7 ms·

According to what I read in that article, Goodwolf didn’t release the data. The hackers released the data, the city lied about it, Goodwolf went and retrieved t

According to what I read in that article, Goodwolf didn’t release the data. The hackers released the data, the city lied about it, Goodwolf went and retrieved the publicly accessible data and gave it to journalists to prove the city’s lie. Unless that article is seriously mischaracterising what happened, I can’t see how this is anything other than a massive civil liberties infringement by the city, who are just trying to scapegoat this Goodwolf person. All of the damages they are describing were caused by their own negligence.

sillysaurusx 2y ago
Retrieving publicly accessible data and then giving it to anyone else is the problem when the data contains the identities of witnesses for ongoing criminal investigations. I’m really far on the side of hackers here, but I’m having trouble justifying sending any data whatsoever to journalists related to criminal investigations. Even one witness’s name, sent merely to prove that the breach happened, could be enough to cause direct harm to that case if the reporter decided to reveal it. You don’t need to do that to show a reporter that the breach happened. And it’s up to the reporter themselves to prove the breach is real.
- Spivak 2y ago
  And that's why you send the data to reporters. Literally the people whose job it is to handle this correctly. They are the next stop when the city doesn't give you the time of day. He didn't send it to some disreputable news podcaster, they're the primary newspaper for the city.
- dccoolgai 2y ago
  But that "harm" was caused by the City failing to secure the data - not this one person who said "the city failed to secure the data - anyone can get it".
  - sillysaurusx 2y ago
    Intent matters. The city was incompetent, but distributing data about active criminal investigations is malicious, or at least dangerous. And unlike Snowden, he wasn’t trying to expose abuses by sending the documents to reporters. Here’s an example from my own life: I created books3, an AI training dataset of almost 200k books. This was thanks to The Eye, who hosted a copy of Bibliotik, a popular shadow library. But everyone is suing the AI companies themselves for using the training data, even though the original harm was caused by The Eye and Bibliotik. > not this one person who said "the city failed to secure the data - anyone can get it". If he simply said that, there wouldn’t have been a problem. He sent actual data related to ongoing criminal investigations, and was on the record saying he might set up a website to more widely disseminate information about that data — which could include names of witnesses in those investigations.
    - throw10920 2y ago
      > And unlike Snowden, he wasn’t trying to expose abuses by sending the documents to reporters. Snowden was, according to all available evidence, not trying to expose abuses. He was trying to commit espionage against the US, and it's extremely clear to anyone who has passing experience with the leaks and a shred of intellectual honesty, because the vast majority of the files were completely unrelated to domestic surveillance programs, and instead concerned foreign surveillance programs. Stop bringing up Snowden; all of the evidence indicates that he was lying about his motive.
      - ToValueFunfetti 2y ago
        It's a bit surprising that he would choose to disseminate his espionage via uncovering mass secret state surveillence and sending documents to a third party so they could publish them. I am not in espionage, but I expect there are considerably easier and more reliable ways to exfiltrate data. I don't think it is as surprising that he took more files than he should have.
        throw10920 2y ago
        He has also shown narcissistic tendencies, which is consistent with the US government's statements that he did this for publicity and personal recognition/profit. Sorry, when I say "espionage", I mean in the more general sense of dealing damage to the government, not specifically sending the documents to Russia or whatever. There's not a lot of evidence for him being a Russian spy. > I don't think it is as surprising that he took more files than he should have. It's extremely surprising if he claims to have been acting in the public's interest by uncovering domestic spying programs and then over 90 percent of the files he took were completely unrelated to that stated goal. That's a very strong indicator of dishonesty.
  - sigseg1v 2y ago
    Try telling the police that it's ok that you distributed drugs because it's actually them that failed to secure them against criminals and let me know how that goes.
- nick238 2y ago
  I mean, if the city keeps saying, "no, there wasn't any data released", then maybe backs up and says "there wasn't any sensitive data released", and keeps backing up, at some point you need to cut to the chase and be like, "OK, here's the most salacious shit possible. Explain that." I don't know how to do that responsibly (just share it with a reputable reporter?), but I definitely get the feeling if you're constantly subjected to bad faith.
  - sillysaurusx 2y ago
    Oh, I agree. But let the reporters do that. It’s their job. Just point them towards the data and they’ll do the rest. If someone’s butt is going to be on the line, it should be a corporation’s (the news agency), or perhaps an individual investigative journalist. Not you. Not for something like this, anyway. If it was just social security numbers I might agree with you, but police databases are obviously dangerous to disseminate, even if it’s just to prove they exist. He could’ve sent redacted screenshots. Point being, we don’t know what he sent, but sending anything at all from a police database is a bad idea. No lawyer would ever say that that’s legal, let alone ethical.
    - rolph 2y ago
      i think i get it. you are in danger but you dont need to know that, its not your job to protect yourself, thats our job.
- AmericanChopper 2y ago
  The people who compromised and published the data (and the people who allowed them to do that) are responsible for 100% of the harm caused here. Once the data has been published, the harm is already done, and from a legal perspective any questions about accessing it and further communicating it are protected by 1A. By the time Goodwolf got to the data, it had already been compromised and published. The only way he could have possibly contributed to the harm was by drawing attention to it. If you take that perspective, then the city has further contributed to that harm themselves by taking legal action against Goodwolf. Furthermore, you could also conclude from this argument that the city had some moral responsibility to lie to the public about the nature of the breach, and that all those who knew the truth would also have the moral responsibility to protect that lie. I would say this is an incredibly perverse position to take. All of the data compromised in this breach was already published, and in the hands of criminals. For anybody whose data was included in this breach, the city lying about it was just putting them in further jeopardy. Now they will at least have the opportunity to learn about the breach. The journalists are hardly likely to abuse it. The only legitimate harm caused by Goodwolf was to harm the integrity of the lying city officials. They deserve that harm, and the other side of that coin is that the public benefits when corruption is exposed.
- rockskon 2y ago
  Unless I'm mistaken, the city lied about the data existing in a form unusable to the hackers. That lie is, itself, giving a false sense of security to witnesses for ongoing criminal investigations. Witnesses whose data is data is accessible on a website primarily (though not exclusively) accessed by criminals. As is described in the article, this is one of the best cases of responsible disclosure I can think of in recent memory - refuting a government lie that put at-risk people's lives in danger.
  - kabdib 2y ago
    It looks fractally terrible, but: > "This is not about speech. It's not. It's about the actual action of > going on the keyboard, going into the dark web, gathering the information, > downloading it to your computer and then disseminating it to people > who are in the press or otherwise," Klein said. ... sounds a lot like free expression (especially when the city is lying)
  - t_sawyer 2y ago
    You are correct. The Mayor of the city said the data stolen was either encrypted or corrupted and unusable. The mayor also refused to confirm something had taken place for weeks. I’ve been following this since early August because I grew up in Columbus and still have family there. Ginther is a terrible mayor and has handled this mess about as poorly as you can. The researcher they’re trying to quiet exposed that Ginther was lying about the data being unusable.
- zadokshi 2y ago
  Reputable news organisations are only reputable because of the effort made to verify all the claims before publishing. They would need to see examples of the range of types of documents claimed to be in there.

sillysaurusx 2y ago

Retrieving publicly accessible data and then giving it to anyone else is the problem when the data contains the identities of witnesses for ongoing criminal investigations. I’m really far on the side of hackers here, but I’m having trouble justifying sending any data whatsoever to journalists related to criminal investigations. Even one witness’s name, sent merely to prove that the breach happened, could be enough to cause direct harm to that case if the reporter decided to reveal it. You don’t need to do that to show a reporter that the breach happened. And it’s up to the reporter themselves to prove the breach is real.

Spivak 2y ago
And that's why you send the data to reporters. Literally the people whose job it is to handle this correctly. They are the next stop when the city doesn't give you the time of day. He didn't send it to some disreputable news podcaster, they're the primary newspaper for the city.
dccoolgai 2y ago
But that "harm" was caused by the City failing to secure the data - not this one person who said "the city failed to secure the data - anyone can get it".
- sillysaurusx 2y ago
  Intent matters. The city was incompetent, but distributing data about active criminal investigations is malicious, or at least dangerous. And unlike Snowden, he wasn’t trying to expose abuses by sending the documents to reporters. Here’s an example from my own life: I created books3, an AI training dataset of almost 200k books. This was thanks to The Eye, who hosted a copy of Bibliotik, a popular shadow library. But everyone is suing the AI companies themselves for using the training data, even though the original harm was caused by The Eye and Bibliotik. > not this one person who said "the city failed to secure the data - anyone can get it". If he simply said that, there wouldn’t have been a problem. He sent actual data related to ongoing criminal investigations, and was on the record saying he might set up a website to more widely disseminate information about that data — which could include names of witnesses in those investigations.
  - throw10920 2y ago
    > And unlike Snowden, he wasn’t trying to expose abuses by sending the documents to reporters. Snowden was, according to all available evidence, not trying to expose abuses. He was trying to commit espionage against the US, and it's extremely clear to anyone who has passing experience with the leaks and a shred of intellectual honesty, because the vast majority of the files were completely unrelated to domestic surveillance programs, and instead concerned foreign surveillance programs. Stop bringing up Snowden; all of the evidence indicates that he was lying about his motive.
    - ToValueFunfetti 2y ago
      It's a bit surprising that he would choose to disseminate his espionage via uncovering mass secret state surveillence and sending documents to a third party so they could publish them. I am not in espionage, but I expect there are considerably easier and more reliable ways to exfiltrate data. I don't think it is as surprising that he took more files than he should have.
      - throw10920 2y ago
        He has also shown narcissistic tendencies, which is consistent with the US government's statements that he did this for publicity and personal recognition/profit. Sorry, when I say "espionage", I mean in the more general sense of dealing damage to the government, not specifically sending the documents to Russia or whatever. There's not a lot of evidence for him being a Russian spy. > I don't think it is as surprising that he took more files than he should have. It's extremely surprising if he claims to have been acting in the public's interest by uncovering domestic spying programs and then over 90 percent of the files he took were completely unrelated to that stated goal. That's a very strong indicator of dishonesty.
- sigseg1v 2y ago
  Try telling the police that it's ok that you distributed drugs because it's actually them that failed to secure them against criminals and let me know how that goes.
nick238 2y ago
I mean, if the city keeps saying, "no, there wasn't any data released", then maybe backs up and says "there wasn't any sensitive data released", and keeps backing up, at some point you need to cut to the chase and be like, "OK, here's the most salacious shit possible. Explain that." I don't know how to do that responsibly (just share it with a reputable reporter?), but I definitely get the feeling if you're constantly subjected to bad faith.
- sillysaurusx 2y ago
  Oh, I agree. But let the reporters do that. It’s their job. Just point them towards the data and they’ll do the rest. If someone’s butt is going to be on the line, it should be a corporation’s (the news agency), or perhaps an individual investigative journalist. Not you. Not for something like this, anyway. If it was just social security numbers I might agree with you, but police databases are obviously dangerous to disseminate, even if it’s just to prove they exist. He could’ve sent redacted screenshots. Point being, we don’t know what he sent, but sending anything at all from a police database is a bad idea. No lawyer would ever say that that’s legal, let alone ethical.
  - rolph 2y ago
    i think i get it. you are in danger but you dont need to know that, its not your job to protect yourself, thats our job.
AmericanChopper 2y ago
The people who compromised and published the data (and the people who allowed them to do that) are responsible for 100% of the harm caused here. Once the data has been published, the harm is already done, and from a legal perspective any questions about accessing it and further communicating it are protected by 1A. By the time Goodwolf got to the data, it had already been compromised and published. The only way he could have possibly contributed to the harm was by drawing attention to it. If you take that perspective, then the city has further contributed to that harm themselves by taking legal action against Goodwolf. Furthermore, you could also conclude from this argument that the city had some moral responsibility to lie to the public about the nature of the breach, and that all those who knew the truth would also have the moral responsibility to protect that lie. I would say this is an incredibly perverse position to take. All of the data compromised in this breach was already published, and in the hands of criminals. For anybody whose data was included in this breach, the city lying about it was just putting them in further jeopardy. Now they will at least have the opportunity to learn about the breach. The journalists are hardly likely to abuse it. The only legitimate harm caused by Goodwolf was to harm the integrity of the lying city officials. They deserve that harm, and the other side of that coin is that the public benefits when corruption is exposed.
rockskon 2y ago
Unless I'm mistaken, the city lied about the data existing in a form unusable to the hackers. That lie is, itself, giving a false sense of security to witnesses for ongoing criminal investigations. Witnesses whose data is data is accessible on a website primarily (though not exclusively) accessed by criminals. As is described in the article, this is one of the best cases of responsible disclosure I can think of in recent memory - refuting a government lie that put at-risk people's lives in danger.
- kabdib 2y ago
  It looks fractally terrible, but: > "This is not about speech. It's not. It's about the actual action of > going on the keyboard, going into the dark web, gathering the information, > downloading it to your computer and then disseminating it to people > who are in the press or otherwise," Klein said. ... sounds a lot like free expression (especially when the city is lying)
- t_sawyer 2y ago
  You are correct. The Mayor of the city said the data stolen was either encrypted or corrupted and unusable. The mayor also refused to confirm something had taken place for weeks. I’ve been following this since early August because I grew up in Columbus and still have family there. Ginther is a terrible mayor and has handled this mess about as poorly as you can. The researcher they’re trying to quiet exposed that Ginther was lying about the data being unusable.
zadokshi 2y ago
Reputable news organisations are only reputable because of the effort made to verify all the claims before publishing. They would need to see examples of the range of types of documents claimed to be in there.