9 ms·

Man Convicted of Hacking Despite Not Hacking

35 points by eplanit 14y ago

snake_plissken 14y ago
Ok, exactly what did he do that is illegal: He paid another company's employees to get information from said company's database, and that these employees accessed the data by using some other employee's login credentials without permission?
- mpyne 14y ago
  Well, "industrial espionage" actually is a crime since 1996, no matter what tools you use to do it (and notably, has the harshest sentence of the 3 major types of crimes Nosal was charged with). Unauthorized access to a computer network was made to help complete the crime, which is itself criminal, just like there is a charge "mail fraud" that makes use of the postal system to further any criminal act illegal. Conspiracy is always illegal itself as well.
  - snake_plissken 14y ago
    thank you. i couldn't recall the exact words, but yeah this is classic industrial espionage
tantalor 14y ago
I don't see what the big deal is. If you pay somebody to commit a crime (e.g., murder), you may be prosecuted for the crime itself.
- betterunix 14y ago
  Four of the six charges were related to accessing a computer. In this case, that amounted to logging in and downloading files.
  - mpyne 14y ago
    And yet the trade secret charge had the harshest penalty, and the conspiracy charge was tied for second-harshest. Maybe the Federal Sentencing Guidelines count the number of charges convicted on but it's hard to claim that the CFAA is the only or predominant reason Nosal will be facing jail time in this particular case.
tptacek 14y ago
He wasn't convicted of "hacking". He was convicted of fraud, under a law that makes it easier to prosecute fraud when it involves a computer. I haven't read any of the case filings, but Wired's own attempt at a charitable description of the events sure sounds like fraud to me. From the source 'rayiner provided: Evidence at trial showed that Nosal, 55, of Danville, entered into an agreement with other Korn/Ferry employees in 2004 to take confidential and proprietary materials from Korn/Ferry’s computer system to be used in a new business that Nosal intended to establish with those individuals after he left Korn/Ferry’s employment in late 2004. The evidence showed that two of those employees downloaded large numbers of “source lists” (essentially, targeted lists of candidates developed by Korn/Ferry for the purpose of filling particular positions at particular client-companies) prior to their own departures from Korn/Ferry. Thereafter, those two employees used the Korn/Ferry login credentials of another conspirator who was still employed at Korn/Ferry to download additional source lists and other information from Korn/Ferry’s computer system in April and July 2005 for use in Nosal’s new business. The trial in this case occurred after remand from the Ninth Circuit Court of Appeals, which had affirmed then-District Court Judge Marilyn H Patel’s pre-trial dismissal of several computer intrusion counts. The CFAA is a hugely problematic law. But I'm not a fan of manipulative news stories either.
- btilly 14y ago
  There have been rules and lawsuits around former employees stealing their employer's list of clients for ages. The fact that said lists are now stored in a computer rather than in a rolodex or filing system should not suddenly increase the potential penalties manyfold. I also don't see why the federal government is prosecuting what I see as a civil dispute between two private parties.
  - danielweber 14y ago
    If I fire someone, and they come back into the office afterwards at night to do whatever, is that still "a civil dispute between two private parties"?
rayiner 14y ago
A more fact-based article: http://7thspace.com/headlines/436581/executive_recruiter_david_nosal_convicted_of_computer_intrusion_and_trade_secret_charges.html http://7thspace.com/headlines/436581/executive_recruiter_dav....
- betterunix 14y ago
  What's your point? Had he walked away with a paper copy of the data in question, more than half those charges would not exist. The issue here is that "involving a computer" has become an excuse for harsher sentencing and greater power for police and prosecutors. Driving that is a law that is so broad that nearly anyone with computer access could be accused of violating it (in other words, the majority of Americans).
  - rayiner 14y ago
    The point is that Wired's egregiously shitty journalism isn't doing anybody any favors when it comes to mustering up legitimate opposition to the CFAA. If I opposed the CFAA in its present incarnation (which I do), I'd be embarassed to be associated with Wired's coverage. If I were a friend of Aaron Swartz, I'd be offended at Wired's repeated attempts to compare guys with malicious intent like this guy and the Watts guy in an article earlier this week to Aaron.
    - betterunix 14y ago
      First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime. Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In all three cases, the CFAA charges were used for no reason other than to pressure the defendant. You are doing a disservice to those who are trying to fix the problems with the CFAA by suggesting that there is any legitimacy to the application of that law in this case.
      - 14y ago
spoiledtechie 14y ago
This sort of Brings back to light Aaron. Can someone please update me on what if any progress has been made to make sure this doesn't happen again? Has his cause and actions just sort of belly flopped and gone no where or have we seen something meaningful come from the tragic loss?
yoster 14y ago
Like the old saying goes, Don't do the crime if you can't do the time....
wvenable 14y ago
The problem is that "hacking" is crime with disproportionate penalties. The consequence is that prosecutors would rather charge and convict someone (who didn't touch a computer) for hacking than for fraud.

35 points by eplanit 14y ago

Ok, exactly what did he do that is illegal: He paid another company's employees to get information from said company's database, and that these employees accessed the data by using some other employee's login credentials without permission?

mpyne 14y ago
Well, "industrial espionage" actually is a crime since 1996, no matter what tools you use to do it (and notably, has the harshest sentence of the 3 major types of crimes Nosal was charged with). Unauthorized access to a computer network was made to help complete the crime, which is itself criminal, just like there is a charge "mail fraud" that makes use of the postal system to further any criminal act illegal. Conspiracy is always illegal itself as well.
- snake_plissken 14y ago
  thank you. i couldn't recall the exact words, but yeah this is classic industrial espionage

tantalor 14y ago

I don't see what the big deal is. If you pay somebody to commit a crime (e.g., murder), you may be prosecuted for the crime itself.

betterunix 14y ago
Four of the six charges were related to accessing a computer. In this case, that amounted to logging in and downloading files.
- mpyne 14y ago
  And yet the trade secret charge had the harshest penalty, and the conspiracy charge was tied for second-harshest. Maybe the Federal Sentencing Guidelines count the number of charges convicted on but it's hard to claim that the CFAA is the only or predominant reason Nosal will be facing jail time in this particular case.

tptacek 14y ago

He wasn't convicted of "hacking". He was convicted of fraud, under a law that makes it easier to prosecute fraud when it involves a computer. I haven't read any of the case filings, but Wired's own attempt at a charitable description of the events sure sounds like fraud to me. From the source 'rayiner provided: Evidence at trial showed that Nosal, 55, of Danville, entered into an agreement with other Korn/Ferry employees in 2004 to take confidential and proprietary materials from Korn/Ferry’s computer system to be used in a new business that Nosal intended to establish with those individuals after he left Korn/Ferry’s employment in late 2004. The evidence showed that two of those employees downloaded large numbers of “source lists” (essentially, targeted lists of candidates developed by Korn/Ferry for the purpose of filling particular positions at particular client-companies) prior to their own departures from Korn/Ferry. Thereafter, those two employees used the Korn/Ferry login credentials of another conspirator who was still employed at Korn/Ferry to download additional source lists and other information from Korn/Ferry’s computer system in April and July 2005 for use in Nosal’s new business. The trial in this case occurred after remand from the Ninth Circuit Court of Appeals, which had affirmed then-District Court Judge Marilyn H Patel’s pre-trial dismissal of several computer intrusion counts. The CFAA is a hugely problematic law. But I'm not a fan of manipulative news stories either.

btilly 14y ago
There have been rules and lawsuits around former employees stealing their employer's list of clients for ages. The fact that said lists are now stored in a computer rather than in a rolodex or filing system should not suddenly increase the potential penalties manyfold. I also don't see why the federal government is prosecuting what I see as a civil dispute between two private parties.
- danielweber 14y ago
  If I fire someone, and they come back into the office afterwards at night to do whatever, is that still "a civil dispute between two private parties"?

rayiner 14y ago

A more fact-based article: http://7thspace.com/headlines/436581/executive_recruiter_david_nosal_convicted_of_computer_intrusion_and_trade_secret_charges.html http://7thspace.com/headlines/436581/executive_recruiter_dav....

betterunix 14y ago
What's your point? Had he walked away with a paper copy of the data in question, more than half those charges would not exist. The issue here is that "involving a computer" has become an excuse for harsher sentencing and greater power for police and prosecutors. Driving that is a law that is so broad that nearly anyone with computer access could be accused of violating it (in other words, the majority of Americans).
- rayiner 14y ago
  The point is that Wired's egregiously shitty journalism isn't doing anybody any favors when it comes to mustering up legitimate opposition to the CFAA. If I opposed the CFAA in its present incarnation (which I do), I'd be embarassed to be associated with Wired's coverage. If I were a friend of Aaron Swartz, I'd be offended at Wired's repeated attempts to compare guys with malicious intent like this guy and the Watts guy in an article earlier this week to Aaron.
  - betterunix 14y ago
    First of all, Watt did not have any malicious intent -- he wrote a packet sniffing program and gave it to a friend, and did not participate in nor benefit from his friend's crime. Really, I am not seeing what your issue is with the comparison between the three cases. In all three cases, men faced charges of CFAA violations that were completely inappropriate. In all three cases, the CFAA charges were used for no reason other than to pressure the defendant. You are doing a disservice to those who are trying to fix the problems with the CFAA by suggesting that there is any legitimacy to the application of that law in this case.
    - 14y ago

spoiledtechie 14y ago

This sort of Brings back to light Aaron. Can someone please update me on what if any progress has been made to make sure this doesn't happen again? Has his cause and actions just sort of belly flopped and gone no where or have we seen something meaningful come from the tragic loss?

yoster 14y ago

Like the old saying goes, Don't do the crime if you can't do the time....

wvenable 14y ago

The problem is that "hacking" is crime with disproportionate penalties. The consequence is that prosecutors would rather charge and convict someone (who didn't touch a computer) for hacking than for fraud.