5 ms·

I think it's illegal under the Computer Fraud and Abuse act. Also, what should the government do when it finds something? What if the site operators are unres

I think it's illegal under the Computer Fraud and Abuse act. Also, what should the government do when it finds something? What if the site operators are unresponsive or cannot be contacted? There are a lot of practical problems.

noodlesUK 4y ago
Something tells me that even with the somewhat stretched version of extraterritoriality that the US claims about laws like CFAA, they wouldn't try applying that to their closest intelligence/defence partner country operating largely domestically...
l33t233372 4y ago
Does CFAA restrict government interactions? If the site operators are unresponsive then that sucks, but it would still help secure those that are responsive.
iot_devs 4y ago
I mean... They could at least ty to contact the operator.
- GartzenDeHaes 4y ago
  Greetings Citizen, We have detected a dangerous virus or service in your hosting environment. Conspiracy theorists and foreign state actors often use these types of methods to spread fake news and influence our elections. These are serious threats to our Democracy, but Fatherland Security is here to help you through this difficult time. Your local neighborhood Security Helper will be at your home in the next few minutes to assist you in removing the dangerous HTTP service. For your safety, please stay away from all doors and windows. Sincerely, Rob E. Friendly
jrockway 4y ago
> What if the site operators are unresponsive or cannot be contacted? This seems like only a minor problem. If people are unresponsive, then oh well, they tried to tell you you're hacked. If the site owner cannot be determined, they can email your ISP. This seems to work well for "one of your customers is torrenting movies", and since every ISP is known by definition (thanks, IP addresses), it should be fairly straightforward to get that message to the actual customer. (Send it with the invoice; if the customer doesn't pay invoices, then it's easy to resolve the hacked site. You were shutting them off anyway.)
fragmede 4y ago
Everything's illegal under the CFAA. It's an old bad overreaching law that should be repealed. The government rarely prosecutes itself though, so that's no reason why. Unfortunately, the culture in the US is such that the populace would freak out if the government tried to do such a thing, never mind practical surmountable issues.
denton-scratch 4y ago
The way I read the article, they're actually collecting vulnerability information. So they check a site with Version X running on it, and detect the vuln; then they later see Version Y, without the vuln, and update their vulnerability database. Nothing in the article suggests that they contact site-owners (I haven't re-read the article, so might be wrong). I'm not sure why you think it's a potential violation of CFAA to connect to a public server and probe it. There's no suggestion of unauthorized access; that would involve exploiting vulnerabilities they find, and that would be unauthorized access.
pessimizer 4y ago
> I think it's illegal under the Computer Fraud and Abuse act. Things that are illegal for individuals to do aren't necessarily illegal for governments to do. This is a reason why the government should be vigorously doing this, rather than leaving it to private citizens, who risk being charged under the Computer Fraud and Abuse Act. ----- > Also, what should the government do when it finds something? It should contact the site operator. ----- > What if the site operators are unresponsive or cannot be contacted? I would imagine that in the case that site operators couldn't be contacted, they wouldn't be contacted.

noodlesUK 4y ago

Something tells me that even with the somewhat stretched version of extraterritoriality that the US claims about laws like CFAA, they wouldn't try applying that to their closest intelligence/defence partner country operating largely domestically...

l33t233372 4y ago

Does CFAA restrict government interactions? If the site operators are unresponsive then that sucks, but it would still help secure those that are responsive.

iot_devs 4y ago

I mean... They could at least ty to contact the operator.

GartzenDeHaes 4y ago
Greetings Citizen, We have detected a dangerous virus or service in your hosting environment. Conspiracy theorists and foreign state actors often use these types of methods to spread fake news and influence our elections. These are serious threats to our Democracy, but Fatherland Security is here to help you through this difficult time. Your local neighborhood Security Helper will be at your home in the next few minutes to assist you in removing the dangerous HTTP service. For your safety, please stay away from all doors and windows. Sincerely, Rob E. Friendly

jrockway 4y ago

> What if the site operators are unresponsive or cannot be contacted? This seems like only a minor problem. If people are unresponsive, then oh well, they tried to tell you you're hacked. If the site owner cannot be determined, they can email your ISP. This seems to work well for "one of your customers is torrenting movies", and since every ISP is known by definition (thanks, IP addresses), it should be fairly straightforward to get that message to the actual customer. (Send it with the invoice; if the customer doesn't pay invoices, then it's easy to resolve the hacked site. You were shutting them off anyway.)

fragmede 4y ago

Everything's illegal under the CFAA. It's an old bad overreaching law that should be repealed. The government rarely prosecutes itself though, so that's no reason why. Unfortunately, the culture in the US is such that the populace would freak out if the government tried to do such a thing, never mind practical surmountable issues.

denton-scratch 4y ago

The way I read the article, they're actually collecting vulnerability information. So they check a site with Version X running on it, and detect the vuln; then they later see Version Y, without the vuln, and update their vulnerability database. Nothing in the article suggests that they contact site-owners (I haven't re-read the article, so might be wrong). I'm not sure why you think it's a potential violation of CFAA to connect to a public server and probe it. There's no suggestion of unauthorized access; that would involve exploiting vulnerabilities they find, and that would be unauthorized access.

pessimizer 4y ago

> I think it's illegal under the Computer Fraud and Abuse act. Things that are illegal for individuals to do aren't necessarily illegal for governments to do. This is a reason why the government should be vigorously doing this, rather than leaving it to private citizens, who risk being charged under the Computer Fraud and Abuse Act. ----- > Also, what should the government do when it finds something? It should contact the site operator. ----- > What if the site operators are unresponsive or cannot be contacted? I would imagine that in the case that site operators couldn't be contacted, they wouldn't be contacted.