14 ms·

This thread is mostly full of jokes, and that's cool. But more seriously I'm exactly the kind of person I suppose this is meant to appeal to. I've spent the las

by bink 5y ago

This thread is mostly full of jokes, and that's cool. But more seriously I'm exactly the kind of person I suppose this is meant to appeal to. I've spent the last 2-3 decades breaking into systems. Many of these systems comprise what the US calls "critical infrastructure". That's pipelines, power generation, transmission, distribution. Air traffic control systems. Government agencies. I'm based in the US. The problem is that the US, unlike Russia, will not simply agree to allow attacks against foreign targets so long as its suits their strategic purposes. And I suppose that's for the best. In the meantime, myself and people like me simply aren't going to risk our entire careers to retaliate. I suppose if we felt strongly enough we would've joined the NSA and done this legally. I wish Ukraine the best and hope our "official" hackers are doing their best to assist or will be unleashed soon.

tunnuz 5y ago
Can you support by training people?
stickfigure 5y ago
I think it's reasonable to assume that for at least the next few months, you have a strange form of "diplomatic immunity" for attacks in Russia. No jury in the US would convict you, even in the unlikely event someone wanted to prosecute (which would be political suicide here). So, have at it.
- mlac 5y ago
  Recognize two more things if you do this: 1) you will never be able to travel to Russia or a Russian controlled territory. Ever. 2) you will always be at risk for a hack-back or other issues when the dust settles and they seek revenge.
  - bitexploder 5y ago
    Not that I would ever apply my considerable talents to this purpose, but seriously, who from the west would ever go to Russia in the next few years without family ties causing one to do so. I don’t think that is a tangible consequence for most of us capable of waging a cyber security attack in a nation state.
- bink 5y ago
  That's a huge gamble most people aren't willing to accept.
  - mahkeiro 5y ago
    Bur remember that by treaty US and UK (and Russia of course) promised to defend Ukraine in exchange of their nukes. At least if they try to go after you, you can still argue that you were trying to comply to a treaty that both countries have decided to ignore.
    - mvkel 5y ago
      Upon orders from the government, sure. Taking the law into your own hands based on vague interpretation is different.
      - saurik 5y ago
        Yeah: my city signing an MOU saying they will enforce parking restrictions doesn't mean I have the OK to camp out on the street and write my own tickets.
    - vkou 5y ago
      Treaties get broken, and your argument will fall on deaf ears.
    - prawel 5y ago
      they promised not to attack, not defend
    - grayfaced 5y ago
      Treaties are between governments. Individual citizens are not a member of the treaty. You don't get any authority to pursue individual action.
  - kweinber 5y ago
    Allies are dying today. Someone could help save them and you are talking them out of it?
- kfichter 5y ago
  Reminder to other readers: don't take legal advice from hn
  - stickfigure 5y ago
    Reminder to people who didn't grow up in the US: Americans are by and large a bloodthirsty, vindictive lot and pay an astounding amount of attention to who their friends are. This is sometimes a force for evil, sometimes a force for good, but it is what it is. Sure, don't take legal advice from me. Use a VPN.
    - reitanqild 5y ago
      > Reminder to people who didn't grow up in the US: Americans are by and large a bloodthirsty, vindictive lot I'd take away "by and large" here. Many of them are also exceedingly generous, open and friendly and cares deeply. This holds true for both sides of the political spectrum. They've also suffered a lot to end two world wars that they didn't start.
      - majewsky 5y ago
        > They've also suffered a lot to end two world wars that they didn't start. This is even more true of the Russians, and as an outsider, I'm wondering how much of their politics is informed by those memories.
        throwrqX 5y ago
        Their politics is overwhelming informed by their memories and they bring it up whenever they can.
        reitanqild 5y ago
        That is a seriously good point. It never ceases to amuse me how ignorant I am in my comments despite my attempts at being smart, wise and fair. Of course you are right. That said, this invasion is still a crime and I am utterly fed up by Russian actions in neighboring states, their constant lying, especially after MH17 was shot down, getting more or less away with state sponsored cheating in sports, simulating bombing raids against Swedish power plants etc. We should have seen this coming a long time ago. (In my defense however, note that from the very start of this, even before the protests in Russia were known to me I think I have not said a bad word about the Russian people, barely a bad word about the men in boots and only after they started aggression and mostly - I hope - just about the leadership.)
- deepGem 5y ago
  Am not from the US but this seems very risky. Is there someone at the government who can clarify such guarantees. Am also curious what are the high level logistics to carry out something like this. Do you seek an untraceable route to Ukarine from US ? Do you unleash a worm like Stuxnet that will eventually cripple all Russian cyber attack infra ?
  - verve_rat 5y ago
    Jury nullification. The idea is that a jury is allowed to make its decision without any outside interference. A jury can acquit a person even it they think the person is guilty. Thus a jury could give you a fee pass on hacking Russian systems, but you'd be relying on them to realise that and then think the moral reasons for acquittal out weigh the legal reasons for conviction. Obviously courts don't like jury nullification try to prevent it, without harming a juries independence. So possibly not a good idea to rely on jury nullification as your get out of jail free card.
    - thebradbain 5y ago
      It’s also not necessarily a legal strategy even as a Hail Mary. California’s state Supreme Court ruled in 2001 that jury nullification is not a valid decision… and my understanding is if the outcome case can be attributed to “jury nullification” (i.e. could be as obvious as the defense suggesting it as an avenue to the jury, which ironically itself is legal, or as technical as the jury refusing to consider or explicitly refusing a piece of evidence that is entered in the record— think a moral objection to the law, or “evidence undeniably shows the defendant left the scene at 7pm, but we the jury contend it was 6pm”) it legally would be considered a mistrial and allowed to be re-litigated— and the sole person who has the power to attribute something to jury nullification and/or declare mistrial? The judge. https://sddefenseattorneys.com/blog/jury-nullification/ https://sddefenseattorneys.com/blog/jury-nullification/
  - grayfaced 5y ago
    There is no guarantee. There is really no one that could even make such a guarantee. Opinions of DOJ change with administrations. The president could issue a pardon after the fact. Congress could make a law. Perhaps the executive could find some loophole to deputize people into US Cybercom but that would likely make them a lawful combatants which has other entanglements.
- lalaland1125 5y ago
  This is extremely terrible advice. You should delete your comment before you cause someone to go to jail.
  - Gwarzo 5y ago
    A sort of side comment, but I absolutely despise this type of thinking. "before you cause someone to go to jail" If you take legal advice from pseudo anonymous users on aggregate websites you deserve to go to jail. Even in writing that, the users did not "cause" anyone to go to jail; the moron reading and acting on that comment did. Have some respect for individuality mate.
    - AussieWog93 5y ago
      Oh come on man. If being a dumbarse and engaging in dangerous behaviour was a jailable offence, then we'd need to arrest every single male under the age of 21. (To any dumbarses reading this comment, launching cyberattacks against adversarial nation states will land you in prison if you're lucky, a body bag if you're not)
    - yesenadam 5y ago
      I looked at your recent comments - in almost every one of them (!) you are insulting, mocking, being a total jerk to people on here. Please stop doing that. You will be banned very soon if you keep that up. Read the guidelines - most of your comments break more than a few. Thanks. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- bagels 5y ago
  It is not reasonable to assume this. You might get lucky, or you might spend decades in prison.
- mellavora 5y ago
  In criminal law, incitement is the encouragement of another person to commit a crime. Depending on the jurisdiction, some or all types of incitement may be illegal. Where illegal, it is known as an inchoate offense, where harm is intended but may or may not have actually occurred. -- from wikipedia https://en.wikipedia.org/wiki/Incitement https://en.wikipedia.org/wiki/Incitement
  - stickfigure 5y ago
    Contact information is in my profile. Come get me. Here's the more relevant wikipedia link: https://en.wikipedia.org/wiki/Legal_realism https://en.wikipedia.org/wiki/Legal_realism
mrits 5y ago
Maybe he could find you a job afterwards? @DAlperovitch
HWR_14 5y ago
I mean, it's probably legal for you to fill out the application as a US citizen, as the Ukrainians are also asking for defensive help. If you have or want a US security clearance there may be issues in helping a foreign power, but absent that you can probably stay on the right side of the line. Obviously, you'd want a real legal opinion. I do wonder at what point the US just declares Russian computer systems beyond the protection of US law. At some point, that happens, right?
- em3rgent0rdr 5y ago
  Aren't Russian computer systems already beyond the protection of US law?
  - zja 5y ago
    No
  - kweinber 5y ago
    Defending an ally from an enemy is not something the US government punishes people for. If you want to help the people of Ukraine then #standwithukraine.
    - lamp987 5y ago
      ukraine is not an ally of USA though
      - ipaddr 5y ago
        They are allies. US, Canada, etc has given loans, sent resources and weapons.
        thaumasiotes 5y ago
        Wouldn't that make Russia an ally too?
jtsuken 5y ago
If you don't want to engage on the offensive side, there is plenty of work on the defensive side of things. * Detect and notify the Ukrainian government about threats or upcoming attacks. * Identify coordinated manipulative behaviour on social media. * Last but not least contact Patreon's management to release the funds that have been donated to Ukrainian veterans (https://news.ycombinator.com/item?id=30461038 https://news.ycombinator.com/item?id=30461038) Feel free to add to the list, as there is going to be a lot of work in the upcoming days.
- black_puppydog 5y ago
  Sorry but what? * It looks like there won't be a Ukrainian government to speak of in a few days. * Manipulative behaviour has been identified on twitter and Facebook almost every day for the last few years, and it hasn't really led to much anything. The Ukrainian government can't do anything about that, if the independent banana republics of FAANG don't decide to act, nothing is gonna change. * Likewise for patreon. It's a private Company and thus sadly, regrettably, out of reach of public scrutiny or regulation. Thoughts and prayers are free and abundant though! Besides, what is the Ukrainian government gonna do with money right now? I bet tanks and air defense systems have long lead times these days, chip shortage and all. Sorry for the overboarding sarkasm... I guess. But these are my points. Edit: Collecting downvotes for that. Not surprised, but I'm not seeing any counterpoints, really. It's okay if you just need a valve to let off your frustration, have at it, but what the parent suggested seems.... pointless, sorry to be blank. I mean, this sort of soft influence might be useful, but we ("the west") have been proving, on an ongoing basis, for multiple years now, that corporate decisions shall not and will not be questioned by our governments, that essentially an american-based platform has unbridled control over what they want to do, and that if they don't care about trolls and bots and harassment and nationalism andandand then there's not much "we" (read: the government, first of all the US government) can^Wwill do. What is the ukraininan government gonna do with more intel on russian propaganda? What's the actionable on that? Start a war with twitter? As for the first point. Yeah... I don't see the mechanism by which any of this will slow down the physical process of soldiers marching on Kyiv. No NATO state will enter into this conflict, Putin has been pretty openly threatening with nuclear annihilation. And I would doubt that the russian soldiers will be hanging out on twitter enough to really get distracted by some well thought-through anti-propaganda measures.
gjsman-1000 5y ago
The US does not currently have a legal permission to be in Ukraine. Ukraine does not have a defense agreement with the US that could land troops, Ukraine is not a NATO member, so forth. Right now, for the US to cyberattack Russia would be a direct act of war and quite literally cause the Cold War to become the Hot War. For this reason, just like how our troops are not in Ukraine but in surrounding countries watching, our NSA hackers are most likely standing down as well, as tragic as it may be.
- bluGill 5y ago
  More likely our NSA is only working when they can cover their tracks. Possibly by giving Ukrainian intelligence credit for their actions.
- onedognight 5y ago
  The US and Russia agreed to defend Ukraine after Ukraine agreed to give up its nuclear weapons in the 1994 Budapest Memorandum. The Russians are violating this agreement today, and the US would be following it to defend Ukraine from Russia’s invasion.
  - gjsman-1000 5y ago
    When the Budapest Memorandum was signed, having one of the defenders be the invaders was not expected. As a result, even if that binding is still in power, is it worth defending Ukraine by going to war against Russia? That would literally start World War III. Letting Ukraine fall is terrible, awful, painful - but it's better than WWIII.
harryvederci 5y ago
> I'm exactly the kind of person I suppose this is meant to appeal to. Quote from the article: > "Ukrainian cybercommunity! It's time to get involved in the cyber defense of our country," the post read, asking hackers and cybersecurity experts to submit an application via Google docs, listing their specialties, such as malware development, and professional references. If you're not Ukrainian, I guess the request is not aimed at you. Probably exactly for the reasons you mention. And if you were, the request is to fill in the form, not to go rogue. Edit: @dang maybe change the title to "[...] calls on its hacker underground [...]" to make this a bit more clear?
- bink 5y ago
  That's a very important clarification. Thank you.
  - Zenst 5y ago
    You are though, allowed to offer educational training to Ukraine nationals. Maybe there could be some formal initiative to clear out the grey/black area's so white hats can not fall upon their ethics.
blobbers 5y ago
Based in the US, which law prevents you from committing cyber attacks in Russia? Genuinely curious how you would be prosecuted and how this would cause you to risk your entire career.
- bink 5y ago
  There's a seemingly endless collection of crimes you could be charged with if you're hacking a foreign country from inside the US. From wire fraud to conspiracy and everything in-between. A federal charge of conspiracy carries a mandatory minimum of 5 years in jail.
  - NickKampe 5y ago
    even if you were to get a US attorney to prosecute you by turning yourself in, they'll highly likely give you probation even with "mandatory minimums"
- deleted 5y ago
  [deleted]
- mellavora 5y ago
  So in general (i.e. not specific to cyber), and even under the condition that Congress had declared war on Russia, it is illegal for civilians to engage in acts which harm the enemy. Only the military is allowed to attack. read up on "unlawful combatant" and "irregular combatant" Now if look more specifically at cyber, then there are laws such as The Computer Fraud and Abuse Act (CFAA) The Stored Communications Act (SCA) The Electronic Communications Privacy Act (ECPA) The Defend Trade Secrets Act (DTSA) which define certain activities as criminal. If a person is on US soil and engaging in activities described in these laws, they may be in violation of criminal law. The location of the victim has little to do with it, it is location of the actor. By analogy, if A does crime to B, it isn't B who prosecutes, it is the appropriate governmental organization.
  - blobbers 5y ago
    Informative, but these seem hazy. What is soil in the cyber world? Or is it the passport "A" is carrying? As many have indicated, unlikely anyone in the west will prosecute?
birdyrooster 5y ago
There are plenty of independent clandestine attackers from the US and they interact with the US government through DISA, which might confuse you if you take their name literally. The government is looking the other way and isn't looking or trying to bring their domestic hackers to justice.
- phishermann 5y ago
  Not that anonymity goes a very long way, but I can vouch for USG not giving a shit. I used to work for an anti-phishing firm that you’ve likely never heard of. We routinely disrupted and dismantled phishing campaigns and bot networks being used by Russian crime networks as well as suspected IRGC (those folks have to get currency somewhere and importing an crack cocaine is apparently not their style) Our malware research and SOC folks were pretty much all former Feds or Military Intelligence. They would routinely counter-hack servers we couldn’t take-down through legitimate means. While it was most certainly a “let’s not discuss this in an email” it was understand and briefed by our legal department that it was a “grey area” and that the USG would never even bother us as we were hitting adversarial nations anyway. If you’re gonna play hackerman for UA, just do it smart.
throwawaynay 5y ago
trevormcneal 5y ago
I can say that I know people who are much less skilled than you and also less ethic, that are hacking into any low hanging fruit that they can and selling a shell (access) to those systems to FSB. I imagine that Ukraine would have a similar program to pay for such kind of access on Russia infrastructure or government systems.
irthomasthomas 5y ago
I assumed it was aimed at Ukraine hackers? They don't have much to lose at this point.
deleted 5y ago
[deleted]
belter 5y ago
I am surprised this is the top comment. Not that it's not well argued but what seems to imply of the reading by most of the current situation. The joke of sanctions implemented by the EU and the US, and they are a joke, since EU continues to import gas from Russia, and SWIFT use continues by the Russian Federation, is a symptom of the same attitude seen on many Ukraine residents just 48 hours ago. A kind of cognitive disconnect between the obvious war coming your way, and a refusal to accept it, until it is at your door. You have a ex-president of the United States openly praising the Russian president on the media, and also US TV networks openly doing the treasonous job of promoting Russian views in the US. If the Russian army quickly overtakes Ukraine you have Russian troops staring across the border to Polish troops. Some of the small countries that are now members of NATO, still have small pockets of Russian speaking communities. You think Russia will not claim they are also being discriminated and need another peace keeping operation? In case of a conflict between Russia and a NATO member, it's mushroom clouds we are looking into. So I find your legalistic concerns incredibly detached from the seriousness of the current situation.
- donogh 5y ago
  That’s a good point. I visited Latvia a few years ago and was struck by how large a section of society there identifies as Russian, to the extent that in some places you were more likely to hear people speaking Russian than Latvian. Poland would be a more difficult target to justify than the Baltics; only 0.1% of Poles speak Russian; 30% of Latvians are native Russian speakers. I could see Putin going there next.
  - cobbzilla 5y ago
    All three Baltic nations are NATO members. An attack on any NATO member requires a response by NATO. So, not likely that Latvia is next.
    - belter 5y ago
      For the sake of all of us let's hope you are right: "‘If a war starts, they will come here first’: Latvia mounts a wary border watch" https://www.politico.eu/article/war-russia-ukraine-latvia-mounts-border-watch/ https://www.politico.eu/article/war-russia-ukraine-latvia-mo...
simonh 5y ago
I take it you hack into critical infrastructure systems legally, as part of security audits and such? After all if you were doing it illegally, and therefore are clearly fine doing illegal hacking, claiming that you won't risk hacking Russia because it might be illegal would seem like a weird defence to make.
100011_100001 5y ago
Since there is no way to contact you directly. I am interested in learning how to pen test etc. Do you have a recommended path to take? I'm lacking a good starting point.
- exikyut 5y ago
  I wondered this too but didn't have any good ideas (generally speaking, building theory, etc) Just belatedly noticed https://news.ycombinator.com/item?id=30471631 https://news.ycombinator.com/item?id=30471631, perhaps you hadn't seen it
  - 100011_100001 5y ago
    This is actually very useful. Thanks.
deleted 5y ago
[deleted]

by bink 5y ago

tunnuz 5y ago

Can you support by training people?

stickfigure 5y ago

I think it's reasonable to assume that for at least the next few months, you have a strange form of "diplomatic immunity" for attacks in Russia. No jury in the US would convict you, even in the unlikely event someone wanted to prosecute (which would be political suicide here). So, have at it.

mlac 5y ago
Recognize two more things if you do this: 1) you will never be able to travel to Russia or a Russian controlled territory. Ever. 2) you will always be at risk for a hack-back or other issues when the dust settles and they seek revenge.
- bitexploder 5y ago
  Not that I would ever apply my considerable talents to this purpose, but seriously, who from the west would ever go to Russia in the next few years without family ties causing one to do so. I don’t think that is a tangible consequence for most of us capable of waging a cyber security attack in a nation state.
bink 5y ago
That's a huge gamble most people aren't willing to accept.
- mahkeiro 5y ago
  Bur remember that by treaty US and UK (and Russia of course) promised to defend Ukraine in exchange of their nukes. At least if they try to go after you, you can still argue that you were trying to comply to a treaty that both countries have decided to ignore.
  - mvkel 5y ago
    Upon orders from the government, sure. Taking the law into your own hands based on vague interpretation is different.
    - saurik 5y ago
      Yeah: my city signing an MOU saying they will enforce parking restrictions doesn't mean I have the OK to camp out on the street and write my own tickets.
  - vkou 5y ago
    Treaties get broken, and your argument will fall on deaf ears.
  - prawel 5y ago
    they promised not to attack, not defend
  - grayfaced 5y ago
    Treaties are between governments. Individual citizens are not a member of the treaty. You don't get any authority to pursue individual action.
- kweinber 5y ago
  Allies are dying today. Someone could help save them and you are talking them out of it?
kfichter 5y ago
Reminder to other readers: don't take legal advice from hn
- stickfigure 5y ago
  Reminder to people who didn't grow up in the US: Americans are by and large a bloodthirsty, vindictive lot and pay an astounding amount of attention to who their friends are. This is sometimes a force for evil, sometimes a force for good, but it is what it is. Sure, don't take legal advice from me. Use a VPN.
  - reitanqild 5y ago
    > Reminder to people who didn't grow up in the US: Americans are by and large a bloodthirsty, vindictive lot I'd take away "by and large" here. Many of them are also exceedingly generous, open and friendly and cares deeply. This holds true for both sides of the political spectrum. They've also suffered a lot to end two world wars that they didn't start.
    - majewsky 5y ago
      > They've also suffered a lot to end two world wars that they didn't start. This is even more true of the Russians, and as an outsider, I'm wondering how much of their politics is informed by those memories.
      - throwrqX 5y ago
        Their politics is overwhelming informed by their memories and they bring it up whenever they can.
      - reitanqild 5y ago
        That is a seriously good point. It never ceases to amuse me how ignorant I am in my comments despite my attempts at being smart, wise and fair. Of course you are right. That said, this invasion is still a crime and I am utterly fed up by Russian actions in neighboring states, their constant lying, especially after MH17 was shot down, getting more or less away with state sponsored cheating in sports, simulating bombing raids against Swedish power plants etc. We should have seen this coming a long time ago. (In my defense however, note that from the very start of this, even before the protests in Russia were known to me I think I have not said a bad word about the Russian people, barely a bad word about the men in boots and only after they started aggression and mostly - I hope - just about the leadership.)
deepGem 5y ago
Am not from the US but this seems very risky. Is there someone at the government who can clarify such guarantees. Am also curious what are the high level logistics to carry out something like this. Do you seek an untraceable route to Ukarine from US ? Do you unleash a worm like Stuxnet that will eventually cripple all Russian cyber attack infra ?
- verve_rat 5y ago
  Jury nullification. The idea is that a jury is allowed to make its decision without any outside interference. A jury can acquit a person even it they think the person is guilty. Thus a jury could give you a fee pass on hacking Russian systems, but you'd be relying on them to realise that and then think the moral reasons for acquittal out weigh the legal reasons for conviction. Obviously courts don't like jury nullification try to prevent it, without harming a juries independence. So possibly not a good idea to rely on jury nullification as your get out of jail free card.
  - thebradbain 5y ago
    It’s also not necessarily a legal strategy even as a Hail Mary. California’s state Supreme Court ruled in 2001 that jury nullification is not a valid decision… and my understanding is if the outcome case can be attributed to “jury nullification” (i.e. could be as obvious as the defense suggesting it as an avenue to the jury, which ironically itself is legal, or as technical as the jury refusing to consider or explicitly refusing a piece of evidence that is entered in the record— think a moral objection to the law, or “evidence undeniably shows the defendant left the scene at 7pm, but we the jury contend it was 6pm”) it legally would be considered a mistrial and allowed to be re-litigated— and the sole person who has the power to attribute something to jury nullification and/or declare mistrial? The judge. https://sddefenseattorneys.com/blog/jury-nullification/ https://sddefenseattorneys.com/blog/jury-nullification/
- grayfaced 5y ago
  There is no guarantee. There is really no one that could even make such a guarantee. Opinions of DOJ change with administrations. The president could issue a pardon after the fact. Congress could make a law. Perhaps the executive could find some loophole to deputize people into US Cybercom but that would likely make them a lawful combatants which has other entanglements.
lalaland1125 5y ago
This is extremely terrible advice. You should delete your comment before you cause someone to go to jail.
- Gwarzo 5y ago
  A sort of side comment, but I absolutely despise this type of thinking. "before you cause someone to go to jail" If you take legal advice from pseudo anonymous users on aggregate websites you deserve to go to jail. Even in writing that, the users did not "cause" anyone to go to jail; the moron reading and acting on that comment did. Have some respect for individuality mate.
  - AussieWog93 5y ago
    Oh come on man. If being a dumbarse and engaging in dangerous behaviour was a jailable offence, then we'd need to arrest every single male under the age of 21. (To any dumbarses reading this comment, launching cyberattacks against adversarial nation states will land you in prison if you're lucky, a body bag if you're not)
  - yesenadam 5y ago
    I looked at your recent comments - in almost every one of them (!) you are insulting, mocking, being a total jerk to people on here. Please stop doing that. You will be banned very soon if you keep that up. Read the guidelines - most of your comments break more than a few. Thanks. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
bagels 5y ago
It is not reasonable to assume this. You might get lucky, or you might spend decades in prison.
mellavora 5y ago
In criminal law, incitement is the encouragement of another person to commit a crime. Depending on the jurisdiction, some or all types of incitement may be illegal. Where illegal, it is known as an inchoate offense, where harm is intended but may or may not have actually occurred. -- from wikipedia https://en.wikipedia.org/wiki/Incitement https://en.wikipedia.org/wiki/Incitement
- stickfigure 5y ago
  Contact information is in my profile. Come get me. Here's the more relevant wikipedia link: https://en.wikipedia.org/wiki/Legal_realism https://en.wikipedia.org/wiki/Legal_realism

mrits 5y ago

Maybe he could find you a job afterwards? @DAlperovitch

HWR_14 5y ago

I mean, it's probably legal for you to fill out the application as a US citizen, as the Ukrainians are also asking for defensive help. If you have or want a US security clearance there may be issues in helping a foreign power, but absent that you can probably stay on the right side of the line. Obviously, you'd want a real legal opinion. I do wonder at what point the US just declares Russian computer systems beyond the protection of US law. At some point, that happens, right?

em3rgent0rdr 5y ago
Aren't Russian computer systems already beyond the protection of US law?
- zja 5y ago
  No
- kweinber 5y ago
  Defending an ally from an enemy is not something the US government punishes people for. If you want to help the people of Ukraine then #standwithukraine.
  - lamp987 5y ago
    ukraine is not an ally of USA though
    - ipaddr 5y ago
      They are allies. US, Canada, etc has given loans, sent resources and weapons.
      - thaumasiotes 5y ago
        Wouldn't that make Russia an ally too?

jtsuken 5y ago

If you don't want to engage on the offensive side, there is plenty of work on the defensive side of things. * Detect and notify the Ukrainian government about threats or upcoming attacks. * Identify coordinated manipulative behaviour on social media. * Last but not least contact Patreon's management to release the funds that have been donated to Ukrainian veterans (https://news.ycombinator.com/item?id=30461038 https://news.ycombinator.com/item?id=30461038) Feel free to add to the list, as there is going to be a lot of work in the upcoming days.

black_puppydog 5y ago
Sorry but what? * It looks like there won't be a Ukrainian government to speak of in a few days. * Manipulative behaviour has been identified on twitter and Facebook almost every day for the last few years, and it hasn't really led to much anything. The Ukrainian government can't do anything about that, if the independent banana republics of FAANG don't decide to act, nothing is gonna change. * Likewise for patreon. It's a private Company and thus sadly, regrettably, out of reach of public scrutiny or regulation. Thoughts and prayers are free and abundant though! Besides, what is the Ukrainian government gonna do with money right now? I bet tanks and air defense systems have long lead times these days, chip shortage and all. Sorry for the overboarding sarkasm... I guess. But these are my points. Edit: Collecting downvotes for that. Not surprised, but I'm not seeing any counterpoints, really. It's okay if you just need a valve to let off your frustration, have at it, but what the parent suggested seems.... pointless, sorry to be blank. I mean, this sort of soft influence might be useful, but we ("the west") have been proving, on an ongoing basis, for multiple years now, that corporate decisions shall not and will not be questioned by our governments, that essentially an american-based platform has unbridled control over what they want to do, and that if they don't care about trolls and bots and harassment and nationalism andandand then there's not much "we" (read: the government, first of all the US government) can^Wwill do. What is the ukraininan government gonna do with more intel on russian propaganda? What's the actionable on that? Start a war with twitter? As for the first point. Yeah... I don't see the mechanism by which any of this will slow down the physical process of soldiers marching on Kyiv. No NATO state will enter into this conflict, Putin has been pretty openly threatening with nuclear annihilation. And I would doubt that the russian soldiers will be hanging out on twitter enough to really get distracted by some well thought-through anti-propaganda measures.

gjsman-1000 5y ago

The US does not currently have a legal permission to be in Ukraine. Ukraine does not have a defense agreement with the US that could land troops, Ukraine is not a NATO member, so forth. Right now, for the US to cyberattack Russia would be a direct act of war and quite literally cause the Cold War to become the Hot War. For this reason, just like how our troops are not in Ukraine but in surrounding countries watching, our NSA hackers are most likely standing down as well, as tragic as it may be.

bluGill 5y ago
More likely our NSA is only working when they can cover their tracks. Possibly by giving Ukrainian intelligence credit for their actions.
onedognight 5y ago
The US and Russia agreed to defend Ukraine after Ukraine agreed to give up its nuclear weapons in the 1994 Budapest Memorandum. The Russians are violating this agreement today, and the US would be following it to defend Ukraine from Russia’s invasion.
- gjsman-1000 5y ago
  When the Budapest Memorandum was signed, having one of the defenders be the invaders was not expected. As a result, even if that binding is still in power, is it worth defending Ukraine by going to war against Russia? That would literally start World War III. Letting Ukraine fall is terrible, awful, painful - but it's better than WWIII.

harryvederci 5y ago

> I'm exactly the kind of person I suppose this is meant to appeal to. Quote from the article: > "Ukrainian cybercommunity! It's time to get involved in the cyber defense of our country," the post read, asking hackers and cybersecurity experts to submit an application via Google docs, listing their specialties, such as malware development, and professional references. If you're not Ukrainian, I guess the request is not aimed at you. Probably exactly for the reasons you mention. And if you were, the request is to fill in the form, not to go rogue. Edit: @dang maybe change the title to "[...] calls on its hacker underground [...]" to make this a bit more clear?

bink 5y ago
That's a very important clarification. Thank you.
- Zenst 5y ago
  You are though, allowed to offer educational training to Ukraine nationals. Maybe there could be some formal initiative to clear out the grey/black area's so white hats can not fall upon their ethics.

blobbers 5y ago

Based in the US, which law prevents you from committing cyber attacks in Russia? Genuinely curious how you would be prosecuted and how this would cause you to risk your entire career.

bink 5y ago
There's a seemingly endless collection of crimes you could be charged with if you're hacking a foreign country from inside the US. From wire fraud to conspiracy and everything in-between. A federal charge of conspiracy carries a mandatory minimum of 5 years in jail.
- NickKampe 5y ago
  even if you were to get a US attorney to prosecute you by turning yourself in, they'll highly likely give you probation even with "mandatory minimums"
deleted 5y ago
[deleted]
mellavora 5y ago
So in general (i.e. not specific to cyber), and even under the condition that Congress had declared war on Russia, it is illegal for civilians to engage in acts which harm the enemy. Only the military is allowed to attack. read up on "unlawful combatant" and "irregular combatant" Now if look more specifically at cyber, then there are laws such as The Computer Fraud and Abuse Act (CFAA) The Stored Communications Act (SCA) The Electronic Communications Privacy Act (ECPA) The Defend Trade Secrets Act (DTSA) which define certain activities as criminal. If a person is on US soil and engaging in activities described in these laws, they may be in violation of criminal law. The location of the victim has little to do with it, it is location of the actor. By analogy, if A does crime to B, it isn't B who prosecutes, it is the appropriate governmental organization.
- blobbers 5y ago
  Informative, but these seem hazy. What is soil in the cyber world? Or is it the passport "A" is carrying? As many have indicated, unlikely anyone in the west will prosecute?

birdyrooster 5y ago

There are plenty of independent clandestine attackers from the US and they interact with the US government through DISA, which might confuse you if you take their name literally. The government is looking the other way and isn't looking or trying to bring their domestic hackers to justice.

phishermann 5y ago
Not that anonymity goes a very long way, but I can vouch for USG not giving a shit. I used to work for an anti-phishing firm that you’ve likely never heard of. We routinely disrupted and dismantled phishing campaigns and bot networks being used by Russian crime networks as well as suspected IRGC (those folks have to get currency somewhere and importing an crack cocaine is apparently not their style) Our malware research and SOC folks were pretty much all former Feds or Military Intelligence. They would routinely counter-hack servers we couldn’t take-down through legitimate means. While it was most certainly a “let’s not discuss this in an email” it was understand and briefed by our legal department that it was a “grey area” and that the USG would never even bother us as we were hitting adversarial nations anyway. If you’re gonna play hackerman for UA, just do it smart.

throwawaynay 5y ago

trevormcneal 5y ago

I can say that I know people who are much less skilled than you and also less ethic, that are hacking into any low hanging fruit that they can and selling a shell (access) to those systems to FSB. I imagine that Ukraine would have a similar program to pay for such kind of access on Russia infrastructure or government systems.

irthomasthomas 5y ago

I assumed it was aimed at Ukraine hackers? They don't have much to lose at this point.

deleted 5y ago

[deleted]

belter 5y ago

I am surprised this is the top comment. Not that it's not well argued but what seems to imply of the reading by most of the current situation. The joke of sanctions implemented by the EU and the US, and they are a joke, since EU continues to import gas from Russia, and SWIFT use continues by the Russian Federation, is a symptom of the same attitude seen on many Ukraine residents just 48 hours ago. A kind of cognitive disconnect between the obvious war coming your way, and a refusal to accept it, until it is at your door. You have a ex-president of the United States openly praising the Russian president on the media, and also US TV networks openly doing the treasonous job of promoting Russian views in the US. If the Russian army quickly overtakes Ukraine you have Russian troops staring across the border to Polish troops. Some of the small countries that are now members of NATO, still have small pockets of Russian speaking communities. You think Russia will not claim they are also being discriminated and need another peace keeping operation? In case of a conflict between Russia and a NATO member, it's mushroom clouds we are looking into. So I find your legalistic concerns incredibly detached from the seriousness of the current situation.

donogh 5y ago
That’s a good point. I visited Latvia a few years ago and was struck by how large a section of society there identifies as Russian, to the extent that in some places you were more likely to hear people speaking Russian than Latvian. Poland would be a more difficult target to justify than the Baltics; only 0.1% of Poles speak Russian; 30% of Latvians are native Russian speakers. I could see Putin going there next.
- cobbzilla 5y ago
  All three Baltic nations are NATO members. An attack on any NATO member requires a response by NATO. So, not likely that Latvia is next.
  - belter 5y ago
    For the sake of all of us let's hope you are right: "‘If a war starts, they will come here first’: Latvia mounts a wary border watch" https://www.politico.eu/article/war-russia-ukraine-latvia-mounts-border-watch/ https://www.politico.eu/article/war-russia-ukraine-latvia-mo...

simonh 5y ago

I take it you hack into critical infrastructure systems legally, as part of security audits and such? After all if you were doing it illegally, and therefore are clearly fine doing illegal hacking, claiming that you won't risk hacking Russia because it might be illegal would seem like a weird defence to make.

100011_100001 5y ago

Since there is no way to contact you directly. I am interested in learning how to pen test etc. Do you have a recommended path to take? I'm lacking a good starting point.

exikyut 5y ago
I wondered this too but didn't have any good ideas (generally speaking, building theory, etc) Just belatedly noticed https://news.ycombinator.com/item?id=30471631 https://news.ycombinator.com/item?id=30471631, perhaps you hadn't seen it
- 100011_100001 5y ago
  This is actually very useful. Thanks.

deleted 5y ago

[deleted]