6 ms·

I really hope they don't arrest him. But at the same time, I hope they do and then he fights the CFAA and kills that stupid law once and for all.

Someone1234 12y ago
You can tell that the CFAA got created during a period of moral panic about computer crimes (e.g. "a single hacker could take over our nuclear warheads and start WWIII" which is actually what the movie War Games (1983 Vs 1984 for the CFAA) is based upon). The crimes are vague and the prison terms are absolutely bonkers. You can literally go hit someone over the head with a 2x4 and get less prison time than you could get for breaking into their iPhone. The fact that a lot of courts are completely ignorant about technology in general and will eat up whatever junk a company tells them (e.g. "this XSS exploit cost us $50K in wages to repair!") is also a huge problem.
- sarciszewski 12y ago
  Don't I know it! I'm still paying my $9370 in restitution for discovering a 2+ year old unpatched vulnerability in 2011 and NOT using it to compromise their system further.
  - Someone1234 12y ago
    You likely cannot go into it too much, but any more to that story? Did you try and report it, and they turned you over to the feds, or did you see if it was exploitable and they reported you?
    - sarciszewski 12y ago
      "You likely cannot go into it too much, but any more to that story?" Nah, I already posted my experiences in multiple places. It's a long story. https://scott.arciszewski.me/blog/2014/03/black-and-white-2600-article https://scott.arciszewski.me/blog/2014/03/black-and-white-26... https://news.ycombinator.com/item?id=7954123 https://news.ycombinator.com/item?id=7954123
- declan 12y ago
  There's an excellent article written by some journalist (now ex-journalist, I suppose) on that point: http://www.cnet.com/news/from-wargames-to-aaron-swartz-how-u-s-anti-hacking-law-went-astray/ http://www.cnet.com/news/from-wargames-to-aaron-swartz-how-u... the CFAA's punishments, drafted during a post-WarGames computer hacking scare and designed to deter intrusions into NORAD, threatened Swartz with stiffer penalties than if he had been convicted of assault with an actual crowbar... "WarGames" inspired these extra-long prison terms. As soon as it was released in June 1983, the movie, starring Matthew Broderick as a teenage hacker who broke into NORAD's mainframe and nearly ignited World War III, electrified Capitol Hill and kicked off an anti-hacker panic... No fewer than six different anti-hacking bills were introduced that year, and Congress convened its first hearings as soon as politicians returned from their summer recess. Rep. Dan Glickman, a Kansas Democrat, opened the proceedings by saying: "We're gonna show about four minutes from the movie 'WarGames,' which I think outlines the problem fairly clearly." A House committee report solemnly intoned: "'WarGames' showed a realistic representation of the automatic dialing and access capabilities of the personal computer."...
  - A_COMPUTER 12y ago
    On the positive side, I was a kid and I watched some of those news reports on TV and begged for a computer because the idea of hacking into government computers looked so cool. That's what started my interest in programming.
pdabbadabba 12y ago
> But at the same time, I hope they do and then he fights the CFAA and kills that stupid law once and for all. I can't see any possible way this could happen in the courts. Yes, the law is too harsh, but it is pretty far from being unconstitutionally harsh. For anything less than life in prison (i.e., any "term of years" sentence) courts are incredibly deferential to congress in analyzing a sentence's proportionality. (In fact, until recently, at least one circuit had a rule that any term-of-years sentence was per se proportionate.) The supreme court has used examples like life sentences for parking offenses in explaining the threshold. Can anyone here think of a ground for overturning CFAA on a ground other than disproportionality?
- sarciszewski 12y ago
  Other than the fact that it's so vague that it ought to be void?
  - pdabbadabba 12y ago
    I've never found it especially vague. (At least, not substantially more vague than any number of other criminal statutes.) The problem, rather, is that as it's written it seems to criminalize more than we want it to. That's bad, but not something the judiciary can fix for us.
    - sarciszewski 12y ago
      You never received explicit authorization to access ycombinator.com did you, criminal?
      - pdabbadabba 12y ago
        1. Your point has nothing to do with vagueness. It has to do with precisely what I described: criminalizing too much. 2. The CFAA says nothing about explicit authorization. It just requires "authorization." There will be fringe cases where it will be difficult to determine what that means, but usually (including the example you helpfully provided -- yes, of course I'm authorized to access news.ycombinator.com) it could not be easier.
suyash 12y ago
I hope he doesn't. He seemed like genuinely wanting to help Yahoo against attack and probably copied FBI as a courtsey.

Someone1234 12y ago

You can tell that the CFAA got created during a period of moral panic about computer crimes (e.g. "a single hacker could take over our nuclear warheads and start WWIII" which is actually what the movie War Games (1983 Vs 1984 for the CFAA) is based upon). The crimes are vague and the prison terms are absolutely bonkers. You can literally go hit someone over the head with a 2x4 and get less prison time than you could get for breaking into their iPhone. The fact that a lot of courts are completely ignorant about technology in general and will eat up whatever junk a company tells them (e.g. "this XSS exploit cost us $50K in wages to repair!") is also a huge problem.

sarciszewski 12y ago
Don't I know it! I'm still paying my $9370 in restitution for discovering a 2+ year old unpatched vulnerability in 2011 and NOT using it to compromise their system further.
- Someone1234 12y ago
  You likely cannot go into it too much, but any more to that story? Did you try and report it, and they turned you over to the feds, or did you see if it was exploitable and they reported you?
  - sarciszewski 12y ago
    "You likely cannot go into it too much, but any more to that story?" Nah, I already posted my experiences in multiple places. It's a long story. https://scott.arciszewski.me/blog/2014/03/black-and-white-2600-article https://scott.arciszewski.me/blog/2014/03/black-and-white-26... https://news.ycombinator.com/item?id=7954123 https://news.ycombinator.com/item?id=7954123
declan 12y ago
There's an excellent article written by some journalist (now ex-journalist, I suppose) on that point: http://www.cnet.com/news/from-wargames-to-aaron-swartz-how-u-s-anti-hacking-law-went-astray/ http://www.cnet.com/news/from-wargames-to-aaron-swartz-how-u... the CFAA's punishments, drafted during a post-WarGames computer hacking scare and designed to deter intrusions into NORAD, threatened Swartz with stiffer penalties than if he had been convicted of assault with an actual crowbar... "WarGames" inspired these extra-long prison terms. As soon as it was released in June 1983, the movie, starring Matthew Broderick as a teenage hacker who broke into NORAD's mainframe and nearly ignited World War III, electrified Capitol Hill and kicked off an anti-hacker panic... No fewer than six different anti-hacking bills were introduced that year, and Congress convened its first hearings as soon as politicians returned from their summer recess. Rep. Dan Glickman, a Kansas Democrat, opened the proceedings by saying: "We're gonna show about four minutes from the movie 'WarGames,' which I think outlines the problem fairly clearly." A House committee report solemnly intoned: "'WarGames' showed a realistic representation of the automatic dialing and access capabilities of the personal computer."...
- A_COMPUTER 12y ago
  On the positive side, I was a kid and I watched some of those news reports on TV and begged for a computer because the idea of hacking into government computers looked so cool. That's what started my interest in programming.

pdabbadabba 12y ago

> But at the same time, I hope they do and then he fights the CFAA and kills that stupid law once and for all. I can't see any possible way this could happen in the courts. Yes, the law is too harsh, but it is pretty far from being unconstitutionally harsh. For anything less than life in prison (i.e., any "term of years" sentence) courts are incredibly deferential to congress in analyzing a sentence's proportionality. (In fact, until recently, at least one circuit had a rule that any term-of-years sentence was per se proportionate.) The supreme court has used examples like life sentences for parking offenses in explaining the threshold. Can anyone here think of a ground for overturning CFAA on a ground other than disproportionality?

sarciszewski 12y ago
Other than the fact that it's so vague that it ought to be void?
- pdabbadabba 12y ago
  I've never found it especially vague. (At least, not substantially more vague than any number of other criminal statutes.) The problem, rather, is that as it's written it seems to criminalize more than we want it to. That's bad, but not something the judiciary can fix for us.
  - sarciszewski 12y ago
    You never received explicit authorization to access ycombinator.com did you, criminal?
    - pdabbadabba 12y ago
      1. Your point has nothing to do with vagueness. It has to do with precisely what I described: criminalizing too much. 2. The CFAA says nothing about explicit authorization. It just requires "authorization." There will be fringe cases where it will be difficult to determine what that means, but usually (including the example you helpfully provided -- yes, of course I'm authorized to access news.ycombinator.com) it could not be easier.

suyash 12y ago

I hope he doesn't. He seemed like genuinely wanting to help Yahoo against attack and probably copied FBI as a courtsey.