19 ms·

I conceal my identity the same way Aaron was indicted for

409 points by twentysix 14y ago

JayNeely 14y ago
Besides taking the "civil liberty" angle, I'm trying to get to the "witchcraft" angle. As Arthur C Clarke puts it, "Any sufficiently advanced technology is indistinguishable from magic". Here is my corollary: "Any sufficiently technical expert is indistinguishable from a witch". People fear magic they don't understand, and distrust those who wield that magic. Things that seem reasonable to technical geeks seem illegal to the non-technical. Excellent insight.
- rayiner 14y ago
  No, it's wild self aggrandizement.
  - JayNeely 14y ago
    Why do you think so?
    - rayiner 14y ago
      He's basically saying "I'm being persecuted because I'm so much smarter than everyone else they can't possibly understand me, and people attack what they don't understand."
      - jlgreco 14y ago
        Is really such an unlikely reality? The general public is quite ignorant about technical matters. This becomes evident when, just as a trivial example, you complain about technical inaccuracies in a hollywood movie. You'll immediately be told in no unclear terms that the general public neither knows nor cares. People attacking that which they do not understand is just as old as recorded history. I'll take that phenomenon as just an axiom of human behaviour.
        dpark 14y ago
        > the general public neither knows nor cares. Exactly. The general public does not care about tedious technical things you can do. Nor should they. Spoofing your MAC address simply isn't interesting to other people. > People attacking that which they do not understand is just as old as recorded history. I'll take that phenomenon as just an axiom of human behaviour. This is sad cynicism. In general, people don't just arbitrarily attack things they don't understand. And people certainly don't attack things they don't care about. You kind of have to care about something in order to put in the effort to attack it.
        jlgreco 14y ago
        People certainly care about hacking, why do you think it is in the movies so much? What people don't care about is an accurate portrayal of hacking. The problem occurs when people are trying to make ethical calls in a context outside of hollywood movies. Any string of technobable sounds insidious to them; writers (quite reasonably) use this to their advantage to reduce the amount of research they need to do, but prosecutors also use it to their advantage. > You kind of have to care about something in order to put in the effort to attack it. Yeah, and that something they care about is "ze evil haxxors". They care about a topic they have absolutely no technical insight into.
        dpark 14y ago
        You're conflating a number of separate issues. Sure, people care about "hacking". That doesn't mean that the general public automatically attacks anyone accused of hacking. More to the point, is there some evidence that the general public considers MAC spoofing to be hacking? Most people don't know what MAC spoofing is, and don't care. Sure, if you can convince someone that MAC spoofing is hacking, then you might be able to convince them to care, but first you have to convince them that it's hacking. > Any string of technobable sounds insidious to them; writers (quite reasonably) use this to their advantage to reduce the amount of research they need to do, but prosecutors also use it to their advantage. Any string of technobabble sounds like technobabble to the average person. It makes no sense to them, by design. That doesn't mean they automatically consider it evil or hacking. Writers use this to their advantage because they know they can assign whatever meaning they want to the technobabble by using appropriate framing. Now a prosecutor might well stand up and spout a bunch of technobabble and then say "that's hacking". The defense needs to stand up and explain why that's stupid. A prosecutor in a medical malpractice trial could also stand up and describe a heart bypass surgery using medical terms and then announce that the doctor is clearly responsible for the patient's death. It would be pure medical babble to the typical jury, and without accurate context, the jury could indeed be led to believe that the doctors actions were negligent or even malicious, despite them being standard procedure. The defense needs to step up and provide context for those terms that the jury doesn't understand. (The judge also needs to step up and not allow the prosecution to intentionally mislead.) The jury here isn't attacking the doctor, though. They're making a judgement based on the information they are provided.
      - tedunangst 14y ago
        The ol' Hans Reiser defense. I'm too smart to get caught if I were guilty, but you caught me, therefore I must be innocent.
    - dpark 14y ago
      Probably because the implication of that little blurb was that the author is so advanced technically that laypersons see him as magic. Clarke's quote isn't "anything you don't understand looks like magic". Spoofing a MAC address is not especially advanced. It certainly doesn't look like magic. And people who spoof their MAC addresses don't look like witches. The "witchhunt" -> "advanced technology looks like magic" connection had the potential to be interesting, but I don't think it worked out well. And I agree with rayiner that it came off as self-aggrandizing more than anything else.
      - john_b 14y ago
        To average jury members, who likely wouldn't know what a MAC address was prior to a potential trial, spoofing a MAC address might seem quite sophisticated, actually.
        dpark 14y ago
        I get your point, and the level of perceived sophistication probably comes down to how well the concept is explained. (At its heart, it's just changing a number. But it could look pretty complex if explained in terms of Python scripts and system services and such.) Of course, there's also still a rather large gap between something seeming sophisticated and that thing seeming to be magic.
- simmons 14y ago
  The "witch" comment reminded me of the shift in the term "hacker" to refer to criminal behavior. A lot of people distrust cleverness. I've always suspected that if another term was adopted for positive hacking, such as "tinkerer", it too would be shifted to have a negative or criminal connotation. It was frustrating that in high school, whenever any computer shenanigans went down, I would always be the one who was automatically called to the principal's office. And some of those times, I wasn't even the one responsible. ;)
CurtHagenlocher 14y ago
I am not a lawyer, and neither is the author. But I suspect that there's nothing illegal about randomizing your MAC address or concealing your online identity. It's the combination of those things and committing some other "crime" (ie accessing data or systems for which you don't have permission) that becomes a problem, in that it shows intent to deceive the other party. But again, I am not a lawyer.
- djt 14y ago
  I believe that because his MAC address was blocked and he spoofed it to circumvent the ban, they believe that shows intent.
- johndavidback 14y ago
  Not a lawyer either. But from reading a dozen or so articles regarding the case it sounds like the general timbre of human emotion in those posts believes that charges of 'concealing his true identity' are used simply to increase the possible sentence. It reminds me similarly of RICO statutes which allow prosecutors to lump various charges together in order to create 'super' charges. Also reminds of me Captain Planet for some reason. Except his evil doppelganger.
- lukifer 14y ago
  The problem is that the various computer crime laws are vague and subject to interpretation. I read an article recently claiming that accessing a URL manually that is not intentionally exposed via a public link could be considered a form of unauthorized access and wire fraud.
  - duqee 14y ago
    Would this include viewing / reading .css files and .js files? As they are not exactly a public link.
  - 1337biz 14y ago
    You are probably talking about the Auernheimer case: http://www.digitaltrends.com/mobile/att-ipad-hacker-auernheimer/ http://www.digitaltrends.com/mobile/att-ipad-hacker-auernhei...
nsmartt 14y ago
As I understand it, the problem was that he continued to connect to the network after being kicked off. It's unauthorized access. I don't really know how to explain how I feel about it, but that's my understanding.
- tomp 14y ago
  No, he wasn't kicked off, just the MAC address of his laptop was banned. As the article author wrote, if someone blocks your number, it's not illegal to call him/her from a different phone number. Maybe they could make it illegal if they got a restraining order, but AFAIK MIT did not do that.
  - CurtHagenlocher 14y ago
    How do you kick an anonymous person off of a network? Other than blocking the MAC address, the only thing I can think of is to block non-HTTP access and redirect any HTTP requests to a page explaining what has happened with instructions for getting unblocked in case the block was due to a misunderstanding.
    - 1337biz 14y ago
      I find it odd to provide unlimited access to a network without any further form of authentication than just the IP address. There are enough alternatives out (e.g. Shibboleth) that could have been implemented if there were a needed for closer monitoring of access to journal databases.
      - danielweber 14y ago
        Just because my door is unlocked doesn't mean you have the right to be on my property. The law, for good reason, doesn't follow a "whatever you can get away with is legal" stance. For one, because then we don't have law anymore.
        maxerickson 14y ago
juzfoo 14y ago
Why should we even be trying to sugarcoat what he did? His intention was right but perhaps means weren't and thats how every rebel goes about doing their stuff. They aren't too much concerned about "confirming", and ,duh, not for nothing they are a rebel. The moment the society and the government start treating A Rebel With a Cause for the means they take than read the message they are trying to convey, it invariably shows the rot in the system. A system that doesnt like mirror being shown at. Lets please stop finding reasons for Aaron's action, instead lets accept what he did was not confirming to the system, we also need people who question and challenge the system not just those who confirms!
- wlievens 14y ago
  There's also the notion of proportionality.
watty 14y ago
Context is important in law. It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. I'm really sick of these sensational posts/comments showing up on HN. I know, I'm not supposed to complain about quality of posts or comments but the past week has really changed my view on the current state of HN. Witch hunts, sensational stories, jumping to conclusions, hating the law/government, etc. Let's go back to technical news.
- wwwtyro 14y ago
  > It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. Honest question: why is that? Why is it not enough to charge someone for the actual crime they committed? Why does someone need to be charged for committing it a specific way?
  - scarmig 14y ago
    Anonymity is anathema to the government. There are plenty of laws on the books prohibiting it even if you're not committing any other crimes: many locations (most? all?) ban wearing masks at legal, peaceful public protests, even if the protesters have legitimate reasons to fear employer or community reprisal for participating in the protest. That's because State Power is not, contra popular imagination, based on a monopoly of violence, which only exists nowadays thanks to the triumph of its real source. It's based on legibility: by abstracting the world and identifying and naming its subsystems, the State creates its own power. Naming and identifying people is a natural part of that: indeed, adding last names to a first name to create a (ostensibly) unique global identifier was one of the first projects of the modern State. One hundred faceless people you have to monitor at the moment is far more dangerous than a thousand identified people you can attack after the fact.
  - deleted 14y ago
    [deleted]
  - tedunangst 14y ago
    It's not so much that wearing a ski mask is illegal (though that's true in some cities) but it demonstrates you are deliberately committing the real crime, not an accident. You can wear a mask. You can tell a bank teller "I'm here to make a large withdrawal." Doing both at the same time? Good luck convincing the jury you were just trying to hide from your wife while getting some cash for a friends bachelor party.
downandout 14y ago
Under the CFAA, it might in fact be illegal to randomize your MAC address depending on the terms of use for the network you are accessing. It is not illegal for this guy to access his home network in this way, because he owns the network. However, the danger of the CFAA is that it makes it a crime to violate user agreements - which can say anything that the network or site owner wants them to. It effectively allows anyone to author and implement their own criminal laws and have them be enforced by the full power of the federal government. As for the wire fraud implications (which are separate from the CFAA), if you cause a false statement to be transmitted for the purpose of obtaining money or property, you have committed wire fraud and face a potential 20 year sentence. Spoofing MAC addresses to exceed access limits, for example, would qualify. You are causing your device to mask its true identity for the purpose of obtaining "property" that you wouldn't otherwise have access to.
- SoftwareMaven 14y ago
  This blog post and the OP's router would be pretty good pieces in his defense. However, at $1.5M for a trial, would he be willing to defend himself?
- timbre 14y ago
  At least one court, in US vs Lori Drew (http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew) has determined that violation of terms of use does not qualify as "unauthorized access" under the CFAA.
  - danielweber 14y ago
    And the lawyer that won in that case (Orin Kerr) did a nice write-up of the case from a legal perspective earlier this week: http://www.volokh.com/2013/01/14/aaron-swartz-charges/ http://www.volokh.com/2013/01/14/aaron-swartz-charges/
louischatriot 14y ago
I anxiously await the day (that may never come) when legislators actually understand what they do when they try to regulate technology.
TheAmazingIdiot 14y ago
This argument goes towards the DMCA, as well as what is considered under the CFAA.. "Intentionally accessing a computer without authorization to obtain: ....Information from any protected computer." What does 'without authorization' mean, and what does 'protected' mean? Does without authorization mean you violate a click-through license? Or is there some nebulous authentication chit you are handed? Is it a felony to fake your name on a website demanding your name? And with that keyword 'protected', how do we know it is indeed protected? What steps one must take to protect, and what steps one must go through to understand that it is indeed protected computer/data? In other words, we are all felons-on-standby. The laws are so vague as to entrap all by default.
- AnthonyMouse 14y ago
  >What does 'without authorization' mean, and what does 'protected' mean? Protected computer is actually defined in the statute (subsection (e)(2)): http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 The problem, of course, is that in the original law it actually said "federal interest computer" instead and was targeted primarily at computers used by financial institutions and the U.S. Government (which you still see in subsection (A)), but has since been amended to include computers "used in or affecting interstate or foreign commerce or communication" which is a term of art that means anything within the power of Congress to regulate under the interstate commerce clause, which I'm led to understand means pretty much everything now. So that's even worse then: Sorry you thought it was vague and might have been able to argue your way out of it, I hope you enjoy your cell. I really am astonished at how bad this law is. "Without authorization" is undefined and so overly broad that it seems to capture just about anything and then the penalties are preposterous even for the smallest of violations. We really need to fix this.
- darkarmani 14y ago
  > Is it a felony to fake your name on a website demanding your name? If so, facebook has made us all felons. We won't get access to facebook if we didn't give up our names, so it's wirefraud.
  - 14y ago
BashiBazouk 14y ago
I always wonder at these sort of tinfoil hat articles. It seems to me that someone who has the skills and access to the internet but does not leave much of a trace is a huge red flag for what ever the tinfoil hatter fears. A better strategy would be to boot in to your original MAC address then have a covert switch that randomizes it for doing things out of the ordinary, then returns it to normal once they are done. If you fear you are being tracked, it would be better to leave a completely normal, boring footprint that is easy to find. Normal boring Facebook page, tweets, etc. All the way down to a cache of vanilla porn on your hard drive with just a hint of kink for that ah ha moment. Then anything that goes beyond what you want that footprint to look like then moves to randomized MAC addresses, TOR networks and all the other tricks…
ChristianMarks 14y ago
The author has not bothered to read the indictment. Maybe he should talk with MIT's sysadmins, who were attempting to block Swartz's MAC address as he changed them when the MIT sysadmins found out about them. They were trying to block Swartz. It's their network. The author's blog post doesn't mention any of this. What the author should do is block his own access based on his MAC address, change his MAC address to get around his own block, and then blog about it. He could wear a bike helmet to conceal his identity and run away when he attempts to apprehend himself, for extra realism. Then he could think about the implications for the case, as a "security" expert.
- randomdata 14y ago
  It is their network, but does changing a MAC address to resolve, presumably, flaky network problems count as circumvention? I don't think Access was meant to imply Authentication in the naming of MAC. If my telephone at home suddenly and inexplicably stopped working and I walked up the pay phone down the street to get another phone number, am I running the risk of legal consequences because my own phone number may have been cut off on purpose? If he was explicitly told why his MAC addresses were being blocked, you may have a point. However, if he was explicitly talked to about what was going on, how was it able to escalate to the level it did?
  - ChristianMarks 14y ago
    I think you should read the NY Times article on how AS worked assiduously to avoid detection.
hcarvalhoalves 14y ago
The charges are most likely not for how he did (spoof MAC addresses), but what he did (redistribute material he obtained without permission). A crime exists if it can proved there's intention.
nitrogen 14y ago
I once did a test on my own network to see what would happen if I assigned two computers the same MAC address (but different IP addresses). You know what happened? Nothing. Despite my best efforts (for all of 30 seconds), I couldn't see any meaningful difference in the behavior of the computers. I was expecting tons of dropped packets as my switches tried to figure out what port that address was really on, but it didn't happen.
annnnd 14y ago
You do know that being the only iPhone user in the world who tells that he is using HTC One X is actually a pretty lead on you? :) Sometimes the very acts that you do when trying to conceal your identity can be used to reveal it.
goggles99 14y ago
You can carry a concealed handgun and shoot it at a shooting range, but if you murder someone with it - you will not only be charged with murder, but also with unlawful use of a handgun. This is common sense stuff here people sheesh.

409 points by twentysix 14y ago

Besides taking the "civil liberty" angle, I'm trying to get to the "witchcraft" angle. As Arthur C Clarke puts it, "Any sufficiently advanced technology is indistinguishable from magic". Here is my corollary: "Any sufficiently technical expert is indistinguishable from a witch". People fear magic they don't understand, and distrust those who wield that magic. Things that seem reasonable to technical geeks seem illegal to the non-technical. Excellent insight.

rayiner 14y ago
No, it's wild self aggrandizement.
- JayNeely 14y ago
  Why do you think so?
  - rayiner 14y ago
    He's basically saying "I'm being persecuted because I'm so much smarter than everyone else they can't possibly understand me, and people attack what they don't understand."
    - jlgreco 14y ago
      Is really such an unlikely reality? The general public is quite ignorant about technical matters. This becomes evident when, just as a trivial example, you complain about technical inaccuracies in a hollywood movie. You'll immediately be told in no unclear terms that the general public neither knows nor cares. People attacking that which they do not understand is just as old as recorded history. I'll take that phenomenon as just an axiom of human behaviour.
      - dpark 14y ago
        > the general public neither knows nor cares. Exactly. The general public does not care about tedious technical things you can do. Nor should they. Spoofing your MAC address simply isn't interesting to other people. > People attacking that which they do not understand is just as old as recorded history. I'll take that phenomenon as just an axiom of human behaviour. This is sad cynicism. In general, people don't just arbitrarily attack things they don't understand. And people certainly don't attack things they don't care about. You kind of have to care about something in order to put in the effort to attack it.
        jlgreco 14y ago
        People certainly care about hacking, why do you think it is in the movies so much? What people don't care about is an accurate portrayal of hacking. The problem occurs when people are trying to make ethical calls in a context outside of hollywood movies. Any string of technobable sounds insidious to them; writers (quite reasonably) use this to their advantage to reduce the amount of research they need to do, but prosecutors also use it to their advantage. > You kind of have to care about something in order to put in the effort to attack it. Yeah, and that something they care about is "ze evil haxxors". They care about a topic they have absolutely no technical insight into.
        dpark 14y ago
        You're conflating a number of separate issues. Sure, people care about "hacking". That doesn't mean that the general public automatically attacks anyone accused of hacking. More to the point, is there some evidence that the general public considers MAC spoofing to be hacking? Most people don't know what MAC spoofing is, and don't care. Sure, if you can convince someone that MAC spoofing is hacking, then you might be able to convince them to care, but first you have to convince them that it's hacking. > Any string of technobable sounds insidious to them; writers (quite reasonably) use this to their advantage to reduce the amount of research they need to do, but prosecutors also use it to their advantage. Any string of technobabble sounds like technobabble to the average person. It makes no sense to them, by design. That doesn't mean they automatically consider it evil or hacking. Writers use this to their advantage because they know they can assign whatever meaning they want to the technobabble by using appropriate framing. Now a prosecutor might well stand up and spout a bunch of technobabble and then say "that's hacking". The defense needs to stand up and explain why that's stupid. A prosecutor in a medical malpractice trial could also stand up and describe a heart bypass surgery using medical terms and then announce that the doctor is clearly responsible for the patient's death. It would be pure medical babble to the typical jury, and without accurate context, the jury could indeed be led to believe that the doctors actions were negligent or even malicious, despite them being standard procedure. The defense needs to step up and provide context for those terms that the jury doesn't understand. (The judge also needs to step up and not allow the prosecution to intentionally mislead.) The jury here isn't attacking the doctor, though. They're making a judgement based on the information they are provided.
    - tedunangst 14y ago
      The ol' Hans Reiser defense. I'm too smart to get caught if I were guilty, but you caught me, therefore I must be innocent.
  - dpark 14y ago
    Probably because the implication of that little blurb was that the author is so advanced technically that laypersons see him as magic. Clarke's quote isn't "anything you don't understand looks like magic". Spoofing a MAC address is not especially advanced. It certainly doesn't look like magic. And people who spoof their MAC addresses don't look like witches. The "witchhunt" -> "advanced technology looks like magic" connection had the potential to be interesting, but I don't think it worked out well. And I agree with rayiner that it came off as self-aggrandizing more than anything else.
    - john_b 14y ago
      To average jury members, who likely wouldn't know what a MAC address was prior to a potential trial, spoofing a MAC address might seem quite sophisticated, actually.
      - dpark 14y ago
        I get your point, and the level of perceived sophistication probably comes down to how well the concept is explained. (At its heart, it's just changing a number. But it could look pretty complex if explained in terms of Python scripts and system services and such.) Of course, there's also still a rather large gap between something seeming sophisticated and that thing seeming to be magic.
simmons 14y ago
The "witch" comment reminded me of the shift in the term "hacker" to refer to criminal behavior. A lot of people distrust cleverness. I've always suspected that if another term was adopted for positive hacking, such as "tinkerer", it too would be shifted to have a negative or criminal connotation. It was frustrating that in high school, whenever any computer shenanigans went down, I would always be the one who was automatically called to the principal's office. And some of those times, I wasn't even the one responsible. ;)

CurtHagenlocher 14y ago

I am not a lawyer, and neither is the author. But I suspect that there's nothing illegal about randomizing your MAC address or concealing your online identity. It's the combination of those things and committing some other "crime" (ie accessing data or systems for which you don't have permission) that becomes a problem, in that it shows intent to deceive the other party. But again, I am not a lawyer.

djt 14y ago
I believe that because his MAC address was blocked and he spoofed it to circumvent the ban, they believe that shows intent.
johndavidback 14y ago
Not a lawyer either. But from reading a dozen or so articles regarding the case it sounds like the general timbre of human emotion in those posts believes that charges of 'concealing his true identity' are used simply to increase the possible sentence. It reminds me similarly of RICO statutes which allow prosecutors to lump various charges together in order to create 'super' charges. Also reminds of me Captain Planet for some reason. Except his evil doppelganger.
lukifer 14y ago
The problem is that the various computer crime laws are vague and subject to interpretation. I read an article recently claiming that accessing a URL manually that is not intentionally exposed via a public link could be considered a form of unauthorized access and wire fraud.
- duqee 14y ago
  Would this include viewing / reading .css files and .js files? As they are not exactly a public link.
- 1337biz 14y ago
  You are probably talking about the Auernheimer case: http://www.digitaltrends.com/mobile/att-ipad-hacker-auernheimer/ http://www.digitaltrends.com/mobile/att-ipad-hacker-auernhei...

nsmartt 14y ago

As I understand it, the problem was that he continued to connect to the network after being kicked off. It's unauthorized access. I don't really know how to explain how I feel about it, but that's my understanding.

tomp 14y ago
No, he wasn't kicked off, just the MAC address of his laptop was banned. As the article author wrote, if someone blocks your number, it's not illegal to call him/her from a different phone number. Maybe they could make it illegal if they got a restraining order, but AFAIK MIT did not do that.
- CurtHagenlocher 14y ago
  How do you kick an anonymous person off of a network? Other than blocking the MAC address, the only thing I can think of is to block non-HTTP access and redirect any HTTP requests to a page explaining what has happened with instructions for getting unblocked in case the block was due to a misunderstanding.
  - 1337biz 14y ago
    I find it odd to provide unlimited access to a network without any further form of authentication than just the IP address. There are enough alternatives out (e.g. Shibboleth) that could have been implemented if there were a needed for closer monitoring of access to journal databases.
    - danielweber 14y ago
      Just because my door is unlocked doesn't mean you have the right to be on my property. The law, for good reason, doesn't follow a "whatever you can get away with is legal" stance. For one, because then we don't have law anymore.
      - maxerickson 14y ago

juzfoo 14y ago

Why should we even be trying to sugarcoat what he did? His intention was right but perhaps means weren't and thats how every rebel goes about doing their stuff. They aren't too much concerned about "confirming", and ,duh, not for nothing they are a rebel. The moment the society and the government start treating A Rebel With a Cause for the means they take than read the message they are trying to convey, it invariably shows the rot in the system. A system that doesnt like mirror being shown at. Lets please stop finding reasons for Aaron's action, instead lets accept what he did was not confirming to the system, we also need people who question and challenge the system not just those who confirms!

wlievens 14y ago
There's also the notion of proportionality.

watty 14y ago

Context is important in law. It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. I'm really sick of these sensational posts/comments showing up on HN. I know, I'm not supposed to complain about quality of posts or comments but the past week has really changed my view on the current state of HN. Witch hunts, sensational stories, jumping to conclusions, hating the law/government, etc. Let's go back to technical news.

wwwtyro 14y ago
> It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. Honest question: why is that? Why is it not enough to charge someone for the actual crime they committed? Why does someone need to be charged for committing it a specific way?
- scarmig 14y ago
  Anonymity is anathema to the government. There are plenty of laws on the books prohibiting it even if you're not committing any other crimes: many locations (most? all?) ban wearing masks at legal, peaceful public protests, even if the protesters have legitimate reasons to fear employer or community reprisal for participating in the protest. That's because State Power is not, contra popular imagination, based on a monopoly of violence, which only exists nowadays thanks to the triumph of its real source. It's based on legibility: by abstracting the world and identifying and naming its subsystems, the State creates its own power. Naming and identifying people is a natural part of that: indeed, adding last names to a first name to create a (ostensibly) unique global identifier was one of the first projects of the modern State. One hundred faceless people you have to monitor at the moment is far more dangerous than a thousand identified people you can attack after the fact.
- deleted 14y ago
  [deleted]
- tedunangst 14y ago
  It's not so much that wearing a ski mask is illegal (though that's true in some cities) but it demonstrates you are deliberately committing the real crime, not an accident. You can wear a mask. You can tell a bank teller "I'm here to make a large withdrawal." Doing both at the same time? Good luck convincing the jury you were just trying to hide from your wife while getting some cash for a friends bachelor party.

downandout 14y ago

Under the CFAA, it might in fact be illegal to randomize your MAC address depending on the terms of use for the network you are accessing. It is not illegal for this guy to access his home network in this way, because he owns the network. However, the danger of the CFAA is that it makes it a crime to violate user agreements - which can say anything that the network or site owner wants them to. It effectively allows anyone to author and implement their own criminal laws and have them be enforced by the full power of the federal government. As for the wire fraud implications (which are separate from the CFAA), if you cause a false statement to be transmitted for the purpose of obtaining money or property, you have committed wire fraud and face a potential 20 year sentence. Spoofing MAC addresses to exceed access limits, for example, would qualify. You are causing your device to mask its true identity for the purpose of obtaining "property" that you wouldn't otherwise have access to.

SoftwareMaven 14y ago
This blog post and the OP's router would be pretty good pieces in his defense. However, at $1.5M for a trial, would he be willing to defend himself?
timbre 14y ago
At least one court, in US vs Lori Drew (http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew) has determined that violation of terms of use does not qualify as "unauthorized access" under the CFAA.
- danielweber 14y ago
  And the lawyer that won in that case (Orin Kerr) did a nice write-up of the case from a legal perspective earlier this week: http://www.volokh.com/2013/01/14/aaron-swartz-charges/ http://www.volokh.com/2013/01/14/aaron-swartz-charges/

louischatriot 14y ago

I anxiously await the day (that may never come) when legislators actually understand what they do when they try to regulate technology.

TheAmazingIdiot 14y ago

This argument goes towards the DMCA, as well as what is considered under the CFAA.. "Intentionally accessing a computer without authorization to obtain: ....Information from any protected computer." What does 'without authorization' mean, and what does 'protected' mean? Does without authorization mean you violate a click-through license? Or is there some nebulous authentication chit you are handed? Is it a felony to fake your name on a website demanding your name? And with that keyword 'protected', how do we know it is indeed protected? What steps one must take to protect, and what steps one must go through to understand that it is indeed protected computer/data? In other words, we are all felons-on-standby. The laws are so vague as to entrap all by default.

AnthonyMouse 14y ago
>What does 'without authorization' mean, and what does 'protected' mean? Protected computer is actually defined in the statute (subsection (e)(2)): http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 The problem, of course, is that in the original law it actually said "federal interest computer" instead and was targeted primarily at computers used by financial institutions and the U.S. Government (which you still see in subsection (A)), but has since been amended to include computers "used in or affecting interstate or foreign commerce or communication" which is a term of art that means anything within the power of Congress to regulate under the interstate commerce clause, which I'm led to understand means pretty much everything now. So that's even worse then: Sorry you thought it was vague and might have been able to argue your way out of it, I hope you enjoy your cell. I really am astonished at how bad this law is. "Without authorization" is undefined and so overly broad that it seems to capture just about anything and then the penalties are preposterous even for the smallest of violations. We really need to fix this.
darkarmani 14y ago
> Is it a felony to fake your name on a website demanding your name? If so, facebook has made us all felons. We won't get access to facebook if we didn't give up our names, so it's wirefraud.
- 14y ago

BashiBazouk 14y ago

I always wonder at these sort of tinfoil hat articles. It seems to me that someone who has the skills and access to the internet but does not leave much of a trace is a huge red flag for what ever the tinfoil hatter fears. A better strategy would be to boot in to your original MAC address then have a covert switch that randomizes it for doing things out of the ordinary, then returns it to normal once they are done. If you fear you are being tracked, it would be better to leave a completely normal, boring footprint that is easy to find. Normal boring Facebook page, tweets, etc. All the way down to a cache of vanilla porn on your hard drive with just a hint of kink for that ah ha moment. Then anything that goes beyond what you want that footprint to look like then moves to randomized MAC addresses, TOR networks and all the other tricks…

ChristianMarks 14y ago

The author has not bothered to read the indictment. Maybe he should talk with MIT's sysadmins, who were attempting to block Swartz's MAC address as he changed them when the MIT sysadmins found out about them. They were trying to block Swartz. It's their network. The author's blog post doesn't mention any of this. What the author should do is block his own access based on his MAC address, change his MAC address to get around his own block, and then blog about it. He could wear a bike helmet to conceal his identity and run away when he attempts to apprehend himself, for extra realism. Then he could think about the implications for the case, as a "security" expert.

randomdata 14y ago
It is their network, but does changing a MAC address to resolve, presumably, flaky network problems count as circumvention? I don't think Access was meant to imply Authentication in the naming of MAC. If my telephone at home suddenly and inexplicably stopped working and I walked up the pay phone down the street to get another phone number, am I running the risk of legal consequences because my own phone number may have been cut off on purpose? If he was explicitly told why his MAC addresses were being blocked, you may have a point. However, if he was explicitly talked to about what was going on, how was it able to escalate to the level it did?
- ChristianMarks 14y ago
  I think you should read the NY Times article on how AS worked assiduously to avoid detection.

hcarvalhoalves 14y ago

The charges are most likely not for how he did (spoof MAC addresses), but what he did (redistribute material he obtained without permission). A crime exists if it can proved there's intention.

nitrogen 14y ago

I once did a test on my own network to see what would happen if I assigned two computers the same MAC address (but different IP addresses). You know what happened? Nothing. Despite my best efforts (for all of 30 seconds), I couldn't see any meaningful difference in the behavior of the computers. I was expecting tons of dropped packets as my switches tried to figure out what port that address was really on, but it didn't happen.

annnnd 14y ago

You do know that being the only iPhone user in the world who tells that he is using HTC One X is actually a pretty lead on you? :) Sometimes the very acts that you do when trying to conceal your identity can be used to reveal it.

goggles99 14y ago

You can carry a concealed handgun and shoot it at a shooting range, but if you murder someone with it - you will not only be charged with murder, but also with unlawful use of a handgun. This is common sense stuff here people sheesh.