9 ms·

Good to hear. I have quite a lot of respect for Kerr; he's one of the foremost experts in this area (the intersection of the 4th ammendment with computers and

by Lazare 14y ago

Good to hear. I have quite a lot of respect for Kerr; he's one of the foremost experts in this area (the intersection of the 4th ammendment with computers and networks), and I think Weev's case is a serious injustice. As an aside, I actually think it's clear that Weev's case is a vastly larger injustice than Aaron Swartz's case. Swartz clearly violated the law in an act of willing and knowing civil disobedience. The law restricts people from unauthorized access to a network; Swartz and the MIT network admins played a game of cat and mouse as they kept banning him, and he kept finding new ways of gaining access to the network. There's no way to argue Swartz didn't realize that he was gaining unauthorized access to a network. At one point he was hiding his face from security cameras; there's no way to spin that as "oh, he thought he was doing something perfectly allowable!" And once caught, he was offered a reasonable plea deal. In contrast, Weev...fairly clearly did not gain unauthorized access to a network. It was a publicly available website, and no one ever tried to stop him. His actions were at worse borderline, and yet he ended up with a sentence MUCH higher than Swartz. I have a lot of sympathy for Swartz (not least because of his tragic suicide), but at the end of the day he knowingly and wilfully violated the law in an act of civil disobedience, and was offered a plea deal of less than a year. Weev probably did not violate the law, and was sentenced to years in prison. Weev needs and deserves help. I had to cheer a bit when I saw Kerr was going to be helping him.

sigzero 14y ago
Didn't he use an unpublished link? That would be "unauthorized" to me.
- cheald 14y ago
  http://en.wikipedia.org/wiki/Security_through_obscurity http://en.wikipedia.org/wiki/Security_through_obscurity
  - rayiner 14y ago
    The fact that a security mechanism is poor shouldn't mean that it doesn't create a legally enforceable boundary. If I tape my door shut instead of buying a proper lock, that doesn't give you the right to walk in.
    - cheald 14y ago
      Bad analogy. A door is an access control mechanism. A Uniform Resource Locator is not. A more apt analogy would claiming that having your phone number not published in the phone book constitutes a legally enforceable boundary against being contacted by phone.
      - rayiner 14y ago
        We can debate about whether URLs have elements of an access control mechanism or not, but if obscured URLs don't create a legally protect-able boundary, the argument should be because they're not an access control mechanism, not that they're a poor access control mechanism (which is the usual implication of "security through obscurity"). In other words, the argument should be about how clearly the boundaries are drawn, not how effective the security mechanisms are.
        cheald 14y ago
        Granted. The security-through-obscurity link was an oversimplification.
      - aqme28 14y ago
        Here's an analogy for you: I don't publish my address in the phonebook or anywhere, but because you know that 4001 Example streeet is a house and 4003 Example street is a house, you're still able to solicit me at 4005 Example street.
- jonathanwallace 14y ago
  Can you clarify what "published" means in the context of a http link? Preferably citing the appropriate section in the RFC, http://www.w3.org/Protocols/rfc2616/rfc2616.html http://www.w3.org/Protocols/rfc2616/rfc2616.html?
- ghshephard 14y ago
  Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the URL bar? (One less than this article's URL)
  - rayiner 14y ago
    It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized. There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.
    - doppel 14y ago
      Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).
      - jerf 14y ago
        I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.
- mcherm 14y ago
  That strikes me as a very surprising position to take. So you consider it a felony to enter in a browser some URL that has not been been "published". What exactly counts as published? For instance, if I created another page that links to it, is that "published"? Is it still "published" if I later delete that other page? Is it "published" if someone else somewhere in the world creates a page linking to it, but I never create one? What if I print a riddle in the newspaper, which says that the answer to the riddle is the URL in question... is that "publishing" it? What if it's a really HARD riddle? What if I don't print the riddle in the newspaper, but it's a really easy riddle... something like "just add one"? I honestly do not think that whether you "publish" a URL should be used as an indicator of whether access is authorized. Every web server I have ever heard of has the ability to return a "401 Unauthorized" error code, and to do so or not based on the credentials of the person connecting. If I were writing the law, I would say that guessing a password to put in such a box, or accessing it with a malformed request used a bug in the server to bypass such a credential check would certainly qualify as "unauthorized access", but that "AT&T didn't bother to require a check before returning the data to any browser that asked for it" would be evidence that it was explicitly authorized.
- mk3 14y ago
  basically if he looses the court. 404 page may result in getting orange jumpsuit and nice check to be paid. In my opinion leaving personal information accessible to general public (i.e. no authentication needed) is a crime. Letting journalists know is not a crime. In this case AT&T is responsible for misplacing personal data, and not the guy who had free access to it. In some ways it's really similar to Aaron Swartz case, as both guys found a way to get the data, and both got sued. I would suggest looking into this case more closelly as if he ends up in jail or pays a dime, a simple misuse of some companies website and/or public API (think Google Maps, etc.) Could land you in jail
rayiner 14y ago
Honestly, both are/were/would have been bad test cases. With Swartz you've got two issues in the same case: downloading JSTOR articles and trying to get on MIT's network despite being banned. It's easy to support the former without supporting the latter and "muddled" makes for a bad test case. With Weev, you've also got two issues. He was not just convicted of downloading things from AT&T's network. If that was the beginning and end of it, it would have made for a good test case. Instead, he downloaded tends of thousands of pieces of personal information then bragged on IRC how he was going to sell it to scammers to damage AT&T. That's not "civil disobedience." That's malicious. Note that this is on appeal, so the jury's verdict on the "fraud in connection with personal information" charge is to a degree locked in. On appeal, you don't get to argue: "the jury was wrong, he didn't really intend to sell the information to scammers or to use the information maliciously." The jury is empowered to decide whether they believe the defendant's story or not, and on issues of credibility it's almost impossible to overturn the jury's finding on appeal. Thus, you're left arguing from a very weak position: yes, the guy did commit fraud in connection with personal information, but changing letters in a URL isn't "illegal access of a network" so the CFAA charge should be dropped. So at best you're hoping for a remand to re-sentence without the CFAA conviction, and the fraud charge by itself carries a maximum penalty of more than 41 months anyway.
- eridius 14y ago
  I agree with you completely here. However, I think that it's worth arguing from that weak position. I've had a hard time articulating why I think that a) weev's online actions aren't illegal, and yet b) why weev should still be punished. But arguing from that weak position and getting the CFAA charge dropped would actually resolve this issue. My problem with what weev did, and why I think he should be published, is because of his malicious intent. So getting the CFAA charge dropped would be a win for everyone, but leaving the fraud charge in place would still appropriately punish weev (although I think 41 months is too high).
  - rayiner 14y ago
    I totally agree on the substance of what you said. Just noting that these sorts of cases are much easier when the client is pure as the virgin snow.

by Lazare 14y ago

sigzero 14y ago

Didn't he use an unpublished link? That would be "unauthorized" to me.

cheald 14y ago
http://en.wikipedia.org/wiki/Security_through_obscurity http://en.wikipedia.org/wiki/Security_through_obscurity
- rayiner 14y ago
  The fact that a security mechanism is poor shouldn't mean that it doesn't create a legally enforceable boundary. If I tape my door shut instead of buying a proper lock, that doesn't give you the right to walk in.
  - cheald 14y ago
    Bad analogy. A door is an access control mechanism. A Uniform Resource Locator is not. A more apt analogy would claiming that having your phone number not published in the phone book constitutes a legally enforceable boundary against being contacted by phone.
    - rayiner 14y ago
      We can debate about whether URLs have elements of an access control mechanism or not, but if obscured URLs don't create a legally protect-able boundary, the argument should be because they're not an access control mechanism, not that they're a poor access control mechanism (which is the usual implication of "security through obscurity"). In other words, the argument should be about how clearly the boundaries are drawn, not how effective the security mechanisms are.
      - cheald 14y ago
        Granted. The security-through-obscurity link was an oversimplification.
    - aqme28 14y ago
      Here's an analogy for you: I don't publish my address in the phonebook or anywhere, but because you know that 4001 Example streeet is a house and 4003 Example street is a house, you're still able to solicit me at 4005 Example street.
jonathanwallace 14y ago
Can you clarify what "published" means in the context of a http link? Preferably citing the appropriate section in the RFC, http://www.w3.org/Protocols/rfc2616/rfc2616.html http://www.w3.org/Protocols/rfc2616/rfc2616.html?
ghshephard 14y ago
Curious - did I do something "unauthorized" by entering: https://news.ycombinator.com/item?id=5419914 https://news.ycombinator.com/item?id=5419914 Into the URL bar? (One less than this article's URL)
- rayiner 14y ago
  It's absurdly reductionist to make arguments like this. There are lots of things that are okay or not okay based on context. Is it unauthorized to type the above into a URL bar? Almost certainly not. Might it be unauthorized if you type it into a URL bar, see that it contains private information that by its nature was probably not intended to be public, then do it 10,000 more times? Then that might be unauthorized. There is no reason to reduce the world to absurd simplicities when even children would be able to distinguish between various courses of action.
  - doppel 14y ago
    Actually, that is exactly what Orin Kerr is arguing. Prior cases show that accessing a public URL, even if you enter specific IDs or similar, is NOT unauthorized access, neither is doing it multiple times or using a script. The URLs were public to start with (so that the iPads could make use of it), he just went further than intended by AT&T, but that is not a crime (at least, that is what is argued).
    - jerf 14y ago
      I do have to disagree a bit with Orin there. Poking at an integer on a querystring and discovering that you can freely change it and get other people's results shouldn't be a crime, misdemeanor, felony, or otherwise. It's so easy that one can literally perform this "hack" by accidentally failing to copy and paste the last character of a URL somebody sent to you. If we're going to make that a felony every computer owner might as well just give up and report to the nearest prison forthwith, because you're all but doomed to commit crimes in the course of normal usage. However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else. I agree with the rest of his analysis, but a sufficiently large quantitative change can become a qualitative change just by sheer size.
mcherm 14y ago
That strikes me as a very surprising position to take. So you consider it a felony to enter in a browser some URL that has not been been "published". What exactly counts as published? For instance, if I created another page that links to it, is that "published"? Is it still "published" if I later delete that other page? Is it "published" if someone else somewhere in the world creates a page linking to it, but I never create one? What if I print a riddle in the newspaper, which says that the answer to the riddle is the URL in question... is that "publishing" it? What if it's a really HARD riddle? What if I don't print the riddle in the newspaper, but it's a really easy riddle... something like "just add one"? I honestly do not think that whether you "publish" a URL should be used as an indicator of whether access is authorized. Every web server I have ever heard of has the ability to return a "401 Unauthorized" error code, and to do so or not based on the credentials of the person connecting. If I were writing the law, I would say that guessing a password to put in such a box, or accessing it with a malformed request used a bug in the server to bypass such a credential check would certainly qualify as "unauthorized access", but that "AT&T didn't bother to require a check before returning the data to any browser that asked for it" would be evidence that it was explicitly authorized.
mk3 14y ago
basically if he looses the court. 404 page may result in getting orange jumpsuit and nice check to be paid. In my opinion leaving personal information accessible to general public (i.e. no authentication needed) is a crime. Letting journalists know is not a crime. In this case AT&T is responsible for misplacing personal data, and not the guy who had free access to it. In some ways it's really similar to Aaron Swartz case, as both guys found a way to get the data, and both got sued. I would suggest looking into this case more closelly as if he ends up in jail or pays a dime, a simple misuse of some companies website and/or public API (think Google Maps, etc.) Could land you in jail

rayiner 14y ago

Honestly, both are/were/would have been bad test cases. With Swartz you've got two issues in the same case: downloading JSTOR articles and trying to get on MIT's network despite being banned. It's easy to support the former without supporting the latter and "muddled" makes for a bad test case. With Weev, you've also got two issues. He was not just convicted of downloading things from AT&T's network. If that was the beginning and end of it, it would have made for a good test case. Instead, he downloaded tends of thousands of pieces of personal information then bragged on IRC how he was going to sell it to scammers to damage AT&T. That's not "civil disobedience." That's malicious. Note that this is on appeal, so the jury's verdict on the "fraud in connection with personal information" charge is to a degree locked in. On appeal, you don't get to argue: "the jury was wrong, he didn't really intend to sell the information to scammers or to use the information maliciously." The jury is empowered to decide whether they believe the defendant's story or not, and on issues of credibility it's almost impossible to overturn the jury's finding on appeal. Thus, you're left arguing from a very weak position: yes, the guy did commit fraud in connection with personal information, but changing letters in a URL isn't "illegal access of a network" so the CFAA charge should be dropped. So at best you're hoping for a remand to re-sentence without the CFAA conviction, and the fraud charge by itself carries a maximum penalty of more than 41 months anyway.

eridius 14y ago
I agree with you completely here. However, I think that it's worth arguing from that weak position. I've had a hard time articulating why I think that a) weev's online actions aren't illegal, and yet b) why weev should still be punished. But arguing from that weak position and getting the CFAA charge dropped would actually resolve this issue. My problem with what weev did, and why I think he should be published, is because of his malicious intent. So getting the CFAA charge dropped would be a win for everyone, but leaving the fraud charge in place would still appropriately punish weev (although I think 41 months is too high).
- rayiner 14y ago
  I totally agree on the substance of what you said. Just noting that these sorts of cases are much easier when the client is pure as the virgin snow.