3 ms·

> this kid is incredibly destructive Incredibly? There are many kids that age who murder and commit other serious felonies.

dghlsakjg 3y ago
Hundreds of thousands of man hours have been spent at the companies he hacked and in the justice system on his behalf. If you were the one whose crypto account he cleared out, or one of the people responsible for cleaning up after him, or even one of the lawyers trying to defend some idiot who tells the court he plans on committing more crimes as soon as he is released you might feel different. Do you think any of these people wanted to spend their time on this, that otherwise important things weren't delayed and sidelined? Do you think that the people he stole crypto enjoy having to work extra hours to make up for what he stole? His crimes weren't victimless, and plenty of real people were impacted in serious ways. This wasn't some kid who pushed his computer skills a little too far and went somewhere he shouldn't. He engaged in an international conspiracy to extort millions using stolen data. There are kids that age who commit murder and other serious crimes, and they should face consequences just like he is. But the grand majority of kids that age get through life without committing any serious crime at all.
- cf1241290841 3y ago
  From an IT security perspective this sounds detached from reality to me. If one kid can do this to your organization, someone isnt doing their job. Given economic competitors, hostile nation state actors and the possible stock market impacts, this isnt a matter of people having had better things to do. They had this to do and they didnt. The resulting extra cost is how you get your company to fix these things. Yes its hard, no it doesnt mean you get to ignore it because police will handle it. Not a moral argument but a very practical one. If somebody like that manages to find a hole in your process big enough to exploit yet dumb enough to get caught you should feel really lucky that nothing worse happened (that you know of) with the hole you just got notified you had all along.
  - dghlsakjg 3y ago
    It wasn’t one kid. It was an international group of at least three people (known so far), and likely more. Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
    - cf1241290841 3y ago
      >It was an international group of at least three people (known so far), and likely more. I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers. >But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society. I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable. While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that. Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.
- wolverine876 3y ago
  First, > some idiot He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults. On the scale of things, what you describe is not "incredibly destructive". Many, many people have done worse (many legally). It's a crime (I never said otherwise) but not a big deal relative to very many other crimes - Rockstar didn't face any material danger; the justice system has lots and lots of cases going through it. I'd be more concerned if he was committing serious violent felonies. > you might feel different I'm pretty confident I'd feel exactly the same. > Hundreds of thousands of man hours What is that based on? > international conspiracy All the hyperbole undermines your point, imho.
  - dghlsakjg 3y ago
    > He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults. Granted. I was speaking more to the general frustration of defense lawyers who have clients that say things when they should have said nothing. > Hundreds of thousands of man hours - What is that based on? A guess from years of working for large tech corporations. A company level crisis of this magnitude sucks in a lot of people from a lot of departments. Add in all the other time spent by investigators and the courts, and I don't think I'm overestimating at all. Now multiply that times the 11 major breaches he was part of. > international conspiracy - All the hyperbole undermines your point, imho. Arrests were made in Brazil and the UK. Organizations from at least six countries were attacked. They attempted to extort millions from multiple companies. Personal data from 300k people in Argentina was released. They took down the site for COVID vaccination records in Brazil. Rockstar was the 11th attack and one of the less harmful ones, I'm not sure why people are so focused on that one. What about the leaked personal info, what about the impacts to Brazilian health ministry and Brazilian citizens? These weren't explorers just getting in to see if they could. They got in, pillaged data, and followed up with more crimes. They certainly conspired, and it was certainly international. I'm not saying that this is the most heinous crime an 18 year old can commit, and I never did. I am simply saying that this was more harmful than a lot of people think, and if it was mental illness that caused him to do it, then it is pretty reasonable for the court to say that he wont be criminally liable, but that he is required to get help before he is trusted to be out in the world again.

dghlsakjg 3y ago

Hundreds of thousands of man hours have been spent at the companies he hacked and in the justice system on his behalf. If you were the one whose crypto account he cleared out, or one of the people responsible for cleaning up after him, or even one of the lawyers trying to defend some idiot who tells the court he plans on committing more crimes as soon as he is released you might feel different. Do you think any of these people wanted to spend their time on this, that otherwise important things weren't delayed and sidelined? Do you think that the people he stole crypto enjoy having to work extra hours to make up for what he stole? His crimes weren't victimless, and plenty of real people were impacted in serious ways. This wasn't some kid who pushed his computer skills a little too far and went somewhere he shouldn't. He engaged in an international conspiracy to extort millions using stolen data. There are kids that age who commit murder and other serious crimes, and they should face consequences just like he is. But the grand majority of kids that age get through life without committing any serious crime at all.

cf1241290841 3y ago
From an IT security perspective this sounds detached from reality to me. If one kid can do this to your organization, someone isnt doing their job. Given economic competitors, hostile nation state actors and the possible stock market impacts, this isnt a matter of people having had better things to do. They had this to do and they didnt. The resulting extra cost is how you get your company to fix these things. Yes its hard, no it doesnt mean you get to ignore it because police will handle it. Not a moral argument but a very practical one. If somebody like that manages to find a hole in your process big enough to exploit yet dumb enough to get caught you should feel really lucky that nothing worse happened (that you know of) with the hole you just got notified you had all along.
- dghlsakjg 3y ago
  It wasn’t one kid. It was an international group of at least three people (known so far), and likely more. Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
  - cf1241290841 3y ago
    >It was an international group of at least three people (known so far), and likely more. I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers. >But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society. I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable. While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that. Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.
wolverine876 3y ago
First, > some idiot He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults. On the scale of things, what you describe is not "incredibly destructive". Many, many people have done worse (many legally). It's a crime (I never said otherwise) but not a big deal relative to very many other crimes - Rockstar didn't face any material danger; the justice system has lots and lots of cases going through it. I'd be more concerned if he was committing serious violent felonies. > you might feel different I'm pretty confident I'd feel exactly the same. > Hundreds of thousands of man hours What is that based on? > international conspiracy All the hyperbole undermines your point, imho.
- dghlsakjg 3y ago
  > He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults. Granted. I was speaking more to the general frustration of defense lawyers who have clients that say things when they should have said nothing. > Hundreds of thousands of man hours - What is that based on? A guess from years of working for large tech corporations. A company level crisis of this magnitude sucks in a lot of people from a lot of departments. Add in all the other time spent by investigators and the courts, and I don't think I'm overestimating at all. Now multiply that times the 11 major breaches he was part of. > international conspiracy - All the hyperbole undermines your point, imho. Arrests were made in Brazil and the UK. Organizations from at least six countries were attacked. They attempted to extort millions from multiple companies. Personal data from 300k people in Argentina was released. They took down the site for COVID vaccination records in Brazil. Rockstar was the 11th attack and one of the less harmful ones, I'm not sure why people are so focused on that one. What about the leaked personal info, what about the impacts to Brazilian health ministry and Brazilian citizens? These weren't explorers just getting in to see if they could. They got in, pillaged data, and followed up with more crimes. They certainly conspired, and it was certainly international. I'm not saying that this is the most heinous crime an 18 year old can commit, and I never did. I am simply saying that this was more harmful than a lot of people think, and if it was mental illness that caused him to do it, then it is pretty reasonable for the court to say that he wont be criminally liable, but that he is required to get help before he is trusted to be out in the world again.