2 ms·

CFAA covers this. Its a crime to > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentio

CFAA covers this. Its a crime to > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; Where one of the definitions of “protected computer” is one that is used in interstate commerce, which covers effectively all of them.

pbhjpbhj 3y ago
It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se? The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission. Seems weak, unless you know of some precedent case(s)?
- whartung 3y ago
  The back door is damage. The resulting sshd is like a door with a broken lock. This patch breaks the lock. Transmitting the patch caused intentional damage.
- semiquaver 3y ago
  The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library). You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have zero trouble convicting on these facts.
  - refulgentis 3y ago
    Hello fellow "law isn't code" traveller. (my least favorite engineer habit!)
- refulgentis 3y ago
  Law isn't code. If someone finds precedent, there will be a way to argue it doesn't cover this specific scenario. They call this conversational process "hypos" in law school, and this fundamental truth is why you never hear of a lawyer being stumped as to how to defend a client. Ultimately, the CFAA will get it done if it gets that far, armchair lawyering aside. To pressure test this fully, since this can be caricatured as "we can punish degenerate behavior as needed", which isn't necessarily great: it's also why there's a thin line between a authoritarian puppet judiciary and a fair one.

pbhjpbhj 3y ago

It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se? The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission. Seems weak, unless you know of some precedent case(s)?

whartung 3y ago
The back door is damage. The resulting sshd is like a door with a broken lock. This patch breaks the lock. Transmitting the patch caused intentional damage.
semiquaver 3y ago
The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library). You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have zero trouble convicting on these facts.
- refulgentis 3y ago
  Hello fellow "law isn't code" traveller. (my least favorite engineer habit!)
refulgentis 3y ago
Law isn't code. If someone finds precedent, there will be a way to argue it doesn't cover this specific scenario. They call this conversational process "hypos" in law school, and this fundamental truth is why you never hear of a lawyer being stumped as to how to defend a client. Ultimately, the CFAA will get it done if it gets that far, armchair lawyering aside. To pressure test this fully, since this can be caricatured as "we can punish degenerate behavior as needed", which isn't necessarily great: it's also why there's a thin line between a authoritarian puppet judiciary and a fair one.