13 ms·

Context is important in law. It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing oth

by watty 14y ago

Context is important in law. It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. I'm really sick of these sensational posts/comments showing up on HN. I know, I'm not supposed to complain about quality of posts or comments but the past week has really changed my view on the current state of HN. Witch hunts, sensational stories, jumping to conclusions, hating the law/government, etc. Let's go back to technical news.

wwwtyro 14y ago
> It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. Honest question: why is that? Why is it not enough to charge someone for the actual crime they committed? Why does someone need to be charged for committing it a specific way?
- scarmig 14y ago
  Anonymity is anathema to the government. There are plenty of laws on the books prohibiting it even if you're not committing any other crimes: many locations (most? all?) ban wearing masks at legal, peaceful public protests, even if the protesters have legitimate reasons to fear employer or community reprisal for participating in the protest. That's because State Power is not, contra popular imagination, based on a monopoly of violence, which only exists nowadays thanks to the triumph of its real source. It's based on legibility: by abstracting the world and identifying and naming its subsystems, the State creates its own power. Naming and identifying people is a natural part of that: indeed, adding last names to a first name to create a (ostensibly) unique global identifier was one of the first projects of the modern State. One hundred faceless people you have to monitor at the moment is far more dangerous than a thousand identified people you can attack after the fact.
- deleted 14y ago
  [deleted]
- tedunangst 14y ago
  It's not so much that wearing a ski mask is illegal (though that's true in some cities) but it demonstrates you are deliberately committing the real crime, not an accident. You can wear a mask. You can tell a bank teller "I'm here to make a large withdrawal." Doing both at the same time? Good luck convincing the jury you were just trying to hide from your wife while getting some cash for a friends bachelor party.
  - zmmmmm 14y ago
    > but it demonstrates you are deliberately committing the real crime So once again you're back to saying that it provides evidence of another crime. But many people are saying the anonymity becomes a crime itself when in the context of another crime. I'm kind of bothered by that as it puts a liability (or a chilling effect, if you like) on being anonymous, something I do every day and cherish very much as an important aspect of my privacy. Even though it won't become relevant until the day I am (perhaps wrongly) accused of another crime, suddenly it will become a very huge liability if that ever happens. Now if you say the anonymity crime is "planning and preparing to commit a crime" then that's (sort of) OK. Once again, the anonymity is part of committing a separate crime that I can at least rationalize is wrongful. But if you tell me that the pure anonymity itself is a crime then I'm very disturbed by that.
    - tedunangst 14y ago
      I am not telling anyone that being anonymous is itself a crime.
nsmartt 14y ago
There are very real problems with our laws. That Aaron was facing 35 years in prison for what he did is very clear evidence of that, and this is far from the only broken law. While hating on the system can be done in stupid ways, ignoring these sorts of things doesn't make them less real. Besides that, this sort of thing fits the criteria for submissions on HN. I'd even go so far as to say that this is more appropriate than the latest news about incremental changes in X.
- Symmetry 14y ago
  I very much agree here. The problem isn't that there's a law against accessing a computer system without authorization or how it's defined. The problem is that the law treats unauthorized access to a computer system so much more harshly than the equivalent trespasses on physical property. If he'd been charged with a misdemeanor resulting in "a fine of not more than $100 and up to 30 days in jail" I could see that as being a just law. Decades in prison and a felony record? Not so much.
  - danielweber 14y ago
    It wasn't just that he made unauthorized access to the network; it was so that he could download millions documents that JSTOR sells a subscription to for tens of thousands of dollars a year. You can't ignore that. If he had trespassed into JSTOR's offices to grab the same information, it wouldn't be a $100 fine. (Ob: I'm not saying justice would have been Aaron sitting in jail for 7 years.)
    - Symmetry 14y ago
      Yes, but the current civil remedies we have in copyright and trade secret laws would work fine in this case.
    - ricardobeat 14y ago
      He only did this because the majority of them are publicly funded and should be available for free. The only reason they are not available to the public is JSTOR's grasp on journals and monopoly over archiving. Maybe we should be blaming the journals for being greedy instead, but the point stands.
clicks 14y ago
You have completely and absolutely missed the point. Changing MAC addresses (upon every restart) is something I do too. It is an extremely easy thing to do. That such an obvious thing will effortlessly add to a list of charges, amplifying the prosecutor's case for no good reason, is what the issue is. The most frustrating thing about your comment is your condescending attitude. It's exactly this kind of behavior that is sliding us down a path of draconian laws that will in the end harm us all. Please think before going off like this.
- ajross 14y ago
  I think you're completely and absolutely talking past the argument. In the law as it exists, doing something "anonymously" for the purpose of committing a crime is itself a crime. It's not the act of changing the MAC address that is illegal by itself. That was the point. Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it. In fact, they have a duty to do so. Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all.
  - ynniv 14y ago
    Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all. That is exactly what the law says in this case. The government has declared that MAC randomization is the creation of fraudulent identities for the purposes of authentication, not unlike creating fraudulent photo identification. You can say that randomizing a MAC address is not a crime, just as one can say that creating a fake passport for a movie is not a crime. The crime is in using that fake identification for authentication, which is obvious when customs asks for your passport, but undetectable when a network is using MAC addresses to enforce policy. If subverting that network policy is a felony, then MAC randomization is, by law, sometimes an involuntary felony. While MAC addresses are obviously not a form of identification to technical folks, this stance would not be unprecedented as the US has also made it a felony to forge another trivially forged pseudo identify, Caller ID[1]. Enforcement of CNID spoofing is much easier given the nature of the phone system, since only a few providers bridge from VoIP to POTS. [ 1 https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation_in_the_United_States https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation... ]
Symmetry 14y ago
A minor quible, since it seems to be confusing people elsewhere in the thread. It isn't illegal to change your MAC address at all per se. It's illegal to access a network without permission. All the MAC spoofing did was help prove mens rea, that Aaron knew that the people in charge of the network were trying to keep him off of it when he accessed it anyways. By analogy, there's nothing illegal about entering a building through the window. But if you try the door of a random and find it locked and then enter through the window that's still trespass. But if you make a habit of always entering buildings through open windows when they're available so you never try the door you might be able to argue that you didn't know the building wasn't public. At least, you could try to argue it to a jury and depending on the circumstances I guess it might work.
- vy8vWJlco 14y ago
  So: MAC spoofing doesn't really help prove mens rea (that Aaron thought he was trespassing, but did so anyways). From another comment: "People fear magic they don't understand, and distrust those who wield that magic. Things that seem reasonable to technical geeks seem illegal to the non-technical." ( http://news.ycombinator.com/item?id=5067146 http://news.ycombinator.com/item?id=5067146 ) There is a chasm between what "normal"/non-tech people might consider proof of mens rea (and probably explains some of the history of the laws) and what technical people would consider proof. Technical people do stuff like MAC spoofing all the time, as in the article. I run Tor because I can always reach my SSH server as a hidden service, even through firewalls. I strip my HTTP headers with an HTTP proxy because I don't like having to constantly configure all my browsers to throw out adnet cookies. I set curl and wget to spoof a more common user agent, because some things simply don't work otherwise. This sort of remedial stuff literally scares non-tech people, and having to constantly explain and justify such network magic to anyone who doesn't know how technology and networks work just to make them feel better is tantamount to bending over for a TSA screening because you're brown (OK, not quite that bad). It's increasingly demoralizing, and doesn't feel like freedom in a supposedly free country (Canada). I have nothing to hide; I'm still not willing to bend over like that. No one should. It's the new McCarthyism. Lawmakers and non-techs are afraid of us, and so we're treated differently, and it's becoming scarier (just because SOPA was stopped in one country doesn't mean there won't be more). I don't want to work to help people who fear my knowledge rather than celebrate it and, while I hardly think "web apps" represent anything like the future of the Internet, I'm a little afraid to work on much else if I intended to release it. (The person who made bitcoin didn't want his identity on it.) We're already paying the price.
ChuckMcM 14y ago
Interesting post. Not sure if your point is to dispute the OP or to whine about HN but to be safe I'll comment on both :-) The OP is alarmed at the use of common privacy enhancing techniques (of which wearing a ski mask is one) which allows a prosecutor to 'enhance' the charges against someone to increase the threat level. They are also alarmed that non-technical people cannot see that changing your MAC address is just "easy" for a technical person to do as holding one hand over the other as you type in your PIN at the grocery store, and equally innocuous. Nobody disputes that 'changing your MAC address' should not be considered as evidence of intent when prosecuting a crime, but there is a lot of dispute as to whether that action in and of itself rises to the level a crime in its own right. This is what the OP fears will happen, and there is some evidence to support that. That takes us to your second paragraph which talks about how painful it is for you when others express their emotions with respect to the events of the past weekend (and to be clear other events like it). Generally, yes, HN is a community of technologists and technology enthusiasts who discuss the merits or lack thereof of various technology trends, events, and personalities. That said, it is also a community of people. People can often discuss dispassionately about topics that are at arms length, but the weekend case struck close to home for noticeable fraction of the hundreds of thousands of people who visit this community. They need time to process these events, and one way they process them is that they talk about them. My point is that it helps to appreciate that others may be more affected by recent events than you were and this is their way of processing their emotions. No need to whine about it, you can take a break from HN for a week or so until it winds down. When things are continued beyond their reasonable lifetime they tend to get moderated down. Patience.
- tcuk 14y ago
  I'd expect more intelligent people, which this community claims to consist of, to not react the way it has to the events, with nothing but hyperbole and sensationalism. The only clear concise analysis I have seen in the myriad of submissions was an analysis by Prof Orin Kerr, which was full of comments containing more hyperbole, that disappeared to no where instantly. Speaks volumes IMO, and it's really deterring to some of us who prefer learning and discussing the facts in a more well thought concise, clear, and logical manner.
deleted 14y ago
[deleted]
anigbrowl 14y ago
I'm really sick of these sensational posts/comments showing up on HN. Seconded, and I'm also tired of the dogmatic and uninformed approach to legal issues. Just because law employs logic does not mean that being a programmer gives a superior understanding of law. The same misconceptions crop up over and over again and badly lower the signal:noise ratio.
smsm42 14y ago
That is exactly the thing that drives charge inflation. You don't just get indicted for committing a crime, you also get charged with walking the streets while intending to commit the crime, wearing the pants with intent to commit crime, not telling the policemen you're going to commit crime, using your laptop in committing the crime, using public airwaves while committing crime, concealing your identity with criminal intent, etc. etc. That's where 30-year charges come from. I think it does indicate serious problem - why changing MAC address should be a felony in any context? If somebody did something evil and changed MAC address - convict him for something evil, not for changing MAC address. Only reason I see why such charges exist is to coerce plea bargains.
philiac 14y ago
The pathos-heavy articles are not going to disappear; rather, they portend HN's inevitable fate. Camel's nose, etc.
goggles99 14y ago
THANK YOU - you can pick up your friend from the store with your car and it is legal, but if your friend is robbing the store and you are helping him escape, you are now an accessory. You can carry a concealed handgun and shoot it at a shooting range, but if you murder someone with it - you will not only be charged with murder, but also with unlawful use of a handgun. There is no story here. Ugg...

by watty 14y ago

wwwtyro 14y ago

> It's not illegal to change your mac address or wear a ski mask. It can be illegal to do both of these things while committing other crimes. Honest question: why is that? Why is it not enough to charge someone for the actual crime they committed? Why does someone need to be charged for committing it a specific way?

scarmig 14y ago
Anonymity is anathema to the government. There are plenty of laws on the books prohibiting it even if you're not committing any other crimes: many locations (most? all?) ban wearing masks at legal, peaceful public protests, even if the protesters have legitimate reasons to fear employer or community reprisal for participating in the protest. That's because State Power is not, contra popular imagination, based on a monopoly of violence, which only exists nowadays thanks to the triumph of its real source. It's based on legibility: by abstracting the world and identifying and naming its subsystems, the State creates its own power. Naming and identifying people is a natural part of that: indeed, adding last names to a first name to create a (ostensibly) unique global identifier was one of the first projects of the modern State. One hundred faceless people you have to monitor at the moment is far more dangerous than a thousand identified people you can attack after the fact.
deleted 14y ago
[deleted]
tedunangst 14y ago
It's not so much that wearing a ski mask is illegal (though that's true in some cities) but it demonstrates you are deliberately committing the real crime, not an accident. You can wear a mask. You can tell a bank teller "I'm here to make a large withdrawal." Doing both at the same time? Good luck convincing the jury you were just trying to hide from your wife while getting some cash for a friends bachelor party.
- zmmmmm 14y ago
  > but it demonstrates you are deliberately committing the real crime So once again you're back to saying that it provides evidence of another crime. But many people are saying the anonymity becomes a crime itself when in the context of another crime. I'm kind of bothered by that as it puts a liability (or a chilling effect, if you like) on being anonymous, something I do every day and cherish very much as an important aspect of my privacy. Even though it won't become relevant until the day I am (perhaps wrongly) accused of another crime, suddenly it will become a very huge liability if that ever happens. Now if you say the anonymity crime is "planning and preparing to commit a crime" then that's (sort of) OK. Once again, the anonymity is part of committing a separate crime that I can at least rationalize is wrongful. But if you tell me that the pure anonymity itself is a crime then I'm very disturbed by that.
  - tedunangst 14y ago
    I am not telling anyone that being anonymous is itself a crime.

nsmartt 14y ago

There are very real problems with our laws. That Aaron was facing 35 years in prison for what he did is very clear evidence of that, and this is far from the only broken law. While hating on the system can be done in stupid ways, ignoring these sorts of things doesn't make them less real. Besides that, this sort of thing fits the criteria for submissions on HN. I'd even go so far as to say that this is more appropriate than the latest news about incremental changes in X.

Symmetry 14y ago
I very much agree here. The problem isn't that there's a law against accessing a computer system without authorization or how it's defined. The problem is that the law treats unauthorized access to a computer system so much more harshly than the equivalent trespasses on physical property. If he'd been charged with a misdemeanor resulting in "a fine of not more than $100 and up to 30 days in jail" I could see that as being a just law. Decades in prison and a felony record? Not so much.
- danielweber 14y ago
  It wasn't just that he made unauthorized access to the network; it was so that he could download millions documents that JSTOR sells a subscription to for tens of thousands of dollars a year. You can't ignore that. If he had trespassed into JSTOR's offices to grab the same information, it wouldn't be a $100 fine. (Ob: I'm not saying justice would have been Aaron sitting in jail for 7 years.)
  - Symmetry 14y ago
    Yes, but the current civil remedies we have in copyright and trade secret laws would work fine in this case.
  - ricardobeat 14y ago
    He only did this because the majority of them are publicly funded and should be available for free. The only reason they are not available to the public is JSTOR's grasp on journals and monopoly over archiving. Maybe we should be blaming the journals for being greedy instead, but the point stands.

clicks 14y ago

You have completely and absolutely missed the point. Changing MAC addresses (upon every restart) is something I do too. It is an extremely easy thing to do. That such an obvious thing will effortlessly add to a list of charges, amplifying the prosecutor's case for no good reason, is what the issue is. The most frustrating thing about your comment is your condescending attitude. It's exactly this kind of behavior that is sliding us down a path of draconian laws that will in the end harm us all. Please think before going off like this.

ajross 14y ago
I think you're completely and absolutely talking past the argument. In the law as it exists, doing something "anonymously" for the purpose of committing a crime is itself a crime. It's not the act of changing the MAC address that is illegal by itself. That was the point. Your point, I think, is that that "extra" crime is a silly law. Which I think many of us agree with. But it's still the law, and it's not unreasonable for a prosecutor to enforce it. In fact, they have a duty to do so. Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all.
- ynniv 14y ago
  Turning around and claiming that "the gubmint wants to lock up MAC randomizers!", however, is just dumb. That's not what the law in this case says at all. That is exactly what the law says in this case. The government has declared that MAC randomization is the creation of fraudulent identities for the purposes of authentication, not unlike creating fraudulent photo identification. You can say that randomizing a MAC address is not a crime, just as one can say that creating a fake passport for a movie is not a crime. The crime is in using that fake identification for authentication, which is obvious when customs asks for your passport, but undetectable when a network is using MAC addresses to enforce policy. If subverting that network policy is a felony, then MAC randomization is, by law, sometimes an involuntary felony. While MAC addresses are obviously not a form of identification to technical folks, this stance would not be unprecedented as the US has also made it a felony to forge another trivially forged pseudo identify, Caller ID[1]. Enforcement of CNID spoofing is much easier given the nature of the phone system, since only a few providers bridge from VoIP to POTS. [ 1 https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation_in_the_United_States https://en.wikipedia.org/wiki/Caller_ID_spoofing#Legislation... ]

Symmetry 14y ago

A minor quible, since it seems to be confusing people elsewhere in the thread. It isn't illegal to change your MAC address at all per se. It's illegal to access a network without permission. All the MAC spoofing did was help prove mens rea, that Aaron knew that the people in charge of the network were trying to keep him off of it when he accessed it anyways. By analogy, there's nothing illegal about entering a building through the window. But if you try the door of a random and find it locked and then enter through the window that's still trespass. But if you make a habit of always entering buildings through open windows when they're available so you never try the door you might be able to argue that you didn't know the building wasn't public. At least, you could try to argue it to a jury and depending on the circumstances I guess it might work.

vy8vWJlco 14y ago
So: MAC spoofing doesn't really help prove mens rea (that Aaron thought he was trespassing, but did so anyways). From another comment: "People fear magic they don't understand, and distrust those who wield that magic. Things that seem reasonable to technical geeks seem illegal to the non-technical." ( http://news.ycombinator.com/item?id=5067146 http://news.ycombinator.com/item?id=5067146 ) There is a chasm between what "normal"/non-tech people might consider proof of mens rea (and probably explains some of the history of the laws) and what technical people would consider proof. Technical people do stuff like MAC spoofing all the time, as in the article. I run Tor because I can always reach my SSH server as a hidden service, even through firewalls. I strip my HTTP headers with an HTTP proxy because I don't like having to constantly configure all my browsers to throw out adnet cookies. I set curl and wget to spoof a more common user agent, because some things simply don't work otherwise. This sort of remedial stuff literally scares non-tech people, and having to constantly explain and justify such network magic to anyone who doesn't know how technology and networks work just to make them feel better is tantamount to bending over for a TSA screening because you're brown (OK, not quite that bad). It's increasingly demoralizing, and doesn't feel like freedom in a supposedly free country (Canada). I have nothing to hide; I'm still not willing to bend over like that. No one should. It's the new McCarthyism. Lawmakers and non-techs are afraid of us, and so we're treated differently, and it's becoming scarier (just because SOPA was stopped in one country doesn't mean there won't be more). I don't want to work to help people who fear my knowledge rather than celebrate it and, while I hardly think "web apps" represent anything like the future of the Internet, I'm a little afraid to work on much else if I intended to release it. (The person who made bitcoin didn't want his identity on it.) We're already paying the price.

ChuckMcM 14y ago

Interesting post. Not sure if your point is to dispute the OP or to whine about HN but to be safe I'll comment on both :-) The OP is alarmed at the use of common privacy enhancing techniques (of which wearing a ski mask is one) which allows a prosecutor to 'enhance' the charges against someone to increase the threat level. They are also alarmed that non-technical people cannot see that changing your MAC address is just "easy" for a technical person to do as holding one hand over the other as you type in your PIN at the grocery store, and equally innocuous. Nobody disputes that 'changing your MAC address' should not be considered as evidence of intent when prosecuting a crime, but there is a lot of dispute as to whether that action in and of itself rises to the level a crime in its own right. This is what the OP fears will happen, and there is some evidence to support that. That takes us to your second paragraph which talks about how painful it is for you when others express their emotions with respect to the events of the past weekend (and to be clear other events like it). Generally, yes, HN is a community of technologists and technology enthusiasts who discuss the merits or lack thereof of various technology trends, events, and personalities. That said, it is also a community of people. People can often discuss dispassionately about topics that are at arms length, but the weekend case struck close to home for noticeable fraction of the hundreds of thousands of people who visit this community. They need time to process these events, and one way they process them is that they talk about them. My point is that it helps to appreciate that others may be more affected by recent events than you were and this is their way of processing their emotions. No need to whine about it, you can take a break from HN for a week or so until it winds down. When things are continued beyond their reasonable lifetime they tend to get moderated down. Patience.

tcuk 14y ago
I'd expect more intelligent people, which this community claims to consist of, to not react the way it has to the events, with nothing but hyperbole and sensationalism. The only clear concise analysis I have seen in the myriad of submissions was an analysis by Prof Orin Kerr, which was full of comments containing more hyperbole, that disappeared to no where instantly. Speaks volumes IMO, and it's really deterring to some of us who prefer learning and discussing the facts in a more well thought concise, clear, and logical manner.

deleted 14y ago

[deleted]

anigbrowl 14y ago

I'm really sick of these sensational posts/comments showing up on HN. Seconded, and I'm also tired of the dogmatic and uninformed approach to legal issues. Just because law employs logic does not mean that being a programmer gives a superior understanding of law. The same misconceptions crop up over and over again and badly lower the signal:noise ratio.

smsm42 14y ago

That is exactly the thing that drives charge inflation. You don't just get indicted for committing a crime, you also get charged with walking the streets while intending to commit the crime, wearing the pants with intent to commit crime, not telling the policemen you're going to commit crime, using your laptop in committing the crime, using public airwaves while committing crime, concealing your identity with criminal intent, etc. etc. That's where 30-year charges come from. I think it does indicate serious problem - why changing MAC address should be a felony in any context? If somebody did something evil and changed MAC address - convict him for something evil, not for changing MAC address. Only reason I see why such charges exist is to coerce plea bargains.

philiac 14y ago

The pathos-heavy articles are not going to disappear; rather, they portend HN's inevitable fate. Camel's nose, etc.

goggles99 14y ago

THANK YOU - you can pick up your friend from the store with your car and it is legal, but if your friend is robbing the store and you are helping him escape, you are now an accessory. You can carry a concealed handgun and shoot it at a shooting range, but if you murder someone with it - you will not only be charged with murder, but also with unlawful use of a handgun. There is no story here. Ugg...