42 ms·

Andrew Auernheimer case uncomfortably similar to Aaron Swartz case

137 points by usaphp 14y ago

dubfan 14y ago
Even if they are similar cases (an assessment I disagree with), I doubt Auernheimer will get nearly as much sympathy among the hacker community given his history of trolling and malicious behavior, compared to Swartz's history of creative and constructive actions.
- duskwuff 14y ago
  Yeah, there are some pretty significant differences here. Among other things, weev more or less stated that he intended to harm AT&T by leaking their customer data and driving down their stock price, and that he was, at one point, considering selling the leaked data for profit. http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-...
  - dmix 14y ago
    So the important question is what's the appropriate punishment... if this was his motives (assuming it's accurate)? The illegality of Aarons actions is debatable, but the sentencing and lawyering by the DoJ has been seen as inappropriate and over-zealous by almost all spectators.
  - wnight 14y ago
    If any harm could come to AT&T's customers over this, then their stock price should fall. Also, as facts those email addresses aren't copyrightable. Taking them and selling them for profit is what all direct mail companies legally do with phone numbers and email addresses they find. Websites without passwords are like postcards. Don't try to mandate restrictions on reading postcards, just use envelopes where needed.
- filmgirlcw 14y ago
  Exactly. This guy was very publicly trying to either blackmail or sell the data. As someone who had an iPad 3G and was alerted my info was stolen, I was pissed at the future spam I knew I'd end up getting out of the whole thing. Weev is a troll. That's not a judgment, that's fact. His antics weren't about liberating data or making a bigger statement, it was about embarrassing a company. He did it for the lulz. The law might not see these as different cases (though like you, I know I do), but public opinion certainly will. To be totally honest, I'm sort of disgusted that he's using Aaron's suicide as fodder to try to gain sympathy or sentiment ahead of his sentencing.
  - tobyjsullivan 14y ago
    I have no issue with his personality being judged in the court of public opinion but I must ask if you really think he deserves this case being brought against him? Like the man or not, it's pretty easy for any technically savvy individual to see your information was leaked by AT&T, not this guy. He just pointed out what was going on. And this is hardly an "exploit" so much as stumbling across a glaring bug that he did report to a news organization, not leverage for profit. Does this really deserve a sentence that will effectively ruin a mans life (beyond the damage that has allegedly already been done)? Have you so much as stopped doing business with AT&T? I think the public has some responsibility to demand the justice system be fair for all individuals without bias, not just the ones we like. It's probably also worth asking what is being done about companies, like AT&T in this case, that are carelessly releasing said private information to the public while we are actively prosecuting people who stumble across it.
    - deleted 14y ago
      [deleted]
      - tobyjsullivan 14y ago
        > He did report it to a news organization,[1] but he also talked about how he was going to blackmail AT&T with it. Which is better evidence of his intent? His actions.
- deleted 14y ago
  [deleted]
- politician 14y ago
  The community has an opportunity to publicly judge whether the charges levied on Auernheimer match the severity of the actions he allegedly took. Specifically, is the prosecution trying to "make an example" of him by heaping charge upon overlapping charge? Are they pursuing a strategy of maximum years in jail in order to obtain a plea deal for an easy win? Are they claiming to the press that they Auernheimer is a Arthur C. Clarke-ian "frightening technology wizard or witch"? Do the prosecutors involved have an unreasonable stake in this case or political aspirations? Let's get some answers to these questions.
mcantelon 14y ago
I thought what had happened was they used his (pretty benign) hacking to justify a raid on his place then nailed him on drug charges? Or did they also pin hacking charges on his as well? http://news.cnet.com/8301-27080_3-20007827-245.html http://news.cnet.com/8301-27080_3-20007827-245.html
- rdl 14y ago
  They dropped all the local drug charges and stuck to federal hacking charges. Fayetteville, AR is a very poor/bad place and I think someone with a trivial amount of drugs, who is also a supreme internet troll, is not someone they'd want to prosecute locally.
  - joe_bleau 14y ago
    Ever been there? Fayetteville is a nice little college town and part of the booming northwest corner of the state. It's certainly not very poor.
    - rdl 14y ago
      Ah, no, you are right. I was generalizing from "Arkansas and not Bentonville", but I didn't realize how close it was. (I think this was based on an IRC discussion a few years before weev's arrest when people were wondering wtf everyone was moving to Fayetteville). Although court funding is state level, so Arkansas being poor overall would increase the desire to push stuff up to the feds. And I think states always do that anyway.
Anechoic 14y ago
HN Discussion from yesterday: http://news.ycombinator.com/item?id=5095634 http://news.ycombinator.com/item?id=5095634
denzil_correa 14y ago
Did Andrew try to sell the data for profit? He took a sample of the output to a journalist at Gawker and notified AT&T [0]. Why would one do that if he wants to sell data? However, what worries me is that in the same article it is mentioned that Since a member of the group tells us the script was shared with third-parties prior to AT&T closing the security hole, it's not known exactly whose hands the exploit fell into and what those people did with the names they obtained. It's pretty hard to know what really happened. I don't understand Auernheimer's actions at all - on one hand he informs AT&T/Gawker and on the other he sends the script to third parties. Even if his intentions were not malicious, Auernheimer acted immaturely. The lengthy blog post he wrote explaining his actions is no longer available and here's a cached version [1]. Some of the points directly contradict with the earlier Gawker article. The only person to receive the dataset was Gawker journalist Ryan Tate who responsibly redacted it. So, does this mean he didn't reveal the dataset but revealed the script? [0] http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed http://gawker.com/5559346/apples-worst-security-breach-11400... [1] http://webcache.googleusercontent.com/search?q=cache:PChrEDRqtCwJ:security.goatse.fr/on-disclosure-ethics+&cd=2&hl=en&ct=clnk&gl=in http://webcache.googleusercontent.com/search?q=cache:PChrEDR...
- Cushman 14y ago
  Just to be clear, by "script" here do we mean "Dude, check this out, you can just change /accounts?id=12345 to /accounts?id=12346"?
  - denzil_correa 14y ago
    Good point. The question I would ask is - Should he be doing even that given the fact he is in complete knowledge of the situation?
    - deleted 14y ago
      [deleted]
  - duskwuff 14y ago
    By "script", we mean a program written in PHP* which would generate plausible iPad ICC-IDs, run them by AT&T's web site, and save any ICC-IDs and email addresses it ended up with. *: per the Gawker article, http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed http://gawker.com/5559346/apples-worst-security-breach-11400...
mcantelon 14y ago
The knee jerk force is strong... just as HN excused itself from supporting Aaron because he was financially successful (he should "man up" and pay his own legal costs, etc.), weev's trolling serves as another excuse to withhold support.
- 1337biz 14y ago
  I absolutely agree with this point. There seems to be an ongoing pandering for some individual characteristics that made it somewhat okay to put someone in prison on ridiculous charges. Sure, Auenheimer is no saint, but these 'but he made babies cry' stories are just trying to distract from the real issue at hand.
davesims 14y ago
On the contrary, imo this actually highlights the gross injustice in Aaron's case, considering the outrageous imbalance in the potential sentencing in the two cases. I'm assuming here that the following two press accounts are not grossly misrepresenting the facts: http://www.reuters.com/article/2011/01/18/us-apple-ipad-idUSTRE70H3BH20110118 http://www.reuters.com/article/2011/01/18/us-apple-ipad-idUS... http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-... Here at least you have clearly stated malicious intent, which may or may not have been serious, in jest or otherwise, but clearly the potential harm in Andrew Auernheimer's case is real, so much so that they 'joked' about shorting ATT stock before they released the data. They were facing potentially only 10 years each max, compared to Aaron's 50. To me, the disproportionate charges in the two cases is the most galling thing and should serve to highlight how out of control the prosecutors were in the Swartz case. 10 years may even disproportionate in Auernheimer's case as well, but at the moment I'm quite unsympathetic given what I've read. I say all of that fully ready for the inevitable "HN Turnaround" when more facts and POVs are brought to bear and I change my mind on this. But at the moment I see very little in common between two self-aggrandizing lulzing jokers and Aaron Swartz.
- AnthonyMouse 14y ago
  As far as I can tell, Auernheimer is indeed a spectacular idiot. But that's kind of the problem. What he did was idiotic but still shouldn't have been criminal. What he did was, in is essence, pointing out that AT&T was allowing people worse than he is to easily get access to this information. Proof by demonstration, in a way that was almost entirely harmless -- no one malicious was given access to any new information, since the actual malicious parties could have about as easily exploited the exact same vulnerability if these idiots had done nothing. But here's the thing. Screw Auernheimer. Forget about him. He's a jerk, nobody is going to be motivated to fix anything to help someone like that. He opens his mouth and stupid comes out and it makes otherwise helpful people dislike him. And we need to fix the laws. For everyone. Not even these idiots deserve to be felons. But I agree that we shouldn't be touting them as examples, because they probably smell funny and it would be a great shame for the stench to rub off.
xb95 14y ago
Andrew Auernheimer, known online as "weev" (http://en.wikipedia.org/wiki/Weev http://en.wikipedia.org/wiki/Weev), is nothing like Aaron Swartz. I speak from personal experience with weev. Thanks to weev and his associates, my business partner, many of my volunteers, some family members of the above, and everybody who weev and his "trolls" could reach were subjected to a months-long campaign of constant harassement. * One volunteer had to interview with Child Protective Services and the police because of false complaints made by weev and his friends. * Another volunteer had trouble at her university because they tracked down her professors and made false claims. * Our business faced several Denial of Service attacks and false complaints to our merchant processors and hosting providers. * Harassing voicemails, phone calls, emails, IMs, IRC messages, etc etc etc. The list of things that weev and the so-called Gay Niggers Association of America (http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_America http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_Ameri...) did to us is pretty long. It's sad, really. In the end, it stopped when (I can only assume) he got bored. We developed a strong relationship with our hosting provider, our new payment processor, and we did as much as we could to help people who were put in bad situations because of weev's actions. Ultimately, we lost some volunteers and bled money for 3 months, but we survived. So, weev has a good enough story to get his "confession" in TechCrunch and on Twitter and people think that he's another example of the over-broad reach of law and the destruction of young lives by powerful corporations/organizations. Maybe it is. But if you value the legacy of Aaron Swartz, do not for one minute confuse him and Andrew Auernheimer. One was a man driven by a vision who helped defeat SOPA and did many other good and noble things, the other is a self-described troll who spent years of his life doing his best to extract "lulz" from the pain and suffering of his fellow human beings.
- lessnonymous 14y ago
  The story here is not about the person, but about the prosecution. weev is an ass, but the story should be about the persecution from the US DoJ. Being an ass doesn't mean you're not entitled to fair justice.
- mike_esspe 14y ago
  Is it related to LiveJournal abuse team moderation? If yes, you are not saying the whole story.

137 points by usaphp 14y ago

Even if they are similar cases (an assessment I disagree with), I doubt Auernheimer will get nearly as much sympathy among the hacker community given his history of trolling and malicious behavior, compared to Swartz's history of creative and constructive actions.

duskwuff 14y ago
Yeah, there are some pretty significant differences here. Among other things, weev more or less stated that he intended to harm AT&T by leaking their customer data and driving down their stock price, and that he was, at one point, considering selling the leaked data for profit. http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-...
- dmix 14y ago
  So the important question is what's the appropriate punishment... if this was his motives (assuming it's accurate)? The illegality of Aarons actions is debatable, but the sentencing and lawyering by the DoJ has been seen as inappropriate and over-zealous by almost all spectators.
- wnight 14y ago
  If any harm could come to AT&T's customers over this, then their stock price should fall. Also, as facts those email addresses aren't copyrightable. Taking them and selling them for profit is what all direct mail companies legally do with phone numbers and email addresses they find. Websites without passwords are like postcards. Don't try to mandate restrictions on reading postcards, just use envelopes where needed.
filmgirlcw 14y ago
Exactly. This guy was very publicly trying to either blackmail or sell the data. As someone who had an iPad 3G and was alerted my info was stolen, I was pissed at the future spam I knew I'd end up getting out of the whole thing. Weev is a troll. That's not a judgment, that's fact. His antics weren't about liberating data or making a bigger statement, it was about embarrassing a company. He did it for the lulz. The law might not see these as different cases (though like you, I know I do), but public opinion certainly will. To be totally honest, I'm sort of disgusted that he's using Aaron's suicide as fodder to try to gain sympathy or sentiment ahead of his sentencing.
- tobyjsullivan 14y ago
  I have no issue with his personality being judged in the court of public opinion but I must ask if you really think he deserves this case being brought against him? Like the man or not, it's pretty easy for any technically savvy individual to see your information was leaked by AT&T, not this guy. He just pointed out what was going on. And this is hardly an "exploit" so much as stumbling across a glaring bug that he did report to a news organization, not leverage for profit. Does this really deserve a sentence that will effectively ruin a mans life (beyond the damage that has allegedly already been done)? Have you so much as stopped doing business with AT&T? I think the public has some responsibility to demand the justice system be fair for all individuals without bias, not just the ones we like. It's probably also worth asking what is being done about companies, like AT&T in this case, that are carelessly releasing said private information to the public while we are actively prosecuting people who stumble across it.
  - deleted 14y ago
    [deleted]
    - tobyjsullivan 14y ago
      > He did report it to a news organization,[1] but he also talked about how he was going to blackmail AT&T with it. Which is better evidence of his intent? His actions.
deleted 14y ago
[deleted]
politician 14y ago
The community has an opportunity to publicly judge whether the charges levied on Auernheimer match the severity of the actions he allegedly took. Specifically, is the prosecution trying to "make an example" of him by heaping charge upon overlapping charge? Are they pursuing a strategy of maximum years in jail in order to obtain a plea deal for an easy win? Are they claiming to the press that they Auernheimer is a Arthur C. Clarke-ian "frightening technology wizard or witch"? Do the prosecutors involved have an unreasonable stake in this case or political aspirations? Let's get some answers to these questions.

mcantelon 14y ago

I thought what had happened was they used his (pretty benign) hacking to justify a raid on his place then nailed him on drug charges? Or did they also pin hacking charges on his as well? http://news.cnet.com/8301-27080_3-20007827-245.html http://news.cnet.com/8301-27080_3-20007827-245.html

rdl 14y ago
They dropped all the local drug charges and stuck to federal hacking charges. Fayetteville, AR is a very poor/bad place and I think someone with a trivial amount of drugs, who is also a supreme internet troll, is not someone they'd want to prosecute locally.
- joe_bleau 14y ago
  Ever been there? Fayetteville is a nice little college town and part of the booming northwest corner of the state. It's certainly not very poor.
  - rdl 14y ago
    Ah, no, you are right. I was generalizing from "Arkansas and not Bentonville", but I didn't realize how close it was. (I think this was based on an IRC discussion a few years before weev's arrest when people were wondering wtf everyone was moving to Fayetteville). Although court funding is state level, so Arkansas being poor overall would increase the desire to push stuff up to the feds. And I think states always do that anyway.

Anechoic 14y ago

HN Discussion from yesterday: http://news.ycombinator.com/item?id=5095634 http://news.ycombinator.com/item?id=5095634

denzil_correa 14y ago

Did Andrew try to sell the data for profit? He took a sample of the output to a journalist at Gawker and notified AT&T [0]. Why would one do that if he wants to sell data? However, what worries me is that in the same article it is mentioned that Since a member of the group tells us the script was shared with third-parties prior to AT&T closing the security hole, it's not known exactly whose hands the exploit fell into and what those people did with the names they obtained. It's pretty hard to know what really happened. I don't understand Auernheimer's actions at all - on one hand he informs AT&T/Gawker and on the other he sends the script to third parties. Even if his intentions were not malicious, Auernheimer acted immaturely. The lengthy blog post he wrote explaining his actions is no longer available and here's a cached version [1]. Some of the points directly contradict with the earlier Gawker article. The only person to receive the dataset was Gawker journalist Ryan Tate who responsibly redacted it. So, does this mean he didn't reveal the dataset but revealed the script? [0] http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed http://gawker.com/5559346/apples-worst-security-breach-11400... [1] http://webcache.googleusercontent.com/search?q=cache:PChrEDRqtCwJ:security.goatse.fr/on-disclosure-ethics+&cd=2&hl=en&ct=clnk&gl=in http://webcache.googleusercontent.com/search?q=cache:PChrEDR...

Cushman 14y ago
Just to be clear, by "script" here do we mean "Dude, check this out, you can just change /accounts?id=12345 to /accounts?id=12346"?
- denzil_correa 14y ago
  Good point. The question I would ask is - Should he be doing even that given the fact he is in complete knowledge of the situation?
  - deleted 14y ago
    [deleted]
- duskwuff 14y ago
  By "script", we mean a program written in PHP* which would generate plausible iPad ICC-IDs, run them by AT&T's web site, and save any ICC-IDs and email addresses it ended up with. *: per the Gawker article, http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed http://gawker.com/5559346/apples-worst-security-breach-11400...

mcantelon 14y ago

The knee jerk force is strong... just as HN excused itself from supporting Aaron because he was financially successful (he should "man up" and pay his own legal costs, etc.), weev's trolling serves as another excuse to withhold support.

1337biz 14y ago
I absolutely agree with this point. There seems to be an ongoing pandering for some individual characteristics that made it somewhat okay to put someone in prison on ridiculous charges. Sure, Auenheimer is no saint, but these 'but he made babies cry' stories are just trying to distract from the real issue at hand.

davesims 14y ago

On the contrary, imo this actually highlights the gross injustice in Aaron's case, considering the outrageous imbalance in the potential sentencing in the two cases. I'm assuming here that the following two press accounts are not grossly misrepresenting the facts: http://www.reuters.com/article/2011/01/18/us-apple-ipad-idUSTRE70H3BH20110118 http://www.reuters.com/article/2011/01/18/us-apple-ipad-idUS... http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-... Here at least you have clearly stated malicious intent, which may or may not have been serious, in jest or otherwise, but clearly the potential harm in Andrew Auernheimer's case is real, so much so that they 'joked' about shorting ATT stock before they released the data. They were facing potentially only 10 years each max, compared to Aaron's 50. To me, the disproportionate charges in the two cases is the most galling thing and should serve to highlight how out of control the prosecutors were in the Swartz case. 10 years may even disproportionate in Auernheimer's case as well, but at the moment I'm quite unsympathetic given what I've read. I say all of that fully ready for the inevitable "HN Turnaround" when more facts and POVs are brought to bear and I change my mind on this. But at the moment I see very little in common between two self-aggrandizing lulzing jokers and Aaron Swartz.

AnthonyMouse 14y ago
As far as I can tell, Auernheimer is indeed a spectacular idiot. But that's kind of the problem. What he did was idiotic but still shouldn't have been criminal. What he did was, in is essence, pointing out that AT&T was allowing people worse than he is to easily get access to this information. Proof by demonstration, in a way that was almost entirely harmless -- no one malicious was given access to any new information, since the actual malicious parties could have about as easily exploited the exact same vulnerability if these idiots had done nothing. But here's the thing. Screw Auernheimer. Forget about him. He's a jerk, nobody is going to be motivated to fix anything to help someone like that. He opens his mouth and stupid comes out and it makes otherwise helpful people dislike him. And we need to fix the laws. For everyone. Not even these idiots deserve to be felons. But I agree that we shouldn't be touting them as examples, because they probably smell funny and it would be a great shame for the stench to rub off.

xb95 14y ago

Andrew Auernheimer, known online as "weev" (http://en.wikipedia.org/wiki/Weev http://en.wikipedia.org/wiki/Weev), is nothing like Aaron Swartz. I speak from personal experience with weev. Thanks to weev and his associates, my business partner, many of my volunteers, some family members of the above, and everybody who weev and his "trolls" could reach were subjected to a months-long campaign of constant harassement. * One volunteer had to interview with Child Protective Services and the police because of false complaints made by weev and his friends. * Another volunteer had trouble at her university because they tracked down her professors and made false claims. * Our business faced several Denial of Service attacks and false complaints to our merchant processors and hosting providers. * Harassing voicemails, phone calls, emails, IMs, IRC messages, etc etc etc. The list of things that weev and the so-called Gay Niggers Association of America (http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_America http://en.wikipedia.org/wiki/Gay_Nigger_Association_of_Ameri...) did to us is pretty long. It's sad, really. In the end, it stopped when (I can only assume) he got bored. We developed a strong relationship with our hosting provider, our new payment processor, and we did as much as we could to help people who were put in bad situations because of weev's actions. Ultimately, we lost some volunteers and bled money for 3 months, but we survived. So, weev has a good enough story to get his "confession" in TechCrunch and on Twitter and people think that he's another example of the over-broad reach of law and the destruction of young lives by powerful corporations/organizations. Maybe it is. But if you value the legacy of Aaron Swartz, do not for one minute confuse him and Andrew Auernheimer. One was a man driven by a vision who helped defeat SOPA and did many other good and noble things, the other is a self-described troll who spent years of his life doing his best to extract "lulz" from the pain and suffering of his fellow human beings.

lessnonymous 14y ago
The story here is not about the person, but about the prosecution. weev is an ass, but the story should be about the persecution from the US DoJ. Being an ass doesn't mean you're not entitled to fair justice.
mike_esspe 14y ago
Is it related to LiveJournal abuse team moderation? If yes, you are not saying the whole story.