4 ms·

I believe the specific charge was "Access to financial records or to 'protected systems'". Unlike a blog which is not protected, the AT&T data was behind a log

by rprasad 14y ago

I believe the specific charge was "Access to financial records or to 'protected systems'". Unlike a blog which is not protected, the AT&T data was behind a login system.

tptacek 14y ago
It wasn't behind a login system, and the indictment did IIRC make reference to AT&T's computers meeting the definition of "protected". But they charged fraud and conspiracy.
- ScottBurson 14y ago
  Okay, I'm looking at the indictment. I see lots of IRC conversations about things the defendants, Auernheimer and Spitler, could do with the email addresses they were getting... but no concrete plans to actually do those things. Yes, the downloading of the addresses itself was an overt act, but I see no overt act alleged that specifically reveals fraudulent intent or acts in furtherance of a plan to commit fraud. The only overt acts alleged, other than the downloading itself, were (1) they sent some email messages to some of the victims, and (2) they gave all the email addresses to Gawker. I see nothing in here alleging concrete steps toward extorting the victims, or stealing their bank accounts, or deceiving them in any way, or indeed anything by which they would actually profit. Again, they discussed various possibilities, but I see no evidence here that they actually undertook any of them. I'm sure it didn't help their case that they figured that what they were doing was illegal or at least tortious, and that they attempted to destroy evidence. But the crux of your response to Rob is that they had the intent to commit fraud, and frankly, reading this indictment, I still don't see any evidence of that beyond some IRC banter. There's also, seems to me, an odd circularity to the government's argument. They're alleging conspiracy, and among the overt acts that demonstrate this alleged conspiracy, they include the scraping of the email addresses. But the crime that that overt act is supposedly in furtherance of is... conspiracy. Seems to me this recursion is missing a base case :-) Count 2 of the indictment has a slightly different thrust. Even though it's titled "Fraud in connection with personal information", it references USC 18 § 1028 (a) (7), which says: "Whoever ... knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law [shall be punished, etc.]." What they seem to be saying here is that the ICC-IDs themselves count as a "means of identification" and that the fraud consisted simply of using said IDs to access the AT&T accounts. But this is also circular. The "unlawful activity" is the violation of the CFAA itself. The demonstration that the CFAA was violated rests on the assertion that it was violated. If this indictment reflects the strongest arguments the prosecution has, I must respectfully disagree with this jury.
  - vidarh 14y ago
    > But the crux of your response to Rob is that they had the intent to commit fraud No, the crux of his response is that the government alleged fraud, and so using the case to claim that just accessing a site is a federal crime is at best hyperbole. Whether or not the allegation of intent to commit fraud is accurate or not is not relevant fo that argument.
    - ScottBurson 14y ago
      I don't quite agree. While the (relevant clause of the) statue does indeed require the intent to commit fraud, arguably a bit of sophistry by the prosecutors allowed them to sidestep the intent of that requirement in this case. If the law is written and interpreted in such a way as to make that possible, I think it's fair to say there's a problem with the law.
      - tptacek 14y ago
        It's a little of both, right? They charged conspiracy and fraud. The conspiracy charge was indeed rooted in 1030(a)(2), which is the hotbutton issue on this thread. I think one thing that is happening here is that we're getting our wires crossed between Rob's post, which says you've committed a crime by reading his blog but that's OK because he committed a crime by sending you Javascript and that post is simply incorrect, and the Auernheimer case from yesterday which is not nearly as cut and dry. Rob is wrong. But even I think the Auernheimer result is shady; I think "unauthorized access" should be cut and dry (if you know you're not supposed to do something with someone else's computer system and you do it anyways, that's unauthorized access), but the conspiracy charge is shady, the allegation of fraud is extremely shady (they were spitballing about the impact of what they found, not planning an elaborate fraud), and using 1030(a)(2) + conspiracy to avoid confronting those issues is also shady.
- deleted 14y ago
  [deleted]

by rprasad 14y ago

I believe the specific charge was "Access to financial records or to 'protected systems'". Unlike a blog which is not protected, the AT&T data was behind a login system.

tptacek 14y ago

It wasn't behind a login system, and the indictment did IIRC make reference to AT&T's computers meeting the definition of "protected". But they charged fraud and conspiracy.

ScottBurson 14y ago
Okay, I'm looking at the indictment. I see lots of IRC conversations about things the defendants, Auernheimer and Spitler, could do with the email addresses they were getting... but no concrete plans to actually do those things. Yes, the downloading of the addresses itself was an overt act, but I see no overt act alleged that specifically reveals fraudulent intent or acts in furtherance of a plan to commit fraud. The only overt acts alleged, other than the downloading itself, were (1) they sent some email messages to some of the victims, and (2) they gave all the email addresses to Gawker. I see nothing in here alleging concrete steps toward extorting the victims, or stealing their bank accounts, or deceiving them in any way, or indeed anything by which they would actually profit. Again, they discussed various possibilities, but I see no evidence here that they actually undertook any of them. I'm sure it didn't help their case that they figured that what they were doing was illegal or at least tortious, and that they attempted to destroy evidence. But the crux of your response to Rob is that they had the intent to commit fraud, and frankly, reading this indictment, I still don't see any evidence of that beyond some IRC banter. There's also, seems to me, an odd circularity to the government's argument. They're alleging conspiracy, and among the overt acts that demonstrate this alleged conspiracy, they include the scraping of the email addresses. But the crime that that overt act is supposedly in furtherance of is... conspiracy. Seems to me this recursion is missing a base case :-) Count 2 of the indictment has a slightly different thrust. Even though it's titled "Fraud in connection with personal information", it references USC 18 § 1028 (a) (7), which says: "Whoever ... knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law [shall be punished, etc.]." What they seem to be saying here is that the ICC-IDs themselves count as a "means of identification" and that the fraud consisted simply of using said IDs to access the AT&T accounts. But this is also circular. The "unlawful activity" is the violation of the CFAA itself. The demonstration that the CFAA was violated rests on the assertion that it was violated. If this indictment reflects the strongest arguments the prosecution has, I must respectfully disagree with this jury.
- vidarh 14y ago
  > But the crux of your response to Rob is that they had the intent to commit fraud No, the crux of his response is that the government alleged fraud, and so using the case to claim that just accessing a site is a federal crime is at best hyperbole. Whether or not the allegation of intent to commit fraud is accurate or not is not relevant fo that argument.
  - ScottBurson 14y ago
    I don't quite agree. While the (relevant clause of the) statue does indeed require the intent to commit fraud, arguably a bit of sophistry by the prosecutors allowed them to sidestep the intent of that requirement in this case. If the law is written and interpreted in such a way as to make that possible, I think it's fair to say there's a problem with the law.
    - tptacek 14y ago
      It's a little of both, right? They charged conspiracy and fraud. The conspiracy charge was indeed rooted in 1030(a)(2), which is the hotbutton issue on this thread. I think one thing that is happening here is that we're getting our wires crossed between Rob's post, which says you've committed a crime by reading his blog but that's OK because he committed a crime by sending you Javascript and that post is simply incorrect, and the Auernheimer case from yesterday which is not nearly as cut and dry. Rob is wrong. But even I think the Auernheimer result is shady; I think "unauthorized access" should be cut and dry (if you know you're not supposed to do something with someone else's computer system and you do it anyways, that's unauthorized access), but the conspiracy charge is shady, the allegation of fraud is extremely shady (they were spitballing about the impact of what they found, not planning an elaborate fraud), and using 1030(a)(2) + conspiracy to avoid confronting those issues is also shady.
deleted 14y ago
[deleted]