4 ms·

Despite the assertions of tptacek, there is no requirement for any fraud to occur for a crime to have occurred. This is a pretty important thing for computer p

Despite the assertions of tptacek, there is no requirement for any fraud to occur for a crime to have occurred. This is a pretty important thing for computer people to understand, and it's really unfortunate that one knucklehead vehemently asserting false facts has ruined this whole thread. http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf Essentially, anything you do exceeding authorization to a computer connected to the internet is potentially a U.S. federal crime. Anywhere in the world. No fraud need be proved. For example, here are the elements of a crime under 1030(a)(2): 1030(a)(2) Summary (Misd.) 1. Intentionally access a computer 2. without or in excess of authorization 3. obtain information 4. from financial records of financial institution or consumer reporting agency OR the U.S. government OR a protected computer So if the government can prove these things: you intentionally accessed a computer; without or in excess of authorization; obtained any information at all; and it was a computer connected to the internet, then they have successfully proved that you violated 1030(a)(2). Numerous whistleblowers have been charged with violating this law, including Bradley Manning; at least one "cyberbullying" case has been charged under it, etc. NO FRAUD IS REQUIRED. You can shouldersurf someone's password, log in as them, type "ls", log out and never use that password again - you've violated that law. Every person working with computers in the U.S. or anywhere the U.S. can reach with its laws should have this engraved along the top of their keyboard.

anigbrowl 14y ago
you're skating over a bunch of precedent about what constitutes authorization (and indeed fraud, but that's another story). I'm not committing a federal crime right now because the free accessibility of Rob's blog post or this comment thread on HN, free of caveats, provide implicit authorization to the viewer. Normally I would go and dig up a bunch of supporting material to justify this assertion, but your blanket assertions and dismissal of other posters as 'knuckleheads' tells me that it's simply not worth the effort. Flagged.
jlgreco 14y ago
> You can shouldersurf someone's password, log in as them, type "ls", log out and never use that password again - you've violated that law. I am not disagreeing with you, but in your example, wouldn't the part I have emphasised technically be fraud in some letter of the law way, because you have represented yourself as them to the computer?
- jellicle 14y ago
  Fraud is deception for the purpose of financial or personal gain. It's quite possible to violate 1030(a)(2) without any deception and without any financial or personal gain.
rprasad 14y ago
Despite the assertions of tptacek, there is no requirement for any fraud to occur for a crime to have occurred. This is a pretty important thing for computer people to understand, and it's really unfortunate that one knucklehead vehemently asserting false facts has ruined this whole thread. I agree, you should stop embarrassing yourself. Multiple lawyers, including practitioners in this field, are discussing in depth why you are completely wrong. Fraud, it should be noted, is only one of the possible violations--there are others. But tptacek's point was that the intent to commit one of these violations is necessary (and that specific intent determines which charges apply. As you can clearly see from the statute, intent is an element for every one of these charges http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030. You can shouldersurf someone's password, log in as them, type "ls", log out and never use that password again - you've violated that law. That's not fraud. That's accessing a protected system, which is a separate charge. It's a problem if you don't have permission, express or implicit, for that access.
- chacham15 14y ago
  > You wonder what the next article is, so you go to the URL and change it “articleId=31338” and hit return. Does that constitute intent?
  - jellicle 14y ago
    The "intent" is "intent to access a computer". It's not "intent to commit a crime". If I am unconscious, and someone lifts my hand up and uses my fingers to type in a password, I didn't have intent to access a computer - I am not guilty of a crime. But if I intentionally struck keys on my keyboard, knowing that I was striking keys on my keyboard - that's intent. I do NOT have to know that it's a crime or intend to commit a crime. Some crimes do have specific intent elements, where the person must be proved to have intended some specific result. This isn't one of them.
- jellicle 14y ago
  > tptacek's point was that the intent to commit one of these violations is necessary No, to be clear, tptacek is saying that fraud is necessary for any conviction under 1030(a). That's false. You're saying that intent to commit a crime is necessary for any conviction under 1030(a). That's false too. It's you and tptacek vs. the DOJ's cybercrimes manual. Good luck!
saraid216 14y ago
Your blog post is visible to the public internet. IANAL, but my first argument as the defendant would probably be to point out that that's implicit authorization to access, as is the act of accessing an implicit authorization for you to run Javascript. I could see an argument against the second w.r.t. the option to disable Javascript not being clear or well-known to most people.
CodeMage 14y ago
and it's really unfortunate that one knucklehead vehemently asserting false facts has ruined this whole thread. What is it with Hacker News lately? I've never whined about the quality of community before, but this trend is beginning to worry me. Further bellow you can see someone else saying that your arguments are "bullshit". Then there was this submission the other day stating that "Stephen Elop is so full of shit". Not even "full of it" -- no, it's like that "Madagascar" quote: "Well, of course we're going to throw poo at him!" I often state my position quite bluntly when I disagree with someone, but personal insults are a different story. (Not that I haven't made that mistake ever, but you make a mistake and you learn from it.) Honestly, I don't know what I might achieve by writing this, but there's a small part of me that harbors hope that things might change. It doesn't hurt anyone to maintain a modicum of civility, people.
- mkr-hn 14y ago
  It's that time of year.
- tptacek 14y ago
  I read things like "knucklehead" as an expression of frustration, and I'm aware that being on the other side of an argument about the legalities of hacking --- OK, I'll own it, being on the other side of any argument with me --- is very frustrating. Yesterday wasn't a banner day for me on HN; I was chasing down emulator bugs and every time I fixed one I'd procrastinate for another 30 minutes to avoid digging into the next. I think I created a lot of frustration in the process. Not to make it about me; I'm just saying, there are message board pathologies that are as annoying as "knucklehead" but not as obvious, so let's not single them out.

anigbrowl 14y ago

you're skating over a bunch of precedent about what constitutes authorization (and indeed fraud, but that's another story). I'm not committing a federal crime right now because the free accessibility of Rob's blog post or this comment thread on HN, free of caveats, provide implicit authorization to the viewer. Normally I would go and dig up a bunch of supporting material to justify this assertion, but your blanket assertions and dismissal of other posters as 'knuckleheads' tells me that it's simply not worth the effort. Flagged.

jlgreco 14y ago

> You can shouldersurf someone's password, log in as them, type "ls", log out and never use that password again - you've violated that law. I am not disagreeing with you, but in your example, wouldn't the part I have emphasised technically be fraud in some letter of the law way, because you have represented yourself as them to the computer?

jellicle 14y ago
Fraud is deception for the purpose of financial or personal gain. It's quite possible to violate 1030(a)(2) without any deception and without any financial or personal gain.

rprasad 14y ago

Despite the assertions of tptacek, there is no requirement for any fraud to occur for a crime to have occurred. This is a pretty important thing for computer people to understand, and it's really unfortunate that one knucklehead vehemently asserting false facts has ruined this whole thread. I agree, you should stop embarrassing yourself. Multiple lawyers, including practitioners in this field, are discussing in depth why you are completely wrong. Fraud, it should be noted, is only one of the possible violations--there are others. But tptacek's point was that the intent to commit one of these violations is necessary (and that specific intent determines which charges apply. As you can clearly see from the statute, intent is an element for every one of these charges http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030. You can shouldersurf someone's password, log in as them, type "ls", log out and never use that password again - you've violated that law. That's not fraud. That's accessing a protected system, which is a separate charge. It's a problem if you don't have permission, express or implicit, for that access.

chacham15 14y ago
> You wonder what the next article is, so you go to the URL and change it “articleId=31338” and hit return. Does that constitute intent?
- jellicle 14y ago
  The "intent" is "intent to access a computer". It's not "intent to commit a crime". If I am unconscious, and someone lifts my hand up and uses my fingers to type in a password, I didn't have intent to access a computer - I am not guilty of a crime. But if I intentionally struck keys on my keyboard, knowing that I was striking keys on my keyboard - that's intent. I do NOT have to know that it's a crime or intend to commit a crime. Some crimes do have specific intent elements, where the person must be proved to have intended some specific result. This isn't one of them.
jellicle 14y ago
> tptacek's point was that the intent to commit one of these violations is necessary No, to be clear, tptacek is saying that fraud is necessary for any conviction under 1030(a). That's false. You're saying that intent to commit a crime is necessary for any conviction under 1030(a). That's false too. It's you and tptacek vs. the DOJ's cybercrimes manual. Good luck!

saraid216 14y ago

Your blog post is visible to the public internet. IANAL, but my first argument as the defendant would probably be to point out that that's implicit authorization to access, as is the act of accessing an implicit authorization for you to run Javascript. I could see an argument against the second w.r.t. the option to disable Javascript not being clear or well-known to most people.

CodeMage 14y ago

and it's really unfortunate that one knucklehead vehemently asserting false facts has ruined this whole thread. What is it with Hacker News lately? I've never whined about the quality of community before, but this trend is beginning to worry me. Further bellow you can see someone else saying that your arguments are "bullshit". Then there was this submission the other day stating that "Stephen Elop is so full of shit". Not even "full of it" -- no, it's like that "Madagascar" quote: "Well, of course we're going to throw poo at him!" I often state my position quite bluntly when I disagree with someone, but personal insults are a different story. (Not that I haven't made that mistake ever, but you make a mistake and you learn from it.) Honestly, I don't know what I might achieve by writing this, but there's a small part of me that harbors hope that things might change. It doesn't hurt anyone to maintain a modicum of civility, people.

mkr-hn 14y ago
It's that time of year.
tptacek 14y ago
I read things like "knucklehead" as an expression of frustration, and I'm aware that being on the other side of an argument about the legalities of hacking --- OK, I'll own it, being on the other side of any argument with me --- is very frustrating. Yesterday wasn't a banner day for me on HN; I was chasing down emulator bugs and every time I fixed one I'd procrastinate for another 30 minutes to avoid digging into the next. I think I created a lot of frustration in the process. Not to make it about me; I'm just saying, there are message board pathologies that are as annoying as "knucklehead" but not as obvious, so let's not single them out.