5 ms·

I am not a lawyer, and neither is the author. But I suspect that there's nothing illegal about randomizing your MAC address or concealing your online identity.

I am not a lawyer, and neither is the author. But I suspect that there's nothing illegal about randomizing your MAC address or concealing your online identity. It's the combination of those things and committing some other "crime" (ie accessing data or systems for which you don't have permission) that becomes a problem, in that it shows intent to deceive the other party. But again, I am not a lawyer.

djt 14y ago
I believe that because his MAC address was blocked and he spoofed it to circumvent the ban, they believe that shows intent.
johndavidback 14y ago
Not a lawyer either. But from reading a dozen or so articles regarding the case it sounds like the general timbre of human emotion in those posts believes that charges of 'concealing his true identity' are used simply to increase the possible sentence. It reminds me similarly of RICO statutes which allow prosecutors to lump various charges together in order to create 'super' charges. Also reminds of me Captain Planet for some reason. Except his evil doppelganger.
lukifer 14y ago
The problem is that the various computer crime laws are vague and subject to interpretation. I read an article recently claiming that accessing a URL manually that is not intentionally exposed via a public link could be considered a form of unauthorized access and wire fraud.
- duqee 14y ago
  Would this include viewing / reading .css files and .js files? As they are not exactly a public link.
- 1337biz 14y ago
  You are probably talking about the Auernheimer case: http://www.digitaltrends.com/mobile/att-ipad-hacker-auernheimer/ http://www.digitaltrends.com/mobile/att-ipad-hacker-auernhei...
- danso 14y ago
  This is highly unlikely (but of course, courts may rule differently depending on what is put in front of them). The closest thing that comes to mind is the 2006 incident in which a researcher from the candidate opposing Governor Schwarzenegger logged onto the governor's public FTP site and stepped-up a directory to find a bunch of private audio recordings: http://articles.latimes.com/2006/sep/13/local/me-audio13 http://articles.latimes.com/2006/sep/13/local/me-audio13 A five month investigation by the CHP found that no illegal action had been done: http://www.mercurynews.com/ci_5145796 http://www.mercurynews.com/ci_5145796 Of course, this involved a political campaign with millions of dollars (and publicity) behind it. The CHP arresting Arnold's opponent would not turn out well for anyone...if this had been a teenager who tried it, who knows?
- mpyne 14y ago
  The problem is that the laws have to be almost impossibly vague. In just a few years we move from Sun RPC to DCOM/ActiveX to XML to SOAP to various SOA web standards onward to REST APIs/Ajax/etc. etc. That's why the law leaves it couched in terms unlikely to change (like "authorized access", "intentionally" doing something, etc.) and leave the charges to be considered in light of the totality of what went on. Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Would a jury convict on building a screen-scraper that steals the password for users by incrementing ID's on a URL that wasn't public but wasn't properly secured? I would think so. Sometimes the circumstances of the case matter more than the law itself.
  - danielweber 14y ago
    Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Real-world analogies are fraught, but: If you innocently walk into a room, thinking you are allowed, and find out it's a bank vault, you are (in general) innocent.
  - AnthonyMouse 14y ago
    >The problem is that the laws have to be almost impossibly vague. No they don't! Please don't say things like that in public, someone may actually believe you. It is not possible for the laws to be perfect. They can't be like programs or catch every possible nuance or edge case (and when they try they look like the tax code). But we have specific articulable laws that are severely defective in ways that normal laws aren't, and they can certainly be improved to attain roughly the same level of imperfection found in the large body of legislation rather than their current state of total absurdity.
    - mpyne 14y ago
      For ours laws that can be clarified then by all means let's get those clarified. By what I mean by almost impossibly vague is things like even basic elements of the CFAA. There have been debates up and down HN, Reddit, and across the web about whether logging onto a website that uses laughably poor authentication schemes even counts as "unauthorized access". If a specific-enough term like "unauthorized access" can lead to so much controversy in practice then yes, I don't see how one could argue that a legal code could simultaneously encompass all reasonable aspects of computer technology, in the present and future, and still not be at least somewhat vague. It's the principle of indirection applied at a legal level. "What does unauthorized access mean? Well, I guess that's for the specific judge to hash out and the specific jury to decide"
- tehwalrus 14y ago
  Someone in the UK was prosecuted for this; the statute is something like "don't use other peoples' computers in a way they did not intend", and the guy appended "/../" to the URL to try and read the parent directory listing (it worked). He also lied to police about having done it, but the server logs showed that he had.
- TylerE 14y ago
  Let's cut the crap. They're not difficult to interpret. You just don't like them. Be intellectually honest. The laws don't recognize "information wants to be freeee" or any such pablum.
  - DannyBee 14y ago
    Okay, let's cut the crap. Speaking as a knowledgable lawyer (It's not my specialty, but I studied it intensely in the past with experts :P), they are in fact, quite difficult to interpret. This is even empirically true: Different federal appeals courts (which have panels of knowledgable judges) have come to different conclusions about the scope, reach, and interpretation of different parts of the law. I'm not sure what your evidence is to the contrary.
    - AnthonyMouse 14y ago
      Thank you. I would only point out that it's actually both: Not only are they unclear, even if they were clarified but still prohibited roughly the same breadth of things with the same extraordinary penalties, we still should not like them. A law that plausibly imposes the same (felony) penalty for using one's brother's laptop without permission as for breaking into a military intelligence satellite to steal classified materials is a defective law in need of serious reform.
  - darkarmani 14y ago
    So interpret this for me: Is posting a deep-linking URL a crime or not?
    - TylerE 14y ago
      A publically linked URL...fine A URL you found by guessing URLs, like say on an internal test site? You're on your own
      - DannyBee 14y ago
        Can you please cite exactly what provision you believe this violates, and back it up with caselaw?
danielweber 14y ago
Yes, it's pretty simple. If I knew, or should have known, that you did not want me on your wireless network, and I kept on going on by changing MACs, I've crossed a line. Probably a line with small damages if it's just your home router.
btilly 14y ago
Changing your MAC address is not, by itself, illegal. But the path from there to a felony is easy to cross. Suppose that you have an ISP that only allows you to connect one device to their modem. (This used to be very common.) Suppose that you want to connect a different device. (Again a common desire.) Suppose that you spoof the MAC address of the original device so that you can connect. (This use case is a big part of why consumer electronics added the ability to spoof MAC addresses.) Under federal law, you've now committed a felony for which you can serve jail time. Your access to your ISP's network is unauthorized. Let me make this personal. This is not a random use case. I have done this. If anyone had cared, I could be charged with a felony. I could serve jail time, for accessing a network that I paid for in a way that I thought was pretty fair. (My "crime" being that I wanted to attach a wireless modem to the network so that I didn't have to have a wire connecting my laptop while I was using it. OK, I was bad, my wife and I could both use computers at the same time.) I didn't think I was doing anything wrong. It was a pretty common act. It was still a felony. So no, randomizing your MAC address is not illegal. But the line between legal and a felony here is awfully easy to cross.
- tedunangst 14y ago
  I'm not convinced even then you've committed a felony. Your access to the cable network, assuming your bills are paid up, is authorized. They'd have to demonstrate that your decision to change your router's MAC was intended to defraud them. Setting up four different laptops all with the same MAC, so that either you or your three neighbors could share the connection, is probably closer to the kind of thing that would land you in jail.
  - btilly 14y ago
    Existing precedent says that my access to the cable network is only authorized if I am within their terms of service. The terms of service said "one device" and explicitly said I couldn't plug a router in. I used that network from more than one device, and plugged a router in. I was therefore accessing the cable network in a way that was not authorized. Furthermore I intentionally changed the MAC address on my router so that I could circumvent their control mechanism that was intended to make sure that I followed their terms of use. There is no question that I did this in full knowledge of the fact that, according to the owner of that network, I was not allowed to do that. Among other things that I did with that network connection was gained access to online collections of software, including CPAN and Debian repositories. I therefore used unauthorized access to a computer to obtain information. When valued in accord to the standards used in precedent as described in http://www.volokh.com/2013/01/14/aaron-swartz-charges/ http://www.volokh.com/2013/01/14/aaron-swartz-charges/ there is no question that the cost of production of the property that I gained access to was worth more than $5000. (The fact that my cable provider did not produce that content does not enter into the statute, and is therefore irrelevant.) By my reading, my changing of the MAC address allowed me to gain unauthorized access under false pretenses to property worth more than $5000 that resided in another state from me at that time. That means that a prosecutor could, in theory, have charged me with the first 3 of the 4 original charges that were leveled at Aaron Swartz. But, you say, no prosecutor would have actually done so, and a judge would not impose a serious penalty if one did? That is absolutely true. The phenomena is called selective enforcement. And selective enforcement of bad laws only against people that someone in power doesn't like is a real problem. Which would be my whole point.

djt 14y ago

I believe that because his MAC address was blocked and he spoofed it to circumvent the ban, they believe that shows intent.

johndavidback 14y ago

Not a lawyer either. But from reading a dozen or so articles regarding the case it sounds like the general timbre of human emotion in those posts believes that charges of 'concealing his true identity' are used simply to increase the possible sentence. It reminds me similarly of RICO statutes which allow prosecutors to lump various charges together in order to create 'super' charges. Also reminds of me Captain Planet for some reason. Except his evil doppelganger.

lukifer 14y ago

The problem is that the various computer crime laws are vague and subject to interpretation. I read an article recently claiming that accessing a URL manually that is not intentionally exposed via a public link could be considered a form of unauthorized access and wire fraud.

duqee 14y ago
Would this include viewing / reading .css files and .js files? As they are not exactly a public link.
1337biz 14y ago
You are probably talking about the Auernheimer case: http://www.digitaltrends.com/mobile/att-ipad-hacker-auernheimer/ http://www.digitaltrends.com/mobile/att-ipad-hacker-auernhei...
danso 14y ago
This is highly unlikely (but of course, courts may rule differently depending on what is put in front of them). The closest thing that comes to mind is the 2006 incident in which a researcher from the candidate opposing Governor Schwarzenegger logged onto the governor's public FTP site and stepped-up a directory to find a bunch of private audio recordings: http://articles.latimes.com/2006/sep/13/local/me-audio13 http://articles.latimes.com/2006/sep/13/local/me-audio13 A five month investigation by the CHP found that no illegal action had been done: http://www.mercurynews.com/ci_5145796 http://www.mercurynews.com/ci_5145796 Of course, this involved a political campaign with millions of dollars (and publicity) behind it. The CHP arresting Arnold's opponent would not turn out well for anyone...if this had been a teenager who tried it, who knows?
mpyne 14y ago
The problem is that the laws have to be almost impossibly vague. In just a few years we move from Sun RPC to DCOM/ActiveX to XML to SOAP to various SOA web standards onward to REST APIs/Ajax/etc. etc. That's why the law leaves it couched in terms unlikely to change (like "authorized access", "intentionally" doing something, etc.) and leave the charges to be considered in light of the totality of what went on. Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Would a jury convict on building a screen-scraper that steals the password for users by incrementing ID's on a URL that wasn't public but wasn't properly secured? I would think so. Sometimes the circumstances of the case matter more than the law itself.
- danielweber 14y ago
  Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Real-world analogies are fraught, but: If you innocently walk into a room, thinking you are allowed, and find out it's a bank vault, you are (in general) innocent.
- AnthonyMouse 14y ago
  >The problem is that the laws have to be almost impossibly vague. No they don't! Please don't say things like that in public, someone may actually believe you. It is not possible for the laws to be perfect. They can't be like programs or catch every possible nuance or edge case (and when they try they look like the tax code). But we have specific articulable laws that are severely defective in ways that normal laws aren't, and they can certainly be improved to attain roughly the same level of imperfection found in the large body of legislation rather than their current state of total absurdity.
  - mpyne 14y ago
    For ours laws that can be clarified then by all means let's get those clarified. By what I mean by almost impossibly vague is things like even basic elements of the CFAA. There have been debates up and down HN, Reddit, and across the web about whether logging onto a website that uses laughably poor authentication schemes even counts as "unauthorized access". If a specific-enough term like "unauthorized access" can lead to so much controversy in practice then yes, I don't see how one could argue that a legal code could simultaneously encompass all reasonable aspects of computer technology, in the present and future, and still not be at least somewhat vague. It's the principle of indirection applied at a legal level. "What does unauthorized access mean? Well, I guess that's for the specific judge to hash out and the specific jury to decide"
tehwalrus 14y ago
Someone in the UK was prosecuted for this; the statute is something like "don't use other peoples' computers in a way they did not intend", and the guy appended "/../" to the URL to try and read the parent directory listing (it worked). He also lied to police about having done it, but the server logs showed that he had.
TylerE 14y ago
Let's cut the crap. They're not difficult to interpret. You just don't like them. Be intellectually honest. The laws don't recognize "information wants to be freeee" or any such pablum.
- DannyBee 14y ago
  Okay, let's cut the crap. Speaking as a knowledgable lawyer (It's not my specialty, but I studied it intensely in the past with experts :P), they are in fact, quite difficult to interpret. This is even empirically true: Different federal appeals courts (which have panels of knowledgable judges) have come to different conclusions about the scope, reach, and interpretation of different parts of the law. I'm not sure what your evidence is to the contrary.
  - AnthonyMouse 14y ago
    Thank you. I would only point out that it's actually both: Not only are they unclear, even if they were clarified but still prohibited roughly the same breadth of things with the same extraordinary penalties, we still should not like them. A law that plausibly imposes the same (felony) penalty for using one's brother's laptop without permission as for breaking into a military intelligence satellite to steal classified materials is a defective law in need of serious reform.
- darkarmani 14y ago
  So interpret this for me: Is posting a deep-linking URL a crime or not?
  - TylerE 14y ago
    A publically linked URL...fine A URL you found by guessing URLs, like say on an internal test site? You're on your own
    - DannyBee 14y ago
      Can you please cite exactly what provision you believe this violates, and back it up with caselaw?

danielweber 14y ago

Yes, it's pretty simple. If I knew, or should have known, that you did not want me on your wireless network, and I kept on going on by changing MACs, I've crossed a line. Probably a line with small damages if it's just your home router.

btilly 14y ago

Changing your MAC address is not, by itself, illegal. But the path from there to a felony is easy to cross. Suppose that you have an ISP that only allows you to connect one device to their modem. (This used to be very common.) Suppose that you want to connect a different device. (Again a common desire.) Suppose that you spoof the MAC address of the original device so that you can connect. (This use case is a big part of why consumer electronics added the ability to spoof MAC addresses.) Under federal law, you've now committed a felony for which you can serve jail time. Your access to your ISP's network is unauthorized. Let me make this personal. This is not a random use case. I have done this. If anyone had cared, I could be charged with a felony. I could serve jail time, for accessing a network that I paid for in a way that I thought was pretty fair. (My "crime" being that I wanted to attach a wireless modem to the network so that I didn't have to have a wire connecting my laptop while I was using it. OK, I was bad, my wife and I could both use computers at the same time.) I didn't think I was doing anything wrong. It was a pretty common act. It was still a felony. So no, randomizing your MAC address is not illegal. But the line between legal and a felony here is awfully easy to cross.

tedunangst 14y ago
I'm not convinced even then you've committed a felony. Your access to the cable network, assuming your bills are paid up, is authorized. They'd have to demonstrate that your decision to change your router's MAC was intended to defraud them. Setting up four different laptops all with the same MAC, so that either you or your three neighbors could share the connection, is probably closer to the kind of thing that would land you in jail.
- btilly 14y ago
  Existing precedent says that my access to the cable network is only authorized if I am within their terms of service. The terms of service said "one device" and explicitly said I couldn't plug a router in. I used that network from more than one device, and plugged a router in. I was therefore accessing the cable network in a way that was not authorized. Furthermore I intentionally changed the MAC address on my router so that I could circumvent their control mechanism that was intended to make sure that I followed their terms of use. There is no question that I did this in full knowledge of the fact that, according to the owner of that network, I was not allowed to do that. Among other things that I did with that network connection was gained access to online collections of software, including CPAN and Debian repositories. I therefore used unauthorized access to a computer to obtain information. When valued in accord to the standards used in precedent as described in http://www.volokh.com/2013/01/14/aaron-swartz-charges/ http://www.volokh.com/2013/01/14/aaron-swartz-charges/ there is no question that the cost of production of the property that I gained access to was worth more than $5000. (The fact that my cable provider did not produce that content does not enter into the statute, and is therefore irrelevant.) By my reading, my changing of the MAC address allowed me to gain unauthorized access under false pretenses to property worth more than $5000 that resided in another state from me at that time. That means that a prosecutor could, in theory, have charged me with the first 3 of the 4 original charges that were leveled at Aaron Swartz. But, you say, no prosecutor would have actually done so, and a judge would not impose a serious penalty if one did? That is absolutely true. The phenomena is called selective enforcement. And selective enforcement of bad laws only against people that someone in power doesn't like is a real problem. Which would be my whole point.