8 ms·

Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

41 points by your_username 5y ago

Throwaway for obvious reasons. I’ll try to be as concise as possible. Some details have been changed to protect myself. I used to operate a website that hotlinked to an asset from $company’s S3 bucket. When $company was made aware of my doing from the FBI, the FBI asked them to calculate the loss amount. They did this by looking at IPs that hit the bucket over a span of 1 month, and the IPs that logged into $company’s service. The number of IPs that they didn’t recognize (about 25,000), multiplied by some multiplier, came out to about $6MM. The problem: I know how many people I had on my website that hit that asset. It was in the hundreds, not the thousands, definitely not tens of thousands. I know this because my site required a subscription and I know how many subscribers I had. There were (and still are!) hundreds of sites that hotlink to $company’s S3 bucket today, causing them loss, that are free and easily accessible. I can show this. When I told my lawyer that this couldn’t possibly have been calculated correctly, he said that I’m pretty SOL in arguing this loss amount. He’s not technical so I don’t know if he really understands. Regardless, I’m in the process of discharging him because he’s failed me multiple times in this case so far. This reeks of all sorts of wrong. $company is an organization known to probably 95% of HNers, they’re a technical organization, and they could not have possibly made the calculation in good faith. If anyone has any advice, I’d appreciate it. I’ll be checking this thread closely, but I can also be reached by email at hotlinking@protonmail[.]com.

ss108 5y ago
You shouldn't be posting on here, you should be looking for another lawyer. Sounds like you have a good argument to lower the restitution you'd owe if convicted. Great. But a) ideally you're not convicted; b) somone has to take your argument and prove it in court You need a solid lawyer. That is it.
smoyer 5y ago
First, I understand your technical arguments above (but IANAL.) Find a technical lawyer who understands that your logs and/or subscribers list sets a hard limit to the damage you might have caused. I'm a bit curious about why you're being charged at all if the S3 bucket was publicly available - there are easy ways for the company to secure their bucket if they choose (one example - https://www.msp360.com/resources/blog/how-to-prevent-hotlinking-of-imaged-hosted-on-amazon-s3/ https://www.msp360.com/resources/blog/how-to-prevent-hotlink...). You're headline states that you didn't do it but your descriptions admits you did, but maybe not all of it. You need to be completely honest with this. The journalist in Missouri who identified teachers SSNs on the state's web-site was in a similar situation and, while he's ultimately not going to be charged, his legal fees are hefty.
- lalahazel 5y ago
  My understanding is they admitted they did it but not to the extent of loss this company is claiming they did-- thus would legally make the case more severe with sentencing...
replygirl 5y ago
IANAL but it sounds like the fact that you offered a subscription service for access to $company's asset puts you in more trouble. you may have only gotten x dollars from your subscribers, but it's hard to dispute that you intended to extract y dollars in potential lifetime revenue from those 25k monthly visitors, especially if your revenue growth hasn't been trending negative. it's arguable those free sites didn't cause $company any loss, as those people may not have been interested in the asset had they had to pay for it, but if someone pays you instead of the owner of the IP...
Canada 5y ago
Why are you facing any liability whatsoever for linking to public resources? If the owner of that S3 bucket is facing losses from serving files to the public, why don't they revoke public access? S3 prints big warnings that you are making things public, so it's unreasonable for a company to claim "We didn't mean to make this public" What was in the bucket? In any case, sounds like you need a better lawyer, I don't see how HN can help you without you going public and telling the whole story.
- otterley 5y ago
  It is no defense to burglary that the homeowner left their front door unlocked.
  - theli0nheart 5y ago
    This is a little different. This is akin to knocking on the door, asking if you can be let in, being invited in by the homeowner, and then having them give a tour around the house. It's entirely up to the owner of an S3 bucket as to who they serve their static assets to. If the policies are so lenient that anyone can request the resources, then that is a configuration error—not unauthorized access.
    - otterley 5y ago
      You are falsely assuming that allowing public access and serving the requested object constitutes an intentional act of invitation by a bucket owner. If the alleged victim sought the FBI's assistance, it seems pretty clear that they did not intend to extend such an invitation, regardless of the bucket's configuration. Or, to extend the metaphor I made earlier, just because I left the door unlocked, it doesn't mean I meant to invite anyone in. And if they tricked my housekeeper to invite them in by falsely claiming I authorized them to come to pick up my broken laptop, they'd have no invitation defense, either. (Maybe they wouldn't be guilty of burglary, but certainly larceny.) Unauthorized access can occur whether the bucket is public or not. The law does not require that sufficient measures (or any measures, really) be taken to protect the assets in question. We can disagree as to whether it should, but that's not how it's written today. Before making comparative arguments here, it's a good idea to think about whether a judge would laugh at you or not. :-)
rosndo 5y ago
This story doesn’t really make sense. What would you risk by truthfully telling us what company and what kind of assets you’re talking about? You shouldn’t be having this conversation with the FBI anyway, these details are figured out in courts.
- runnerup 5y ago
  Most likely OP cannot afford the team of comprehensive legal advisors which would be necessary to achieve a truly fair outcome. I imagine OP has been dealing with this situation mostly silently for approximately a year by now. The "wheels of justice" turn slowly but generally inexorably. Once the FBI decides to bring charges, they almost always have already completely made up their mind and get exactly the outcome they want. OP's life has been and will continue to be thoroughly destroyed by the consequences of their poor judgement and there's likely no actions OP can take at this point to change the medium-term outcomes. Barring winning the lottery (in some form or another), OP would not be able to pay this debt if they lived to be 1,000 years old. And it's not dischargeable in bankruptcy. That's ignoring any potential jail time and consequences on OP's future employment options. So, quite frankly, at this point OP is probably posting here in a state of pseudo-panic, because there's very little chance this post would make it worse now that he's already been criminally charged -- again, 99+% of the time, the main outcomes are usually decided at the time of charging, not sentencing. Long-term, OP may be able to eventually build a life that they are happy with. But they will have many, many doors closed to them. On an absolute scale, it's possible that OP's actions directly caused a response that wasted many, many man-years of labor even if the data leaked wasn't itself important (technical and legal investigation, management conversations/energy/time that could have been spent on other things, security containment and mitigation, FBI investigators times, the courts time). Its probably not possible for OP to "pay back" the time and energy to all those people that they've affected. But on a relative scale, its likely that no individual or corporation was threatened with existential harm over this, while OP certainly is facing what feels like existential consequences. So that will be very very hard for them to deal with right now.
  - rosndo 5y ago
    If OP wants advice beyond “get a better lawyer”, it would be useful to know what they actually did or are accused of doing. As it stands his post doesn’t really provide any useful details beyond “I’m facing federal charges and am not happy with my lawyer”.
spansoa 5y ago
Aren't cases like this a rare exception and you're let away with a slap on the wrist by Amazon and they will look the other way? If you keep doing it, you will have to cough up the funds, so just learn from the lesson?
otterley 5y ago
IAAL, but am not providing legal advice here. If this is a criminal case (I assume it is, given the FBI's involvement), the presiding judge has pretty wide discretion to set the terms of the punishment for a conviction, subject to the specific penalties imposed by law and federal sentencing guidelines. Unlike in a civil case, monetary penalties are intended to be punitive, not restorative. The best your attorney can do is make the case as best as they can and plea bargain with the AUSA to get the penalty as low as possible; and failing that, beg the court for mercy, and be thankful if you manage not to go to prison. You can also plead innocence, go to trial, and hopefully avoid conviction altogether. (BTW, this post can be admitted into evidence if it comes to the AUSA's attention.)
psygnisfive 5y ago
Contact the Electronic Frontier Foundation. This is literally what they do. I don't know if they'll take up the case, but talk to them.
- pyuser583 5y ago
  Sadly the EFF is not usually in a position to serve as a technical witness in criminal cases.
vgeek 5y ago
As little as 10 years ago, the most common solution to hotlinking was swapping out the hotlinked images with something different/offensive to shoo away the hotlinker. Or various anti-hotlinking scripts. Or maybe even check request headers against your own domain at the server level. Now the solution is a 7 figure cry of foul enforced by the FBI? Was the offense more egregious and involved hotlinking of novel IP, leading to more aggressive enforcement?
- titusjohnson 5y ago
  If you don't have money you spend a few evenings setting up referrer protection of some fashion and serve goatse to unauthorized clients. Problem self-solves over time. I was on the receiving end of this a few times, back when I was young and had no way of paying for my own legit image hosting. If you have money you may also have scale and a public image, so this solution is not so palatable. And since you have money and lawsuits are socially acceptable, you go that route. If sending security to your house with baseball bats were socially acceptable that would be the route utilized.
faangiq 5y ago
This sucks and shouldn’t be a crime. But the iron fist of Uncle Sam has struck and you’re screwed basically. Try to get a very good lawyer, I’d focus your efforts on that.
nextlevelwizard 5y ago
Murica is pretty fucked up country if you can get sued for linking to a public resource on the web.
- otterley 5y ago
  America is a great country because we respect people's intent, even if they make inadvertent mistakes.
  - nextlevelwizard 5y ago
jrc2022 5y ago
This is not legal advice. IANAL. Please seek better legal representation. There's legislated protection for you and also already US case law as precedent.
- giantg2 5y ago
  Links?
ffhhj 5y ago
> Instead of communicating a copy of the image, Google provides HTML instructions that direct a user’s browser to a website publisher’s computer that stores the full-size photographic image. https://en.m.wikipedia.org/wiki/Inline_linking https://en.m.wikipedia.org/wiki/Inline_linking It seems Google saved its butt with that explanation. Can you do the same?
- titusjohnson 5y ago
  Mostly true, image search results are shown to the user using a base64 encoded thumbnail representation of the source. Focused view results in a request made to the source image inline with Google's site. They definitely store & process copies. Color search, subject search, none of that is possible without storage of some kind. Freshness searches require polling resources with modest frequency, too.
giantg2 5y ago
"he said that I’m pretty SOL in arguing this loss amount." That's how I see it. The government has obscene resources and power to prosecute you. Even if you win, you'll likely be screwed with the cost to defend. The law generally favors the victim and in many cases judges seem to accept any amount that can explained, even if it's not fair.
segmondy 5y ago
Why will the FBI just randomly tell a company you linked to their site? There's more to this, but get a better lawyer, and the FBI won't be the one to calculate/charge you. Sorry, but your story doesn't add up.

41 points by your_username 5y ago

ss108 5y ago

You shouldn't be posting on here, you should be looking for another lawyer. Sounds like you have a good argument to lower the restitution you'd owe if convicted. Great. But a) ideally you're not convicted; b) somone has to take your argument and prove it in court You need a solid lawyer. That is it.

smoyer 5y ago

First, I understand your technical arguments above (but IANAL.) Find a technical lawyer who understands that your logs and/or subscribers list sets a hard limit to the damage you might have caused. I'm a bit curious about why you're being charged at all if the S3 bucket was publicly available - there are easy ways for the company to secure their bucket if they choose (one example - https://www.msp360.com/resources/blog/how-to-prevent-hotlinking-of-imaged-hosted-on-amazon-s3/ https://www.msp360.com/resources/blog/how-to-prevent-hotlink...). You're headline states that you didn't do it but your descriptions admits you did, but maybe not all of it. You need to be completely honest with this. The journalist in Missouri who identified teachers SSNs on the state's web-site was in a similar situation and, while he's ultimately not going to be charged, his legal fees are hefty.

lalahazel 5y ago
My understanding is they admitted they did it but not to the extent of loss this company is claiming they did-- thus would legally make the case more severe with sentencing...

replygirl 5y ago

IANAL but it sounds like the fact that you offered a subscription service for access to $company's asset puts you in more trouble. you may have only gotten x dollars from your subscribers, but it's hard to dispute that you intended to extract y dollars in potential lifetime revenue from those 25k monthly visitors, especially if your revenue growth hasn't been trending negative. it's arguable those free sites didn't cause $company any loss, as those people may not have been interested in the asset had they had to pay for it, but if someone pays you instead of the owner of the IP...

Canada 5y ago

Why are you facing any liability whatsoever for linking to public resources? If the owner of that S3 bucket is facing losses from serving files to the public, why don't they revoke public access? S3 prints big warnings that you are making things public, so it's unreasonable for a company to claim "We didn't mean to make this public" What was in the bucket? In any case, sounds like you need a better lawyer, I don't see how HN can help you without you going public and telling the whole story.

otterley 5y ago
It is no defense to burglary that the homeowner left their front door unlocked.
- theli0nheart 5y ago
  This is a little different. This is akin to knocking on the door, asking if you can be let in, being invited in by the homeowner, and then having them give a tour around the house. It's entirely up to the owner of an S3 bucket as to who they serve their static assets to. If the policies are so lenient that anyone can request the resources, then that is a configuration error—not unauthorized access.
  - otterley 5y ago
    You are falsely assuming that allowing public access and serving the requested object constitutes an intentional act of invitation by a bucket owner. If the alleged victim sought the FBI's assistance, it seems pretty clear that they did not intend to extend such an invitation, regardless of the bucket's configuration. Or, to extend the metaphor I made earlier, just because I left the door unlocked, it doesn't mean I meant to invite anyone in. And if they tricked my housekeeper to invite them in by falsely claiming I authorized them to come to pick up my broken laptop, they'd have no invitation defense, either. (Maybe they wouldn't be guilty of burglary, but certainly larceny.) Unauthorized access can occur whether the bucket is public or not. The law does not require that sufficient measures (or any measures, really) be taken to protect the assets in question. We can disagree as to whether it should, but that's not how it's written today. Before making comparative arguments here, it's a good idea to think about whether a judge would laugh at you or not. :-)

rosndo 5y ago

This story doesn’t really make sense. What would you risk by truthfully telling us what company and what kind of assets you’re talking about? You shouldn’t be having this conversation with the FBI anyway, these details are figured out in courts.

runnerup 5y ago
Most likely OP cannot afford the team of comprehensive legal advisors which would be necessary to achieve a truly fair outcome. I imagine OP has been dealing with this situation mostly silently for approximately a year by now. The "wheels of justice" turn slowly but generally inexorably. Once the FBI decides to bring charges, they almost always have already completely made up their mind and get exactly the outcome they want. OP's life has been and will continue to be thoroughly destroyed by the consequences of their poor judgement and there's likely no actions OP can take at this point to change the medium-term outcomes. Barring winning the lottery (in some form or another), OP would not be able to pay this debt if they lived to be 1,000 years old. And it's not dischargeable in bankruptcy. That's ignoring any potential jail time and consequences on OP's future employment options. So, quite frankly, at this point OP is probably posting here in a state of pseudo-panic, because there's very little chance this post would make it worse now that he's already been criminally charged -- again, 99+% of the time, the main outcomes are usually decided at the time of charging, not sentencing. Long-term, OP may be able to eventually build a life that they are happy with. But they will have many, many doors closed to them. On an absolute scale, it's possible that OP's actions directly caused a response that wasted many, many man-years of labor even if the data leaked wasn't itself important (technical and legal investigation, management conversations/energy/time that could have been spent on other things, security containment and mitigation, FBI investigators times, the courts time). Its probably not possible for OP to "pay back" the time and energy to all those people that they've affected. But on a relative scale, its likely that no individual or corporation was threatened with existential harm over this, while OP certainly is facing what feels like existential consequences. So that will be very very hard for them to deal with right now.
- rosndo 5y ago
  If OP wants advice beyond “get a better lawyer”, it would be useful to know what they actually did or are accused of doing. As it stands his post doesn’t really provide any useful details beyond “I’m facing federal charges and am not happy with my lawyer”.

spansoa 5y ago

Aren't cases like this a rare exception and you're let away with a slap on the wrist by Amazon and they will look the other way? If you keep doing it, you will have to cough up the funds, so just learn from the lesson?

otterley 5y ago

IAAL, but am not providing legal advice here. If this is a criminal case (I assume it is, given the FBI's involvement), the presiding judge has pretty wide discretion to set the terms of the punishment for a conviction, subject to the specific penalties imposed by law and federal sentencing guidelines. Unlike in a civil case, monetary penalties are intended to be punitive, not restorative. The best your attorney can do is make the case as best as they can and plea bargain with the AUSA to get the penalty as low as possible; and failing that, beg the court for mercy, and be thankful if you manage not to go to prison. You can also plead innocence, go to trial, and hopefully avoid conviction altogether. (BTW, this post can be admitted into evidence if it comes to the AUSA's attention.)

psygnisfive 5y ago

Contact the Electronic Frontier Foundation. This is literally what they do. I don't know if they'll take up the case, but talk to them.

pyuser583 5y ago
Sadly the EFF is not usually in a position to serve as a technical witness in criminal cases.

vgeek 5y ago

As little as 10 years ago, the most common solution to hotlinking was swapping out the hotlinked images with something different/offensive to shoo away the hotlinker. Or various anti-hotlinking scripts. Or maybe even check request headers against your own domain at the server level. Now the solution is a 7 figure cry of foul enforced by the FBI? Was the offense more egregious and involved hotlinking of novel IP, leading to more aggressive enforcement?

titusjohnson 5y ago
If you don't have money you spend a few evenings setting up referrer protection of some fashion and serve goatse to unauthorized clients. Problem self-solves over time. I was on the receiving end of this a few times, back when I was young and had no way of paying for my own legit image hosting. If you have money you may also have scale and a public image, so this solution is not so palatable. And since you have money and lawsuits are socially acceptable, you go that route. If sending security to your house with baseball bats were socially acceptable that would be the route utilized.

faangiq 5y ago

This sucks and shouldn’t be a crime. But the iron fist of Uncle Sam has struck and you’re screwed basically. Try to get a very good lawyer, I’d focus your efforts on that.

nextlevelwizard 5y ago

Murica is pretty fucked up country if you can get sued for linking to a public resource on the web.

otterley 5y ago
America is a great country because we respect people's intent, even if they make inadvertent mistakes.
- nextlevelwizard 5y ago

jrc2022 5y ago

This is not legal advice. IANAL. Please seek better legal representation. There's legislated protection for you and also already US case law as precedent.

giantg2 5y ago
Links?

ffhhj 5y ago

> Instead of communicating a copy of the image, Google provides HTML instructions that direct a user’s browser to a website publisher’s computer that stores the full-size photographic image. https://en.m.wikipedia.org/wiki/Inline_linking https://en.m.wikipedia.org/wiki/Inline_linking It seems Google saved its butt with that explanation. Can you do the same?

titusjohnson 5y ago
Mostly true, image search results are shown to the user using a base64 encoded thumbnail representation of the source. Focused view results in a request made to the source image inline with Google's site. They definitely store & process copies. Color search, subject search, none of that is possible without storage of some kind. Freshness searches require polling resources with modest frequency, too.

giantg2 5y ago

"he said that I’m pretty SOL in arguing this loss amount." That's how I see it. The government has obscene resources and power to prosecute you. Even if you win, you'll likely be screwed with the cost to defend. The law generally favors the victim and in many cases judges seem to accept any amount that can explained, even if it's not fair.

segmondy 5y ago

Why will the FBI just randomly tell a company you linked to their site? There's more to this, but get a better lawyer, and the FBI won't be the one to calculate/charge you. Sorry, but your story doesn't add up.