7 ms·

Why I Hope Congress Never Watches “Blackhat”

119 points by noonespecial 12y ago

coldcode 12y ago
What is being proposed for new laws scares me more than any hacker.
- click170 12y ago
  Contact your rep in congress and tell them that. They dont read hackerness unfortunately.
  - sp332 12y ago
    Representatives http://www.house.gov/representatives/find/ http://www.house.gov/representatives/find/ Senators https://www.senate.gov/general/contact_information/senators_cfm.cfm https://www.senate.gov/general/contact_information/senators_...
  - cmurf 12y ago
    Really? And you think they won't assume you're some nasty hacker trying to angle for weak laws so you can just get away with more of this demonic evil hateful hacking thing that you do? Hoodlum! The incompetency here is not striking in the fact there's apparently been no change since 1984.
    - click170 12y ago
      > Hoodlum! I think there's a valid concern that we would be seen this way if we contacted our reps. This is why I think it's important that you present and carry yourself well, be prepared about what you want to talk about, and anticipate questions by having well-thought-out answers ready. These people consider themselves professionals, so despite our views of them, we will better communicate our points if we demonstrate professionalism and respect.
mhurron 12y ago
If Congress is making laws and policy based on movies, we have a bigger problem then which movies they base it on.
- IgorPartola 12y ago
  I don't know, if they watched Inconvenient Truth, it might benefit some of the knuckleheads there. Or 12 Years a Slave. Or even Lincoln.
  - lifeisstillgood 12y ago
    Well the Congressional Cinema Club could put on some special showings and ask for sponsorship - Car Manufacturers Lobby: Bullit - Anti Car Lobby: Duel - Trans-Atlantic Airlines Lobby : Titanic - Construction Lobby: Bridge over the River Kwai - Elon Musk : Iron Man 1 or 3 (but not 2) - The Hamptons Tourist Board: The wicker man - The Banjo Players association of America: Deliverance - Tesla Car Showrooms: Death of a salesman - Climate Change Deniers Lobby: Some Like It Hot - Liberal Atheists for a kinder America: Any Harry Potter
    - godkingjim 12y ago
      "The Hamptons Tourist Board: The wicker man" I'm curious; what you mean by this one?
      - anigbrowl 12y ago
        I laughed hard at this one! The Hamptons is basically a vacation destination in eastern New York state for very very wealthy people, who don't want any riff-raff cluttering up their picturesque vacation views. 'The Wicker Man' is a film (+ a remake) about a police officer who goes to investigate a crime in a remote idyll where everyone knows everyone else and runs into...problems. Translation: let's ensure that the 'wrong' people stay away.
        lifeisstillgood 12y ago
delinka 12y ago
"...making Hemsworth officially the best-looking human to ever use a command line." Psh. Just because I prefer to avoid publicity doesn't mean the honor actually belongs to anyone other than myself.
Someone1234 12y ago
Computer Crime laws are already insanely disproportionate. They were created during a moral panic when only a few individuals, large multinationals and, large governments had computers and the government were worried that "hackers" could break into the electricity grid or the communications system and shut it down. So right now you could literally break into someone's home, knock them unconscious, and then steal their laptop, but yet still get more jail time for "hacking" into their laptop than any of the previous crimes. It only gets more insane when someone "hacks" across state lines. The federal laws are absolutely insane, and the only thing more disproportionate are some of the drug laws (many of which were also created during times of moral panic). In particular are comic cases of when companies fail to secure things at all (e.g. leave data exposed to the public via hidden URLs) and then someone gets prosecuted because they "hacked" that company and "stole" that data.
- disposition2 12y ago
  > In particular are comic cases of when companies fail to secure things at all (e.g. leave data exposed to the public via hidden URLs) and then someone gets prosecuted because they "hacked" that company and "stole" that data. Which is my main concern with all the attention and push for change (or rather more laws and less privacy) in relation to the Sony hack (among others). Would Congress and the media be calling for equitable action if someone had physically broken in to the Sony Films offices and stolen the data, due to lax (physical) security policies? Doubtful, they'd probably be told to buy better locks...
- snowwrestler 12y ago
  > So right now you could literally break into someone's home, knock them unconscious, and then steal their laptop, but yet still get more jail time for "hacking" into their laptop than any of the previous crimes. Can you provide some examples? And not sentencing guidelines or what the prosecutors asked for; actual sentence lengths that were actually served by people convicted solely of computer crimes vs. time served for breaking and entering and assault and battery and theft.
- alistairSH 12y ago
  >In particular are comic cases of when companies fail to secure things at all and then someone gets prosecuted because they "hacked" that company and "stole" that data. <devil's advocate>If I leave my garage open, and somebody takes my golf clubs, is that not theft? Yes, the potential punishments are disproportionately harsh. Yes, the company is silly for leaving data exposed. No, it's not ok to take data because it's unprotected.
angersock 12y ago
Make no mistake: they're coming after what they don't think they can control. That's probably you, friend.
riskable 12y ago
I don't understand how the Sony hack relates to the proposed changes to the CFAA. If the attacker was North Korea--as suggested by the administration (which I don't believe)--then how would increasing penalties for "hacking" or developing (or even sharing) "hacking tools" make a difference? As if we had any jurisdiction whatsoever over there or that the laws of the United States would somehow deter foreign attackers. If they want to increase penalties for anything it should be for companies failing to secure their systems. Attackers can often use very sophisticated methods to make their way into internal networks but once they're in it's run-of-the-mill, patched-three-years-ago vulnerabilities that let them do the most damage. There's a lot of negligence going on inside corporate networks in regards to information security and one of the justifications I often hear is that they can't justify increased spending (or spending any money whatsoever) on IT security when the costs of an attack are unknown. If we apply significant punitive damages then the costs would be much easier to calculate and justify.
- cheepin 12y ago
  > I don't understand how the Sony hack relates to the proposed changes to the CFAA. I'm guessing that the lobbyists behind SOPA, PIPA, CISPA, etc have been trying to push something like this for a while, but now think that the Sony hack has scared enough people that the bill can appear like it has popular support.
- snowwrestler 12y ago
  > If the attacker was North Korea--as suggested by the administration (which I don't believe)--then how would increasing penalties for "hacking" or developing (or even sharing) "hacking tools" make a difference? This might be a bit off-topic, but there's potentially a distinction between North Korea being responsible for the hack of Sony, and whoever the people are who actually penetrated Sony's network and extracted/deleted the data. By analogy: if you pay an assassin to kill someone, the law holds both you and the assassin responsible. I think this is what the government means when they say North Korea was responsible--not necessarily that every participant in the attack was a North Korean in North Korea.
  - 12y ago
nickysielicki 12y ago
Am I crazy for wanting to leave the US? Is it like this everywhere?
- sp332 12y ago
  Where would you go?
  - nickysielicki 12y ago
    Europe
    - sp332 12y ago
      Europe generally has fewer privacy and free speech protections than the US. And in some countries, the NSA and the national government will be spying on you. https://www.thewire.com/global/2013/10/france-not-happy-about-latest-snowden-leak/70733/ https://www.thewire.com/global/2013/10/france-not-happy-abou...
      - krick 12y ago
        I don't need any "protections", I need to be left alone. That's how I actually can speak free, feel free and don't worry about my privacy too much (well, as long as I don't use skype, gmail, mobile phone… well, everything is relative, ok?). And honestly I thing that only fools believe in stuff like "free speech protections", although I usually don't try to persuade anybody about all these abstract matters. So, yeah, I'm just fine in Europe without all these "free speech protections" and stuff. I guess it could be better, but I don't feel like leaving to Siberia or some desert island yet.
        sp332 12y ago
        I don't understand the distinction you are making between free speech and being able to speak freely. I'm not talking about an abstract concept, I mean posting certain things on your blog is actually illegal. And being spied on by the government is the the opposite of being left alone, so I think you should be against that too.
rilita 12y ago
Making the CFAA apply more broadly and criminalizing hacking behaviors that are currently misdemeanors will have the following effects imo: 1. As stated in the article, restrict legitimate security work and creation of useful tools. 2. Glamorize becoming a hacker for the misfits of the world. ( It's a criminal behavior; you'll get underground respect for doing it... ) 3. Drive hacking further underground ( this is like suddenly making weed illegal again in places where it is currently legal ) More crime will result. 4. Cause me to release code I write under an alias through multiple proxies in combination with Tor.
- dragonwriter 12y ago
  If the behaviors are misdemeanors, they are, by definition, already criminalized.
brainy 12y ago
the good news is that africa has cyber laws, so you can all came here.

119 points by noonespecial 12y ago

coldcode 12y ago

What is being proposed for new laws scares me more than any hacker.

click170 12y ago
Contact your rep in congress and tell them that. They dont read hackerness unfortunately.
- sp332 12y ago
  Representatives http://www.house.gov/representatives/find/ http://www.house.gov/representatives/find/ Senators https://www.senate.gov/general/contact_information/senators_cfm.cfm https://www.senate.gov/general/contact_information/senators_...
- cmurf 12y ago
  Really? And you think they won't assume you're some nasty hacker trying to angle for weak laws so you can just get away with more of this demonic evil hateful hacking thing that you do? Hoodlum! The incompetency here is not striking in the fact there's apparently been no change since 1984.
  - click170 12y ago
    > Hoodlum! I think there's a valid concern that we would be seen this way if we contacted our reps. This is why I think it's important that you present and carry yourself well, be prepared about what you want to talk about, and anticipate questions by having well-thought-out answers ready. These people consider themselves professionals, so despite our views of them, we will better communicate our points if we demonstrate professionalism and respect.

mhurron 12y ago

If Congress is making laws and policy based on movies, we have a bigger problem then which movies they base it on.

IgorPartola 12y ago
I don't know, if they watched Inconvenient Truth, it might benefit some of the knuckleheads there. Or 12 Years a Slave. Or even Lincoln.
- lifeisstillgood 12y ago
  Well the Congressional Cinema Club could put on some special showings and ask for sponsorship - Car Manufacturers Lobby: Bullit - Anti Car Lobby: Duel - Trans-Atlantic Airlines Lobby : Titanic - Construction Lobby: Bridge over the River Kwai - Elon Musk : Iron Man 1 or 3 (but not 2) - The Hamptons Tourist Board: The wicker man - The Banjo Players association of America: Deliverance - Tesla Car Showrooms: Death of a salesman - Climate Change Deniers Lobby: Some Like It Hot - Liberal Atheists for a kinder America: Any Harry Potter
  - godkingjim 12y ago
    "The Hamptons Tourist Board: The wicker man" I'm curious; what you mean by this one?
    - anigbrowl 12y ago
      I laughed hard at this one! The Hamptons is basically a vacation destination in eastern New York state for very very wealthy people, who don't want any riff-raff cluttering up their picturesque vacation views. 'The Wicker Man' is a film (+ a remake) about a police officer who goes to investigate a crime in a remote idyll where everyone knows everyone else and runs into...problems. Translation: let's ensure that the 'wrong' people stay away.
      - lifeisstillgood 12y ago

delinka 12y ago

"...making Hemsworth officially the best-looking human to ever use a command line." Psh. Just because I prefer to avoid publicity doesn't mean the honor actually belongs to anyone other than myself.

Someone1234 12y ago

Computer Crime laws are already insanely disproportionate. They were created during a moral panic when only a few individuals, large multinationals and, large governments had computers and the government were worried that "hackers" could break into the electricity grid or the communications system and shut it down. So right now you could literally break into someone's home, knock them unconscious, and then steal their laptop, but yet still get more jail time for "hacking" into their laptop than any of the previous crimes. It only gets more insane when someone "hacks" across state lines. The federal laws are absolutely insane, and the only thing more disproportionate are some of the drug laws (many of which were also created during times of moral panic). In particular are comic cases of when companies fail to secure things at all (e.g. leave data exposed to the public via hidden URLs) and then someone gets prosecuted because they "hacked" that company and "stole" that data.

disposition2 12y ago
> In particular are comic cases of when companies fail to secure things at all (e.g. leave data exposed to the public via hidden URLs) and then someone gets prosecuted because they "hacked" that company and "stole" that data. Which is my main concern with all the attention and push for change (or rather more laws and less privacy) in relation to the Sony hack (among others). Would Congress and the media be calling for equitable action if someone had physically broken in to the Sony Films offices and stolen the data, due to lax (physical) security policies? Doubtful, they'd probably be told to buy better locks...
snowwrestler 12y ago
> So right now you could literally break into someone's home, knock them unconscious, and then steal their laptop, but yet still get more jail time for "hacking" into their laptop than any of the previous crimes. Can you provide some examples? And not sentencing guidelines or what the prosecutors asked for; actual sentence lengths that were actually served by people convicted solely of computer crimes vs. time served for breaking and entering and assault and battery and theft.
alistairSH 12y ago
>In particular are comic cases of when companies fail to secure things at all and then someone gets prosecuted because they "hacked" that company and "stole" that data. <devil's advocate>If I leave my garage open, and somebody takes my golf clubs, is that not theft? Yes, the potential punishments are disproportionately harsh. Yes, the company is silly for leaving data exposed. No, it's not ok to take data because it's unprotected.

angersock 12y ago

Make no mistake: they're coming after what they don't think they can control. That's probably you, friend.

riskable 12y ago

I don't understand how the Sony hack relates to the proposed changes to the CFAA. If the attacker was North Korea--as suggested by the administration (which I don't believe)--then how would increasing penalties for "hacking" or developing (or even sharing) "hacking tools" make a difference? As if we had any jurisdiction whatsoever over there or that the laws of the United States would somehow deter foreign attackers. If they want to increase penalties for anything it should be for companies failing to secure their systems. Attackers can often use very sophisticated methods to make their way into internal networks but once they're in it's run-of-the-mill, patched-three-years-ago vulnerabilities that let them do the most damage. There's a lot of negligence going on inside corporate networks in regards to information security and one of the justifications I often hear is that they can't justify increased spending (or spending any money whatsoever) on IT security when the costs of an attack are unknown. If we apply significant punitive damages then the costs would be much easier to calculate and justify.

cheepin 12y ago
> I don't understand how the Sony hack relates to the proposed changes to the CFAA. I'm guessing that the lobbyists behind SOPA, PIPA, CISPA, etc have been trying to push something like this for a while, but now think that the Sony hack has scared enough people that the bill can appear like it has popular support.
snowwrestler 12y ago
> If the attacker was North Korea--as suggested by the administration (which I don't believe)--then how would increasing penalties for "hacking" or developing (or even sharing) "hacking tools" make a difference? This might be a bit off-topic, but there's potentially a distinction between North Korea being responsible for the hack of Sony, and whoever the people are who actually penetrated Sony's network and extracted/deleted the data. By analogy: if you pay an assassin to kill someone, the law holds both you and the assassin responsible. I think this is what the government means when they say North Korea was responsible--not necessarily that every participant in the attack was a North Korean in North Korea.
- 12y ago

nickysielicki 12y ago

Am I crazy for wanting to leave the US? Is it like this everywhere?

sp332 12y ago
Where would you go?
- nickysielicki 12y ago
  Europe
  - sp332 12y ago
    Europe generally has fewer privacy and free speech protections than the US. And in some countries, the NSA and the national government will be spying on you. https://www.thewire.com/global/2013/10/france-not-happy-about-latest-snowden-leak/70733/ https://www.thewire.com/global/2013/10/france-not-happy-abou...
    - krick 12y ago
      I don't need any "protections", I need to be left alone. That's how I actually can speak free, feel free and don't worry about my privacy too much (well, as long as I don't use skype, gmail, mobile phone… well, everything is relative, ok?). And honestly I thing that only fools believe in stuff like "free speech protections", although I usually don't try to persuade anybody about all these abstract matters. So, yeah, I'm just fine in Europe without all these "free speech protections" and stuff. I guess it could be better, but I don't feel like leaving to Siberia or some desert island yet.
      - sp332 12y ago
        I don't understand the distinction you are making between free speech and being able to speak freely. I'm not talking about an abstract concept, I mean posting certain things on your blog is actually illegal. And being spied on by the government is the the opposite of being left alone, so I think you should be against that too.

rilita 12y ago

Making the CFAA apply more broadly and criminalizing hacking behaviors that are currently misdemeanors will have the following effects imo: 1. As stated in the article, restrict legitimate security work and creation of useful tools. 2. Glamorize becoming a hacker for the misfits of the world. ( It's a criminal behavior; you'll get underground respect for doing it... ) 3. Drive hacking further underground ( this is like suddenly making weed illegal again in places where it is currently legal ) More crime will result. 4. Cause me to release code I write under an alias through multiple proxies in combination with Tor.

dragonwriter 12y ago
If the behaviors are misdemeanors, they are, by definition, already criminalized.

brainy 12y ago

the good news is that africa has cyber laws, so you can all came here.