4 ms·

I totally agree with you in principle. Everything the reporter accessed was publicly accessible. That said, it seems like a prosecutor could articulate an argu

by badRNG 5y ago

I totally agree with you in principle. Everything the reporter accessed was publicly accessible. That said, it seems like a prosecutor could articulate an argument that the reporter accessed information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information. Further, that because the reporter knew the site was using encoding to "protect" this information, by decoding the information he had believed might contain unauthorized information, he had "examined information about another person" that he had no "reasonable grounds" to believe he was authorized to access. For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Further, is a jury or a judge going to be able to find salient AND relevant differences between "decoding" and "decrypting" or "client-side" vs "server-side" software? And are those differences great enough to affect their interpretation of the reporters actions in the context of the statute? Judges, prosecutors, and juries cannot be relied upon to unwrite bad tech laws.

rbanffy 5y ago
> think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. “It is difficult to get a man to understand something when his salary depends upon his not understanding it.” — Upton Sinclair
DarylZero 5y ago
> information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information From a mathematical or CS perspective, i.e. from the perspective of objectivity and rigor, the Base64-encoded strings contain precisely the same information as the decoded version. Even from a lay perspective... it's as if the state issued a public declaration in Chinese, and translating to English was "accessing" different information than the Chinese original.
DarylZero 5y ago
> For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Ask the prosecutor if sharing stolen Base64-encoded SSNs would be _legal_ because Base64-encoding makes them _different information_ than the original SSNs. You won't be able to convince the prosecutor of anything ever, but you won't get a straight answer to that question either.
- kcplate 5y ago
  If that the data was encrypted in a way that was easy to defeat, and the reporter specifically decrypted the data using a method that would not be generally available or known to a layperson without having specific tech knowledge…that reporter is going to have a tough time defending against a “hacking” claim—especially in a state with an overly broad legal definition about accessing unauthorized data. They capitalized on the data and benefitted by writing a story about it. As a juror your job is to convict or acquit based upon the law and jury instructions given to you. Your job is not to convict or acquit based upon your opinion on what the law should be.
  - DarylZero 5y ago
    The data wasn't encrypted at all. I suppose it's true, though, that poorly-encrypted ciphertext still contains the original information as the plaintext. Encryption has the clear intent of removing all the plaintext information from ciphertext, producing a random string that is useless without a secret key, but this may fail, and then the plaintext information remains. However, encoding information (in Base64 or otherwise) has the intent of removing no information. My original formulation of argument was flawed, since it made no reference to or distinctions of intent.
    - kcplate 5y ago
      Ok so let’s use the word “encoded” instead of encrypted, but the distinction between the two to a layperson might not be as nuanced as a reader on Hacker News might understand. Even the word “decoded” as opposed to decrypted would raise eyebrows to a layperson juror. If the law is overly broad about unauthorized access of the information and if by default the information being accessed is not plainly readable without conversion requiring special knowledge or software, I think a conviction might be likely and justified.
ensignavenger 5y ago
When imperfect and unpredictable human beings are involved, nothing is certain. But I can say with a very high level of confidence that ultimately this case has no legs to stand on.

by badRNG 5y ago

rbanffy 5y ago

> think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. “It is difficult to get a man to understand something when his salary depends upon his not understanding it.” — Upton Sinclair

DarylZero 5y ago

> information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information From a mathematical or CS perspective, i.e. from the perspective of objectivity and rigor, the Base64-encoded strings contain precisely the same information as the decoded version. Even from a lay perspective... it's as if the state issued a public declaration in Chinese, and translating to English was "accessing" different information than the Chinese original.

DarylZero 5y ago

> For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Ask the prosecutor if sharing stolen Base64-encoded SSNs would be _legal_ because Base64-encoding makes them _different information_ than the original SSNs. You won't be able to convince the prosecutor of anything ever, but you won't get a straight answer to that question either.

kcplate 5y ago
If that the data was encrypted in a way that was easy to defeat, and the reporter specifically decrypted the data using a method that would not be generally available or known to a layperson without having specific tech knowledge…that reporter is going to have a tough time defending against a “hacking” claim—especially in a state with an overly broad legal definition about accessing unauthorized data. They capitalized on the data and benefitted by writing a story about it. As a juror your job is to convict or acquit based upon the law and jury instructions given to you. Your job is not to convict or acquit based upon your opinion on what the law should be.
- DarylZero 5y ago
  The data wasn't encrypted at all. I suppose it's true, though, that poorly-encrypted ciphertext still contains the original information as the plaintext. Encryption has the clear intent of removing all the plaintext information from ciphertext, producing a random string that is useless without a secret key, but this may fail, and then the plaintext information remains. However, encoding information (in Base64 or otherwise) has the intent of removing no information. My original formulation of argument was flawed, since it made no reference to or distinctions of intent.
  - kcplate 5y ago
    Ok so let’s use the word “encoded” instead of encrypted, but the distinction between the two to a layperson might not be as nuanced as a reader on Hacker News might understand. Even the word “decoded” as opposed to decrypted would raise eyebrows to a layperson juror. If the law is overly broad about unauthorized access of the information and if by default the information being accessed is not plainly readable without conversion requiring special knowledge or software, I think a conviction might be likely and justified.

ensignavenger 5y ago

When imperfect and unpredictable human beings are involved, nothing is certain. But I can say with a very high level of confidence that ultimately this case has no legs to stand on.