3 ms·

I see the children are home from school. Did you have an argument to make?

by aaronem 13y ago

sneak 13y ago
The physical analogy is completely inapplicable as you don't "enter" a webserver, you send it a request. Putting things into a state wherein they get auto-served to any request is something akin to posting documents inside your front window for passerby on the sidewalk to see. The whole thing's a fucking terrible analogy though, and every time I see it trotted out to support some "if I leave my doors unlocked" argument I die a little bit inside.
- tptacek 13y ago
  If you "request" that the doorman of a building let you in and then subsequently rob the place, the doorman's complicity does not lessen the severity of your offense. People like to make this debate more complicated than it really is, what with the warring analogies. Really, the issue is straightforward: did the person accessing the information have a reasonable belief that they were authorized to access it? Your argument is, "if the webserver says it's OK, then my belief that I'm authorized is reasonable". That's a sane argument, but has any court ever agreed with it?
  - streetnigga 13y ago
    I think there is a lack of distinction over exploiting to obtain data or exploiting data obtained. In the web-server case I would argue access was allowed unfettered but authorization for the data was not. This is how more than a few cases have gone down. Gotchas don't really cut it in court. Edit: My original comment further up in this thread hinted at this difference and how lawyers seem to be trying to shift the line so unwanted access by a user is treated the same as exploitation of the data within even if the data was not exploited upon.
    - tptacek 13y ago
      While I'm not with you on how "lawyers" are trying to "shift the lines" on the distinction between accessing and exploiting information, which simply does not exist in the law, I agree that the distinction is important; in a perfect world, non-commercial non-malicious non-damaging use of unauthorized data would be relegated by the sentencing guidelines to something less than a felony.
      - streetnigga 13y ago
        "which simply does not exist in the law" Rather sure it does, some crimes like credit card fraud are separate from unauthorized access of the computer systems the information came from. Exploiting the data is not the same as exploiting to access the data. Lawyers are deployed to push their client's POV, wins or losses may "shift the line" regarding how written laws are upheld in court. Which in my opinion is used by some as a chance to defray from responsibility to properly administer public facing systems.
        tptacek 13y ago
        Here's the CFAA: http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 Perhaps it would be simpler if you just pointed to the part of the statute you're referring to, because I don't follow your argument.
  - sneak 13y ago
    > the doorman of a building let you in and then subsequently rob the place Oh god this again
    - tptacek 13y ago
      By not acknowledging the rest of the comment, do you mean to concede the point?
      - sneak 13y ago
        All of these physical analogies are completely inapplicable. When you send a request to a machine owned by a person and it responds with data that person doesn't want you to have, it is not your fault for sending the request - EVEN IF YOU KNOW/SHOULD KNOW/COULD REASONABLY BE EXPECTED TO KNOW/ETC THE PERSON DOESN'T WANT YOU TO HAVE THE DATA.
        tptacek 13y ago
        I agree about analogies. But: this is a perspective on "unauthorized access" that decriminalizes SQL injection.
        sneak 13y ago
        Yes, SQL injection should not be criminal. You're responsible for what your robots do even if it's contrary to your own wishes.
  - AnthonyMouse 13y ago
    > Really, the issue is straightforward: did the person accessing the information have a reasonable belief that they were authorized to access it? The inherent flaw in this interpretation is that it uses a self-referential definition of authorization. Saying "access is authorized if it is reasonable to believe that access is authorized" is meaningless. You would need an independent definition of authorized access in order to evaluate the reasonableness of the belief, which defeats the purpose of using it to define authorization. Where a "reasonable belief" standard makes sense is in determining intent, not in establishing the definition of an element of the crime. For example, it may be illegal for you to steal my laptop (where the definition of the elements of theft are fairly rigorous), but if it turns out that you have exactly the same model of laptop and "reasonably believed" mine to be yours then even though you objectively stole my laptop, the prosecution may not be able to prove that you intended to. But "authorization" is clearly not about intent. The alleged perpetrator is not the one permitted to define the scope of authorization, so their intent is irrelevant in determining whether the access was in fact authorized, and the intent of the owner of the computer system is also irrelevant because it isn't reasonable to subject a defendant to the intent of a third party if that third party fails to clearly articulate it. What matters instead is what has been articulated -- the information made available to users of the computer system about what level of access is permitted. But then we're back to the terms of service trouble again. If you allow contractual restrictions to define authorization then you're allowing corporations to define the contours of a federal felony and anyone who lies about their name on Facebook can be thrown in prison at the whim of an overzealous prosecutor. Conversely, relying on technological authorization makes the law extremely narrow (capturing only the likes of perpetrators who defeat technological denials of authorization via e.g. physical intrusion into the victim's data center -- although that would align better with the established penalties). Neither seems particularly satisfactory, and the reason is that "unauthorized access" is the wrong thing to prohibit. "Authorization" is vague and subjective, and the specifics of a violation span such a wide range of conduct and misconduct that lumping them all together under the same set of penalties is all but guaranteed to violate proportionality unless the penalties are set so low as to make the prohibition nominal. And I still don't understand what useful purpose it serves as distinguished from the already-existing penalties for vandalism, fraud, misappropriation of trade secrets, etc. etc. If someone engages in access without authorization, without more, the warranted level of punishment is minimal and almost never even worth prosecuting. If they engage in some further malicious act then the penalty for the greater crime can be imposed and unauthorized access is only a side show and a dangerous instrument of prosecutorial overreach. When is it ever supposed to be useful in proportion to the controversy and abuse it produces?
streetnigga 13y ago
"I see the children are home from school." Sir your analogy doesn't mesh with reality as another commenter above noted. Servers provide responses, not hand over the hard-drive. Calling people children is absolutely negative and is a detriment to any reasonable discussion, which is what this site seems to be about. Very kindly shut your gob if you want to continue this route.

I see the children are home from school. Did you have an argument to make?

by aaronem 13y ago

I see the children are home from school. Did you have an argument to make?

sneak 13y ago

The physical analogy is completely inapplicable as you don't "enter" a webserver, you send it a request. Putting things into a state wherein they get auto-served to any request is something akin to posting documents inside your front window for passerby on the sidewalk to see. The whole thing's a fucking terrible analogy though, and every time I see it trotted out to support some "if I leave my doors unlocked" argument I die a little bit inside.

tptacek 13y ago
If you "request" that the doorman of a building let you in and then subsequently rob the place, the doorman's complicity does not lessen the severity of your offense. People like to make this debate more complicated than it really is, what with the warring analogies. Really, the issue is straightforward: did the person accessing the information have a reasonable belief that they were authorized to access it? Your argument is, "if the webserver says it's OK, then my belief that I'm authorized is reasonable". That's a sane argument, but has any court ever agreed with it?
- streetnigga 13y ago
  I think there is a lack of distinction over exploiting to obtain data or exploiting data obtained. In the web-server case I would argue access was allowed unfettered but authorization for the data was not. This is how more than a few cases have gone down. Gotchas don't really cut it in court. Edit: My original comment further up in this thread hinted at this difference and how lawyers seem to be trying to shift the line so unwanted access by a user is treated the same as exploitation of the data within even if the data was not exploited upon.
  - tptacek 13y ago
    While I'm not with you on how "lawyers" are trying to "shift the lines" on the distinction between accessing and exploiting information, which simply does not exist in the law, I agree that the distinction is important; in a perfect world, non-commercial non-malicious non-damaging use of unauthorized data would be relegated by the sentencing guidelines to something less than a felony.
    - streetnigga 13y ago
      "which simply does not exist in the law" Rather sure it does, some crimes like credit card fraud are separate from unauthorized access of the computer systems the information came from. Exploiting the data is not the same as exploiting to access the data. Lawyers are deployed to push their client's POV, wins or losses may "shift the line" regarding how written laws are upheld in court. Which in my opinion is used by some as a chance to defray from responsibility to properly administer public facing systems.
      - tptacek 13y ago
        Here's the CFAA: http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 Perhaps it would be simpler if you just pointed to the part of the statute you're referring to, because I don't follow your argument.
- sneak 13y ago
  > the doorman of a building let you in and then subsequently rob the place Oh god this again
  - tptacek 13y ago
    By not acknowledging the rest of the comment, do you mean to concede the point?
    - sneak 13y ago
      All of these physical analogies are completely inapplicable. When you send a request to a machine owned by a person and it responds with data that person doesn't want you to have, it is not your fault for sending the request - EVEN IF YOU KNOW/SHOULD KNOW/COULD REASONABLY BE EXPECTED TO KNOW/ETC THE PERSON DOESN'T WANT YOU TO HAVE THE DATA.
      - tptacek 13y ago
        I agree about analogies. But: this is a perspective on "unauthorized access" that decriminalizes SQL injection.
        sneak 13y ago
        Yes, SQL injection should not be criminal. You're responsible for what your robots do even if it's contrary to your own wishes.
- AnthonyMouse 13y ago
  > Really, the issue is straightforward: did the person accessing the information have a reasonable belief that they were authorized to access it? The inherent flaw in this interpretation is that it uses a self-referential definition of authorization. Saying "access is authorized if it is reasonable to believe that access is authorized" is meaningless. You would need an independent definition of authorized access in order to evaluate the reasonableness of the belief, which defeats the purpose of using it to define authorization. Where a "reasonable belief" standard makes sense is in determining intent, not in establishing the definition of an element of the crime. For example, it may be illegal for you to steal my laptop (where the definition of the elements of theft are fairly rigorous), but if it turns out that you have exactly the same model of laptop and "reasonably believed" mine to be yours then even though you objectively stole my laptop, the prosecution may not be able to prove that you intended to. But "authorization" is clearly not about intent. The alleged perpetrator is not the one permitted to define the scope of authorization, so their intent is irrelevant in determining whether the access was in fact authorized, and the intent of the owner of the computer system is also irrelevant because it isn't reasonable to subject a defendant to the intent of a third party if that third party fails to clearly articulate it. What matters instead is what has been articulated -- the information made available to users of the computer system about what level of access is permitted. But then we're back to the terms of service trouble again. If you allow contractual restrictions to define authorization then you're allowing corporations to define the contours of a federal felony and anyone who lies about their name on Facebook can be thrown in prison at the whim of an overzealous prosecutor. Conversely, relying on technological authorization makes the law extremely narrow (capturing only the likes of perpetrators who defeat technological denials of authorization via e.g. physical intrusion into the victim's data center -- although that would align better with the established penalties). Neither seems particularly satisfactory, and the reason is that "unauthorized access" is the wrong thing to prohibit. "Authorization" is vague and subjective, and the specifics of a violation span such a wide range of conduct and misconduct that lumping them all together under the same set of penalties is all but guaranteed to violate proportionality unless the penalties are set so low as to make the prohibition nominal. And I still don't understand what useful purpose it serves as distinguished from the already-existing penalties for vandalism, fraud, misappropriation of trade secrets, etc. etc. If someone engages in access without authorization, without more, the warranted level of punishment is minimal and almost never even worth prosecuting. If they engage in some further malicious act then the penalty for the greater crime can be imposed and unauthorized access is only a side show and a dangerous instrument of prosecutorial overreach. When is it ever supposed to be useful in proportion to the controversy and abuse it produces?

streetnigga 13y ago

"I see the children are home from school." Sir your analogy doesn't mesh with reality as another commenter above noted. Servers provide responses, not hand over the hard-drive. Calling people children is absolutely negative and is a detriment to any reasonable discussion, which is what this site seems to be about. Very kindly shut your gob if you want to continue this route.