4 ms·

Clearly the article was wrong, but the reporter could only go off of what the hospital told him or her, and that does not seem to have included the professor's

Clearly the article was wrong, but the reporter could only go off of what the hospital told him or her, and that does not seem to have included the professor's contact information. Rather, I'm guessing the message that got out of the IT department was "we got hacked by a professor", which then likely mutated via the rumor mill into the details about a class demonstration. If anything, I think this shows the hospital gave the professor a lot more benefit of the doubt than I would have expected. The professor did himself no favors with his email: I am Sam Bowne, an instructor at City College San Francisco, and I found two security problems on your server with a Google search. Your FTP server has been compromised, and some files named "w0000000t" were added to it. If I'm the IT administrator who receives this message, then after reading the first two sentences, I've already jumped to the conclusion that this professor is the individual who compromised my server! "Hi, I found security issues with your server, and now it's compromised!" Sure, once you've read the intro by the professor, the meaning is clear, but think of yourself as a sysadmin getting this email, without the context of "I just found this, I had nothing to do with it" in your brain, and how are you going to react? Once the idea that the sender of this email is a hacker who broke into your server has entered your mind, it's going to be very hard to interpret it differently. Given that, the guy got treated pretty nicely by the story and the hospital in the end.

binarymax 12y ago
Your first sentence echoes the sorry state of affairs regarding what passes for journalism these days. Getting all angles of the story and doing fact checking is absolutely the responsibility of the journalist. The author had the professors name - all it takes is 5 minutes of research to get contact information to follow up correctly. The journalist really has no excuse in this matter.
- ar-jan 12y ago
  > The author had the professors name No, as far as we know the articles were based on the University Health legal notice http://www.uhsystem.com/Conway/FINAL%20Conway%20-%20Press%20Release%20-%202014-8-15.pdf http://www.uhsystem.com/Conway/FINAL%20Conway%20-%20Press%20..., which does NOT contain Sam's name. Can you accuse someone of libel if the accused is unnamed? This doesn't take away from the fact that the claims in the report are false, of course.
  - spacemanmatt 12y ago
    Yes, you can accuse someone of anonymous libel. This is how ISPs end up with subpoenas for real identities and attorneys appearing to represent anonymous parties.
  - lutusp 12y ago
    > Can you accuse someone of libel if the accused is unnamed? Only if the unnamed person can be identified. If a person is unnamed, or given a made-up name, and readers cannot associate the name with a real person, the it's not libel. Many legal actions revolve around this issue. A plaintiff says, "I'm the person this article is about!" while simultaneously claiming, "The article doesn't describe me accurately!" Only one of those can be true.
pessimizer 12y ago
"If I'm the IT administrator who receives this message, then after reading the first two sentences, I've already jumped to the conclusion that this professor is the individual who compromised my server! 'Hi, I found security issues with your server, and now it's compromised!' "Sure, once you've read the intro by the professor, the meaning is clear, but think of yourself as a sysadmin getting this email, without the context of 'I just found this, I had nothing to do with it' in your brain, and how are you going to react? Once the idea that the sender of this email is a hacker who broke into your server has entered your mind, it's going to be very hard to interpret it differently. Given that[...]" I can't give you that. I've been a sysadmin, and I've gotten emails about things that were misconfigured. Without the intro, the meaning is clear. Even assuming that the professor had added the w00000t files as a PoC, the note is still a nice gesture and a tip, not an indication of terrorism. Interpreting it another way seems a sign of stupidity IMO. The email starts with his name and place of work. If you read that and think that Sam Bowne, City College, San Fransisco is trying to destroy your servers, you may not be good at thinking.
spacemanmatt 12y ago
No, no, no, no, and no. If you can easily believe that a professor a) attacked your server, then b) wrote you a smarmy read-between-the-lines email claiming-but-not-claiming responsibility for it, you are a fool. If you can accept/forgive anyone in a system/data-administrative role for the same, you are a fool. This is not how professionals work. This how good people lead their lives. This is how idiots and bureaucrats win.
kevin_thibedeau 12y ago
If you're the IT admin you need to be sacked if you overreact without reading the full e-mail with this line: The "w0000000t" file is apparently part of a mass compromise of Microsoft FTP servers, which was found but not explained by a French security company named QuarkLabs in this slide Nothing in the message implied that the professor was responsible for anything other than trying to be helpful.

binarymax 12y ago

Your first sentence echoes the sorry state of affairs regarding what passes for journalism these days. Getting all angles of the story and doing fact checking is absolutely the responsibility of the journalist. The author had the professors name - all it takes is 5 minutes of research to get contact information to follow up correctly. The journalist really has no excuse in this matter.

ar-jan 12y ago
> The author had the professors name No, as far as we know the articles were based on the University Health legal notice http://www.uhsystem.com/Conway/FINAL%20Conway%20-%20Press%20Release%20-%202014-8-15.pdf http://www.uhsystem.com/Conway/FINAL%20Conway%20-%20Press%20..., which does NOT contain Sam's name. Can you accuse someone of libel if the accused is unnamed? This doesn't take away from the fact that the claims in the report are false, of course.
- spacemanmatt 12y ago
  Yes, you can accuse someone of anonymous libel. This is how ISPs end up with subpoenas for real identities and attorneys appearing to represent anonymous parties.
- lutusp 12y ago
  > Can you accuse someone of libel if the accused is unnamed? Only if the unnamed person can be identified. If a person is unnamed, or given a made-up name, and readers cannot associate the name with a real person, the it's not libel. Many legal actions revolve around this issue. A plaintiff says, "I'm the person this article is about!" while simultaneously claiming, "The article doesn't describe me accurately!" Only one of those can be true.

pessimizer 12y ago

"If I'm the IT administrator who receives this message, then after reading the first two sentences, I've already jumped to the conclusion that this professor is the individual who compromised my server! 'Hi, I found security issues with your server, and now it's compromised!' "Sure, once you've read the intro by the professor, the meaning is clear, but think of yourself as a sysadmin getting this email, without the context of 'I just found this, I had nothing to do with it' in your brain, and how are you going to react? Once the idea that the sender of this email is a hacker who broke into your server has entered your mind, it's going to be very hard to interpret it differently. Given that[...]" I can't give you that. I've been a sysadmin, and I've gotten emails about things that were misconfigured. Without the intro, the meaning is clear. Even assuming that the professor had added the w00000t files as a PoC, the note is still a nice gesture and a tip, not an indication of terrorism. Interpreting it another way seems a sign of stupidity IMO. The email starts with his name and place of work. If you read that and think that Sam Bowne, City College, San Fransisco is trying to destroy your servers, you may not be good at thinking.

spacemanmatt 12y ago

No, no, no, no, and no. If you can easily believe that a professor a) attacked your server, then b) wrote you a smarmy read-between-the-lines email claiming-but-not-claiming responsibility for it, you are a fool. If you can accept/forgive anyone in a system/data-administrative role for the same, you are a fool. This is not how professionals work. This how good people lead their lives. This is how idiots and bureaucrats win.

kevin_thibedeau 12y ago

If you're the IT admin you need to be sacked if you overreact without reading the full e-mail with this line: The "w0000000t" file is apparently part of a mass compromise of Microsoft FTP servers, which was found but not explained by a French security company named QuarkLabs in this slide Nothing in the message implied that the professor was responsible for anything other than trying to be helpful.