5 ms·

The particulars of the case matter. Describing it as "hacking" is more than a bit misleading.

JohnMakin 2y ago
They were accessing a system via internal endpoints not released to the public. They were also using stolen credentials a former employee of songbird brought over to ticketmaster, and accessed devices using stolen credentials. If that isn't "hacking" then the word has lost all meaning. https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0 https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-mi...
- LikelyABurner 2y ago
  IANAL but this is textbook unauthorized access of a computer as has been drilled into me in every boring corporate training I do for my security work and thus is "hacking". Telling the judge "but I wasn't wearing my black hoodie while listening to K-pop while doing it!" is going to be about as effective as telling the judge the legal code can't be trusted because it's not backed by a CI/CD system adhering to Agile practices. (Which a non-trivial number of Hacker News posters probably think would work.)
- cbsmith 2y ago
  A former employee taking IP with them is usually considered to be IP theft more than hacking, and that's basically what happened.
  - JohnMakin 2y ago
    Two things can be true at once - he stole credentials, and then used those credentials to gain unauthorized access to multiple systems (hacking). As far as credentials being intellectual property, that doesn't sound quite right but I'm not an IP lawyer and it doesn't really matter.
    - cbsmith 2y ago
      Let's put it this way: we wouldn't call it hacking if he had held on to his badge/keys to the building and got the information that way.
      - chimeracoder 2y ago
        > Let's put it this way: we wouldn't call it hacking if he had held on to his badge/keys to the building and got the information that way. If he did that it'd be prosecutable as breaking and entering, and it's perfectly reasonable to use the term "hacking" as the digital counterpart for "breaking and entering". EDIT: It also looks like you work at Ticketmaster, or at least used to? If that's the case, that's a rather weird thing not to mention in the context of this thread.
        cbsmith 2y ago
        To be clear: I agree it was hacking. I'm saying that aside from the IP theft angle, this kind of hacking doesn't usually get heavy handed consequences for individuals. AFAIK, the individual involved was not prosecuted criminally. I used to work at Ticketmaster. I don't anymore and I didn't at the time of the incident, so it didn't seem relevant to the discussion.
      - JohnMakin 2y ago
        Let's put it this way - if he held on to his badge/keys to enter a building and used these credentials to access a computer system without authorization, then yes, it would be called hacking. The word hacking gets thrown around in dumb contexts sometimes, but this is perhaps the clearest use of the word "hacking" I can think of. Like, what would make this hacking to you? The way an attacker gains credentials to access a system does not really matter. If he socially engineered these credentials, it'd still be hacking.
        cbsmith 2y ago
        Let's put it this way: before there were even laws against hacking, if you had a key you shouldn't have and you used to get into a building and steal some IP, if you were charged, it would be with trespass or breaking & entering, not hacking. The term is appropriate, but it tends to evoke ideas of serious crimes, when hacking can be much more innocuous acts that often don't see much in the way of prosecution.
finack 2y ago
No they don't. Rules for companies and individuals are different in this country, unless you possess some secret to getting away with potentially ruining the lives of 1.5 times the population of the United States with the financial equivalent of a slap on the wrist.
- cbsmith 2y ago
  That hack impacted 1.5 times the population of the United States? I think you're conflating events.
chimeracoder 2y ago
> The particulars of the case matter. Describing it as "hacking" is more than a bit misleading. People have been prosecuted and convicted under the CFAA for significantly less. The CFAA is a terribly abused law, but that is a fair use of the word "hacking".
- cbsmith 2y ago
  If he'd kept a key or badge and got the information that way, no one would call it hacking.
  - chimeracoder 2y ago
    > If he'd kept a key or badge and got the information that way, no one would call it hacking. No, they'd have called it breaking and entering. I don't know what point you think you're making.
    - cbsmith 2y ago
      No, they'd have called it trespassing. That's the point I think I'm making.
      - chimeracoder 2y ago
        > No, they'd have called it trespassing. That's the point I think I'm making. No, if someone retains a key to a location after their legal authorization to access the location has been rescinded, and then uses it to access that physical location, that is breaking and entering. Regardless, "if they committed this crime with physical means instead of digitally, there would be a different criminal charge and a different word for it" is a point that is not particularly insightful, relevant, or interesting to discuss.
        cbsmith 2y ago
        Breaking and entering requires the use of force. Absent that, it is trespass. The claim was that individuals suffer bigger consequences than people. The person involved was not fined $10 million. AFAIK, they were not prosecuted criminally.

They were accessing a system via internal endpoints not released to the public. They were also using stolen credentials a former employee of songbird brought over to ticketmaster, and accessed devices using stolen credentials. If that isn't "hacking" then the word has lost all meaning. https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-million-criminal-fine-intrusions-competitor-s-computer-systems-0 https://www.justice.gov/usao-edny/pr/ticketmaster-pays-10-mi...

LikelyABurner 2y ago
IANAL but this is textbook unauthorized access of a computer as has been drilled into me in every boring corporate training I do for my security work and thus is "hacking". Telling the judge "but I wasn't wearing my black hoodie while listening to K-pop while doing it!" is going to be about as effective as telling the judge the legal code can't be trusted because it's not backed by a CI/CD system adhering to Agile practices. (Which a non-trivial number of Hacker News posters probably think would work.)
cbsmith 2y ago
A former employee taking IP with them is usually considered to be IP theft more than hacking, and that's basically what happened.
- JohnMakin 2y ago
  Two things can be true at once - he stole credentials, and then used those credentials to gain unauthorized access to multiple systems (hacking). As far as credentials being intellectual property, that doesn't sound quite right but I'm not an IP lawyer and it doesn't really matter.
  - cbsmith 2y ago
    Let's put it this way: we wouldn't call it hacking if he had held on to his badge/keys to the building and got the information that way.
    - chimeracoder 2y ago
      > Let's put it this way: we wouldn't call it hacking if he had held on to his badge/keys to the building and got the information that way. If he did that it'd be prosecutable as breaking and entering, and it's perfectly reasonable to use the term "hacking" as the digital counterpart for "breaking and entering". EDIT: It also looks like you work at Ticketmaster, or at least used to? If that's the case, that's a rather weird thing not to mention in the context of this thread.
      - cbsmith 2y ago
        To be clear: I agree it was hacking. I'm saying that aside from the IP theft angle, this kind of hacking doesn't usually get heavy handed consequences for individuals. AFAIK, the individual involved was not prosecuted criminally. I used to work at Ticketmaster. I don't anymore and I didn't at the time of the incident, so it didn't seem relevant to the discussion.
    - JohnMakin 2y ago
      Let's put it this way - if he held on to his badge/keys to enter a building and used these credentials to access a computer system without authorization, then yes, it would be called hacking. The word hacking gets thrown around in dumb contexts sometimes, but this is perhaps the clearest use of the word "hacking" I can think of. Like, what would make this hacking to you? The way an attacker gains credentials to access a system does not really matter. If he socially engineered these credentials, it'd still be hacking.
      - cbsmith 2y ago
        Let's put it this way: before there were even laws against hacking, if you had a key you shouldn't have and you used to get into a building and steal some IP, if you were charged, it would be with trespass or breaking & entering, not hacking. The term is appropriate, but it tends to evoke ideas of serious crimes, when hacking can be much more innocuous acts that often don't see much in the way of prosecution.

finack 2y ago

No they don't. Rules for companies and individuals are different in this country, unless you possess some secret to getting away with potentially ruining the lives of 1.5 times the population of the United States with the financial equivalent of a slap on the wrist.

cbsmith 2y ago
That hack impacted 1.5 times the population of the United States? I think you're conflating events.

chimeracoder 2y ago

> The particulars of the case matter. Describing it as "hacking" is more than a bit misleading. People have been prosecuted and convicted under the CFAA for significantly less. The CFAA is a terribly abused law, but that is a fair use of the word "hacking".

cbsmith 2y ago
If he'd kept a key or badge and got the information that way, no one would call it hacking.
- chimeracoder 2y ago
  > If he'd kept a key or badge and got the information that way, no one would call it hacking. No, they'd have called it breaking and entering. I don't know what point you think you're making.
  - cbsmith 2y ago
    No, they'd have called it trespassing. That's the point I think I'm making.
    - chimeracoder 2y ago
      > No, they'd have called it trespassing. That's the point I think I'm making. No, if someone retains a key to a location after their legal authorization to access the location has been rescinded, and then uses it to access that physical location, that is breaking and entering. Regardless, "if they committed this crime with physical means instead of digitally, there would be a different criminal charge and a different word for it" is a point that is not particularly insightful, relevant, or interesting to discuss.
      - cbsmith 2y ago
        Breaking and entering requires the use of force. Absent that, it is trespass. The claim was that individuals suffer bigger consequences than people. The person involved was not fined $10 million. AFAIK, they were not prosecuted criminally.