4 ms·

“There is an argument to be made that there was a violation of law.” I mean, not really, but I guess that could mean anything.

ceejayoz 5y ago
I think that translates roughly as "I'm not allowed to say 'this was fucking stupid' because it involved the Governor".
- DoneWithAllThat 5y ago
  It’s the verbal equivalent of drawing on a hurricane map with a sharpie.
  - CRConrad 5y ago
    The governor's argument was. The DA magnanimously acknowledging that the governor can make that argument wasn't; it was as diplomatically suave as a White House official saying the President can do what he wants with government sharpies.
encryptluks2 5y ago
thinkharderdev 5y ago
The thing is though, I think this is basically correct. They probably could prosecute the reporter if they really, really wanted to. Not that I think they could actually convict someone who was obviously acting in good faith to report a security vulnerability, but security research of this kind seems like such a gray area legally speaking. In general we wouldn't treat an obvious flaw in physical security as a mitigating factor for theft. That is, if I drop my wallet in a public place it is still probably theft for someone to pick it up and take the cash inside. To be clear, this is in NO WAY a defense of the way the government acted in this case which was both insane and harmful, but just to say that a lot of what makes things illegal is subjective judgements about intent. This is why professional pen testers (the careful ones at least) generally specify in very clear terms what the scope of their engagement is (and still sometimes end up getting arrested). I can only imagine that doing independent security research is a mine field.
- wizzwizz4 5y ago
  > but security research of this kind seems like such a gray area legally speaking. Security research in general is a grey area. “Security research” of this kind is like spotting that the entire database is on file in a public library, with confidential data “encrypted” using Pig Latin, then reporting it to the librarian.
  - thinkharderdev 5y ago
    You're right, I shouldn't have said "of this kind" because in this case I don't think any sane person would think this was nefarious. But my point was just that, to use you example, the only way you would know that said database had confidential information in it would be to "decrypt" it. Then it is a question of why you did that. Was it malicious? No, but a sufficiently bad faith actor my try to argue that it was so you should be careful. Take another example. Say you fire up Wireshark in on a public network like a coffee shop and see some unencrypted network traffic with confidential information in it. The packets were delivered to your computer and there for anyone to see. But why are you capturing traffic that wasn't intended for you (in the broader sense)? What if the traffic IS encrypted but with weak encryption that is easily cracked? As soon as you step off the path of "I am viewing information which was clearly meant for me" you're in a gray area. Of course as a society we should recognize that people who do these things and then responsibly disclose them are doing a valuable public service, but not everyone understands these things. Or in this particular case, some people are heavily incentivized to make bad faith arguments in order to deflect blame from their own screw ups. So it's worth being careful.
    - wizzwizz4 5y ago
      > But my point was just that, to use you example, the only way you would know that said database had confidential information in it would be to "decrypt" it. While it looks obscure to the uninitiated, anyone with a day-to-day familiarity with Pig Latin (e.g. a schoolchild) would be able to just read the information straight off, with little-to-no conscious “decoding” stage. > As soon as you step off the path of "I am viewing information which was clearly meant for me" you're in a gray area. People say that, but the law is usually quite explicit about such matters. Your “grey area” is just ignorance of the law. (And I'll go on record as saying that the law around this is usually really silly.)

ceejayoz 5y ago

I think that translates roughly as "I'm not allowed to say 'this was fucking stupid' because it involved the Governor".

DoneWithAllThat 5y ago
It’s the verbal equivalent of drawing on a hurricane map with a sharpie.
- CRConrad 5y ago
  The governor's argument was. The DA magnanimously acknowledging that the governor can make that argument wasn't; it was as diplomatically suave as a White House official saying the President can do what he wants with government sharpies.

encryptluks2 5y ago

thinkharderdev 5y ago

The thing is though, I think this is basically correct. They probably could prosecute the reporter if they really, really wanted to. Not that I think they could actually convict someone who was obviously acting in good faith to report a security vulnerability, but security research of this kind seems like such a gray area legally speaking. In general we wouldn't treat an obvious flaw in physical security as a mitigating factor for theft. That is, if I drop my wallet in a public place it is still probably theft for someone to pick it up and take the cash inside. To be clear, this is in NO WAY a defense of the way the government acted in this case which was both insane and harmful, but just to say that a lot of what makes things illegal is subjective judgements about intent. This is why professional pen testers (the careful ones at least) generally specify in very clear terms what the scope of their engagement is (and still sometimes end up getting arrested). I can only imagine that doing independent security research is a mine field.

wizzwizz4 5y ago
> but security research of this kind seems like such a gray area legally speaking. Security research in general is a grey area. “Security research” of this kind is like spotting that the entire database is on file in a public library, with confidential data “encrypted” using Pig Latin, then reporting it to the librarian.
- thinkharderdev 5y ago
  You're right, I shouldn't have said "of this kind" because in this case I don't think any sane person would think this was nefarious. But my point was just that, to use you example, the only way you would know that said database had confidential information in it would be to "decrypt" it. Then it is a question of why you did that. Was it malicious? No, but a sufficiently bad faith actor my try to argue that it was so you should be careful. Take another example. Say you fire up Wireshark in on a public network like a coffee shop and see some unencrypted network traffic with confidential information in it. The packets were delivered to your computer and there for anyone to see. But why are you capturing traffic that wasn't intended for you (in the broader sense)? What if the traffic IS encrypted but with weak encryption that is easily cracked? As soon as you step off the path of "I am viewing information which was clearly meant for me" you're in a gray area. Of course as a society we should recognize that people who do these things and then responsibly disclose them are doing a valuable public service, but not everyone understands these things. Or in this particular case, some people are heavily incentivized to make bad faith arguments in order to deflect blame from their own screw ups. So it's worth being careful.
  - wizzwizz4 5y ago
    > But my point was just that, to use you example, the only way you would know that said database had confidential information in it would be to "decrypt" it. While it looks obscure to the uninitiated, anyone with a day-to-day familiarity with Pig Latin (e.g. a schoolchild) would be able to just read the information straight off, with little-to-no conscious “decoding” stage. > As soon as you step off the path of "I am viewing information which was clearly meant for me" you're in a gray area. People say that, but the law is usually quite explicit about such matters. Your “grey area” is just ignorance of the law. (And I'll go on record as saying that the law around this is usually really silly.)