4 ms·

There is a lot of confusion in this thread regarding basic concepts of the law. 1. The NJAG is not prosecuting the MIT student(s) (at least not yet). Therefo

There is a lot of confusion in this thread regarding basic concepts of the law. 1. The NJAG is not prosecuting the MIT student(s) (at least not yet). Therefore, this is not similar to the alleged overzealous prosecutors in the Swartz case. 2. A subpoena is a writ compelling testimony or evidence. A subpoena is not synonymous with being a defendant. 3. NJAG served one MIT student with a subpoena to turn over documentation (source code, downloads, users, ect...)for a program which maybe being used by third party websites in a way that violates the rights of NJ residents vis-a-vis unauthorized access to computer systems. 4. It seems there is an issue raised arguing NJAG does not have jurisdiction over the MIT student(s). Personally I would find this analysis the most compelling because it is at the intersection of where facts and law meet. 5. EFF is arguing that complying with the subpoena may violate the students right against self-incrimination. I think this is a losing argument where one's right against self-incrimination is rather limited, generally to information contained within their mind and not typically extended to documentation and records. 6. Though this is not at issue, it would be almost impossible for the MIT student(s) to have committed a crime, as the crime would require intent. It would be nearly impossible to prove the student(s) intended that their code be downloaded by third-party websites for the specific purpose of running on the end users computers without their knowledge. It would be on par with charging a gun manufacturer criminally for intending that their guns be manufactured and sold for the exclusive purpose of committing crimes.

icambron 12y ago
Have you read the subpoena? It's definitely aimed at incriminating the student. I don't disagree with your take on their lack of protection by the 5th amendment, but I think you're just wrong about who they're going after. Excerpts: 3. All documents and correspondence concerning all breaches of security and/or unauthorized access to computers by you. 10. All documents concerning complaints against you...concerning the unauthorized access of computers and/or Bitcoin code. Items 11 - 14 are also aimed at finding evidence that they've done something wrong. Source: https://www.eff.org/document/subpoena-jeremy-rubin-dba-tidbit https://www.eff.org/document/subpoena-jeremy-rubin-dba-tidbi... Edit: trying to cut down on tone
- akira2501 12y ago
  From "New Jersey's Further Reply," this part caught my eye: "For example, Mr. Fakhoury's Certification describes how Plaintiff discovered that the Division issued subpoenas to the New Jersey Coded Websites, Plaintiff's state of mind upon discovering this information, and Plaintiff's decision to send an email to its entire list of users."
lotsofmangos 12y ago
Regarding 5 & 6, EFF seem to think there is a prosecution being sought against the students. "The state has already made clear it believes Rubin and Tidbit are in violation of New Jersey's Consumer Fraud Act. The state recently used consumer protection laws to secure a $1 million settlement from a gambling website that turned its users' computers into a botnet to mine for Bitcoins without the users' knowledge. It appears the state suspects Tidbit of something similar here, despite the fact Tidbit's code was only a proof of concept that could not mine for Bitcoins, and despite the fact Tidbit was clearly not planning to develop code that mined without a user's knowledge and consent." "Some of the interrogatories also suggest that New Jersey believes Rubin and Tidbit are in violation of criminal hacking laws. One interrogatory asks Rubin to provide a list of all instances where Tidbit and websites using the code "accessed consumer computers without express written authorization or accessed consumer computers beyond what was authorized." That language comes from New Jersey's computer fraud act, which, in turn, is modeled after the federal Computer Fraud and Abuse Act. Since the subpoena is clearly demanding Rubin incriminate himself by opening himself to both civil and criminal liability, the privilege against self incrimination applies and he should be given immunity if ordered to comply with the subpoena." https://www.eff.org/deeplinks/2014/02/eff-challenges-new-jersey-subpoena-issued-mit-student-bitcoin-developers https://www.eff.org/deeplinks/2014/02/eff-challenges-new-jer...
- will_brown 12y ago
  If there is a finding of wrong doing I am sure there will be prosecution, only not against the students, but against the operators of websites using the students code without the knowledge of end users. Again it would be an exercise is futility for the AG to attempt to prove beyond a reasonable doubt that was the intent of the students (unless the students operated third party websites running the Tidbit code without knowledge of the end user). EFF simply wants immunity. Everything else is posture: >The state has already made clear it believes Rubin and Tidbit are in violation of New Jersey's Consumer Fraud Act. If that's what the state believed criminal charges would be filed, not a subpoena issued. >One interrogatory asks Rubin to provide a list of all instances where Tidbit and websites using the code "accessed consumer computers without express written authorization or accessed consumer computers beyond what was authorized." Note how the question is not just focused on Tidbit but also 3rd party websites.
cletus 12y ago
I agree the jurisdiction issue is an interesting one but the US as a whole has a long history of overreach (eg I know someone who worked in the UK who was issued with a bench warrant for his arrest by a state judge in the US because he worked on a site that "enabled" Americans to gamble online). I also agree that (5) is an odd argument. From [1]: > Know this, however: There is no Fifth Amendment privilege to refuse to produce subpoenaed documents on the ground their contents are self-incriminating; courts hold that such information is not "compelled testimony." However, as explained below, there is a crucial corollary: In certain circumstances the act of producing such documents may indeed be entitled to protection under the Fifth Amendment. - See more at: http://www.callawyer.com/Clstory.cfm?eid=920910#sthash.NmnSC4GZ.dpuf http://www.callawyer.com/Clstory.cfm?eid=920910#sthash.NmnSC... On the last point, by a strict definition of intent [2], you are probably correct. However, recklessness and negligence can constitute criminal intent. You can argue that it's not reasonable to hold someone accountable for what someone else does with their program. It's easy to fall into what I call the "engineer's trap" here. An example is "you can't prove someone else didn't use my Wifi to distribute [pick your poison], therefore you can't find me guilty". While strictly true, the law doesn't work that way. Subjective standards and tests are applied in situations like this. So if law enforcement can show [bad activity] was happening only when you were home, stopped when you went on vacation and happened on many occasions the balance of evidence will suggest you're responsible even if you can't strictly prove it. So if you designed and distributed a Windows program that was a RATing toolkit that worked with the click of a button and the only real purpose is [illegal stuff] then an argument like "I'm not responsible for what people use this for" will fail before a judge and jury as not being "reasonable". [1]: http://www.callawyer.com/Clstory.cfm?eid=920910 http://www.callawyer.com/Clstory.cfm?eid=920910 [2]: http://en.wikipedia.org/wiki/Mens_rea#United_States http://en.wikipedia.org/wiki/Mens_rea#United_States
xiaoma 12y ago
As one of the many, many people who interacted with Aaron online before his death and as a Node Knockout judge and was pretty shocked to see this news. >"There is a lot of confusion in this thread regarding basic concepts of the law." Just so that we have some idea how to weigh your comments with those of the EFF, could you tell us a little bit about your expertise? Are you a lawyer? Have you worked with this kind of subpoena before?
- will_brown 12y ago
  I am a Florida attorney. In two different instances I have been admitted Pro Hac Vice in the State of New Jersey, and in one of those instances it was a civil case brought by the NJAG office against a corporate client who was alleged to be providing chimney cleaning services without being licensed. In short I have received/reviewed/responded to subpoenas (and other discovery requests) from the very same office.

icambron 12y ago

Have you read the subpoena? It's definitely aimed at incriminating the student. I don't disagree with your take on their lack of protection by the 5th amendment, but I think you're just wrong about who they're going after. Excerpts: 3. All documents and correspondence concerning all breaches of security and/or unauthorized access to computers by you. 10. All documents concerning complaints against you...concerning the unauthorized access of computers and/or Bitcoin code. Items 11 - 14 are also aimed at finding evidence that they've done something wrong. Source: https://www.eff.org/document/subpoena-jeremy-rubin-dba-tidbit https://www.eff.org/document/subpoena-jeremy-rubin-dba-tidbi... Edit: trying to cut down on tone

akira2501 12y ago
From "New Jersey's Further Reply," this part caught my eye: "For example, Mr. Fakhoury's Certification describes how Plaintiff discovered that the Division issued subpoenas to the New Jersey Coded Websites, Plaintiff's state of mind upon discovering this information, and Plaintiff's decision to send an email to its entire list of users."

lotsofmangos 12y ago

Regarding 5 & 6, EFF seem to think there is a prosecution being sought against the students. "The state has already made clear it believes Rubin and Tidbit are in violation of New Jersey's Consumer Fraud Act. The state recently used consumer protection laws to secure a $1 million settlement from a gambling website that turned its users' computers into a botnet to mine for Bitcoins without the users' knowledge. It appears the state suspects Tidbit of something similar here, despite the fact Tidbit's code was only a proof of concept that could not mine for Bitcoins, and despite the fact Tidbit was clearly not planning to develop code that mined without a user's knowledge and consent." "Some of the interrogatories also suggest that New Jersey believes Rubin and Tidbit are in violation of criminal hacking laws. One interrogatory asks Rubin to provide a list of all instances where Tidbit and websites using the code "accessed consumer computers without express written authorization or accessed consumer computers beyond what was authorized." That language comes from New Jersey's computer fraud act, which, in turn, is modeled after the federal Computer Fraud and Abuse Act. Since the subpoena is clearly demanding Rubin incriminate himself by opening himself to both civil and criminal liability, the privilege against self incrimination applies and he should be given immunity if ordered to comply with the subpoena." https://www.eff.org/deeplinks/2014/02/eff-challenges-new-jersey-subpoena-issued-mit-student-bitcoin-developers https://www.eff.org/deeplinks/2014/02/eff-challenges-new-jer...

will_brown 12y ago
If there is a finding of wrong doing I am sure there will be prosecution, only not against the students, but against the operators of websites using the students code without the knowledge of end users. Again it would be an exercise is futility for the AG to attempt to prove beyond a reasonable doubt that was the intent of the students (unless the students operated third party websites running the Tidbit code without knowledge of the end user). EFF simply wants immunity. Everything else is posture: >The state has already made clear it believes Rubin and Tidbit are in violation of New Jersey's Consumer Fraud Act. If that's what the state believed criminal charges would be filed, not a subpoena issued. >One interrogatory asks Rubin to provide a list of all instances where Tidbit and websites using the code "accessed consumer computers without express written authorization or accessed consumer computers beyond what was authorized." Note how the question is not just focused on Tidbit but also 3rd party websites.

cletus 12y ago

I agree the jurisdiction issue is an interesting one but the US as a whole has a long history of overreach (eg I know someone who worked in the UK who was issued with a bench warrant for his arrest by a state judge in the US because he worked on a site that "enabled" Americans to gamble online). I also agree that (5) is an odd argument. From [1]: > Know this, however: There is no Fifth Amendment privilege to refuse to produce subpoenaed documents on the ground their contents are self-incriminating; courts hold that such information is not "compelled testimony." However, as explained below, there is a crucial corollary: In certain circumstances the act of producing such documents may indeed be entitled to protection under the Fifth Amendment. - See more at: http://www.callawyer.com/Clstory.cfm?eid=920910#sthash.NmnSC4GZ.dpuf http://www.callawyer.com/Clstory.cfm?eid=920910#sthash.NmnSC... On the last point, by a strict definition of intent [2], you are probably correct. However, recklessness and negligence can constitute criminal intent. You can argue that it's not reasonable to hold someone accountable for what someone else does with their program. It's easy to fall into what I call the "engineer's trap" here. An example is "you can't prove someone else didn't use my Wifi to distribute [pick your poison], therefore you can't find me guilty". While strictly true, the law doesn't work that way. Subjective standards and tests are applied in situations like this. So if law enforcement can show [bad activity] was happening only when you were home, stopped when you went on vacation and happened on many occasions the balance of evidence will suggest you're responsible even if you can't strictly prove it. So if you designed and distributed a Windows program that was a RATing toolkit that worked with the click of a button and the only real purpose is [illegal stuff] then an argument like "I'm not responsible for what people use this for" will fail before a judge and jury as not being "reasonable". [1]: http://www.callawyer.com/Clstory.cfm?eid=920910 http://www.callawyer.com/Clstory.cfm?eid=920910 [2]: http://en.wikipedia.org/wiki/Mens_rea#United_States http://en.wikipedia.org/wiki/Mens_rea#United_States

xiaoma 12y ago

As one of the many, many people who interacted with Aaron online before his death and as a Node Knockout judge and was pretty shocked to see this news. >"There is a lot of confusion in this thread regarding basic concepts of the law." Just so that we have some idea how to weigh your comments with those of the EFF, could you tell us a little bit about your expertise? Are you a lawyer? Have you worked with this kind of subpoena before?

will_brown 12y ago
I am a Florida attorney. In two different instances I have been admitted Pro Hac Vice in the State of New Jersey, and in one of those instances it was a civil case brought by the NJAG office against a corporate client who was alleged to be providing chimney cleaning services without being licensed. In short I have received/reviewed/responded to subpoenas (and other discovery requests) from the very same office.