4 ms·

The problem is that the various computer crime laws are vague and subject to interpretation. I read an article recently claiming that accessing a URL manually t

by lukifer 14y ago

The problem is that the various computer crime laws are vague and subject to interpretation. I read an article recently claiming that accessing a URL manually that is not intentionally exposed via a public link could be considered a form of unauthorized access and wire fraud.

duqee 14y ago
Would this include viewing / reading .css files and .js files? As they are not exactly a public link.
1337biz 14y ago
You are probably talking about the Auernheimer case: http://www.digitaltrends.com/mobile/att-ipad-hacker-auernheimer/ http://www.digitaltrends.com/mobile/att-ipad-hacker-auernhei...
danso 14y ago
This is highly unlikely (but of course, courts may rule differently depending on what is put in front of them). The closest thing that comes to mind is the 2006 incident in which a researcher from the candidate opposing Governor Schwarzenegger logged onto the governor's public FTP site and stepped-up a directory to find a bunch of private audio recordings: http://articles.latimes.com/2006/sep/13/local/me-audio13 http://articles.latimes.com/2006/sep/13/local/me-audio13 A five month investigation by the CHP found that no illegal action had been done: http://www.mercurynews.com/ci_5145796 http://www.mercurynews.com/ci_5145796 Of course, this involved a political campaign with millions of dollars (and publicity) behind it. The CHP arresting Arnold's opponent would not turn out well for anyone...if this had been a teenager who tried it, who knows?
mpyne 14y ago
The problem is that the laws have to be almost impossibly vague. In just a few years we move from Sun RPC to DCOM/ActiveX to XML to SOAP to various SOA web standards onward to REST APIs/Ajax/etc. etc. That's why the law leaves it couched in terms unlikely to change (like "authorized access", "intentionally" doing something, etc.) and leave the charges to be considered in light of the totality of what went on. Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Would a jury convict on building a screen-scraper that steals the password for users by incrementing ID's on a URL that wasn't public but wasn't properly secured? I would think so. Sometimes the circumstances of the case matter more than the law itself.
- danielweber 14y ago
  Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Real-world analogies are fraught, but: If you innocently walk into a room, thinking you are allowed, and find out it's a bank vault, you are (in general) innocent.
- AnthonyMouse 14y ago
  >The problem is that the laws have to be almost impossibly vague. No they don't! Please don't say things like that in public, someone may actually believe you. It is not possible for the laws to be perfect. They can't be like programs or catch every possible nuance or edge case (and when they try they look like the tax code). But we have specific articulable laws that are severely defective in ways that normal laws aren't, and they can certainly be improved to attain roughly the same level of imperfection found in the large body of legislation rather than their current state of total absurdity.
  - mpyne 14y ago
    For ours laws that can be clarified then by all means let's get those clarified. By what I mean by almost impossibly vague is things like even basic elements of the CFAA. There have been debates up and down HN, Reddit, and across the web about whether logging onto a website that uses laughably poor authentication schemes even counts as "unauthorized access". If a specific-enough term like "unauthorized access" can lead to so much controversy in practice then yes, I don't see how one could argue that a legal code could simultaneously encompass all reasonable aspects of computer technology, in the present and future, and still not be at least somewhat vague. It's the principle of indirection applied at a legal level. "What does unauthorized access mean? Well, I guess that's for the specific judge to hash out and the specific jury to decide"
    - AnthonyMouse 14y ago
      "Unauthorized access" is why it's defective. The wording is wrong and the penalties are wrong. Here's an example. This is the MA law against trespass: http://www.malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Chapter266/Section120 http://www.malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/... Penalty: "shall be punished by a fine of not more than one hundred dollars or by imprisonment for not more than thirty days or both such fine and imprisonment." On top of that, look at the wording: You have to have some specific notice that you're unauthorized before it's trespass. And then the penalty is a $100 fine or 30 days. So okay, you want to have the digital equivalent of trespass, let's do the same thing: You have to have been specifically told (not implied by some trumped up circumstantial nonsense about MAC and IP addresses or URLs) that you aren't allowed to access a particular computer and then have done it anyway, and then the penalty should be $100 or 30 days. Because that's the trivial offense. That's the one that should have the really low penalties because it doesn't necessarily imply any substantial harm. The high penalties should be for high value financial fraud or misappropriating classified materials or disrupting the control systems at a power plant or a chemical processing facility, and they should each be separated out so that we know what they are and have penalties proportional to the specific offense. And to do that we don't need to talk about XML or SOAP or AJAX, because that isn't what matters. It doesn't matter specifically how you did it, it matters what you did and what you intended to do. This is why we don't have laws against trespassing while wearing a yellow shirt. Because you don't need to specify the irrelevant details, only the relevant ones, and the specific underlying technology is almost always irrelevant to a particular class of criminal activity. Sometimes it does make a difference, and then you need to update the law, but that doesn't actually happen so often that we can't keep up with it if we're paying attention.
tehwalrus 14y ago
Someone in the UK was prosecuted for this; the statute is something like "don't use other peoples' computers in a way they did not intend", and the guy appended "/../" to the URL to try and read the parent directory listing (it worked). He also lied to police about having done it, but the server logs showed that he had.
TylerE 14y ago
Let's cut the crap. They're not difficult to interpret. You just don't like them. Be intellectually honest. The laws don't recognize "information wants to be freeee" or any such pablum.
- DannyBee 14y ago
  Okay, let's cut the crap. Speaking as a knowledgable lawyer (It's not my specialty, but I studied it intensely in the past with experts :P), they are in fact, quite difficult to interpret. This is even empirically true: Different federal appeals courts (which have panels of knowledgable judges) have come to different conclusions about the scope, reach, and interpretation of different parts of the law. I'm not sure what your evidence is to the contrary.
  - AnthonyMouse 14y ago
    Thank you. I would only point out that it's actually both: Not only are they unclear, even if they were clarified but still prohibited roughly the same breadth of things with the same extraordinary penalties, we still should not like them. A law that plausibly imposes the same (felony) penalty for using one's brother's laptop without permission as for breaking into a military intelligence satellite to steal classified materials is a defective law in need of serious reform.
- darkarmani 14y ago
  So interpret this for me: Is posting a deep-linking URL a crime or not?
  - TylerE 14y ago
    A publically linked URL...fine A URL you found by guessing URLs, like say on an internal test site? You're on your own
    - DannyBee 14y ago
      Can you please cite exactly what provision you believe this violates, and back it up with caselaw?

by lukifer 14y ago

duqee 14y ago

Would this include viewing / reading .css files and .js files? As they are not exactly a public link.

1337biz 14y ago

You are probably talking about the Auernheimer case: http://www.digitaltrends.com/mobile/att-ipad-hacker-auernheimer/ http://www.digitaltrends.com/mobile/att-ipad-hacker-auernhei...

danso 14y ago

This is highly unlikely (but of course, courts may rule differently depending on what is put in front of them). The closest thing that comes to mind is the 2006 incident in which a researcher from the candidate opposing Governor Schwarzenegger logged onto the governor's public FTP site and stepped-up a directory to find a bunch of private audio recordings: http://articles.latimes.com/2006/sep/13/local/me-audio13 http://articles.latimes.com/2006/sep/13/local/me-audio13 A five month investigation by the CHP found that no illegal action had been done: http://www.mercurynews.com/ci_5145796 http://www.mercurynews.com/ci_5145796 Of course, this involved a political campaign with millions of dollars (and publicity) behind it. The CHP arresting Arnold's opponent would not turn out well for anyone...if this had been a teenager who tried it, who knows?

mpyne 14y ago

The problem is that the laws have to be almost impossibly vague. In just a few years we move from Sun RPC to DCOM/ActiveX to XML to SOAP to various SOA web standards onward to REST APIs/Ajax/etc. etc. That's why the law leaves it couched in terms unlikely to change (like "authorized access", "intentionally" doing something, etc.) and leave the charges to be considered in light of the totality of what went on. Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Would a jury convict on building a screen-scraper that steals the password for users by incrementing ID's on a URL that wasn't public but wasn't properly secured? I would think so. Sometimes the circumstances of the case matter more than the law itself.

danielweber 14y ago
Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not... Real-world analogies are fraught, but: If you innocently walk into a room, thinking you are allowed, and find out it's a bank vault, you are (in general) innocent.
AnthonyMouse 14y ago
>The problem is that the laws have to be almost impossibly vague. No they don't! Please don't say things like that in public, someone may actually believe you. It is not possible for the laws to be perfect. They can't be like programs or catch every possible nuance or edge case (and when they try they look like the tax code). But we have specific articulable laws that are severely defective in ways that normal laws aren't, and they can certainly be improved to attain roughly the same level of imperfection found in the large body of legislation rather than their current state of total absurdity.
- mpyne 14y ago
  For ours laws that can be clarified then by all means let's get those clarified. By what I mean by almost impossibly vague is things like even basic elements of the CFAA. There have been debates up and down HN, Reddit, and across the web about whether logging onto a website that uses laughably poor authentication schemes even counts as "unauthorized access". If a specific-enough term like "unauthorized access" can lead to so much controversy in practice then yes, I don't see how one could argue that a legal code could simultaneously encompass all reasonable aspects of computer technology, in the present and future, and still not be at least somewhat vague. It's the principle of indirection applied at a legal level. "What does unauthorized access mean? Well, I guess that's for the specific judge to hash out and the specific jury to decide"
  - AnthonyMouse 14y ago
    "Unauthorized access" is why it's defective. The wording is wrong and the penalties are wrong. Here's an example. This is the MA law against trespass: http://www.malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Chapter266/Section120 http://www.malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/... Penalty: "shall be punished by a fine of not more than one hundred dollars or by imprisonment for not more than thirty days or both such fine and imprisonment." On top of that, look at the wording: You have to have some specific notice that you're unauthorized before it's trespass. And then the penalty is a $100 fine or 30 days. So okay, you want to have the digital equivalent of trespass, let's do the same thing: You have to have been specifically told (not implied by some trumped up circumstantial nonsense about MAC and IP addresses or URLs) that you aren't allowed to access a particular computer and then have done it anyway, and then the penalty should be $100 or 30 days. Because that's the trivial offense. That's the one that should have the really low penalties because it doesn't necessarily imply any substantial harm. The high penalties should be for high value financial fraud or misappropriating classified materials or disrupting the control systems at a power plant or a chemical processing facility, and they should each be separated out so that we know what they are and have penalties proportional to the specific offense. And to do that we don't need to talk about XML or SOAP or AJAX, because that isn't what matters. It doesn't matter specifically how you did it, it matters what you did and what you intended to do. This is why we don't have laws against trespassing while wearing a yellow shirt. Because you don't need to specify the irrelevant details, only the relevant ones, and the specific underlying technology is almost always irrelevant to a particular class of criminal activity. Sometimes it does make a difference, and then you need to update the law, but that doesn't actually happen so often that we can't keep up with it if we're paying attention.

tehwalrus 14y ago

Someone in the UK was prosecuted for this; the statute is something like "don't use other peoples' computers in a way they did not intend", and the guy appended "/../" to the URL to try and read the parent directory listing (it worked). He also lied to police about having done it, but the server logs showed that he had.

TylerE 14y ago

Let's cut the crap. They're not difficult to interpret. You just don't like them. Be intellectually honest. The laws don't recognize "information wants to be freeee" or any such pablum.

DannyBee 14y ago
Okay, let's cut the crap. Speaking as a knowledgable lawyer (It's not my specialty, but I studied it intensely in the past with experts :P), they are in fact, quite difficult to interpret. This is even empirically true: Different federal appeals courts (which have panels of knowledgable judges) have come to different conclusions about the scope, reach, and interpretation of different parts of the law. I'm not sure what your evidence is to the contrary.
- AnthonyMouse 14y ago
  Thank you. I would only point out that it's actually both: Not only are they unclear, even if they were clarified but still prohibited roughly the same breadth of things with the same extraordinary penalties, we still should not like them. A law that plausibly imposes the same (felony) penalty for using one's brother's laptop without permission as for breaking into a military intelligence satellite to steal classified materials is a defective law in need of serious reform.
darkarmani 14y ago
So interpret this for me: Is posting a deep-linking URL a crime or not?
- TylerE 14y ago
  A publically linked URL...fine A URL you found by guessing URLs, like say on an internal test site? You're on your own
  - DannyBee 14y ago
    Can you please cite exactly what provision you believe this violates, and back it up with caselaw?