4 ms·

Breaking in in a system, whether or not the password was easy to guess, sounds like a crime to me.

by efdee 1y ago

ethbr1 1y ago
It is a crime! But CFAA charges should, and this is the issue a lot of people have with them afaict, have a sliding scale for premeditation though. If I knock on a door, it swings open, and I walk inside and steal something, then imho there should be a lesser maximum charge for possessing burglary tools than if I show up with a lock gun, crowbar, and concrete saw. A lot of the CFAA excesses are maximum penalties from the CFAA being thrown at people using minimally sophisticated / premeditated methods, in addition to charges about the underlying crime. That doesn't seem just or fair. In practice it's turned into an if(computer){increase maximum penalty} clause, solely at the government's discretion.
- efdee 1y ago
  You have a point. But on the other hand you have no idea of what tools the intruder possesses, only (at best!) what they used. I think intent probably matters a lot more than the technicality of how you succeeded.
- JambalayaJimbo 1y ago
  >If I knock on a door, it swings open, and I walk inside and steal something, then imho there should be a lesser maximum charge for possessing burglary tools than if I show up with a lock gun, crowbar, and concrete saw. Why? (I'm not a lawyer...) - shouldn't intent and harm (i.e. the value of the stolen item) be the only relevant details? Now of course its much easier to demonstrate intent if there's a crowbar involved, but once that's already established, it seems irrelevant.
  - ethbr1 1y ago
    Because that's the way most method-specific laws work, at least in the US. There's an underlying result crime (eg causing business harm by destroying a database), then the method by which one chose to do it (eg exceeding authorized access to a computer with the intent to cause harm). The CFAA was originally passed under the erroneous worry that existing laws wouldn't be enforceable against cybercrime, which turned out to generally be false. When you cause damage, there's almost always a law by which someone can sue you for those damages. What there wasn't, and what the CFAA created, were extra penalties for computer crimes and an ability to charge people with computer crimes where there were no damages (eg Aaron Swartz). And why should those things need to exist? Theft is theft. Destruction is destruction. It was an underspecified law, ripe for prosecutor overreach. See: https://www.congress.gov/crs_external_products/R/HTML/R47557.web.html#_Toc135223781 https://www.congress.gov/crs_external_products/R/HTML/R47557... It fit with 'premeditated intent' intensifiers (where penalties escalate if premeditated intent can be proven)... but that wasn't actually how it was written or how it is used. Instead, it's a method-based checkbox that allows prosecutors to tack on additional charges / penalties. If a computer was used to destroy this thing, add X years the sentence.
  - Dylan16807 1y ago
    If you're saying there should only be theft charges either way, that's fine. But if there are burglary tool charges, they should depend on whether you used burglary tools to burgle, not how much theft you did.
  - Strat296 1y ago
    Am a lawyer - You're correct. Intent is key and almost all laws are based around intent or, in legal parlance, "Mens rea" or the guilty mind. That is what separates a legal act from an illegal act: the intention behind it. Suppose you are leaving a store and heading to your car. For whatever reason, the button on your keys unlocks someone else's car that is the exact same make and model as yours. You hop into the car, your key starts the ignition, and you drive off (Yes, this has really happened). That isn't legally theft because you legitimately believed that was your car - aka you didn't intend to take something that wasn't yours. For 98% of laws, in order to be convicted, the government needs to prove you intended to commit the crime. Obviously, I'm oversimplifying what is a very complicated topic you spent two years learning, but that's the gist
NoMoreNicksLeft 1y ago
It does sound like a crime to me too. But was it a password or other credential that was guessed, or was it just some sequential primary key? The latter is not an authorization system, and I do not believe it a crime to do that unless you have specific knowledge that it is likely to cause damage and/or the intent to cause that damage. As far as I am concerned, I am allowed to send any traffic I wish to public-facing hosts, and if they respond with content that the owners would not wish me to see, I have no responsibility to refrain. The only traffic I am not permitted to send are credentials I am not authorized to use (this would include password guessing, because if I manage to guess correctly, I was still not permitted to use it). So which was it?
- efdee 1y ago
  Maybe as far as you are concerned, but not as far as the law is concerned ;-)
  - NoMoreNicksLeft 1y ago
    Well, I guess it's a good thing for me that they're unable to notice or care and in general incompetent. I am still permitted to do this. None of the details of this case give me the impression that they're using CFAA in such a way as to offend my sensibilities. Sounds like he sabotaged a former employer and caused hundreds of thousands in (tort not physical) damages. I guessed the urls for some issuu.com links that aren't available in search, and downloaded the page images to make a pdf. I was never prompted for a password. Arrest me, I'm a notorious hacker.
- ecb_penguin 1y ago
  You are not allowed unauthorized access regardless of how the key works. > I am allowed to send any traffic I wish to public-facing hosts No you're not. Denial of service is a federal crime. > I have no responsibility to refrain Yes you do, and this is just beyond silly. The nuance of how you obtained it will be decided in a court. Stop making everything so reductionist and lazy. > The only traffic I am not permitted to send are credentials I am not authorized to use Absolutely not. Use of a vulnerability to cause a data breach is OBVIOUSLY a federal crime. This is beyond absurd.

Breaking in in a system, whether or not the password was easy to guess, sounds like a crime to me.

by efdee 1y ago

Breaking in in a system, whether or not the password was easy to guess, sounds like a crime to me.

It is a crime! But CFAA charges should, and this is the issue a lot of people have with them afaict, have a sliding scale for premeditation though. If I knock on a door, it swings open, and I walk inside and steal something, then imho there should be a lesser maximum charge for possessing burglary tools than if I show up with a lock gun, crowbar, and concrete saw. A lot of the CFAA excesses are maximum penalties from the CFAA being thrown at people using minimally sophisticated / premeditated methods, in addition to charges about the underlying crime. That doesn't seem just or fair. In practice it's turned into an if(computer){increase maximum penalty} clause, solely at the government's discretion.

efdee 1y ago
You have a point. But on the other hand you have no idea of what tools the intruder possesses, only (at best!) what they used. I think intent probably matters a lot more than the technicality of how you succeeded.
JambalayaJimbo 1y ago
>If I knock on a door, it swings open, and I walk inside and steal something, then imho there should be a lesser maximum charge for possessing burglary tools than if I show up with a lock gun, crowbar, and concrete saw. Why? (I'm not a lawyer...) - shouldn't intent and harm (i.e. the value of the stolen item) be the only relevant details? Now of course its much easier to demonstrate intent if there's a crowbar involved, but once that's already established, it seems irrelevant.
- ethbr1 1y ago
  Because that's the way most method-specific laws work, at least in the US. There's an underlying result crime (eg causing business harm by destroying a database), then the method by which one chose to do it (eg exceeding authorized access to a computer with the intent to cause harm). The CFAA was originally passed under the erroneous worry that existing laws wouldn't be enforceable against cybercrime, which turned out to generally be false. When you cause damage, there's almost always a law by which someone can sue you for those damages. What there wasn't, and what the CFAA created, were extra penalties for computer crimes and an ability to charge people with computer crimes where there were no damages (eg Aaron Swartz). And why should those things need to exist? Theft is theft. Destruction is destruction. It was an underspecified law, ripe for prosecutor overreach. See: https://www.congress.gov/crs_external_products/R/HTML/R47557.web.html#_Toc135223781 https://www.congress.gov/crs_external_products/R/HTML/R47557... It fit with 'premeditated intent' intensifiers (where penalties escalate if premeditated intent can be proven)... but that wasn't actually how it was written or how it is used. Instead, it's a method-based checkbox that allows prosecutors to tack on additional charges / penalties. If a computer was used to destroy this thing, add X years the sentence.
- Dylan16807 1y ago
  If you're saying there should only be theft charges either way, that's fine. But if there are burglary tool charges, they should depend on whether you used burglary tools to burgle, not how much theft you did.
- Strat296 1y ago
  Am a lawyer - You're correct. Intent is key and almost all laws are based around intent or, in legal parlance, "Mens rea" or the guilty mind. That is what separates a legal act from an illegal act: the intention behind it. Suppose you are leaving a store and heading to your car. For whatever reason, the button on your keys unlocks someone else's car that is the exact same make and model as yours. You hop into the car, your key starts the ignition, and you drive off (Yes, this has really happened). That isn't legally theft because you legitimately believed that was your car - aka you didn't intend to take something that wasn't yours. For 98% of laws, in order to be convicted, the government needs to prove you intended to commit the crime. Obviously, I'm oversimplifying what is a very complicated topic you spent two years learning, but that's the gist

NoMoreNicksLeft 1y ago

It does sound like a crime to me too. But was it a password or other credential that was guessed, or was it just some sequential primary key? The latter is not an authorization system, and I do not believe it a crime to do that unless you have specific knowledge that it is likely to cause damage and/or the intent to cause that damage. As far as I am concerned, I am allowed to send any traffic I wish to public-facing hosts, and if they respond with content that the owners would not wish me to see, I have no responsibility to refrain. The only traffic I am not permitted to send are credentials I am not authorized to use (this would include password guessing, because if I manage to guess correctly, I was still not permitted to use it). So which was it?

efdee 1y ago
Maybe as far as you are concerned, but not as far as the law is concerned ;-)
- NoMoreNicksLeft 1y ago
  Well, I guess it's a good thing for me that they're unable to notice or care and in general incompetent. I am still permitted to do this. None of the details of this case give me the impression that they're using CFAA in such a way as to offend my sensibilities. Sounds like he sabotaged a former employer and caused hundreds of thousands in (tort not physical) damages. I guessed the urls for some issuu.com links that aren't available in search, and downloaded the page images to make a pdf. I was never prompted for a password. Arrest me, I'm a notorious hacker.
ecb_penguin 1y ago
You are not allowed unauthorized access regardless of how the key works. > I am allowed to send any traffic I wish to public-facing hosts No you're not. Denial of service is a federal crime. > I have no responsibility to refrain Yes you do, and this is just beyond silly. The nuance of how you obtained it will be decided in a court. Stop making everything so reductionist and lazy. > The only traffic I am not permitted to send are credentials I am not authorized to use Absolutely not. Use of a vulnerability to cause a data breach is OBVIOUSLY a federal crime. This is beyond absurd.