4 ms·

On the contrary, imo this actually highlights the gross injustice in Aaron's case, considering the outrageous imbalance in the potential sentencing in the two c

On the contrary, imo this actually highlights the gross injustice in Aaron's case, considering the outrageous imbalance in the potential sentencing in the two cases. I'm assuming here that the following two press accounts are not grossly misrepresenting the facts: http://www.reuters.com/article/2011/01/18/us-apple-ipad-idUSTRE70H3BH20110118 http://www.reuters.com/article/2011/01/18/us-apple-ipad-idUS... http://arstechnica.com/apple/2011/01/goatse-security-trolls-were-after-max-lols-in-att-ipad-hack/ http://arstechnica.com/apple/2011/01/goatse-security-trolls-... Here at least you have clearly stated malicious intent, which may or may not have been serious, in jest or otherwise, but clearly the potential harm in Andrew Auernheimer's case is real, so much so that they 'joked' about shorting ATT stock before they released the data. They were facing potentially only 10 years each max, compared to Aaron's 50. To me, the disproportionate charges in the two cases is the most galling thing and should serve to highlight how out of control the prosecutors were in the Swartz case. 10 years may even disproportionate in Auernheimer's case as well, but at the moment I'm quite unsympathetic given what I've read. I say all of that fully ready for the inevitable "HN Turnaround" when more facts and POVs are brought to bear and I change my mind on this. But at the moment I see very little in common between two self-aggrandizing lulzing jokers and Aaron Swartz.

AnthonyMouse 14y ago
As far as I can tell, Auernheimer is indeed a spectacular idiot. But that's kind of the problem. What he did was idiotic but still shouldn't have been criminal. What he did was, in is essence, pointing out that AT&T was allowing people worse than he is to easily get access to this information. Proof by demonstration, in a way that was almost entirely harmless -- no one malicious was given access to any new information, since the actual malicious parties could have about as easily exploited the exact same vulnerability if these idiots had done nothing. But here's the thing. Screw Auernheimer. Forget about him. He's a jerk, nobody is going to be motivated to fix anything to help someone like that. He opens his mouth and stupid comes out and it makes otherwise helpful people dislike him. And we need to fix the laws. For everyone. Not even these idiots deserve to be felons. But I agree that we shouldn't be touting them as examples, because they probably smell funny and it would be a great shame for the stench to rub off.
- davesims 14y ago
  I get it, but the flip side is that if Auernheimer is brought into the same discussion, do we not risk alienating a public likely very sympathetic to Swartz's plight? In other words, if it's possible that legal reform designed to prevent cases like Aaron's from occuring again, could also let bad actors like Auernheimer off the hook, that could undermine support for the reform. As far as whether Auernheimer is a felon, I still don't know. It's one thing to find a vulnerability, it's another thing entirely to not only not report it, but exploit it and openly discuss how to use the results to cause significant material harm. Reported actions of Auernheimer in the AT&T case: - Did not report the vulnerability but sat on it and refined a script to exploit the data and debated how and who in the press to report the vulnerability to in order to inflict the most economic damage. - Harvested over 114k emails. Alleged quotes of Auernheimer: - "I don't see the point unless we phish for passes even then that's boring" - "[A]t this point we won. we dropepd [sic] the stock price," Auernheimer wrote. "[L]et's not like do anything else we fking win and i get to like spin us as a legitimate security organization." Very, very hard to be sympathetic here. He exploited a vulnerability, stole information and discussed at length how to use it to inflict damage. Weigh into that his past malicious behavior, and I wonder if he's not getting off easy.
  - nookiemonster 14y ago
    I want this anecdote about weev to be the first thing that people talk about when someone brings up any comparison to Weev. http://bedizen.livejournal.com/258763.html http://bedizen.livejournal.com/258763.html Comparing Weev to Aaron is like comparing the dali lama to hitler. Weev is actively cultivating this comparison. DO NOT FEED THE FUCKING TROLL.
    - josephlord 14y ago
      From what I've heard Weev is an Ass and Aaron was a superhero. You don't need to compare them however to see similarities in how they were treated and the problems with the US "Justice" system. Prosecutorial bullying and overreach is bad whoever it is done to (even if they are an Ass/Hitler). Do you want 10 years to be the normal sentence (or even the prosecutors threat) for crawling URLs and reporting the privacy breaching results to the news media? In my view some of the behaviour in the story that you linked to is MORE criminal than the actions against AT&T. If evidence can be found for that I would be fully in favour of that prosecution but the he's done all these horrible things that we can't prove so lets trump up a minor issue we can prove concept doesn't feel like a secure route to freedom and justice for anybody. If the linked information could all be proved in court to be Weev I would be happy for him to get 1-2 years in prison for harassment or longer if it is a pattern of behaviour against other people too but for the AT&T "hack" anything over a month or two would seem excessive to me.
berlinbrown 14y ago
I have played the middle ground on this issue. I was trying to see it from the eye's the prosecutors or the law as it is concerned with the Computer Fraud and Abuse Act. How do they craft law that is generic enough to catch guys like meev but flexible that people like Aaron are found not guilty. I tell others, maybe the severity of the charges were harsh in Aaron's case but I was wondering if we should have had a trial proceed and hear the facts. Others argue that we shouldn't have had a trial and the prosecutor should be fired. But how do we know for sure that Aaron didn't commit a crime?
rsingel 14y ago
Let me pose another scenario. Say you have a journalist who suspects a company is doing something not kosher or has a big acquisition coming. That company has a strict policy that employees may not talk to the press without permission. Despite that the journalist probes, he tries a bunch of people, he then finds someone inside the company who is willing to talk and reveal the company is doing something unethical or is going to buy a company. The journalist then publishes that info and hopes, as a sign of the power of the story, that it is market-moving news. In an e-mail to an editor, she jokes that they ought to short the company. Or if you are Mark Cuban's short-lived venture, one actually shorts the company. Given the journalist has exceeded authorized access to an employee and hoped to do damage to a company, should that journalist be prosecuted and charged with a felony? If not, why is Weev being charged with a felony for doing the same exact thing by getting the info from a publicly available server that had no password protection?
- davesims 14y ago
  A journalist is protected by freedom of speech and freedom of association. We are not, no the other hand, free to take and publish data that is not ours from, for instance, filing cabinets or servers, no matter how good or bad the security is. A better example would be a competitor walking into an open office, opening a filing cabinet, taking yearly accounting reports and publishing them right before an IPO in order to tank the stock value. This is much closer to what weev actually did. To follow your analogy further, the Chinese spies who socially engineered access to RSA's security hashes wouldn't be guilty either. A security hole, like an open door, is not a tacit abdication of rights to a company's data, nor a tacit invitation to do any and all kinds of harm to the company with that data, nor a tacit surrender of all legal means to recoup damages resulting from the stolen data.

AnthonyMouse 14y ago

As far as I can tell, Auernheimer is indeed a spectacular idiot. But that's kind of the problem. What he did was idiotic but still shouldn't have been criminal. What he did was, in is essence, pointing out that AT&T was allowing people worse than he is to easily get access to this information. Proof by demonstration, in a way that was almost entirely harmless -- no one malicious was given access to any new information, since the actual malicious parties could have about as easily exploited the exact same vulnerability if these idiots had done nothing. But here's the thing. Screw Auernheimer. Forget about him. He's a jerk, nobody is going to be motivated to fix anything to help someone like that. He opens his mouth and stupid comes out and it makes otherwise helpful people dislike him. And we need to fix the laws. For everyone. Not even these idiots deserve to be felons. But I agree that we shouldn't be touting them as examples, because they probably smell funny and it would be a great shame for the stench to rub off.

davesims 14y ago
I get it, but the flip side is that if Auernheimer is brought into the same discussion, do we not risk alienating a public likely very sympathetic to Swartz's plight? In other words, if it's possible that legal reform designed to prevent cases like Aaron's from occuring again, could also let bad actors like Auernheimer off the hook, that could undermine support for the reform. As far as whether Auernheimer is a felon, I still don't know. It's one thing to find a vulnerability, it's another thing entirely to not only not report it, but exploit it and openly discuss how to use the results to cause significant material harm. Reported actions of Auernheimer in the AT&T case: - Did not report the vulnerability but sat on it and refined a script to exploit the data and debated how and who in the press to report the vulnerability to in order to inflict the most economic damage. - Harvested over 114k emails. Alleged quotes of Auernheimer: - "I don't see the point unless we phish for passes even then that's boring" - "[A]t this point we won. we dropepd [sic] the stock price," Auernheimer wrote. "[L]et's not like do anything else we fking win and i get to like spin us as a legitimate security organization." Very, very hard to be sympathetic here. He exploited a vulnerability, stole information and discussed at length how to use it to inflict damage. Weigh into that his past malicious behavior, and I wonder if he's not getting off easy.
- nookiemonster 14y ago
  I want this anecdote about weev to be the first thing that people talk about when someone brings up any comparison to Weev. http://bedizen.livejournal.com/258763.html http://bedizen.livejournal.com/258763.html Comparing Weev to Aaron is like comparing the dali lama to hitler. Weev is actively cultivating this comparison. DO NOT FEED THE FUCKING TROLL.
  - josephlord 14y ago
    From what I've heard Weev is an Ass and Aaron was a superhero. You don't need to compare them however to see similarities in how they were treated and the problems with the US "Justice" system. Prosecutorial bullying and overreach is bad whoever it is done to (even if they are an Ass/Hitler). Do you want 10 years to be the normal sentence (or even the prosecutors threat) for crawling URLs and reporting the privacy breaching results to the news media? In my view some of the behaviour in the story that you linked to is MORE criminal than the actions against AT&T. If evidence can be found for that I would be fully in favour of that prosecution but the he's done all these horrible things that we can't prove so lets trump up a minor issue we can prove concept doesn't feel like a secure route to freedom and justice for anybody. If the linked information could all be proved in court to be Weev I would be happy for him to get 1-2 years in prison for harassment or longer if it is a pattern of behaviour against other people too but for the AT&T "hack" anything over a month or two would seem excessive to me.

berlinbrown 14y ago

I have played the middle ground on this issue. I was trying to see it from the eye's the prosecutors or the law as it is concerned with the Computer Fraud and Abuse Act. How do they craft law that is generic enough to catch guys like meev but flexible that people like Aaron are found not guilty. I tell others, maybe the severity of the charges were harsh in Aaron's case but I was wondering if we should have had a trial proceed and hear the facts. Others argue that we shouldn't have had a trial and the prosecutor should be fired. But how do we know for sure that Aaron didn't commit a crime?

rsingel 14y ago

Let me pose another scenario. Say you have a journalist who suspects a company is doing something not kosher or has a big acquisition coming. That company has a strict policy that employees may not talk to the press without permission. Despite that the journalist probes, he tries a bunch of people, he then finds someone inside the company who is willing to talk and reveal the company is doing something unethical or is going to buy a company. The journalist then publishes that info and hopes, as a sign of the power of the story, that it is market-moving news. In an e-mail to an editor, she jokes that they ought to short the company. Or if you are Mark Cuban's short-lived venture, one actually shorts the company. Given the journalist has exceeded authorized access to an employee and hoped to do damage to a company, should that journalist be prosecuted and charged with a felony? If not, why is Weev being charged with a felony for doing the same exact thing by getting the info from a publicly available server that had no password protection?

davesims 14y ago
A journalist is protected by freedom of speech and freedom of association. We are not, no the other hand, free to take and publish data that is not ours from, for instance, filing cabinets or servers, no matter how good or bad the security is. A better example would be a competitor walking into an open office, opening a filing cabinet, taking yearly accounting reports and publishing them right before an IPO in order to tank the stock value. This is much closer to what weev actually did. To follow your analogy further, the Chinese spies who socially engineered access to RSA's security hashes wouldn't be guilty either. A security hole, like an open door, is not a tacit abdication of rights to a company's data, nor a tacit invitation to do any and all kinds of harm to the company with that data, nor a tacit surrender of all legal means to recoup damages resulting from the stolen data.