4 ms·

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find

Agreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.

stephc_int13 3y ago
It is like opening the door of a safe and letting someone else rob the money inside. This is way beyond "moral level".
fragmede 3y ago
CFAA covers distribution of malicious software without the owners consent, the Wire Fraud Act covers malware distribution schemes intended to defraud for property, Computer Misuse act in the UK is broad and far reaching like the CFAA, so this likely fall afoul of that. The GDPR protects personal data, so there's possibly a case that could be made that this violates that as well, though that might be a bit of reach.
- javajosh 3y ago
  In which case the defense will claim, correctly, that this malware was never distributed. It was caught. "Attempted malware distribution" may not actually be a crime (but IANAL so I don't know).
  - timschmidt 3y ago
    Folks who run Debian SID or Fedora testing may disagree.
  - deleted 3y ago
    [deleted]
ndriscoll 3y ago
If more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).
- sneak 3y ago
  The criminal conspiracy laws don’t apply to the organizations that write this kind of code, just like murder laws don’t.
  - ceejayoz 3y ago
    Sure they do. Getting the perpetrator into your jurisdiction is the tough part. Putin is, for example, unlikely to go anywhere willing to execute an ICC arrest warrant.
    - sneak 3y ago
      Nah, the CIA assassinates people in MLAT zones all the time. The laws that apply to you and I don’t apply to the privileged operators of the state’s prerogatives. We don’t even know that this specific backdoor wasn’t the NSA or CIA. Assuming it was a foreign intelligence service because the fake name was asian-sounding is a bit silly. The people who wrote this code might be sitting in Virginia or Maryland already.
      - ceejayoz 3y ago
        > The people who wrote this code might be sitting in Virginia or Maryland already. Sure, that’s possible. They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.
        rl3 3y ago
        >They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport. First of all, it's not like their individual identities would ever be known. Second, they would already know that traveling to a hostile country is a great way to catch bullshit espionage charges, maybe end up tortured, and certainly be used as a political pawn. Third, this is too sloppy to have originated from there anyways—however clever it was.
deleted 3y ago
[deleted]
semiquaver 3y ago
CFAA covers this. Its a crime to > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; Where one of the definitions of “protected computer” is one that is used in interstate commerce, which covers effectively all of them.
- pbhjpbhj 3y ago
  It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se? The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission. Seems weak, unless you know of some precedent case(s)?
  - whartung 3y ago
    The back door is damage. The resulting sshd is like a door with a broken lock. This patch breaks the lock. Transmitting the patch caused intentional damage.
  - semiquaver 3y ago
    The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library). You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have zero trouble convicting on these facts.
    - refulgentis 3y ago
      Hello fellow "law isn't code" traveller. (my least favorite engineer habit!)
  - refulgentis 3y ago
    Law isn't code. If someone finds precedent, there will be a way to argue it doesn't cover this specific scenario. They call this conversational process "hypos" in law school, and this fundamental truth is why you never hear of a lawyer being stumped as to how to defend a client. Ultimately, the CFAA will get it done if it gets that far, armchair lawyering aside. To pressure test this fully, since this can be caricatured as "we can punish degenerate behavior as needed", which isn't necessarily great: it's also why there's a thin line between a authoritarian puppet judiciary and a fair one.

stephc_int13 3y ago

It is like opening the door of a safe and letting someone else rob the money inside. This is way beyond "moral level".

fragmede 3y ago

CFAA covers distribution of malicious software without the owners consent, the Wire Fraud Act covers malware distribution schemes intended to defraud for property, Computer Misuse act in the UK is broad and far reaching like the CFAA, so this likely fall afoul of that. The GDPR protects personal data, so there's possibly a case that could be made that this violates that as well, though that might be a bit of reach.

javajosh 3y ago
In which case the defense will claim, correctly, that this malware was never distributed. It was caught. "Attempted malware distribution" may not actually be a crime (but IANAL so I don't know).
- timschmidt 3y ago
  Folks who run Debian SID or Fedora testing may disagree.
- deleted 3y ago
  [deleted]

ndriscoll 3y ago

If more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).

sneak 3y ago
The criminal conspiracy laws don’t apply to the organizations that write this kind of code, just like murder laws don’t.
- ceejayoz 3y ago
  Sure they do. Getting the perpetrator into your jurisdiction is the tough part. Putin is, for example, unlikely to go anywhere willing to execute an ICC arrest warrant.
  - sneak 3y ago
    Nah, the CIA assassinates people in MLAT zones all the time. The laws that apply to you and I don’t apply to the privileged operators of the state’s prerogatives. We don’t even know that this specific backdoor wasn’t the NSA or CIA. Assuming it was a foreign intelligence service because the fake name was asian-sounding is a bit silly. The people who wrote this code might be sitting in Virginia or Maryland already.
    - ceejayoz 3y ago
      > The people who wrote this code might be sitting in Virginia or Maryland already. Sure, that’s possible. They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.
      - rl3 3y ago
        >They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport. First of all, it's not like their individual identities would ever be known. Second, they would already know that traveling to a hostile country is a great way to catch bullshit espionage charges, maybe end up tortured, and certainly be used as a political pawn. Third, this is too sloppy to have originated from there anyways—however clever it was.

deleted 3y ago

[deleted]

semiquaver 3y ago

CFAA covers this. Its a crime to > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; Where one of the definitions of “protected computer” is one that is used in interstate commerce, which covers effectively all of them.

pbhjpbhj 3y ago
It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se? The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission. Seems weak, unless you know of some precedent case(s)?
- whartung 3y ago
  The back door is damage. The resulting sshd is like a door with a broken lock. This patch breaks the lock. Transmitting the patch caused intentional damage.
- semiquaver 3y ago
  The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library). You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have zero trouble convicting on these facts.
  - refulgentis 3y ago
    Hello fellow "law isn't code" traveller. (my least favorite engineer habit!)
- refulgentis 3y ago
  Law isn't code. If someone finds precedent, there will be a way to argue it doesn't cover this specific scenario. They call this conversational process "hypos" in law school, and this fundamental truth is why you never hear of a lawyer being stumped as to how to defend a client. Ultimately, the CFAA will get it done if it gets that far, armchair lawyering aside. To pressure test this fully, since this can be caricatured as "we can punish degenerate behavior as needed", which isn't necessarily great: it's also why there's a thin line between a authoritarian puppet judiciary and a fair one.