4 ms·

Given the infected folks in question likely had their machines involved in illegal activity, I'm not sure I'd want to test it. If someone starts running a meth

by tw04 3y ago

Given the infected folks in question likely had their machines involved in illegal activity, I'm not sure I'd want to test it. If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? And are you really going to try to sue the police for shutting down the lab and locking the door on their way out?

anonym29 3y ago
>If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? Are you implying that the property owner is liable because they neglected to lock the cellar, or because they weren't aware a crime was taking place there? If the former, isn't that as clear an example of victim blaming as telling people to carry firearms/protection if they don't want to be sexually assaulted? In a civil society, it is not the responsibility or duty of the victim to set up security measures to prevent themselves from being victimized. It is the responsibility and duty of the culprit to not commit those unlawful crimes in the first place. Bringing the analogy back to security - who is guilty of a crime when a ransomware attack happens, the victim, or the criminal (who obtained unauthorized access, and used that access to perform extortion)?
- tw04 3y ago
  >or because they weren't aware a crime was taking place there? If someone is running a meth lab out of your cellar for a year, and you don't notice the smell, the power bill, the people coming and going, at what point are you no longer able to claim ignorance? If your answer is: you can claim ignorance indefinitely, what is preventing someone from just letting a meth lab be run from their basement and taking cash on the side? If the police can't find the cash, you're just not guilty? >It is not the responsibility of the victim to set up security measures to prevent themselves from being victimized. It is ABSOLUTELY the responsibility of the "victim" to not create an environment that FACILITATES crime. If you leave a gun unsupervised and unlocked on your front step, and a neighbor kid "steals" the gun off your front steps and proceeds to shoot and kill their friend, you are going to jail despite you being the "victim" of theft. Your internet connection in this instance is the loaded gun when your systems are being used in DDoS attacks.
  - AndrewKemendo 3y ago
    Yes, and there’s plenty of case law to support that - In fact, one of the most popular TV shows of all time had its finale specifically addressing the fact that a law needed to be made to discourage “bystanders” from actively ignoring crime.
    - lelanthran 3y ago
      Which show was this?
      - kevinh 3y ago
        Probably Seinfeld.
      - nirvdrum 3y ago
        Seinfeld.
  - dcow 3y ago
    > and taking cash on the side With this statement you’re arguing past the person you’re responding to. If you are taking cash on the side to feign ignorance when the DEA comes squawking about the meth lab in your basement then you are clearly in the know. Nobody is talking about negligence here. Your rebuttal is essentially “well victims can be blamed if they’re being negligent”. Yeah, sure, by definition they’re not just a victim, they’re a negligent individual. (I mean I’d even argue they can be blamed for less—I’m not one of those 100% the victim is always innocent types, but that’s a different topic.) The original question is if you are honestly unaware (and not negligent) that your property is being used to commit a crime, are you culpable for the crime? The answer is a resounding “no”. If someone hacks your PC and installs botnet software, and it evades your OS antivirus heuristics and protections because it’s a sophisticated root-kit, then no, you’re not culpable.
    - tw04 3y ago
      >With this statement you’re arguing past the person you’re responding to. If you are taking cash on the side to feign ignorance when the DEA comes squawking about the meth lab in your basement then you are clearly in the know. Ironic that you're doing what you accused me of. I didn't say the person was taking cash, I asked WHEN op would consider the person to be culpable. You literally took an entire discussion and clipped four words then made up a bunch of stuff I didn't actually say or even imply. >The original question is if you are honestly unaware (and not negligent) that your property is being used to commit a crime, are you culpable for the crime? The answer is a resounding “no”. That was NOT the original question. The original question was whether or not someone could sue the police for removing malware and patching their system. My example was the cops shutting down a meth lab and locking the door. Be my guest attempting to sue, and be prepared to have to defend yourself in a court of law that you were truly unaware. That's going to be a VERY expensive proposition - so who in their right mind would even start down that path?
- shkkmo 3y ago
  Landlords can indeed be liable is many ways for some kinds of illegal activity that take place on their property (especially if it involves drugs.) There are a variety of local and federal laws that enable this.
- wutwutwat 3y ago
  [dead]
dcow 3y ago
> And are you really going to try to sue the police for shutting down the lab and locking the door on their way out? If the police enter your property without a warrant then sure. The potential presence of illegal activity does not grant the police special powers to skirt judicial process (unless there’s imminent danger to someone’s life or something, obviously). If the police unduly lock you out of your own property on the way out then doubly sure. Obviously most people will be relieved that their machine no longer has malware on it (save willing participants, which is a different question altogether…). What would piss me off is not being notified, and not being given the chance to remediate myself (what if the police damage other pieces of property on the way and I could avoid the damage if I’m simply made aware), etc. So let’s go back to the meth lab example: do you think it’s okay for the police to show up on your property unannounced in the middle of the night while you’re sleeping to silently shut down the meth lab without notifying you that they’re trespassing and then slap a lock on your basement door behind which you store your emergency cash, medical supplies, prescription drug refills, personal protection equipment, defensive firearms, etc. without leaving the keys or so much as a word? Edit (two more things): 1. It’s possible someone might have been running a copy of the botnet for research purposes, so presumably this copy is not engaged in illicit activity and only installed on lab hardware. I wonder if the FBI’s program considered this scenario. Maybe they only targeted IPs involved in actual DDOS attacks? That’d be cool. 2. You can question something without implying it’s wrong. One can both believe the FBI is acting in a responsible and just way while also being curious how this would play out in court. The fervor in your responses seems slightly out of place considering the comment you’re responding to is simply raising a question.
- mandevil 3y ago
  Oh hey, look at that, the FBI did get a warrant authorizing this action, and signed off by a United States Magistrate Judge: https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_application_reda... Now, are judges sometimes too easy with warrants? Certainly. But this is definitely not the same as entering your house without a warrant, because the FBI did get a warrant. The warrant involves them promising to a judge under penalty of perjury that the Qakbot Uninstaller they are using makes no further changes and collects no additional data on any of the victim computers they are running on. So, the FBI is aware of your concerns and is taking steps to alleviate them. Does that make you feel better?
airstrike 3y ago
> If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? The problem with analogies is that they assume they are correctly "analogous" but 9/10 times they really describe an entirely different situation, making them unhelpful if not misleading
- ToValueFunfetti 3y ago
  The problem with analogies is that people who disagree tend to just say "X is not Y" instead of "X is different from Y in this context due to Z". I'm not sure whether that is just a social behavior or if saying the second thing is especially hard.
  - rzzzt 3y ago
    A duck is not a horse due to... it not being a horse. You can macroexpand Z to "not having four legs", etc., but incomparable things will end up being different just based on their very essence.
    - ToValueFunfetti 3y ago
      "Why can't I pull a small wagon with a team of ducks? I can pull a large wagon with a team of horses." Useful answers: Ducks are not as intelligent as horses and aren't as easy to train. There is not a good way to strap a harness onto a duck for this task. Ducks waddle and this introduces turbulence. Ducks have substantially less pulling power. etc. Useless answer: A duck is not a horse because a duck is different from a horse. The person making the analogy knows that it is an analogy; it is not the source of confusion.
  - airstrike 3y ago
    It's not especially hard -- the burden of proof just isn't on the listener. Saying "X is not Y" is just saying "I'm not convinced, you must do better with your analogies". With enough context, one can infer as much Letting someone run a meth lab in your cellar is pretty obviously not the same as "letting" some malware run on your box, for crying out loud
hinkley 3y ago
Probably at the moment you try to sue them for taking away your volunteer meth lab.
wutwutwat 3y ago
[dead]
neodymiumphish 3y ago
There's plenty of room for security researchers running infected machines to monitor for behavioral and developmental changes in the malware to be more than a little irritated by the notion that the FBI or anyone else abused the malware servers to remove the infection surreptitiously.

by tw04 3y ago

anonym29 3y ago

>If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? Are you implying that the property owner is liable because they neglected to lock the cellar, or because they weren't aware a crime was taking place there? If the former, isn't that as clear an example of victim blaming as telling people to carry firearms/protection if they don't want to be sexually assaulted? In a civil society, it is not the responsibility or duty of the victim to set up security measures to prevent themselves from being victimized. It is the responsibility and duty of the culprit to not commit those unlawful crimes in the first place. Bringing the analogy back to security - who is guilty of a crime when a ransomware attack happens, the victim, or the criminal (who obtained unauthorized access, and used that access to perform extortion)?

tw04 3y ago
>or because they weren't aware a crime was taking place there? If someone is running a meth lab out of your cellar for a year, and you don't notice the smell, the power bill, the people coming and going, at what point are you no longer able to claim ignorance? If your answer is: you can claim ignorance indefinitely, what is preventing someone from just letting a meth lab be run from their basement and taking cash on the side? If the police can't find the cash, you're just not guilty? >It is not the responsibility of the victim to set up security measures to prevent themselves from being victimized. It is ABSOLUTELY the responsibility of the "victim" to not create an environment that FACILITATES crime. If you leave a gun unsupervised and unlocked on your front step, and a neighbor kid "steals" the gun off your front steps and proceeds to shoot and kill their friend, you are going to jail despite you being the "victim" of theft. Your internet connection in this instance is the loaded gun when your systems are being used in DDoS attacks.
- AndrewKemendo 3y ago
  Yes, and there’s plenty of case law to support that - In fact, one of the most popular TV shows of all time had its finale specifically addressing the fact that a law needed to be made to discourage “bystanders” from actively ignoring crime.
  - lelanthran 3y ago
    Which show was this?
    - kevinh 3y ago
      Probably Seinfeld.
    - nirvdrum 3y ago
      Seinfeld.
- dcow 3y ago
  > and taking cash on the side With this statement you’re arguing past the person you’re responding to. If you are taking cash on the side to feign ignorance when the DEA comes squawking about the meth lab in your basement then you are clearly in the know. Nobody is talking about negligence here. Your rebuttal is essentially “well victims can be blamed if they’re being negligent”. Yeah, sure, by definition they’re not just a victim, they’re a negligent individual. (I mean I’d even argue they can be blamed for less—I’m not one of those 100% the victim is always innocent types, but that’s a different topic.) The original question is if you are honestly unaware (and not negligent) that your property is being used to commit a crime, are you culpable for the crime? The answer is a resounding “no”. If someone hacks your PC and installs botnet software, and it evades your OS antivirus heuristics and protections because it’s a sophisticated root-kit, then no, you’re not culpable.
  - tw04 3y ago
    >With this statement you’re arguing past the person you’re responding to. If you are taking cash on the side to feign ignorance when the DEA comes squawking about the meth lab in your basement then you are clearly in the know. Ironic that you're doing what you accused me of. I didn't say the person was taking cash, I asked WHEN op would consider the person to be culpable. You literally took an entire discussion and clipped four words then made up a bunch of stuff I didn't actually say or even imply. >The original question is if you are honestly unaware (and not negligent) that your property is being used to commit a crime, are you culpable for the crime? The answer is a resounding “no”. That was NOT the original question. The original question was whether or not someone could sue the police for removing malware and patching their system. My example was the cops shutting down a meth lab and locking the door. Be my guest attempting to sue, and be prepared to have to defend yourself in a court of law that you were truly unaware. That's going to be a VERY expensive proposition - so who in their right mind would even start down that path?
shkkmo 3y ago
Landlords can indeed be liable is many ways for some kinds of illegal activity that take place on their property (especially if it involves drugs.) There are a variety of local and federal laws that enable this.
wutwutwat 3y ago
[dead]

dcow 3y ago

> And are you really going to try to sue the police for shutting down the lab and locking the door on their way out? If the police enter your property without a warrant then sure. The potential presence of illegal activity does not grant the police special powers to skirt judicial process (unless there’s imminent danger to someone’s life or something, obviously). If the police unduly lock you out of your own property on the way out then doubly sure. Obviously most people will be relieved that their machine no longer has malware on it (save willing participants, which is a different question altogether…). What would piss me off is not being notified, and not being given the chance to remediate myself (what if the police damage other pieces of property on the way and I could avoid the damage if I’m simply made aware), etc. So let’s go back to the meth lab example: do you think it’s okay for the police to show up on your property unannounced in the middle of the night while you’re sleeping to silently shut down the meth lab without notifying you that they’re trespassing and then slap a lock on your basement door behind which you store your emergency cash, medical supplies, prescription drug refills, personal protection equipment, defensive firearms, etc. without leaving the keys or so much as a word? Edit (two more things): 1. It’s possible someone might have been running a copy of the botnet for research purposes, so presumably this copy is not engaged in illicit activity and only installed on lab hardware. I wonder if the FBI’s program considered this scenario. Maybe they only targeted IPs involved in actual DDOS attacks? That’d be cool. 2. You can question something without implying it’s wrong. One can both believe the FBI is acting in a responsible and just way while also being curious how this would play out in court. The fervor in your responses seems slightly out of place considering the comment you’re responding to is simply raising a question.

mandevil 3y ago
Oh hey, look at that, the FBI did get a warrant authorizing this action, and signed off by a United States Magistrate Judge: https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf https://www.justice.gov/d9/2023-08/23mj4244_application_reda... Now, are judges sometimes too easy with warrants? Certainly. But this is definitely not the same as entering your house without a warrant, because the FBI did get a warrant. The warrant involves them promising to a judge under penalty of perjury that the Qakbot Uninstaller they are using makes no further changes and collects no additional data on any of the victim computers they are running on. So, the FBI is aware of your concerns and is taking steps to alleviate them. Does that make you feel better?

airstrike 3y ago

> If someone starts running a meth lab out of your unlocked cellar, at what point do you become culpable for not knowing? The problem with analogies is that they assume they are correctly "analogous" but 9/10 times they really describe an entirely different situation, making them unhelpful if not misleading

ToValueFunfetti 3y ago
The problem with analogies is that people who disagree tend to just say "X is not Y" instead of "X is different from Y in this context due to Z". I'm not sure whether that is just a social behavior or if saying the second thing is especially hard.
- rzzzt 3y ago
  A duck is not a horse due to... it not being a horse. You can macroexpand Z to "not having four legs", etc., but incomparable things will end up being different just based on their very essence.
  - ToValueFunfetti 3y ago
    "Why can't I pull a small wagon with a team of ducks? I can pull a large wagon with a team of horses." Useful answers: Ducks are not as intelligent as horses and aren't as easy to train. There is not a good way to strap a harness onto a duck for this task. Ducks waddle and this introduces turbulence. Ducks have substantially less pulling power. etc. Useless answer: A duck is not a horse because a duck is different from a horse. The person making the analogy knows that it is an analogy; it is not the source of confusion.
- airstrike 3y ago
  It's not especially hard -- the burden of proof just isn't on the listener. Saying "X is not Y" is just saying "I'm not convinced, you must do better with your analogies". With enough context, one can infer as much Letting someone run a meth lab in your cellar is pretty obviously not the same as "letting" some malware run on your box, for crying out loud

hinkley 3y ago

Probably at the moment you try to sue them for taking away your volunteer meth lab.

wutwutwat 3y ago

[dead]

neodymiumphish 3y ago

There's plenty of room for security researchers running infected machines to monitor for behavioral and developmental changes in the malware to be more than a little irritated by the notion that the FBI or anyone else abused the malware servers to remove the infection surreptitiously.