4 ms·

His actions enabled him to cause damage if he chose, but it would be disingenuous for us to avoid examining his intent. The only evidence we have of his intent

by stevenh 12y ago

His actions enabled him to cause damage if he chose, but it would be disingenuous for us to avoid examining his intent. The only evidence we have of his intent is that he warned the hosts who were vulnerable, and also warned the customers whose personal information and private emails may no longer be safe. If he had malicious intent as you imply, then I believe he would not have disclosed anything, let alone under his real name. He seems honest to a fault, loquacious to the point of legally endangering himself just to spread awareness of some horrible things he witnessed. In my opinion, spinning his actions as anything other than heroic is itself an order of magnitude more malicious than what you're claiming, because it contributes to a false narrative in which the end goal is to completely destroy another human being's life when he was just trying to help.

pdabbadabba 12y ago
I have mixed feelings about this. I think you're probably right that he did this with altruistic intent (or, at worst, just to satisfy his curiosity), and I hope he hasn't gotten himself into serious trouble. (Though I fear he may have.) But I hasten to add that intent is clearly not dispositive of whether it was OK for him to infiltrate someone else's system. Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent. Certainly it is worse to break into a house intending to steal something than to walk into someone else's house out of curiosity, but neither is legal or, in my view, morally acceptable. So I say: good for him for making these breaches known, but he definitely should not have been in there poking around in the first place.
- lutorm 12y ago
  If you walk by a house seeing someone crack a window and crawl in, do you think it's morally acceptable to trespass on the property to ascertain whether this is a burglary in progress or someone who forgot their key? (This case seems somewhere between my and your example.)
  - tempestn 12y ago
    Perhaps, but this case is more like walking by a house, seeing a cracked window, and crawling in yourself to take a look around and see if anyone else might have done the same.
  - xorcist 12y ago
    Stop the allegories already. This is unlawful computer access, not burglary. There is nothing to be gained from comparing with unrelated crimes, neither moral understanding nor any understanding of judicial consequences.
- AnthonyMouse 12y ago
  > Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent. In the case of physical property the most common remedies for trespassing are either an injunction prohibiting future trespassing on the same property or a modest fine (e.g. $100). Applying the same penalties to the equivalent behavior in the computer context would be completely reasonable, but that empirically isn't what happens, because the CFAA is defective.
  - pdabbadabba 12y ago
    I basically agree - though I hasten to add that I never said anything about what penalty a person would actually receive or whether it is appropriate. I do think that it makes sense for "computer tresspass" to be punished more harshly than tresspass to physical property. It takes a lot more effort to break into a server than it does to walk through someone's door (or into their yard), so I think the baseline level of culpability is higher (though bear in mind that these are generalizations). There is also a lot more risk involved in a "casual" computer tresspass. But I agree with you that this doesn't gets us to the maximum CFAA sentence. This gets us into complicated territory, though. There are very few people who have ever actually been sentenced to the maximum CFAA penalty. (I'm actually aware of none.) The actual punishments actually imposed are often, I think, fairly reasonable. Of course, there are plenty who have been threatened with the huge maximum by federal prosecutors, but this is no different from any other crime. Of course federal prosecutors will menace defendants with the maximum possible penalty. They want to extract a guilty plea, and it would also be dangerous for them to claim that any shorter penalty than the maximum applied, since they do no actually control sentencing. (Imagine the controversy if the U.S. Attorney told a defendant that he was only realistically looking at 6 months but the judge gave him 2 years.) It's the defense attorney's role to make sure that her client has a realistic understanding of the likely punishment, not the government's. What's really needed is a replacement for CFAA (and, for that matter, most other criminal statutes) with more carefully graded maximum sentences, but I've never heard a realistic proposal about how such a law would work.
  - saurik 12y ago
    This isn't quite trespassing, though: this is breaking and entering (without malicious intent). This is someone noting that your door lock is easily pickable and then going on a quest to see just how far they can get, maybe finding a key to the car in the garage and then going into their glove compartment. The equivalent situation with physical property is clearly "criminal".
- cruisername 12y ago
  The Law should have a case for the need to ignore some rights in order to protect other rights, given that any damage will be compensated. E.g. break a window to get someone out of a car crash. Seeing that he didn't do any damage, it should be fine. I know that's the case in German civic law. Intent is regularly a deciding factor in measure of punishment. This may as well go without a warning.
deleted 12y ago
[deleted]
Donzo 12y ago
It's been stated here several times before. The reward for pointing out lapses in security like the aforementioned are generally awarded in the form of hostility. He'll probably get a big reward for this one. That said, it was a well-written article by an obviously talented hacker, though I did find the simile about the infant with a genital wart to be unsettling.
brianpgordon 12y ago
Notwithstanding HN's very reasonable ideas about right and wrong in this case, getting an unauthorized shell on someone's server and cd'ing/ls'ing around is probably illegal in most jurisdictions.

by stevenh 12y ago

pdabbadabba 12y ago

I have mixed feelings about this. I think you're probably right that he did this with altruistic intent (or, at worst, just to satisfy his curiosity), and I hope he hasn't gotten himself into serious trouble. (Though I fear he may have.) But I hasten to add that intent is clearly not dispositive of whether it was OK for him to infiltrate someone else's system. Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent. Certainly it is worse to break into a house intending to steal something than to walk into someone else's house out of curiosity, but neither is legal or, in my view, morally acceptable. So I say: good for him for making these breaches known, but he definitely should not have been in there poking around in the first place.

lutorm 12y ago
If you walk by a house seeing someone crack a window and crawl in, do you think it's morally acceptable to trespass on the property to ascertain whether this is a burglary in progress or someone who forgot their key? (This case seems somewhere between my and your example.)
- tempestn 12y ago
  Perhaps, but this case is more like walking by a house, seeing a cracked window, and crawling in yourself to take a look around and see if anyone else might have done the same.
- xorcist 12y ago
  Stop the allegories already. This is unlawful computer access, not burglary. There is nothing to be gained from comparing with unrelated crimes, neither moral understanding nor any understanding of judicial consequences.
AnthonyMouse 12y ago
> Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent. In the case of physical property the most common remedies for trespassing are either an injunction prohibiting future trespassing on the same property or a modest fine (e.g. $100). Applying the same penalties to the equivalent behavior in the computer context would be completely reasonable, but that empirically isn't what happens, because the CFAA is defective.
- pdabbadabba 12y ago
  I basically agree - though I hasten to add that I never said anything about what penalty a person would actually receive or whether it is appropriate. I do think that it makes sense for "computer tresspass" to be punished more harshly than tresspass to physical property. It takes a lot more effort to break into a server than it does to walk through someone's door (or into their yard), so I think the baseline level of culpability is higher (though bear in mind that these are generalizations). There is also a lot more risk involved in a "casual" computer tresspass. But I agree with you that this doesn't gets us to the maximum CFAA sentence. This gets us into complicated territory, though. There are very few people who have ever actually been sentenced to the maximum CFAA penalty. (I'm actually aware of none.) The actual punishments actually imposed are often, I think, fairly reasonable. Of course, there are plenty who have been threatened with the huge maximum by federal prosecutors, but this is no different from any other crime. Of course federal prosecutors will menace defendants with the maximum possible penalty. They want to extract a guilty plea, and it would also be dangerous for them to claim that any shorter penalty than the maximum applied, since they do no actually control sentencing. (Imagine the controversy if the U.S. Attorney told a defendant that he was only realistically looking at 6 months but the judge gave him 2 years.) It's the defense attorney's role to make sure that her client has a realistic understanding of the likely punishment, not the government's. What's really needed is a replacement for CFAA (and, for that matter, most other criminal statutes) with more carefully graded maximum sentences, but I've never heard a realistic proposal about how such a law would work.
- saurik 12y ago
  This isn't quite trespassing, though: this is breaking and entering (without malicious intent). This is someone noting that your door lock is easily pickable and then going on a quest to see just how far they can get, maybe finding a key to the car in the garage and then going into their glove compartment. The equivalent situation with physical property is clearly "criminal".
cruisername 12y ago
The Law should have a case for the need to ignore some rights in order to protect other rights, given that any damage will be compensated. E.g. break a window to get someone out of a car crash. Seeing that he didn't do any damage, it should be fine. I know that's the case in German civic law. Intent is regularly a deciding factor in measure of punishment. This may as well go without a warning.

deleted 12y ago

[deleted]

Donzo 12y ago

It's been stated here several times before. The reward for pointing out lapses in security like the aforementioned are generally awarded in the form of hostility. He'll probably get a big reward for this one. That said, it was a well-written article by an obviously talented hacker, though I did find the simile about the infant with a genital wart to be unsettling.

brianpgordon 12y ago

Notwithstanding HN's very reasonable ideas about right and wrong in this case, getting an unauthorized shell on someone's server and cd'ing/ls'ing around is probably illegal in most jurisdictions.