7 ms·
Weev 'violated' the CFAA for incrementing a GET request, with his overturned conviction only for wrong jurisdiction. So the government has put us in a position
by mothballed 1y ago
Weev 'violated' the CFAA for incrementing a GET request, with his overturned conviction only for wrong jurisdiction. So the government has put us in a position where it's hard to take the CFAA seriously.
We also know from prosecutions in other statutes that the government will often prosecute a a broad crime with many separate sub-definitions of the various way you can break it, then refuse to tell you under which sub-definition you're being charged, meaning you have no way to know if the jury even were unanimously convicting for the same thing and no way to know what you're even defending against.
- ambicapter 1y agoWhat does "incrementing a GET request" mean?
- mothballed 1y agoHe incremented a number in the query string of a get request https://www.w3schools.com/tags/ref_httpmethods.asp https://www.w3schools.com/tags/ref_httpmethods.asp
- JambalayaJimbo 1y agoOkay but what information did he obtain by doing that? If I break into a mistakenly locked police station, surely I cannot use the excuse "I was simply turning a door knob"
- kayge 1y agoAs an example: Take a look at the URL of this page (https://news.ycombinator.com/item?id=45261163 https://news.ycombinator.com/item?id=45261163). Add 1 to that ID value (45261164) in your address bar. Hit Enter, your browser will GET whatever exists at the next ID.
- rirze 1y agoOk, that makes sense but why is this so serious? Is this a grave crime in some context?
- tptacek 1y agoIt's not about the actual HTTP request. Per se unauthorized access is just one predicate in these kinds of cases. It's about what the prosecutors claim you were doing when you made the access.
- ecb_penguin 1y agoBecause people think they are clever and are trying to separate the act from the intent. Unlocked doors, open windows, any lack of security doesn't give you permission to enter. Just as "incrementing a GET request" doesn't mean anything outside of the intent. The intent was to do damage.
- Dylan16807 1y agoHe did have permission to "enter". He was authorized to use the server. His intent of releasing the data was bad (assuming he started with that intent!) but he wasn't committing any fraud when collecting it. He didn't bypass any authentication or damage the server. CFAA is the wrong law to use. If a restaurant puts a bunch of proprietary documents in a dusty corner of the public lobby, you shouldn't browse through them but you're not breaking and entering if you do so. No matter what your intent is.
- VWWHFSfQ 1y agoThe CFAA isn't super complicated. It basically boils down to: Don't fuck with other people's shit if they don't want you to.
- boston_clone 1y agoAre you a lawyer by chance? I seem to remember cases or interpretations of the CFAA in which even guessing the username password combo of "admin:admin" would violate the act, resulting in teenagers or children being caught up in cYbEr FrAuD
- petcat 1y agoIt doesn't matter if you brute forced their crappy login with commonly-used credentials. You think it's OK for someone to rummage around in your garage just because they correctly guessed your keycode was 12345? Of course not.
- boston_clone 1y agoI'm more focused on the assertion that "The CFAA isn't super complicated." Which raises sincere doubts about the commenter's credibility to make such a claim.
- echoangle 1y agoHow does „you’re not allowed to guess credentials“ mean it’s complicated?
- boston_clone 1y agoI think that's a massive oversimplification of how the CFAA has been applied.
- RankingMember 1y agoDoesn't this posture also criminalize white-hat hackers, whose disclosures would protect you from the people who actually want to do damage?
- Aurornis 1y agoThis case has far more than the CFAA violation, though. There were multiple parole violations after the first incident, multiple attempts to evade the parole restrictions on Internet use, discovery of a pedophilia relate search query on his computer, a history of intentional damage to a company’s infrastructure to disrupt their operations, and more. Being angry at the CFAA is one thing, but this case has no relation to modifying a simple GET request.
- akerl_ 1y agoIn this case you have the evidence of what he did and it does in fact look pretty serious.
- tptacek 1y agoAs you probably know, it's everything that happened after they incremented that HTTP request that formed the basis for his charges. Message board discussions tend to want to distill "hacking" CFAA cases down to the specific shell script that ran, but these cases are almost always heavily situational and fact dependent. Interestingly, Rockenhaus's isn't --- it's more or less exactly the circumstance foreseen by the authors of CFAA, who believed that even though existing law covered most hacking-type scenarios, they didn't form a clear basis for felony charges for purely destructive computer abuse.
- aw1621107 1y ago> We also know from prosecutions in other statutes that the government will often prosecute a a broad crime with many separate sub-definitions of the various way you can break it, then refuse to tell you under which sub-definition you're being charged, meaning you have no way to know if the jury even were unanimously convicting for the same thing and no way to know what you're even defending against. Could you give some examples of this?
- mothballed 1y agoYes, https://www.courtlistener.com/docket/63291773/united-states-v-adamiak/ https://www.courtlistener.com/docket/63291773/united-states-.... Navy sailor was convicted of possessing machine guns and destructive devices. The ATF for example put back together de-milled RPGs, which could be a destructive device However the statute says the following: (2) any type of weapon by whatever name known which will, or which may be readily converted to, expel a projectile by the action of an explosive or other propellant, the barrel or barrels of which have a bore of more than one-half inch in diameter, except a shotgun or shotgun shell which the Secretary finds is generally recognized as particularly suitable for sporting purposes; and (3) any combination of parts either designed or intended for use in converting any device into a destructive device as defined in subparagraphs (1) and (2) and from which a destructive device may be readily assembled. The ATF took his demilled RPG, put another gun (owned by the ATF) inside of it, then fired it to prove it had a bore over 0.5 inch capable of expelling projectile. But the state didn't tell him under what definition he was charged, so they didn't know if they were defending against the collection of parts the ATF took (falls under 3), or against the weapon the ATF claimed it was after they put the parts together (which falls under 2).
- aw1621107 1y agoThanks for the reference! For the convenience of anyone else reading, the appeals docket is at https://www.courtlistener.com/docket/67566242/united-states-v-patrick-adamiak/ https://www.courtlistener.com/docket/67566242/united-states-.... Note that there are two appeals briefs; it seems the defendant replaced their attorney at some point during the appeals process. For what it's worth, I think this is the government's response to the argument you raise (on page 22 of the response brief, PDF page 30): > Section 5845, captioned “[d]efinitions,” is a definitional provision, not a criminal prohibition. As relevant here, § 5845(b) defines the term “machinegun,” and § 5845(f) defines the term “destructive device.” These definitions do not create additional elements of the offenses charged under §§ 5861(d) and 922(o). Therefore, the government was not required to charge the applicable definition(s) in the indictment. See, e.g., Robbins, 476 F.2d at 30 (holding that an indictment under § 5861(d) need not refer to the definitions in § 5845 to “fairly notify a defendant of the charge against him”); United States v. Hoover, 635 F. Supp. 3d 1305, 1316 (M.D. Fla. 2022) (rejecting the argument that the government “was required to plead the specific facts supporting its contention that the [firearms] at issue fall within the definition of a machinegun”); cf. United States v. Pennington, 168 F.3d 1060, 1065 (8th Cir. 1999) (“The indictment’s failure to cite [18 U.S.C.] § 1346, a definitional provision, and to use its specific term, ‘honest’ services, does not mean no crime was charged.”). And defendant's response, page 5: > The question is whether the indictment “fully, directly, and expressly, without any uncertainty or ambiguity, set forth all the elements necessary to constitute the offence intended to be punished” and whether the indictment complied “with the necessity of alleging in the indictment all the facts necessary to bring the case” within the intent of the statute. United States v. Carll, 105 U.S. 611 (1881) (emphasis added). The government’s failure to give any specificity in the indictment cannot be remedied by wriggling as to whether the missing information can be considered an “element” or not. Even if the government were correct that the particular definition (or definitions) the prosecution is proceeding under does not change “elements,” it changes the “facts” underlying the scope of the statute. I have no idea who is correct legally, and since oral arguments appear to have been held a few days ago I suppose I'll have to wait to see who is right.
- stockresearcher 1y ago> his overturned conviction only for wrong jurisdiction What are you getting at? If an appeals court says “wrong jurisdiction”, that’s an “rm -rf” on the whole entire case. There’s nothing left to argue about.
- JadeNB 1y ago> > his overturned conviction only for wrong jurisdiction > What are you getting at? > If an appeals court says “wrong jurisdiction”, that’s an “rm -rf” on the whole entire case. There’s nothing left to argue about. I think your parent comment meant something like "the case wasn't overturned on the basis of deficiencies in the legal theory of the crime."
- stockresearcher 1y agoIf it’s in the wrong jurisdiction, the court doesn’t get to the point where they look at the legal theory.
- JadeNB 1y agoRight. I think your parent comment was pointing out that it's not that the legal theory failed, but that it was never tested, and so might (or might not) still be sound.
- torstenvl 1y ago"jurisdiction" literally means "the power to say what the law is" If the court had no jurisdiction, it is not possible for them to rule on "deficiencies in the legal theory of the crime" in that case.
- kemayo 1y agoGenerally this is a good thing to happen, because it's fairly quick and easy to argue you're in the wrong jurisdiction... and if that's the case, it doesn't matter what the legal theory was, since the court couldn't convict you anyway. Perhaps selfishly, I'd rather get out of a trial in the motion to dismiss stage, rather than having to very-expensively argue the merits all the way to the end.
- 1vuio0pswjnm7 1y agoWould the evidence in the Auernheimer case support a CFAA conviction today, after Van Buren (USSC) and HiQ (9th Circuit) The CFAA claim was never decided in HiQ. The chances of success on that claim did not look good and Microsoft settled Even in 2014, 3rd Cir. COA seemed doubtful there was a valid CFAA claim "5 We also note that in order to be guilty of accessing without authorization, or in excess of authorization under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code- or password-based barrier to access. See State v. Riley, 988 A.2d 1252, 1267 (N.J. Super. Ct. Law Div. 2009). Although we need not resolve whether Auernheimers conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published." https://web.archive.org/web/20140513205343if_/http://cdn.arstechnica.net:80/wp-content/uploads/2014/04/weevrulingvacation.pdf https://web.archive.org/web/20140513205343if_/http://cdn.ars...