6 ms·

IANAL, but the local Missouri computer crime statute is very broad [1]. Technically, the reporter seems to have factually "Accessed a computer, a computer syste

by badRNG 5y ago

IANAL, but the local Missouri computer crime statute is very broad [1]. Technically, the reporter seems to have factually "Accessed a computer, a computer system, or a computer network, and intentionally examined information about another person" without "authorization." Considering the conservative PAC for the state has already pushed attack ads against the reporter [2], and the fact that the prosecutor is elected (potentially supported by conservative PACs), I definitely see a possibility of this going to court and potentially arriving at a conviction. Again, IANAL, and I don't know the jurisprudence or case history behind this particular statute. [1] https://revisor.mo.gov/main/OneSection.aspx?section=569.095 https://revisor.mo.gov/main/OneSection.aspx?section=569.095 [2] https://www.youtube.com/watch?v=9IBPeRa7U8E https://www.youtube.com/watch?v=9IBPeRa7U8E

ensignavenger 5y ago
The reporter did not access anything they did not have permission to access! It was on a publicly accessible website, posted publicly, for the purpose of public dissemination. The statue is even more restrictive than that- the part you didn't quote: "A person commits the offense of tampering with computer data if he or she knowingly and without authorization or without reasonable grounds to believe that he has such authorization" No one could possibly prove beyond a reasonable doubt that the reporter did not have "reasonable grounds to believe that he has such authorization". The reporter did not know that the website had private information on it when he accessed the page. The law does allow for a civil action to be taken by the owner of the computer system (In this case the state) which would lower the standard of evidence to more likely than not- but given the facts of the case, I don't think it comes even close to meeting that bar.
- badRNG 5y ago
  I totally agree with you in principle. Everything the reporter accessed was publicly accessible. That said, it seems like a prosecutor could articulate an argument that the reporter accessed information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information. Further, that because the reporter knew the site was using encoding to "protect" this information, by decoding the information he had believed might contain unauthorized information, he had "examined information about another person" that he had no "reasonable grounds" to believe he was authorized to access. For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Further, is a jury or a judge going to be able to find salient AND relevant differences between "decoding" and "decrypting" or "client-side" vs "server-side" software? And are those differences great enough to affect their interpretation of the reporters actions in the context of the statute? Judges, prosecutors, and juries cannot be relied upon to unwrite bad tech laws.
  - rbanffy 5y ago
    > think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. “It is difficult to get a man to understand something when his salary depends upon his not understanding it.” — Upton Sinclair
  - DarylZero 5y ago
    > information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information From a mathematical or CS perspective, i.e. from the perspective of objectivity and rigor, the Base64-encoded strings contain precisely the same information as the decoded version. Even from a lay perspective... it's as if the state issued a public declaration in Chinese, and translating to English was "accessing" different information than the Chinese original.
  - DarylZero 5y ago
    > For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Ask the prosecutor if sharing stolen Base64-encoded SSNs would be _legal_ because Base64-encoding makes them _different information_ than the original SSNs. You won't be able to convince the prosecutor of anything ever, but you won't get a straight answer to that question either.
    - kcplate 5y ago
      If that the data was encrypted in a way that was easy to defeat, and the reporter specifically decrypted the data using a method that would not be generally available or known to a layperson without having specific tech knowledge…that reporter is going to have a tough time defending against a “hacking” claim—especially in a state with an overly broad legal definition about accessing unauthorized data. They capitalized on the data and benefitted by writing a story about it. As a juror your job is to convict or acquit based upon the law and jury instructions given to you. Your job is not to convict or acquit based upon your opinion on what the law should be.

by badRNG 5y ago

ensignavenger 5y ago

The reporter did not access anything they did not have permission to access! It was on a publicly accessible website, posted publicly, for the purpose of public dissemination. The statue is even more restrictive than that- the part you didn't quote: "A person commits the offense of tampering with computer data if he or she knowingly and without authorization or without reasonable grounds to believe that he has such authorization" No one could possibly prove beyond a reasonable doubt that the reporter did not have "reasonable grounds to believe that he has such authorization". The reporter did not know that the website had private information on it when he accessed the page. The law does allow for a civil action to be taken by the owner of the computer system (In this case the state) which would lower the standard of evidence to more likely than not- but given the facts of the case, I don't think it comes even close to meeting that bar.

badRNG 5y ago
I totally agree with you in principle. Everything the reporter accessed was publicly accessible. That said, it seems like a prosecutor could articulate an argument that the reporter accessed information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information. Further, that because the reporter knew the site was using encoding to "protect" this information, by decoding the information he had believed might contain unauthorized information, he had "examined information about another person" that he had no "reasonable grounds" to believe he was authorized to access. For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Further, is a jury or a judge going to be able to find salient AND relevant differences between "decoding" and "decrypting" or "client-side" vs "server-side" software? And are those differences great enough to affect their interpretation of the reporters actions in the context of the statute? Judges, prosecutors, and juries cannot be relied upon to unwrite bad tech laws.
- rbanffy 5y ago
  > think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. “It is difficult to get a man to understand something when his salary depends upon his not understanding it.” — Upton Sinclair
- DarylZero 5y ago
  > information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information From a mathematical or CS perspective, i.e. from the perspective of objectivity and rigor, the Base64-encoded strings contain precisely the same information as the decoded version. Even from a lay perspective... it's as if the state issued a public declaration in Chinese, and translating to English was "accessing" different information than the Chinese original.
- DarylZero 5y ago
  > For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Ask the prosecutor if sharing stolen Base64-encoded SSNs would be _legal_ because Base64-encoding makes them _different information_ than the original SSNs. You won't be able to convince the prosecutor of anything ever, but you won't get a straight answer to that question either.
  - kcplate 5y ago
    If that the data was encrypted in a way that was easy to defeat, and the reporter specifically decrypted the data using a method that would not be generally available or known to a layperson without having specific tech knowledge…that reporter is going to have a tough time defending against a “hacking” claim—especially in a state with an overly broad legal definition about accessing unauthorized data. They capitalized on the data and benefitted by writing a story about it. As a juror your job is to convict or acquit based upon the law and jury instructions given to you. Your job is not to convict or acquit based upon your opinion on what the law should be.