4 ms·
The courtcase has been followed closely by the Danish media, especially the tech-savvy version2.dk that has had a reporter in the courtroom every day of the tri
by mixmax 12y ago
The courtcase has been followed closely by the Danish media, especially the tech-savvy version2.dk that has had a reporter in the courtroom every day of the trial. It has caused quite a stir as all sorts of problems with CSC, the prosecutor and police investigation came to light during the hearings. Some highlights:
- CSC, that handles a large part of Danish infrastructure including social security numbers, police backend, etc. has dismal security. They don't even update their software as security patches become available. Warg had access to their mainframe for 9 months without them having a clue about it. The only reason they found out was because the Swedish police called them and told them.
- username/password pairs for CSC's server were readily available on one of their subsites(!)
- Warg turned off the logs on the CSC mainframe, and they didn't notice. It appears that logs were turned off for months. As a result CSC doesn't know whether data has been altered. We're talking about all police systems, social security systems, and more.
- The police have not had their own investigative team at CSC, and haven't looked at the technical evidence. This has been done by CSC, which is an obvious problem.
- The Danish police was contacted by Swedish police three times during 2012 because the evidence from a Swedish case turned up files from CSC, and the Danish police didn't respond as they apparently didn't find the information important. During the courtcase the Danish police's chief IT investigator was caught lying about this.
- The prosecutor and judge were clueless, bordering on the hilarious, about technical issues. For instance the prosecutor refused to acknowledge that other user accounts except Wargs existed on the computer (there were 5 accounts), tried to paint putty as a hacking tool that only criminals would use, tried to establish Jacob Applebaum and Warg as friends because Applebaum retweeted one of Wargs tweets (only friends do that!), etc. etc.
These are just the highlights...
- lucb1e 12y ago> tried to establish Jacob Applebaum and Warg as friends because Applebaum retweeted one of Wargs tweets (only friends do that!) I understand the ignorance displayed by the judge here, but did the judge also see being Applebaum's friend as a bad thing?
- mixmax 12y agoApplebaum was an expert witness called in to testify on how a computer could be remote controlled, and the prosecutor tried to have him dismissed based on the retweet. He ended up testifying, so I guess the attempt wasn't successful.
- rayiner 12y agoI don't think that's a technically ignorant argument for a prosecutor to make. There's certainly a factual inference that could (but does not necessarily have to be drawn) between retweeting and being friends. Especially in the context of getting someone disqualified based on conflict of interest.
- lucb1e 12y agoThere are many people I retweet whom I have no connection to whatsoever. I like what they wrote and I think it's relevant to or interesting for my followers.
- netcan 12y agoThere may also be people you had a drink with to whom I have no connection to whatsoever. It's not disqualifying but it is a piece of information.
- TheCraiggers 12y agoGenerally, information that has absolutely no merit in a court case isn't allowed in the courtroom because (I presume) it can subconsciously alter a person's judgement of the proceedings. Assuming a retweet is the full extent of their "friendship", this is the real-world equivalent of dismissing an expert witness because the defendant quoted them in a paper once.
- netcan 12y agoThis is actually kind of interesting. Something like a tweet is context dependent. Some people tweet mostly to their friends and a lot of retweets are in fact indicative of a personal relationship. It will often be easy to estimate for a twitter user, but very hard to make objective enough to work as evidence in court. Do they have just 12 or 12000 followers? Are they tweeting personal tidbits or politics & jokes? etc. These things can add up to an very informed guess.
- chvid 12y agoThis case is all over the Danish tech media and it is very hard to judge the technical quality of the underlaying police work; though I am pretty sure that it is much better than what the "internet" gives police credit for. The troubles the lawyers had with the tech is noted even by the lawyers themselves: http://jyllands-posten.dk/indland/politiretsvaesen/ECE7160924/Hackersag-har-været-plaget-af-teknisk-svære-beviser/ http://jyllands-posten.dk/indland/politiretsvaesen/ECE716092... "Hacker case plagued by complex technical evidence" - all in Danish. What is clear is that Warg's computer was used and contained the stolen records. And JT succesfully denied police access to his encrypted computer. The police were unable to prove his involvement beyond aiding.
- JoeAltmaier 12y agoIsn't that litany of vandalism enough to convict? He's meddled with public safety systems. No less serious than destroying traffic signs or cutting the phone lines to the fire department. Lack of security isn't any kind of defense e.g. just because phone lines are not hardened against tampering doesn't mean its OK to cut them.