; those often have the policies with the least wiggle-room -- like "Weekend Jail for Sharing a WiFi password" (insane). At the school my child attends, I am confident he would have ended up with a pat on the back if the circumstances were similar. I can't speak for the district -- I'd be willing to bet that'd be very risky. At the school I had once attended, I'd expect the entire district would behave similarly. I'm sure there were people within the district administration that wanted to throw the book at the kids involved. Here's the thing for those people: the last thing a school district wants is to become national news for punishing a bunch of kids who the evening news can make out to look like "Geniuses". Since nothing failed in their plan -- that's crazy important -- there would be very few ways to frame the story that makes the administration look like anything but bullies, and many will frame them as "petty bullies". I have a friend I went to High School with who is now a High School principal. He's still "that guy I went to High School with." I have no doubt he would have given the kids an award privately, if not publicly. It's sad that some public school districts are using discipline approaches you'd expect to see in prisons, rather than a school, and I'm sure in certain places in the country, that might be a necessity. Context matters, too -- were these kids who were constantly pulling pranks like this, had been talked to in the past/impacted things in the past, etc, I'd expect a harsh response: "Yes, we get it, you're smart, stop breaking things already, read the horrors of the 1986 CFAA because that's coming if it happens again." I'm guessing these were otherwise good students.
runjake 5y ago
That said, maybe we should lighten up on minors performing harmless/non-destructive pranks. Not everything warrants felony charges for kids.
- jjoonathan 5y ago
  Of course -- but we aren't the ones making the rules, and the ones who do make the rules have certain incentives that lead them in dark directions.
dec0dedab0de 5y ago
Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you'll be seen as an adorable Matthew Broderick type Wargames character. I can't overemphasize how far this is from the truth in 2021. Or maybe it will shame other IT departments into not having a stick up their butt. Especially if there is already a culture of overlooking minor criminal activity in the name of harmless pranks.
tkinom 5y ago
For anyone who like to hack legally and ethically, check out https://www.hackerone.com/ https://www.hackerone.com/. If you're very good at hacking devices, software, networks, etc, companies will pay bounties for the vulnerabilities you find thru HackerOne. Looks like they paid out millions in bounty in 2020: https://www.zdnet.com/article/hackerones-2020-top-10-public-bug-bounty-programs/
- cwkoss 5y ago
  Worth a try, but I didn't have a good experience with it. Companies can mark items as duplicates without fixing the underlying bug for an indefinite period of time. So the 3 vulnerabilities I found all got marked as duplicates without any compensation or even acknowledgement of my time writing up the issues. Felt like a complete waste of time. If you're great, you can probably find novel stuff better than I was able to, but if you're that great you likely already have plenty of employment opportunities.
hparadiz 5y ago
Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that are currently in place. If more kids rebelled and this was a regular occurrence it would help to desensitize society to digital pranks instead of always treating these kids like terrorists.
- paxys 5y ago
  I don't understand this response. Having been on the wrong end of it you should be advocating harder than anyone to teach kids the complexities of cybersecurity law and ensure they can make the right decisions rather than throw away their future over a stupid prank. There is no "validation" happening here, the OP is just stating reality. Random high schoolers' rebellions aren't going to result in Congress overturning the Computer Fraud and Abuse Act and a hundred related laws.
  - rkk3 5y ago
    > ensure they can make the right decisions rather than throw away their future over a stupid prank. Is it a good system if a "stupid prank" can "throw away your future" ?
    - paxys 5y ago
      No it is not a good system. But nothing I said is invalid because of that.
    - skeaker 5y ago
      No, but that doesn't mean you should deliberately play into it.
- quasarj 5y ago
  What? How is warning someone that they are going to ruin their lives the same as endorsing it?
outworlder 5y ago
> because it sends the signal to other young aspiring cybersecurity professionals that this is OK, There are multiple disclaimers in the text, almost every other paragraph.
ActorNightly 5y ago
Id actually wonder if criminal history matters when you have skills like this that are very much in demand. If this went to court, the charges of malicious intent would likely not stick, so jailtime could likely be avoided in leu of fine/community service. Competent tech companies will not give a shit about criminal record of this nature. Expulsion from school is pretty much irrelevant, especially for CS careers. You can get a GED, find any college with CS program that will take your money, spend a year having fun, apply for an internship at a tech company, do a good job to be offered a return, talk to HR to go directly into entry level role, and you are set (have personally seen 2 cases of this happening with an intern). The most functionally harmful thing would be monetary cost, which is still inconsequential considering the salary this guy would make.
- kube-system 5y ago
  It depends on how regulated the particular industry is. If you're building consumer web apps at a startup, it probably won't matter. If you want to be a government contractor, it's probably a nonstarter.
  - ActorNightly 5y ago
    Most of the industry where the guy will be paid appropriately is going to be private. Cyber security specialists for things like AWS get paid much more than any government contractor.
    - kube-system 5y ago
      That's not really the best example; AWS is a government contractor. It isn’t a coincidence that HQ2 is a few blocks away from the Pentagon.
inputsecretcode 5y ago
Wow that's terrifying, I'm from the EU and did 1000x worse stuff than that, never suffered any consequence, which is not right, but teenagers going to prison for hacking pranks it's really fucked up.
bsza 5y ago
> This kid is very very lucky. No, he is just smart. He did it anonymously. He knows how to cover his a$$. > it sends the signal to other young aspiring cybersecurity professionals that this is OK The post literally has a whole section dedicated to explaining that this is not OK, but whatever.
mcbishop 5y ago
Malicious hackers could have shown something unspeakably vile on all those screens. If this kid reduced the likelihood of that... he's a hero. Alas, I totally hear you.
marvin 5y ago
There is something obscenely totalitarian about this whole mindset. You're making a very pragmatic point, but take a step back and look at the whole thing. You're warning a teenager against making a brilliant, harmless, funny and responsible prank so that they won't get their whole life fucked up forever. Think a little about what kind of political system necessitates that kind of ridiculous warning. What sort of nation does this kind of thing to its kids? If we strike the United States from the list, what sort of countries are left? You guys really need to get your so-called justice system sorted out. Sorry to make such a blunt point, but this is depressing as hell.
pascalxus 5y ago
yeah, it's pretty messed up that there's such extremely heavy penalties for merely playing a youtube video on a few screens whereas looting and stealing go completely unpunished. what kind of message is that sending to our youth?
NaturalPhallacy 5y ago
The CFAA exists to make sure that nobody can use computers and the internet to have any power over even tyrannical authorities. CFAA and the DMCA are some of the worst, most authoritarian laws ever created, and they exist to do nothing other ensure a system where being rich enough to afford lawyers means you don't have to do anything else. Use default passwords like an idiot and someone uses their autofill? They're the criminal, not you. Let people just change the account number in the address bar and switch accounts with zero authorization or authentication? They're the criminal, not you. (Bank of America literally did this.) Have open access for students to download papers and one of them uses it to download all of them? They're the criminal, not you. (RIP Aaron Swartz) I support jury nullification for the CFAA and DMCA and so should everyone reading this.

baybal2 5y ago

This is ridiculous

jjoonathan 5y ago

Gross but true. The administration has every incentive and opportunity to spin this into a self-serving story about taking down evil sinister hackers -- and maybe scapegoat a few unrelated problems while they are at it. I am delighted that these admins had the character to resist the perverse incentives of the system.

jdkee 5y ago

This post is 100% spot on. While the local school district may treat it as a prank, in the U.S. the federal authorities may not. To see how seriously the government takes this act, look at the penalties section of the relevant U.S. code. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

dakna 5y ago
And yet, there is overwhelming demand for what the government calls "cyber security". As a developer it is easy to get good at your craft by practicing and learning, how in the world is a security specialist able to practice without asking for permission or already having a job? A home lab setup? A college degree and formal education? I'm curious how people actually evaluate this career choice.
- ActorNightly 5y ago
  In my personal experience with working in government related cyber security, the positions are for dudes that type bash commands to run tools that are all developed by 3p companies, which end up hiring people regardless of criminal history.
- aerostable_slug 5y ago
  Capture The Flag challenges. You don't need much more than a terminal.
  - rhexs 5y ago
    The leetcode of the security world! Thankfully not that bad...yet.
collegeburner 5y ago
Yeah, go to them about ransomware gangs or nation state actors and you basically get told "lol we cant do shit". Complain about a kid prank and theyll go apeshit and make a, uhh, federal case of it to make themselves feel needed.

Faaak 5y ago

I agree, that feels wrong to me... When I was younger (~15) I also did some "fun" (aka stupid) stuff with the school computer network and in the end they got me and I received a "formal warning" (it was in France). In the end I'm glad for it because that scared me off and I never tried again on stuff that I don't own. But putting a kid in jail/having a criminal record seems way to excessive to me. Kids are dumb. And by punishing them that hard they won't become a better person. hell, they won't be able to have a job !

WarOnPrivacy 5y ago
> But putting a kid in jail/having a criminal record seems way to excessive to me. It absolutely is. Society is clearly harmed by laws like the CFAA. LEO do like overly broad laws though. There's nothing better to ruin the lives of people that cops don't like.

donatj 5y ago

When I was in High School in 2003 I discovered you could pretty easily get around the tool that blocked running installers by launching them by entering the full path to the installer in the address bar of Internet Explorer. This was before Windows and IE were decoupled. I installed VNC server on a couple friends computers and used it for some light hearted pranks, but didn't do anything else with it. One of my friends who I did this to went crazy with it and used it to mess with his teachers computers. Ended up in huge trouble, cops knocking on his door, and I believe probation. This was the year after I graduated. On the one hand, I kind of feel responsible for showing him, on the other hand, it's his fault he had to go off and be an idiot with something I just thought was fun.

bellyfullofbac 5y ago

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...

whimsicalism 5y ago
> I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. If you read TFA, that is effectively what happened. Even with the guarantee, only one of them revealed themselves.
- paxys 5y ago
  No point in pulling off a complicated prank without enjoying the notoriety gained from it.
nucleardog 5y ago
> I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money... Criminal charges are generally filed by the prosecutor. They'll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases). There is absolutely zero the school can do to guarantee that you won't be charged if the prosecutor does catch wind of the incident and decides to make an example of you.
- noodlesUK 5y ago
  This is generally true, but the CFAA is obviously not violated by access which is authorised. In this case, you could simply draw up a pentest agreement and get them to say any such activity would be authorised.

usmannk 5y ago

> Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK Maybe a bit overzealous with the reaction here. OK, sure, the OP could have been even more serious about this but literally the first labeled section is "DISCLAIMER" and says: > With that said, what we did was very illegal, and other administrations may have pressed charges. We are grateful that the D214 administration was so understanding.

CobrastanJorji 5y ago

I remember back in high school we had this computer lab that was all locked down. Didn't allow opening the CD-ROM drives, only allowed certain educational websites, etc. I put a little remote access app on my share drive as a way to open my own CD drive, mostly just to see if I could do it. The school's computer guy came and found me and was like "hey, a file pinged as malware, what's up with that" and we had a fun discussion about it and I deleted it and we moved on with our lives. I didn't think about it again. Years later, I looked back with horror at how badly that could have gone for me.

aspenmayer 5y ago
Your school didn’t have paperclips?
- klyrs 5y ago
  Can't get 'em through the metal detector. Gotta grind down a toothbrush on concrete these days...
  - aspenmayer 5y ago
    Oh, I meant to imply that you would procure and assemble your tools once on-site. What you don’t pack-in, you may not need to pack-out, etc.
jfk13 5y ago
Ah, you young whippersnappers with your labs and networks and CDs... my high school just got one Commodore PET, that was "the school computer" in my day. Fortunately, I got on well with the math teacher who had charge of it, and he'd let me take it home over the weekends. Those were the days...
- edoceo 5y ago
  Apple IIe gang over here. Don't bend my floppy!

Mizza 5y ago

I know somebody - I think they post here, hi! - who ended up in "weekend jail" with a conviction for sharing a school's WiFi password without permission. I also once got reprimanded for writing a blog post not too dissimilar to this one at a less sympathetic school. I also remember the joy of hiding a server in the ceiling of our school so we could play UT2K3 on the library computers before that exploded similarly. Adults are so boring.

mdip 5y ago
Every district is different, heck -- every school within a district can be different in extreme discipline like this. Frankly, the size of his district represented a lot of risk; those often have the policies with the least wiggle-room -- like "Weekend Jail for Sharing a WiFi password" (insane). At the school my child attends, I am confident he would have ended up with a pat on the back if the circumstances were similar. I can't speak for the district -- I'd be willing to bet that'd be very risky. At the school I had once attended, I'd expect the entire district would behave similarly. I'm sure there were people within the district administration that wanted to throw the book at the kids involved. Here's the thing for those people: the last thing a school district wants is to become national news for punishing a bunch of kids who the evening news can make out to look like "Geniuses". Since nothing failed in their plan -- that's crazy important -- there would be very few ways to frame the story that makes the administration look like anything but bullies, and many will frame them as "petty bullies". I have a friend I went to High School with who is now a High School principal. He's still "that guy I went to High School with." I have no doubt he would have given the kids an award privately, if not publicly. It's sad that some public school districts are using discipline approaches you'd expect to see in prisons, rather than a school, and I'm sure in certain places in the country, that might be a necessity. Context matters, too -- were these kids who were constantly pulling pranks like this, had been talked to in the past/impacted things in the past, etc, I'd expect a harsh response: "Yes, we get it, you're smart, stop breaking things already, read the horrors of the 1986 CFAA because that's coming if it happens again." I'm guessing these were otherwise good students.

runjake 5y ago

That said, maybe we should lighten up on minors performing harmless/non-destructive pranks. Not everything warrants felony charges for kids.

jjoonathan 5y ago
Of course -- but we aren't the ones making the rules, and the ones who do make the rules have certain incentives that lead them in dark directions.

dec0dedab0de 5y ago

Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you'll be seen as an adorable Matthew Broderick type Wargames character. I can't overemphasize how far this is from the truth in 2021. Or maybe it will shame other IT departments into not having a stick up their butt. Especially if there is already a culture of overlooking minor criminal activity in the name of harmless pranks.

tkinom 5y ago

For anyone who like to hack legally and ethically, check out https://www.hackerone.com/ https://www.hackerone.com/. If you're very good at hacking devices, software, networks, etc, companies will pay bounties for the vulnerabilities you find thru HackerOne. Looks like they paid out millions in bounty in 2020: https://www.zdnet.com/article/hackerones-2020-top-10-public-bug-bounty-programs/

cwkoss 5y ago
Worth a try, but I didn't have a good experience with it. Companies can mark items as duplicates without fixing the underlying bug for an indefinite period of time. So the 3 vulnerabilities I found all got marked as duplicates without any compensation or even acknowledgement of my time writing up the issues. Felt like a complete waste of time. If you're great, you can probably find novel stuff better than I was able to, but if you're that great you likely already have plenty of employment opportunities.

hparadiz 5y ago

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that are currently in place. If more kids rebelled and this was a regular occurrence it would help to desensitize society to digital pranks instead of always treating these kids like terrorists.

paxys 5y ago
I don't understand this response. Having been on the wrong end of it you should be advocating harder than anyone to teach kids the complexities of cybersecurity law and ensure they can make the right decisions rather than throw away their future over a stupid prank. There is no "validation" happening here, the OP is just stating reality. Random high schoolers' rebellions aren't going to result in Congress overturning the Computer Fraud and Abuse Act and a hundred related laws.
- rkk3 5y ago
  > ensure they can make the right decisions rather than throw away their future over a stupid prank. Is it a good system if a "stupid prank" can "throw away your future" ?
  - paxys 5y ago
    No it is not a good system. But nothing I said is invalid because of that.
  - skeaker 5y ago
    No, but that doesn't mean you should deliberately play into it.
quasarj 5y ago
What? How is warning someone that they are going to ruin their lives the same as endorsing it?

outworlder 5y ago

> because it sends the signal to other young aspiring cybersecurity professionals that this is OK, There are multiple disclaimers in the text, almost every other paragraph.

ActorNightly 5y ago

Id actually wonder if criminal history matters when you have skills like this that are very much in demand. If this went to court, the charges of malicious intent would likely not stick, so jailtime could likely be avoided in leu of fine/community service. Competent tech companies will not give a shit about criminal record of this nature. Expulsion from school is pretty much irrelevant, especially for CS careers. You can get a GED, find any college with CS program that will take your money, spend a year having fun, apply for an internship at a tech company, do a good job to be offered a return, talk to HR to go directly into entry level role, and you are set (have personally seen 2 cases of this happening with an intern). The most functionally harmful thing would be monetary cost, which is still inconsequential considering the salary this guy would make.

kube-system 5y ago
It depends on how regulated the particular industry is. If you're building consumer web apps at a startup, it probably won't matter. If you want to be a government contractor, it's probably a nonstarter.
- ActorNightly 5y ago
  Most of the industry where the guy will be paid appropriately is going to be private. Cyber security specialists for things like AWS get paid much more than any government contractor.
  - kube-system 5y ago
    That's not really the best example; AWS is a government contractor. It isn’t a coincidence that HQ2 is a few blocks away from the Pentagon.

inputsecretcode 5y ago

Wow that's terrifying, I'm from the EU and did 1000x worse stuff than that, never suffered any consequence, which is not right, but teenagers going to prison for hacking pranks it's really fucked up.

bsza 5y ago

> This kid is very very lucky. No, he is just smart. He did it anonymously. He knows how to cover his a$$. > it sends the signal to other young aspiring cybersecurity professionals that this is OK The post literally has a whole section dedicated to explaining that this is not OK, but whatever.

mcbishop 5y ago

Malicious hackers could have shown something unspeakably vile on all those screens. If this kid reduced the likelihood of that... he's a hero. Alas, I totally hear you.

marvin 5y ago

There is something obscenely totalitarian about this whole mindset. You're making a very pragmatic point, but take a step back and look at the whole thing. You're warning a teenager against making a brilliant, harmless, funny and responsible prank so that they won't get their whole life fucked up forever. Think a little about what kind of political system necessitates that kind of ridiculous warning. What sort of nation does this kind of thing to its kids? If we strike the United States from the list, what sort of countries are left? You guys really need to get your so-called justice system sorted out. Sorry to make such a blunt point, but this is depressing as hell.

pascalxus 5y ago

yeah, it's pretty messed up that there's such extremely heavy penalties for merely playing a youtube video on a few screens whereas looting and stealing go completely unpunished. what kind of message is that sending to our youth?

NaturalPhallacy 5y ago

The CFAA exists to make sure that nobody can use computers and the internet to have any power over even tyrannical authorities. CFAA and the DMCA are some of the worst, most authoritarian laws ever created, and they exist to do nothing other ensure a system where being rich enough to afford lawyers means you don't have to do anything else. Use default passwords like an idiot and someone uses their autofill? They're the criminal, not you. Let people just change the account number in the address bar and switch accounts with zero authorization or authentication? They're the criminal, not you. (Bank of America literally did this.) Have open access for students to download papers and one of them uses it to download all of them? They're the criminal, not you. (RIP Aaron Swartz) I support jury nullification for the CFAA and DMCA and so should everyone reading this.