12 ms·

So you say that a court would not use 18 USC 1030(a) to charge someone of a crime: > In other words, no court has gone so far as to adopt anything close to the

by clicks 14y ago

So you say that a court would not use 18 USC 1030(a) to charge someone of a crime: > In other words, no court has gone so far as to adopt anything close to the absurd outcomes suggested in this piece. Pardon me if I'm missing something here, but doesn't the post exactly say that that has what weev has been charged for? > This is the issue behind the recent conviction of Andrew Auernheimer for “hacking” AT&T.

saraid216 14y ago
> Pardon me if I'm missing something here, but doesn't the post exactly say that that has what weev has been charged for? weev's actions are a gray area. I don't think that convicting him under the CFAA is absurd. It might be unreasonable or unconstitutional, but there's a valid security issue at stake. To liken weev's actions to viewing a deliberately published-for-public-consumption blog post is a false equivalence: and precisely what makes the piece alarmist.
- dendory 14y ago
  I disagree that it's a one-off case. This case now sends a chilling effect to all security researchers. Next, what if a stock broker finds a press release on a web site that was published early, and makes money from it? What if a blogger finds a leaked photo of an unannounced product? The point is that they took a law that was meant to prevent you from hacking past security measures to get into a private computer, and successfully applied it to data posted on a public web server, and that is ridiculous, regardless what his intent was to do with the data.
  - vidarh 14y ago
    You "disagree that it's a one-off case", but the comment you've replied to did not claim it is a one-off case. Nor did the comment you reply to dispute that it may have chilling effects. Who exactly are you disagreeing with?
lambda 14y ago
No. He's saying that the court would not use 18 USC 1030(a) to charge someone of a crime when they did something completely normal and innocuous but which was technically against the language in 18 USC 1030(a) because it was poorly drafted. He's saying that the courts can make distinctions between what Congress intended (to make it illegal to bypass computer security systems without permission), and what the law might technically forbid but what is completely normal and innocuous to do (like browsing someone's website without their explicit permission).
ghshephard 14y ago
I thought weev was charged (and convicted) for hacking at AT&Ts website and extracting a bunch of people's personal information? He was certainly not engaging in what you would call "ordinary behavior." Now, is this something that I, with a bit of idle time, curl, and awk might have done on a lark - yup. Does it scare me that I then might have been found guilty of criminal behavior? Yes. Would I have done something like publish people's personal information on Gawker? Not anymore. Would I let AT&T know personally that they had a security hole? Probably not - likely to be the messenger that would get shot. Is the NET result of this that the bad guys, who keep quiet, and make use of this information for nefarios purposes now have free rein, because nobody will mention it to AT&T? Yes. Is the NET-EFFECT of this law a reduction in security and increased number of security exploitations? Yes. Should the Law be Fixed? Yes.
- sp332 14y ago
  The information was available just by putting a URL into a browser and nothing more. Just change the number at the end to your iPad/iPhone ID, and the server will send you the user's information. There's no hacking or fraud involved.
  - shpiel 14y ago
    Just because something is easy to do does not mean it should be legal. A person could walk into a business and find documents with private information that have been carelessly left in the open. That does not make it ok to take and publish them. There are plenty of physical crimes that are easy to commit. For example, opening up someone's unlocked mailbox is technically a federal crime in the US (even if you don't take any thing and just put a leaflet there). Pointing out that a 'bad guy' could easily steal someone's mail by opening their mail box does not constitute security research.
    - sp332 14y ago
      Let's not use metaphors. This isn't about federally-protected mailboxes or taking information from a private place like an office. The information was already published when AT&T put it on their public web site. Weev's activity after that was publicizing and commenting on the data.

by clicks 14y ago

saraid216 14y ago

> Pardon me if I'm missing something here, but doesn't the post exactly say that that has what weev has been charged for? weev's actions are a gray area. I don't think that convicting him under the CFAA is absurd. It might be unreasonable or unconstitutional, but there's a valid security issue at stake. To liken weev's actions to viewing a deliberately published-for-public-consumption blog post is a false equivalence: and precisely what makes the piece alarmist.

dendory 14y ago
I disagree that it's a one-off case. This case now sends a chilling effect to all security researchers. Next, what if a stock broker finds a press release on a web site that was published early, and makes money from it? What if a blogger finds a leaked photo of an unannounced product? The point is that they took a law that was meant to prevent you from hacking past security measures to get into a private computer, and successfully applied it to data posted on a public web server, and that is ridiculous, regardless what his intent was to do with the data.
- vidarh 14y ago
  You "disagree that it's a one-off case", but the comment you've replied to did not claim it is a one-off case. Nor did the comment you reply to dispute that it may have chilling effects. Who exactly are you disagreeing with?

lambda 14y ago

No. He's saying that the court would not use 18 USC 1030(a) to charge someone of a crime when they did something completely normal and innocuous but which was technically against the language in 18 USC 1030(a) because it was poorly drafted. He's saying that the courts can make distinctions between what Congress intended (to make it illegal to bypass computer security systems without permission), and what the law might technically forbid but what is completely normal and innocuous to do (like browsing someone's website without their explicit permission).

ghshephard 14y ago

I thought weev was charged (and convicted) for hacking at AT&Ts website and extracting a bunch of people's personal information? He was certainly not engaging in what you would call "ordinary behavior." Now, is this something that I, with a bit of idle time, curl, and awk might have done on a lark - yup. Does it scare me that I then might have been found guilty of criminal behavior? Yes. Would I have done something like publish people's personal information on Gawker? Not anymore. Would I let AT&T know personally that they had a security hole? Probably not - likely to be the messenger that would get shot. Is the NET result of this that the bad guys, who keep quiet, and make use of this information for nefarios purposes now have free rein, because nobody will mention it to AT&T? Yes. Is the NET-EFFECT of this law a reduction in security and increased number of security exploitations? Yes. Should the Law be Fixed? Yes.

sp332 14y ago
The information was available just by putting a URL into a browser and nothing more. Just change the number at the end to your iPad/iPhone ID, and the server will send you the user's information. There's no hacking or fraud involved.
- shpiel 14y ago
  Just because something is easy to do does not mean it should be legal. A person could walk into a business and find documents with private information that have been carelessly left in the open. That does not make it ok to take and publish them. There are plenty of physical crimes that are easy to commit. For example, opening up someone's unlocked mailbox is technically a federal crime in the US (even if you don't take any thing and just put a leaflet there). Pointing out that a 'bad guy' could easily steal someone's mail by opening their mail box does not constitute security research.
  - sp332 14y ago
    Let's not use metaphors. This isn't about federally-protected mailboxes or taking information from a private place like an office. The information was already published when AT&T put it on their public web site. Weev's activity after that was publicizing and commenting on the data.