3 ms·

Sorry but you’re wrong. In the eyes of the law this is very clear cut. Morally is another question of course.

by HL33tibCe7 3y ago

cortesoft 3y ago
Is there no mens rea requirement in Germany?
- hnbad 3y ago
  Mens rea is a factor in the severity of a crime. Also the prosecution argued that mens rea was established by his act of opening the software in a text editor to look for plaintext strings (which they incorrectly described as "decompiling" apparently). It's hard to see his behavior as merely negligent when he knew the server he was connecting to didn't belong to his client (even if he thought it only had his client's data on it) and used credentials he only found by analyzing the software itself. I don't think he had malicious intent but it can easily be called reckless behavior. Remember that he wasn't testing the software for security issues. He was hired by a user of the software to find out why it had undesired behavior (producing too much log output). He discovered the security issue accidentally while already illegimately accessing the software provider's servers. To add to the pile of strained analogies: imagine you have stored things in a self-storage warehouse and the company that runs the place has given you a token fob to hand the receptionist whenever you want to access your stuff. The fob can easily be opened to allow replacing the battery. You decide to open the fob yourself and find a keycode inside of it. Outside business hours you go to the warehouse and enter the keycode yourself because you want to check on your stuff. But once inside you find that all the storage containers are ajar and have no locks and anyone with one of the token fobs could use the keycode printed inside of it to access anyone else's stuff if they visit outside business hours and use the keycode themselves. You can argue you just wanted to access your stuff but by opening the fob (viewing the software file in an editor), noting down the keycode (copying the credentials), visiting outside business hours (opening a manual database connection) and then entering the building to find your storage container (running queries yourself) you have clearly crossed a line even if you didn't intend to access anyone else's stuff. Basically there are two separate things at play here: - The contractor analyzed the software in a primitive way to find a connection string to a server not operated by his client and decided to try it out and go spelunking despite knowing it was operated and owned by a third party. - While doing so he found out that the connection string allowed him to gain access to other customers' data and a lot of end user data he didn't expect to be in that database, which he reported to the software company as a security issue. The software company was clearly negligent and may have run afoul of privacy laws, risking a fine. But the contractor also gained illegal access to a computer system and used that access to go spelunking. The latter is what the court case is about.
from-nibly 3y ago
I understand, but that doesn't mean I don't want to yell into the void about it.
MetaWhirledPeas 3y ago
Sorry, but the law is wrong.
IshKebab 3y ago
Well yeah, I don't think anyone is really arguing that this is stupid on legal grounds.

Sorry but you’re wrong. In the eyes of the law this is very clear cut. Morally is another question of course.

cortesoft 3y ago

Is there no mens rea requirement in Germany?

hnbad 3y ago
Mens rea is a factor in the severity of a crime. Also the prosecution argued that mens rea was established by his act of opening the software in a text editor to look for plaintext strings (which they incorrectly described as "decompiling" apparently). It's hard to see his behavior as merely negligent when he knew the server he was connecting to didn't belong to his client (even if he thought it only had his client's data on it) and used credentials he only found by analyzing the software itself. I don't think he had malicious intent but it can easily be called reckless behavior. Remember that he wasn't testing the software for security issues. He was hired by a user of the software to find out why it had undesired behavior (producing too much log output). He discovered the security issue accidentally while already illegimately accessing the software provider's servers. To add to the pile of strained analogies: imagine you have stored things in a self-storage warehouse and the company that runs the place has given you a token fob to hand the receptionist whenever you want to access your stuff. The fob can easily be opened to allow replacing the battery. You decide to open the fob yourself and find a keycode inside of it. Outside business hours you go to the warehouse and enter the keycode yourself because you want to check on your stuff. But once inside you find that all the storage containers are ajar and have no locks and anyone with one of the token fobs could use the keycode printed inside of it to access anyone else's stuff if they visit outside business hours and use the keycode themselves. You can argue you just wanted to access your stuff but by opening the fob (viewing the software file in an editor), noting down the keycode (copying the credentials), visiting outside business hours (opening a manual database connection) and then entering the building to find your storage container (running queries yourself) you have clearly crossed a line even if you didn't intend to access anyone else's stuff. Basically there are two separate things at play here: - The contractor analyzed the software in a primitive way to find a connection string to a server not operated by his client and decided to try it out and go spelunking despite knowing it was operated and owned by a third party. - While doing so he found out that the connection string allowed him to gain access to other customers' data and a lot of end user data he didn't expect to be in that database, which he reported to the software company as a security issue. The software company was clearly negligent and may have run afoul of privacy laws, risking a fine. But the contractor also gained illegal access to a computer system and used that access to go spelunking. The latter is what the court case is about.

from-nibly 3y ago

I understand, but that doesn't mean I don't want to yell into the void about it.

MetaWhirledPeas 3y ago

Sorry, but the law is wrong.

IshKebab 3y ago

Well yeah, I don't think anyone is really arguing that this is stupid on legal grounds.