3 ms·

It's somewhat unclear exactly what was shared and how. The article and the linked article about the data breach itself suggested that Goodwolf downloaded the d

It's somewhat unclear exactly what was shared and how. The article and the linked article about the data breach itself suggested that Goodwolf downloaded the data to verify its contents and then showed the data to a reporter, but he didn't actually release any data, nor distribute it into the permanent possession of the reporter. This is akin to Boeing saying "We had no knowledge of the 737 MAX's problems", and then an employee showing screenshots of confidential memos to the media saying "Yes you did, here is the truth." I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to.

sillysaurusx 2y ago
Sure, but the fact that it’s unclear is exactly what the city is reacting to. The point of the restraining order is that they have a reasonable belief that he might have distributed it to reporters, and he’s on the record saying he might create a website where anyone can see information related to ongoing criminal investigations or witness identities. Note that showing the data to the reporter counts as distribution. He didn’t need to do that to prove to the reporter that the data was out there. Even sending screenshots of the data would’ve been ok if he’d redacted anything remotely confidential (it would be obvious from context that the document is probably legit, and the reporter would dig in further). If he didn’t send any sensitive data to anyone, then I completely agree with you. But pentesters generally don’t send actual data to prove a breach exists to anyone but the target of the breach. Publicizing the breach itself is fine, but the article is pretty clear that’s not why they’re going after him.
- oxygen_crisis 2y ago
  Showing it to a reporter with a reputable news agency shouldn't count as distribution. Reporters and their editors are meant to be the experts on the ethics and legalities of what should be redacted and what level of detail is in the public interest to report. You should be able to fork over everything to a reporter securely and let them defer to their ethics, consult with their lawyers, liaise with law enforcement, etc. to determine what level of disclosure is appropriate.
Spivak 2y ago
> I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to. He still should. The dispatch article has more information, this was data that has already been leaked, there is no means of protecting it anymore. The only thing to do is release it so people know if they've been exposed. https://www.dispatch.com/story/opinion/columns/2024/08/30/columbus-dark-web-connor-goodwolf-randomware-restraining-order-against/75001552007/ https://www.dispatch.com/story/opinion/columns/2024/08/30/co... Like it sucks that this is the best option but you can't make it go away, the data is free.
- DaiPlusPlus 2y ago
  > The only thing to do is release it so people know if they've been exposed. Are we talking about a Troy Hunt-style (haveibeenpwned) website? If so, I don't consider a giant hashset-of-hashes a "release" because if that data (haveibeenpwnd's database) gets leaked it's of zero use to anyone because it doesn't contain any original data anymore. But if you mean Wikileaks-style: put it all in a .rar file and publicise it, maintaining that the-ends-justify-the-means approach despite all the irresponsible-journalism, then absolutely no. Yikes. No.
RIMR 2y ago
>but he didn't actually do that, he only had plans to. You can sue for prior restraint if someone is threatening you.

sillysaurusx 2y ago

Sure, but the fact that it’s unclear is exactly what the city is reacting to. The point of the restraining order is that they have a reasonable belief that he might have distributed it to reporters, and he’s on the record saying he might create a website where anyone can see information related to ongoing criminal investigations or witness identities. Note that showing the data to the reporter counts as distribution. He didn’t need to do that to prove to the reporter that the data was out there. Even sending screenshots of the data would’ve been ok if he’d redacted anything remotely confidential (it would be obvious from context that the document is probably legit, and the reporter would dig in further). If he didn’t send any sensitive data to anyone, then I completely agree with you. But pentesters generally don’t send actual data to prove a breach exists to anyone but the target of the breach. Publicizing the breach itself is fine, but the article is pretty clear that’s not why they’re going after him.

oxygen_crisis 2y ago
Showing it to a reporter with a reputable news agency shouldn't count as distribution. Reporters and their editors are meant to be the experts on the ethics and legalities of what should be redacted and what level of detail is in the public interest to report. You should be able to fork over everything to a reporter securely and let them defer to their ethics, consult with their lawyers, liaise with law enforcement, etc. to determine what level of disclosure is appropriate.

Spivak 2y ago

> I agree that creating a website where you can look up a name and see if they've been part of a police investigation is a bad idea, but he didn't actually do that, he only had plans to. He still should. The dispatch article has more information, this was data that has already been leaked, there is no means of protecting it anymore. The only thing to do is release it so people know if they've been exposed. https://www.dispatch.com/story/opinion/columns/2024/08/30/columbus-dark-web-connor-goodwolf-randomware-restraining-order-against/75001552007/ https://www.dispatch.com/story/opinion/columns/2024/08/30/co... Like it sucks that this is the best option but you can't make it go away, the data is free.

DaiPlusPlus 2y ago
> The only thing to do is release it so people know if they've been exposed. Are we talking about a Troy Hunt-style (haveibeenpwned) website? If so, I don't consider a giant hashset-of-hashes a "release" because if that data (haveibeenpwnd's database) gets leaked it's of zero use to anyone because it doesn't contain any original data anymore. But if you mean Wikileaks-style: put it all in a .rar file and publicise it, maintaining that the-ends-justify-the-means approach despite all the irresponsible-journalism, then absolutely no. Yikes. No.

RIMR 2y ago

>but he didn't actually do that, he only had plans to. You can sue for prior restraint if someone is threatening you.