5 ms·

Trolling is not illegal. Embarrassing a company is not illegal. Talking or joking about blackmailing a company on IRC is not illegal. Taking a security exploit

by neilk 14y ago

Trolling is not illegal. Embarrassing a company is not illegal. Talking or joking about blackmailing a company on IRC is not illegal. Taking a security exploit first to a journalist, rather than the parties involved, is not illegal. I am not a lawyer, but as I understand it, the crime that weev is being charged with is literally that he accessed certain publicly available URLs. For this, he is being charged with "accessing a computer without authorization" and fraud. As for Aaron versus weev: our dedication to a principle is tested when it protects people that we don't like.

rayiner 14y ago
Crime = intent + action. Doing two otherwise legal things may amount to a crime. For example, it is not illegal to talk about killing your ex-wife. It is also not illegal to walk to her house with a chainsaw. Both those things are by themselves quite legal. But combine the two, and you can quite fairly be charged for attempted murder.
- craigching 14y ago
  Not trolling, genuinely curious, is it a crime to say "I might do this" vs. actually doing it? What is the law that's broken? I have to agree with neil, though I'm not suggesting you're doing this: > our dedication to a principle is tested when it protects people that we don't like
  - rayiner 14y ago
    > Not trolling, genuinely curious, is it a crime to say "I might do this" vs. actually doing it? What is the law that's broken? You're oversimplifying the situation. See: http://en.wikipedia.org/wiki/Model_Penal_Code http://en.wikipedia.org/wiki/Model_Penal_Code. As I said, crime = intent + action. If you kill someone, and you had no bad intent (it was neither your purpose to kill them nor were you acting negligently), then there is no crime. At the same time, if you fully intend to kill someone, but don't take any action consistent with that intent, there is no crime. The two factors must also exist simultaneously. If you intend to kill someone, and buy a gun, you can be charged with attempted murder. If you fully intend to kill someone today, but then change your mind, and tomorrow buy a gun because of a rash of burglaries tomorrow, then there is no crime. Now, obviously we can't get inside someone's head. So we infer intent from action. But we must always remember that the focus is not the action, but what the action says as evidence of the person's intent. And no matter what intent is inferred, there must still be independent action towards committing the crime. So no, it's not illegal to say "I might do this." But, saying "I might do this" can amount to evidence that you intend, in fact, to do this, and if you independently take some other action consistent with this intent, you can be charged with an attempted crime.
    - AnthonyMouse 14y ago
      Is that really right? So let me get this straight: If I buy a gun with the notion that I intend to hunt a bear with it, maybe not even knowing that it's illegal, then I read on the internet that bears are super deadly and stay home, I'm still guilty of attempting to hunt a bear because I bought a gun intending to hunt a bear with it? What if I go to the beach at night not knowing that you can't enter the beach after sunset, then when I get there I see the sign and turn back without going in? Attempted trespassing on the beach after sunset for driving to the beach with that intent? It seems like there has to be a piece missing somewhere. I mean what if my intent is to do something I'm not sure is a crime but in actual fact is and the act in furtherance of it is to call my lawyer and ask where it's actually a crime? I have to be missing something here.
      - rayiner 14y ago
        Note that I'm talking about the Model Penal Code, which is strongly influential on American criminal law since the last 50 years, but isn't 100% the actual law anywhere. Attempts are one of those areas where the MPC is probably too academic and actual states diverge. E.g. the MPC punishes attempts as harshly as the actual crimes, because it focuses so heavily on intent. In the MPC, there's (at least) three backstops. 1) The act in furtherance must be a "substantial step" and "strongly corroborative of criminal intent." The latter language creates a sliding scale for the former. Building a dirty bomb might be a substantial step towards a terrorist plot, but "attempted bear hunting" probably requires a park ranger to find you aiming at a bear. 2) Abandonment of the plan is a complete defense. 3) The mens rea for attempts is high. Actual crimes that require only reckless intent require purposeful intent for attempts at committing that crime. The MPC indulges itself in a little bit of "if a tree falls in the forest" thinking, but largely because it tries to take principles to their logical conclusions. There is an interesting primer on it: https://www.law.upenn.edu/fac/phrobins/intromodpencode.pdf https://www.law.upenn.edu/fac/phrobins/intromodpencode.pdf.
- neilk 14y ago
  weev is not being charged with blackmail. As far as I know, he didn't do anything to accomplish that goal. He talked a little bit about it on IRC. Instead he went to a journalist, perhaps to increase his infamy. It's become part of the trial to establish that he didn't have good intentions and is a generally obnoxious person. I have to say I agree with that - after discovering the issue, he downloaded lots of people's personal data, which wasn't admirable behavior. You might download 10, 20, 100, just to see what happens. After that, the right thing is to disclose it to the company (anonymously if you have to), and then publicly if they do nothing about it. But if what he did is a crime, there should be a more tightly worded law about it. He didn't misrepresent his identity; it was AT&T's fault for not checking. He didn't access a computer without authorization; AT&T did the equivalent of emptying a box of private documents on their front lawn.
  - rayiner 14y ago
    > It's become part of the trial to establish that he didn't have good intentions and is a generally obnoxious person. But that's not a crime. Not having good intentions then taking action consistent with that is the definition of a crime.
- rsingel 14y ago
  He never contacted AT&T. There was no talk of blackmail. He embarrassed the company. The alleged crime was identity theft. The people he was accused of stealing the identity of were journalists whose emails and UCC-IDs were pulled out of the data in order to email it to them to get their attention. It's a bullshit prosecution and I'm flabbergasted that people on this board 1) can't bother to dig up the facts and 2) support the feds prosecuting yet another hacker who didn't do shit. https://www.documentcloud.org/documents/522213-auren.html https://www.documentcloud.org/documents/522213-auren.html
  - rayiner 14y ago
    You're right, corrected.
  - tptacek 14y ago
    The ID theft charge is obviously bullshit. Of course, the ID theft helps enable the CFAA charge.
- legutierr 14y ago
  It's very frustrating reading the analogies that you are attempting to use to describe the charges in this case. Is what weev did the same as walking to your ex-wife's house with a chainsaw while you shout that you're going to murder her (God forbid)? No, of course not. Given the actual harm or potential harm incurred here, weev's crime was more like walking to your ex-wife's house with an oversized down pillow while you talk about giving her a spanking on the bottom with it. Is what weev did the same thing as walking into a stranger's house through his unlocked front door and then rifling through his personal papers? I don't think so. It would be better to say it is the same thing as walking past a house after the owner has plastered it with old credit card statements and then remarking to a fellow passer-by that you might make some expensive purchases using that now-public information. The problem with the charges filed against weev and the charges filed against aaronsw is that they were based on a law that so lacks specificity and grounding in actual computer practice that even computer professionals need to use analogies to justify the illegality of the acts. If the law were legitimate such analogies would not be required. Is it fair to convict a person based on an analogy, when another analogy might be more correct? If an appropriate analogy is required to determine guilt, then does the analogy itself take on the weight of law, and if so, who is to determine the correct analogy to apply in such a case (when the choice of appropriate analogy is what determines guilt or innocence), the judge, or the jury? No, if an action is going to be criminal, it must be possible to describe that action itself in its own literal terms and thereby determine its criminality. You write that "crime = intent + action", and then you talk about nothing but his intent. The fact is that the action he undertook can only be described as criminal insofar as accessing a public URL that is not otherwise publicized qualifies as "exceeding access", which is what the CFAA makes a crime. This is the problem with your argument, with the cases against both weev and aaronsw, and with the CFAA itself. Whatever ill will may have existed in weev's mind (I'm sure there is plenty there to go around), for his action iteself to be criminal, weev had to know what was in the mind of AT&T. And how could he? Because "authorization" is not a concept in the http protocol (or maybe there is, if you count http authentication, which wasn't used here) there are no methods besides clairvoyancy or pure gussing to determine whether a public URL is intended for open access or not. We have to assume that a public URL automatically grants authorization. This is why the case against weev is so distressing. Although his intent may have been questionable, the actual action that is being prosecuted in this case is nothing more than fiddling with a url in a web browser. Who hasn't done this when looking through an image site like imgur.com or similar, just to see what's there randomly? We do this because it is universally accepted that unless a password restriction has been placed on a url, any publicly-accessible URL is intended to be viewed by the general public. Assuming anything else would break the Internet.

by neilk 14y ago

rayiner 14y ago

Crime = intent + action. Doing two otherwise legal things may amount to a crime. For example, it is not illegal to talk about killing your ex-wife. It is also not illegal to walk to her house with a chainsaw. Both those things are by themselves quite legal. But combine the two, and you can quite fairly be charged for attempted murder.

craigching 14y ago
Not trolling, genuinely curious, is it a crime to say "I might do this" vs. actually doing it? What is the law that's broken? I have to agree with neil, though I'm not suggesting you're doing this: > our dedication to a principle is tested when it protects people that we don't like
- rayiner 14y ago
  > Not trolling, genuinely curious, is it a crime to say "I might do this" vs. actually doing it? What is the law that's broken? You're oversimplifying the situation. See: http://en.wikipedia.org/wiki/Model_Penal_Code http://en.wikipedia.org/wiki/Model_Penal_Code. As I said, crime = intent + action. If you kill someone, and you had no bad intent (it was neither your purpose to kill them nor were you acting negligently), then there is no crime. At the same time, if you fully intend to kill someone, but don't take any action consistent with that intent, there is no crime. The two factors must also exist simultaneously. If you intend to kill someone, and buy a gun, you can be charged with attempted murder. If you fully intend to kill someone today, but then change your mind, and tomorrow buy a gun because of a rash of burglaries tomorrow, then there is no crime. Now, obviously we can't get inside someone's head. So we infer intent from action. But we must always remember that the focus is not the action, but what the action says as evidence of the person's intent. And no matter what intent is inferred, there must still be independent action towards committing the crime. So no, it's not illegal to say "I might do this." But, saying "I might do this" can amount to evidence that you intend, in fact, to do this, and if you independently take some other action consistent with this intent, you can be charged with an attempted crime.
  - AnthonyMouse 14y ago
    Is that really right? So let me get this straight: If I buy a gun with the notion that I intend to hunt a bear with it, maybe not even knowing that it's illegal, then I read on the internet that bears are super deadly and stay home, I'm still guilty of attempting to hunt a bear because I bought a gun intending to hunt a bear with it? What if I go to the beach at night not knowing that you can't enter the beach after sunset, then when I get there I see the sign and turn back without going in? Attempted trespassing on the beach after sunset for driving to the beach with that intent? It seems like there has to be a piece missing somewhere. I mean what if my intent is to do something I'm not sure is a crime but in actual fact is and the act in furtherance of it is to call my lawyer and ask where it's actually a crime? I have to be missing something here.
    - rayiner 14y ago
      Note that I'm talking about the Model Penal Code, which is strongly influential on American criminal law since the last 50 years, but isn't 100% the actual law anywhere. Attempts are one of those areas where the MPC is probably too academic and actual states diverge. E.g. the MPC punishes attempts as harshly as the actual crimes, because it focuses so heavily on intent. In the MPC, there's (at least) three backstops. 1) The act in furtherance must be a "substantial step" and "strongly corroborative of criminal intent." The latter language creates a sliding scale for the former. Building a dirty bomb might be a substantial step towards a terrorist plot, but "attempted bear hunting" probably requires a park ranger to find you aiming at a bear. 2) Abandonment of the plan is a complete defense. 3) The mens rea for attempts is high. Actual crimes that require only reckless intent require purposeful intent for attempts at committing that crime. The MPC indulges itself in a little bit of "if a tree falls in the forest" thinking, but largely because it tries to take principles to their logical conclusions. There is an interesting primer on it: https://www.law.upenn.edu/fac/phrobins/intromodpencode.pdf https://www.law.upenn.edu/fac/phrobins/intromodpencode.pdf.
neilk 14y ago
weev is not being charged with blackmail. As far as I know, he didn't do anything to accomplish that goal. He talked a little bit about it on IRC. Instead he went to a journalist, perhaps to increase his infamy. It's become part of the trial to establish that he didn't have good intentions and is a generally obnoxious person. I have to say I agree with that - after discovering the issue, he downloaded lots of people's personal data, which wasn't admirable behavior. You might download 10, 20, 100, just to see what happens. After that, the right thing is to disclose it to the company (anonymously if you have to), and then publicly if they do nothing about it. But if what he did is a crime, there should be a more tightly worded law about it. He didn't misrepresent his identity; it was AT&T's fault for not checking. He didn't access a computer without authorization; AT&T did the equivalent of emptying a box of private documents on their front lawn.
- rayiner 14y ago
  > It's become part of the trial to establish that he didn't have good intentions and is a generally obnoxious person. But that's not a crime. Not having good intentions then taking action consistent with that is the definition of a crime.
rsingel 14y ago
He never contacted AT&T. There was no talk of blackmail. He embarrassed the company. The alleged crime was identity theft. The people he was accused of stealing the identity of were journalists whose emails and UCC-IDs were pulled out of the data in order to email it to them to get their attention. It's a bullshit prosecution and I'm flabbergasted that people on this board 1) can't bother to dig up the facts and 2) support the feds prosecuting yet another hacker who didn't do shit. https://www.documentcloud.org/documents/522213-auren.html https://www.documentcloud.org/documents/522213-auren.html
- rayiner 14y ago
  You're right, corrected.
- tptacek 14y ago
  The ID theft charge is obviously bullshit. Of course, the ID theft helps enable the CFAA charge.
legutierr 14y ago
It's very frustrating reading the analogies that you are attempting to use to describe the charges in this case. Is what weev did the same as walking to your ex-wife's house with a chainsaw while you shout that you're going to murder her (God forbid)? No, of course not. Given the actual harm or potential harm incurred here, weev's crime was more like walking to your ex-wife's house with an oversized down pillow while you talk about giving her a spanking on the bottom with it. Is what weev did the same thing as walking into a stranger's house through his unlocked front door and then rifling through his personal papers? I don't think so. It would be better to say it is the same thing as walking past a house after the owner has plastered it with old credit card statements and then remarking to a fellow passer-by that you might make some expensive purchases using that now-public information. The problem with the charges filed against weev and the charges filed against aaronsw is that they were based on a law that so lacks specificity and grounding in actual computer practice that even computer professionals need to use analogies to justify the illegality of the acts. If the law were legitimate such analogies would not be required. Is it fair to convict a person based on an analogy, when another analogy might be more correct? If an appropriate analogy is required to determine guilt, then does the analogy itself take on the weight of law, and if so, who is to determine the correct analogy to apply in such a case (when the choice of appropriate analogy is what determines guilt or innocence), the judge, or the jury? No, if an action is going to be criminal, it must be possible to describe that action itself in its own literal terms and thereby determine its criminality. You write that "crime = intent + action", and then you talk about nothing but his intent. The fact is that the action he undertook can only be described as criminal insofar as accessing a public URL that is not otherwise publicized qualifies as "exceeding access", which is what the CFAA makes a crime. This is the problem with your argument, with the cases against both weev and aaronsw, and with the CFAA itself. Whatever ill will may have existed in weev's mind (I'm sure there is plenty there to go around), for his action iteself to be criminal, weev had to know what was in the mind of AT&T. And how could he? Because "authorization" is not a concept in the http protocol (or maybe there is, if you count http authentication, which wasn't used here) there are no methods besides clairvoyancy or pure gussing to determine whether a public URL is intended for open access or not. We have to assume that a public URL automatically grants authorization. This is why the case against weev is so distressing. Although his intent may have been questionable, the actual action that is being prosecuted in this case is nothing more than fiddling with a url in a web browser. Who hasn't done this when looking through an image site like imgur.com or similar, just to see what's there randomly? We do this because it is universally accepted that unless a password restriction has been placed on a url, any publicly-accessible URL is intended to be viewed by the general public. Assuming anything else would break the Internet.