4 ms·

"The new version defines unauthorized access as "the circumvention of technological access barriers," which leaves a much narrower scope for prosecution. It als

• superuser2 14y ago
  That's trespassing, not hacking. I certainly hope plugging into a switch doesn't upgrade a minor local misdemeanor to federal felony hacking.
  • raldi 14y ago
    Hope aside, I'm trying to address what the bill would actually do, and I don't see how it would have cleared Aaron. Reread the first line I quoted. What part of the redefinition of "unauthorized access" makes it no longer apply to plugging into a network layer you know you're not authorized to be on, for the purposes of circumventing a technological access barrier like the JSTOR antiscraping system?
    • politician 14y ago
      Wasn't the trespassing charge dropped?
      • raldi 14y ago
        I don't see how the trespassing charge is relevant here. We're discussing the proposed bill, and what its impact would be on computer crime law.
        • politician 14y ago
          Sorry, I misread you as suggesting that because the proposed bill wouldn't affect the closet access that it was an ineffective bill. In any case, all of the MAC addresses he used were authorized to be on the MIT network until they stopped working without notice. Doesn't the bill now state that changing MAC addresses is not circumvention?
          • mpyne 14y ago
            He saying there's two separate things going on when Aaron went into the closet. 1. Trespassing. This is not germane to this discussion though. 2. Unauthorized circumvention of a technological measure (i.e. deliberately hooking up to a trusted subnet to evade the blocks that had been place on his previous network access) Aaron would very well still have been in violation of even the proposed law, as worded now.
            • deleted 14y ago
              [deleted]
  • tzs 14y ago
    Sneaking into the closet is trespassing. Plugging into the network while he's in there is not trespassing.
    • raldi 14y ago
      Well, to be fair, trespassing law is complicated. If there's a sign like "NO TRESPASSING" or "WELCOME" it's pretty clear-cut, but otherwise, there's several centuries of case history that comes into play, ultimately boiling down to which of the two signs above was implied by the surrounding objects and circumstances. It's hard to know whether his presence in the closet legally counted as trespassing or not, but from my understanding (and the fact that he wasn't being prosecuted for it), I don't think it applied here.
• Cushman 14y ago
  What about the part where he walked into an unlocked closet and plugged into an unsecured Ethernet port, using access to the network he had already been granted? I'd like to think that if I'm walking by your house and connect to your free open hotspot, I'm not committing a felony because you meant to put a password on it.
  • raldi 14y ago
    Clealrly the core network in the closet and the wifi network outside were not equivalent, or he wouldn't have been in there in the first place. He had permission to access the latter, not the former, and the fact that he was hiding his face when he went in there is evidence that he knew he didn't have permission to plug into that layer. He was escalating his level of privilege by connecting at a deeper level than he had been granted access to.
    • Cushman 14y ago
      Anyone who's done networking knows that ethernet and wifi are not equivalent. I'll grant you he was escalating his bandwidth; what is this "privilege" you describe which was neither physical nor technical?
      • raldi 14y ago
        No, I think you're misunderstanding a key part of this: MIT has a layer of defense between their public-access networks (like campus wifi) and their core network. Among other things, that's the layer their antiscraping defenses live in. The closet router was deeper than that -- inside that layer of defense. Aaron didn't just plug in for bandwidth or permanence -- he did it because it was a trusted subnet that would evade the protections and restrictions MIT places on their public access points.
        • Cushman 14y ago
          Ah, noted. Evading rate limiting to a resource you have lawful access to still reads to me as bandwidth, not privilege, but point taken. But still— unlocked closet, unsecured network, all, we are given to understand, because of a very lenient open network policy. If he was not "authorized" access, what is the authority, and when would the authorization have taken place? It seems a terribly tough row to hoe.
• aspensmonster 14y ago
  I'm more interested in how the rewording from "unauthorized access" to "the circumvention of technological access barriers" holds any substantial practical difference. It gives the defense a leg to stand on by specifying "technological" access barriers and their "circumvention," and the amendments also exclude ToS violations as barriers. But what's to stop a prosecutor from arguing that unrelated technological barriers were in place elsewhere, and the fact that a defendant didn't encounter these (technological) barriers still constitutes circumvention? I guess there'd be a big fight over "circumvention," but IANAL so perhaps it's all moot. I also don't understand how "changing one's MAC or IP address [in order to circumvent] 'technological access measures'" doesn't constitute a violation in principle, even if their proposed bill decides to whitelist those two behaviours notwithstanding other portions of the bill.
  • mpyne 14y ago
    > I also don't understand how "changing one's MAC or IP address [in order to circumvent] 'technological access measures'" doesn't constitute a violation in principle It is a violation in principle; the real world equivalent would be having a posted picture saying "DO NOT ADMIT THIS MAN INSIDE" but Aaron walks up wearing a ridiculous faux mustache and gets admitted anyways. IMHO it's explicitly whitelisted not because of the principle, but because it's the behavior Aaron employed that they're trying to make legal in the future.
• sigzero 14y ago
  "The new version defines unauthorized access as "the circumvention of technological access barriers,"" Um no. You don't need to circumvent anything to be "unauthorized".
  • fnordfnordfnord 14y ago
    >"the circumvention of technological access barriers," Oh good grief. That's so vague it could mean jumping a queue, or even less. Here, a criminal circumvents technological access barriers. http://i0.kym-cdn.com/photos/images/newsfeed/000/182/549/cPxPA.jpg?1318992465 http://i0.kym-cdn.com/photos/images/newsfeed/000/182/549/cPx...
  • walshemj 14y ago
    yes thats why the original official secrets act was passed in the UK after they found a german national sketching away inside a dock yard pre WW1. And if I find an open telecoms cab and tap your phone that is still an offense.
• fnordfnordfnord 14y ago
  >I'd like to think that if someone breaks into my home LAN, they won't beat the rap... Burglary is already against the law. I might suggest that you don't leave any conspicuous ethernet jacks in your front yard where passers-by might be tempted.
  • Anechoic 14y ago
    But what if I keep my door unlocked? Is it okay for someone to walk in my house and plug into my network?
    • raldi 14y ago
      Or what if you run a university, or a library, or a restaurant, or a B&B, or anything else where members of the general public are welcome to visit, but not necessarily granted full permission to do anything they want?
      • fnordfnordfnord 14y ago
        I'd say that if you operate any of those entities and leave unprotected (to such a degree) access to anything important enough to actually deserve a felony rap, then you are negligent to some degree. What's wrong with the civil courts for such things?
    • fnordfnordfnord 14y ago
      That's trespassing, and unlawful entry? I'm confident that there is an existing law that covers it without resorting to felony CFAA charges.