4 ms·

Is the constitutional issue here that exploiting a security hole (SQL injection, remote execution to dump the $_SERVER variable, what have you) constitutes an i

Is the constitutional issue here that exploiting a security hole (SQL injection, remote execution to dump the $_SERVER variable, what have you) constitutes an illegal search? If so, is their any guidance from case law about the difference between some sort of legal poking and prodding vs illegal hacking?

eurleif 12y ago
I wonder if this could be considered a case of exigent circumstances? [0] The exigent circumstances exception can be invoked "to forestall the imminent escape of a suspect, or destruction of evidence". Arguably, that's what this was -- Silk Road had a security flaw that could be fixed at any moment, and the FBI may have felt they needed to act quickly to obtain evidence before the security flaw was fixed. [0] https://en.wikipedia.org/wiki/Exigent_circumstance_in_United_States_law https://en.wikipedia.org/wiki/Exigent_circumstance_in_United...
- deleted 12y ago
  [deleted]
- Donzo 12y ago
  Well, they were also committing criminal activity in "plain view" so to speak.
strathmeyer 12y ago
In the past simply typing in random URLs has been deemed illegally circumventing a site's security. Like most things it's fine when the government does it but you'll get jailtime if you do it to one of their friends.
gcb4 12y ago
it can probably set a precedent that will free all scapegoat script kiddies currently in outsourced prisons.
downandout 12y ago
In general in order to break the law you must have a warrant. For example, a cop entering private property without a warrant or probable cause is nothing more than a trespasser. These agents likely violated the CFAA by doing what they did. Because they didn't have a warrant, IMO it probably constitutes an illegal search, but the courts may well have a very different opinion. Regardless of which side loses this argument, this will likely find its way to the appellate courts and possibly the Supreme court, as it seems to be an unanswered question of great importance.
- ohashi 12y ago
  But if it's a server not in the US? Does it get the same legal protections?
- maxerickson 12y ago
  From the CFAA: (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States. I'm not sure what "lawfully authorized" means there, but my current belief is that one form of it is permission from the Attorney General.
  - billyhoffman 12y ago
    +1. I wasn't aware this clause existed in the CFAA.
  - downandout 12y ago
    But I wonder if computer hacking (which this likely would fall under) can be "lawfully authorized" outside the confines of a search warrant. The Attorney General could order the FBI to break into the computers of a hedge fund suspected of insider trading, but that clearly wouldn't be lawful unless authorized via search warrant. This is very similar.
    - maxerickson 12y ago

eurleif 12y ago

I wonder if this could be considered a case of exigent circumstances? [0] The exigent circumstances exception can be invoked "to forestall the imminent escape of a suspect, or destruction of evidence". Arguably, that's what this was -- Silk Road had a security flaw that could be fixed at any moment, and the FBI may have felt they needed to act quickly to obtain evidence before the security flaw was fixed. [0] https://en.wikipedia.org/wiki/Exigent_circumstance_in_United_States_law https://en.wikipedia.org/wiki/Exigent_circumstance_in_United...

deleted 12y ago
[deleted]
Donzo 12y ago
Well, they were also committing criminal activity in "plain view" so to speak.

strathmeyer 12y ago

In the past simply typing in random URLs has been deemed illegally circumventing a site's security. Like most things it's fine when the government does it but you'll get jailtime if you do it to one of their friends.

gcb4 12y ago

it can probably set a precedent that will free all scapegoat script kiddies currently in outsourced prisons.

downandout 12y ago

In general in order to break the law you must have a warrant. For example, a cop entering private property without a warrant or probable cause is nothing more than a trespasser. These agents likely violated the CFAA by doing what they did. Because they didn't have a warrant, IMO it probably constitutes an illegal search, but the courts may well have a very different opinion. Regardless of which side loses this argument, this will likely find its way to the appellate courts and possibly the Supreme court, as it seems to be an unanswered question of great importance.

ohashi 12y ago
But if it's a server not in the US? Does it get the same legal protections?
maxerickson 12y ago
From the CFAA: (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States. I'm not sure what "lawfully authorized" means there, but my current belief is that one form of it is permission from the Attorney General.
- billyhoffman 12y ago
  +1. I wasn't aware this clause existed in the CFAA.
- downandout 12y ago
  But I wonder if computer hacking (which this likely would fall under) can be "lawfully authorized" outside the confines of a search warrant. The Attorney General could order the FBI to break into the computers of a hedge fund suspected of insider trading, but that clearly wouldn't be lawful unless authorized via search warrant. This is very similar.
  - maxerickson 12y ago