9 ms·
French journalist "hacks" govt by inputting correct URL, later fined $4,000+
- steeve 13y agoThe ruling is more complicated than that. If you can read french, I suggest you read Maitre Eolas' take on it [1]. [1] http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut-pas-%C3%AAtre-condamn%C3%A9-pour-utiliser-Gougleu http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut...
- sejje 13y agoI can't. Mind making a brief summary?
- a3_nm 13y agoThe main count on which Bluetouff was found guilty is that of "maintien frauduleux dans un système de traitement automatisé de données (STAD)", namely, remaining "in" a computing system (STAD) without being allowed. The key point is that Bluetouff made an important admission, apparently during his 30 hours of "garde à vue", meaning, being under arrest at the police station, where he seemingly neglected to apply his right to remain silent: he recognized that, when going up the folder hierarchy, he landed on a username-password login page. From this, according to the court, he should have inferred that the documents were private and that he had nothing to do there. Instead, he spent several hours siphoning the documents afterwards, which established his intent to remain in the system despite having found out that he wasn't supposed to. One can then discuss whether this law is fair or not, whether things would have been different had Bluetouff not made this key admission, whether it is reasonable to consider that the login page was sufficient to indicate that the documents weren't intended to be public, and whether the 3000 EUR fine is balanced or not. Meanwhile, Bluetouff has appealed the ruling to the Cour de cassation, France's last-resort court for civil and criminal cases, whose role is to break rulings where the law was not correctly applied (without discussing the findings, only the application of the law and the adequate forms). I do not think we know yet how Bluetouff will phrase his appeal, but Eolas estimates that there would be a possible way to attack the ruling based on the court's finding that Bluetouff's retrieving the documents constitutes "vol" (theft) though it does not fall within the scope of the formal definition of theft (because the ANSES was not deprived of the files).
- yeukhon 13y agoInstead, he spent several hours siphoning the documents afterwards Do we know how he accessed the documents? Did he crawl the directory with a login or without a login (meaning the directory is not protected)? And why would he share such document with his fellow writer? What for? The fact that a judge can't comprehend technical explanation according to the article seems to be the main issue here. Was he given a fair hearing?
- jordanthoms 13y agoThis is a good time to remind people: Don't talk to the police. Ever, under any circumstances - it can only hurt you, never help you. http://www.youtube.com/watch?v=6wXkI4t7nuc http://www.youtube.com/watch?v=6wXkI4t7nuc
- pyre 13y agoThis is a very US-centric view. In some places, you have a right to remain silent, but that can be used against you in a court of law...
- nodata 13y agoHe means don't talk to the police until your lawyer is there. Which countries will use that against you?
- ItendToDisagree 13y agoUK or US, among other countries, if you are being held on 'homeland security' (read: Suspected terrorist) charges. IE: You are required by law to answer questions/turn over passwords when suspected of such things. David Miranda being a recent and well known example.
- nodata 13y ago"Let's wait until my lawyer gets here" will count against me? You got a cite for that?
- deleted 13y ago[deleted]
- norswap 13y agoBasically he was charged on three count: intruding in a private computer system, maintaining himself in said computer system, and theft of private documents. The ruling said he was innocent of the first charge, since it was due to a security flaw, but guilty of the second, since he realized he was in a private system (he admitted to navigating the hierarchy and finding that the repository was "protected" by a login and password). He was also ruled guilty of the theft (the author of the blogpost, an attorney, says he should have been charged with counterfeiting instead, since that is the proper indictment for copyright violations).
- fab13n 13y agoTldr: he's not fined for entering on the website. He's fined because he kept mirroring the site after he realized it was opened by mistake (he unwisely admitted as much to the cops). It's the digital equivalent of figuring out that a house isn't locked, and concluding it's OK to loot it.
- gislifb 13y agoIt's the digital equivalent of figuring out that a house isn't locked, and concluding that it's OK to make a copy of the furniture. FTFY
- Sharlin 13y agoMake a copy of the owner's diary and other sensitive documents, snoop through nightstand drawers... Equivalently, finding someone's personal computer unlocked and deciding it's all right to mirror the contents of its hard disk.
- sejje 13y agoI don't agree with any of these assessments. I think it's the equivalent of going down a public road and passing through a gate that was left open, onto private property. While driving, off in the woods beside the road you notice a "no trespassing" sign, but it's not obvious that you're trespassing currently, even if you start to wonder. A place on the disk was accessed that was unintended.
- fab13n 13y ago> it's not obvious that you're trespassing currently, even if you start to wonder. He's admitted that he kept snooping around after he fully realized that the files were online by mistake.
- fab13n 13y agoMy point wasn't about the theft/piracy distinction. It was that your victim being incompetent at defending themselves is not a valid excuse for committing a crime against them. Besides, counterfeiting one's furniture doesn't cause any embarrassment. I'd rather equate it to photocopying your secret business plan, or your collection of naked self-pictures.
- zz1 13y agoPretty useless until Maître Éolas won't correct the few important mistakes he made in his blog post. Olivier pointed them out in his tweets. If you can read french you shouldn't be reading Maître Éolas (although he's usually great) but Bluetouff's own blog posts: http://bluetouff.com/2013/04/25/la-non-affaire-bluetouff-vs-anses/ http://bluetouff.com/2013/04/25/la-non-affaire-bluetouff-vs-... http://bluetouff.com/2014/01/10/cher-contribuable-je-te-demande-pardon/ http://bluetouff.com/2014/01/10/cher-contribuable-je-te-dema...
- sebastianavina 13y agoso, when you found something like that, lease a dedicated server overseas and use it to download everything. once done, go to a cybercafe and download it to a zip file or something similar via http directly to a usb memory. they can follow your transaction with the company once they find out, but it's going to be a little more difficult.
- bausson 13y agoHe is a journalist, he wasn't found when he downloaded the files, but when he wrote about their content. Leasing a server wouldn't have changed a thing in that specific case. Anyway, bluetouff is well-versed in computer security and the co-founder of a VPN service, so I suspect the files weren't downloaded from a french IP adress.
- tripzilch 13y agoYes it says "Panama", right in the article.
- deleted 13y ago[deleted]
- rch 13y ago> Bluetouff ended up admitting in testimony that when he found the documents, he had traveled back to the homepage that they stemmed from, where he found an authentication page, which indicated that the documents were likely supposed to be protected. That admission played a part in his later conviction in the appeals court. Of course the fine seems absurd to me personally, but this excerpt hints at a couple things one should definitely not do.
- ben0x539 13y agoThis seems weird to me. If I go to, say, the twitter homepage, I will find an authentication page, and yet most content on twitter is obviously intended to be public.
- marcosdumay 13y agoThat, exactly that. If you have a secret document, when I come knocking on your door and ask for that document, you'll refuse to give it to me, or at least ask for something that convinces you that can access it. Nobody would be crazy enough to charge me by a crime if I ask you the document, and you give it to me without any kind of verification. But now, configure a computer to do that exact thing, and suddenly you manufacture plenty of new criminals.
- rch 13y agoIt's more like if you walk up and find the document on my doorstep, turn around to see the 'no trespassing' sign, then leave with the document anyway. Again - I don't really agree with the ruling here - just trying to clarify.
- lstamour 13y agoExcept I found the documents on Google. It's the equivalent to advertising a yard sale but not realising what you were selling / showing the public.
- higherpurpose 13y agoHow many years would he get in prison for this in US? While the interpretation of the law or the law itself are pretty bad here to begin with, at least the punishments are saner for stuff like this. US seems to have both completely terrible and easily abused hacking laws, but also extremely disproportionate punishments.
- nswanberg 13y agoThis is more or less what happened to some kids applying to Harvard Business School about seven years ago: https://freedom-to-tinker.com/blog/felten/harvard-business-school-boots-119-applicants-hacking-admissions-site/ https://freedom-to-tinker.com/blog/felten/harvard-business-s... Their penalty was a denial of admissions, but their hack of using a specially-crafted URL was about the same.
- thomasjoulin 13y agoI don't understand why he's getting fine for that. Those were publicly accessible documents, even though they were intended not to be, as indicated by the login form that Bluetouff admitted to know about. If that's the law, then it needs to change.
- fuckpig 13y agoReminds me of what happened to Andrew Aurenheimer, only iterated a bit more.
- gcb0 13y agohappened in brazil as well. everyone knows you only build large public projects there if money change hands. and it usually happens that the gov official get the quotes from all the companies, call the one paying him the most and tell the other quotes and that company submit a little lower than the lowest and get the job, later including several hidden fees, etc. the, for the sao paulo subway expansion, a journalist did a search and found documents proving all that for that specific job (yellow metro line) and published them. gov removed the documents, waited for all signs of it ever being indexed to disappear and then sued him. i think the trial is still going and they still deny those documents ever existed.
- whitey-chan 13y agoDo you have any links with further info on that case by any chance? Would be interesting to see how that turns out.
- rurban 13y agoHow can government agencies still can get away with accusing someone of "theft" and accessing a "private computer" and "private documents" when they just publish documents on the web, and the public is consuming them? The fact that there was a HTTPAUTH protected login page in some up path on the site does not infer that the documents should have been protected. They are or they are not. And they looked legit, i.e. public. Esp. with government documents you are safe to assume that they are public, if they are public and look public.
- MildlySerious 13y agoExactly. Also, the HTTPAUTH is directory based and does not necessarily include subdirectories, just like permissions on all Linux distros. So that doesn't imply in any way that subdirectories should have been private.
- zacinbusiness 13y agoI'm really on the fence with this one. As has been pointed out, the fact that there's some auth somewhere on the server doesn't necessarily mean that those specific documents were supposed to be private. However, as a journalist he decided to publish the documents on his blog which I think we can take to mean that he assumed they were, in some way, "juicy." And he wouldn't think that if he didn't at least suspect that they were supposed to be private. This is all assumption, of course, but I think it's pretty logical assumption. Still, freedom of the press is a strong right. Though freedom, as they say, isn't free (there can be and often are consequences to exercising your freedoms). In this case I think he's lucky to just get what amounts to a hefty access fee. If he had stumbled onto U.S. documents he may well have found himself taking a ride in a black helicopter.