8 ms·

This reminds me of a The Florida case of Rachel Hoffman [1]. In short Rachel was arrested for marijuana (and 4 ecstasy pills), and flipped as a CI in a sting r

This reminds me of a The Florida case of Rachel Hoffman [1]. In short Rachel was arrested for marijuana (and 4 ecstasy pills), and flipped as a CI in a sting requiring here to buy ounces of cocaine, ecstasy and a gun. Rachel disappeared during the sting under watch of LEO and found murdered. It is similar to charging a "hacker" for scanning websites and cyberstalking (I don't know all the charges) then asking that hacker to obtain information on drug cartels and politicians, it is dangerous and unrelated to the underlying crime. At least in Florida as a result of Hoffman we have enacted Rachel's law to protect people in such a situation in the future (but it does not outlaw CIs totally just gives them protection, such as training for officers and right to a lawyer). [1] http://en.m.wikipedia.org/wiki/Rachel_Hoffman http://en.m.wikipedia.org/wiki/Rachel_Hoffman

orclev 12y ago
I remember reading about this case around the time the charges were originally filed and those are pretty much the charges. The guy ran nmap (or equivalent) on the website, and submitted some attempts at SQL injections in a few forms. That was pretty much the entirety of his "hacking". Honestly what he got on the plea bargain is at the far end of what I'd consider appropriate for what he did. Something like a small fine, say $500 and a "don't do that again" would probably be more appropriate honestly. Had he actually gotten somewhere with the SQL injection, or actually gained access to something I'd say more might be warrented. FYI the 44 counts were arrived at by charging each form submission individually, so it was really just 1 charge, just counted 44 times.
- Consultant32452 12y ago
  The 44 counts thing is kind of ludicrous unless he literally made 44 separate attempts at SQL injection at different times rather than 44 separate HTTP requests. Having said that, I think the punishment for "attempted hacking" should be fairly harsh in the way "attempted robbery" is. He was likely attempting to steal copies of information or perhaps even destroy information that could've cost thousands or perhaps even millions to recover depending on who he'd gone after.
  - yebyen 12y ago
    Or (to present an alternative explanation for why one might try to see what ports are open and whether some rudimentary attacks can succeed) maybe he was trying to evaluate a potential vendor and decide whether or not to put his secure personal or company information into the system. You know, rudimentary attacks that should not succeed on any type of vendor system that has been through the most basic security audit or pen testing? I guess we should either trust the vendor or don't. No real reason why would anyone want to see if other hackers with basic knowledge can get access to a system? I'm sure there are plenty vendors with transparent public records of the authorized penetration tests that they have ordered which have been done, you can trust!
    - Consultant32452 12y ago
      There are a number of passive things you can do to gain some trust in an online vendor. You can, for example, look for certifications from a service like SiteLock. To maintain the brick and mortar analogy, you wouldn't try to pick the locks of a storefront after hours just to determine whether or not you should do business with them. And if you get caught doing that, I dare say you deserve to be charged with a crime.
      - yebyen 12y ago
        Sending packets with strings which are commonly known to cause serious problems if systems are vulnerable to well-known exploits should not be a crime. If your system solicits users to input their private data and is vulnerable to easy attack vectors or common exploits like basic SQL injection, you are the one who should be charged. So, the only problem left is how to establish your standing to sue the lazy vendor. It is a problem since you can't actually bring them up on negligence charges if you were not actually damaged. Well, if picking the lock is thus illegal per your analogy, then the only way to have standing would be to first submit yourself to potential unknown harm and wait for the day when a bad hacker comes! I think your analogy falls down too, because a brick-and-mortar storefront holds its own assets and is liable (or insured) for their own losses in the event of theft. You rarely store your own private things inside a brick and mortar storefront. If you did and they are stolen, the store would normally be liable and reimburse you. People store their private data "in the cloud" all the time, but because of arcana in law which does not correctly distinguish between pulling on the handle and picking the lock, they are not allowed to check and see if the cloud-monger actually locks the door when he goes home at night?
- rayiner 12y ago
  I don't see any reason why attempting SQL injections on a few forms on the County website should be treated any differently than trying a few ways to pick the lock on a county building. Should the punishment for the latter depend on the sophistication of the lock-picking techniques the intruder uses? Web servers are other peoples' property, and there's no "right to tinker" with them. All you have is an implied license to use the site in the way the owner expects you to use it, the same as with a physical storefront.
  - guelo 12y ago
    A better analogy than lock-picking: the door has a sign that says "turn knob to the right to enter", he was arrested for unsuccessfully turning the knob to the left to see if it would opened into another room.
  - orclev 12y ago
    Yes but there are degrees with these things. If you attempt to open a locked door they don't charge you with armed robbery, even if that door has a sign that says "employee's only". I'm not suggesting attempting a SQL injection should just be ignored, but it should clearly be at worst a misdemeanor and not a felony, about on par with trespassing in terms of severity. Now, if you then use that SQL injection to steal protected data, gain further access, or delete data, then yeah you're talking about moving into felony territory. Web servers are other peoples property, but they're also a public space when you open then up to the public by hosting public services on them. A private server is different from a public server in the same way private property is different from a public storefront. By making your server accessible to the public you lose some of the expectations of privacy and implicitly allow a certain degree of access.
    - rayiner 12y ago
      If you try to break into a building under the cover of darkness, you're going to get hit with more than a trespass charge.
      - sillysaurus3 12y ago
- kw71 12y ago
  Uh oh. I might be in trouble for finding out the entire list of people in the local jail by looking up Mr. %
LordKano 12y ago
It also reminds me of Randy Weaver. Fortunately, in this case, no one died.
- hga 12y ago
  He may be too young to have a family for the Feds to threaten and murder. Otherwise sounds identical except for the entrapment angle. Weaver specifically refused to become an informant against the targeted white separatists because they knew and completely loathed each other. The offer made to Salinas sounds like one that could very easily result in his getting tortured to death. For that matter, do some of these cartels go after their target's families?
  - LordKano 12y ago
    In Weaver's case, it seems that even the judge was in on the pressure. If I remember the details correctly, he was erroneously informed that if he was convicted, his property would be seized because he had used it as bond collateral.
dreamweapon 12y ago
A little background on Rachel, from that fine New Yorker article, "The Throwaways" (12/09/03): By the time Rachel was twelve, she had been a ballerina, a Brownie, an equestrian, and a Weeki Wachee Springs Little Mermaid contestant; by eighteen, she had learned to play the flute and the piano, gone skydiving, and hiked the Grand Canyon. By twenty-three, she had completed an undergraduate degree in psychology, interned at a mental-health institute, and travelled internationally. She loved to cook—she’d prepare elaborate multicourse meals for friends and deliver homemade matzo-ball soup to an ailing classmate. She was given to hatching big plans: She had initially dreamed of going into counselling, but decided to apply to culinary school. She would invent a new form of therapy, she told her dad; perhaps troubled kids who hated talking to a therapist from an overstuffed couch would open up as she taught them how to bake cakes and make spaghetti carbonara.
- user_0001 12y ago
  and the police who arranged the sting, mishandled the situation, resulting in her kidnapping and eventual murder? I will hazard a guess, not guilty on all charges. She was a druggy after all and got everything she deserved. That is some serious messed up state of affairs that allowed this to happen.
  - dreamweapon 12y ago
    Per the WP article: The officers involved in the operation were suspended with pay, and the family filed a wrongful death lawsuit against the city. Message to the officers, and to their brethren colleagues in the profession being, in so many words: "Aw shucks, it was just a little misunderstanding. After all, she didn't follow instructions, did she? Don't beat yourselves up over it."
  - classicsnoot 12y ago
    Can you please define 'druggy', in this context and in general? Also, would you be comfortable listing all of your medications and past experiences so i can fit you into a generalized subgroup and decide what you deserve? k thanks

orclev 12y ago

I remember reading about this case around the time the charges were originally filed and those are pretty much the charges. The guy ran nmap (or equivalent) on the website, and submitted some attempts at SQL injections in a few forms. That was pretty much the entirety of his "hacking". Honestly what he got on the plea bargain is at the far end of what I'd consider appropriate for what he did. Something like a small fine, say $500 and a "don't do that again" would probably be more appropriate honestly. Had he actually gotten somewhere with the SQL injection, or actually gained access to something I'd say more might be warrented. FYI the 44 counts were arrived at by charging each form submission individually, so it was really just 1 charge, just counted 44 times.

Consultant32452 12y ago
The 44 counts thing is kind of ludicrous unless he literally made 44 separate attempts at SQL injection at different times rather than 44 separate HTTP requests. Having said that, I think the punishment for "attempted hacking" should be fairly harsh in the way "attempted robbery" is. He was likely attempting to steal copies of information or perhaps even destroy information that could've cost thousands or perhaps even millions to recover depending on who he'd gone after.
- yebyen 12y ago
  Or (to present an alternative explanation for why one might try to see what ports are open and whether some rudimentary attacks can succeed) maybe he was trying to evaluate a potential vendor and decide whether or not to put his secure personal or company information into the system. You know, rudimentary attacks that should not succeed on any type of vendor system that has been through the most basic security audit or pen testing? I guess we should either trust the vendor or don't. No real reason why would anyone want to see if other hackers with basic knowledge can get access to a system? I'm sure there are plenty vendors with transparent public records of the authorized penetration tests that they have ordered which have been done, you can trust!
  - Consultant32452 12y ago
    There are a number of passive things you can do to gain some trust in an online vendor. You can, for example, look for certifications from a service like SiteLock. To maintain the brick and mortar analogy, you wouldn't try to pick the locks of a storefront after hours just to determine whether or not you should do business with them. And if you get caught doing that, I dare say you deserve to be charged with a crime.
    - yebyen 12y ago
      Sending packets with strings which are commonly known to cause serious problems if systems are vulnerable to well-known exploits should not be a crime. If your system solicits users to input their private data and is vulnerable to easy attack vectors or common exploits like basic SQL injection, you are the one who should be charged. So, the only problem left is how to establish your standing to sue the lazy vendor. It is a problem since you can't actually bring them up on negligence charges if you were not actually damaged. Well, if picking the lock is thus illegal per your analogy, then the only way to have standing would be to first submit yourself to potential unknown harm and wait for the day when a bad hacker comes! I think your analogy falls down too, because a brick-and-mortar storefront holds its own assets and is liable (or insured) for their own losses in the event of theft. You rarely store your own private things inside a brick and mortar storefront. If you did and they are stolen, the store would normally be liable and reimburse you. People store their private data "in the cloud" all the time, but because of arcana in law which does not correctly distinguish between pulling on the handle and picking the lock, they are not allowed to check and see if the cloud-monger actually locks the door when he goes home at night?
rayiner 12y ago
I don't see any reason why attempting SQL injections on a few forms on the County website should be treated any differently than trying a few ways to pick the lock on a county building. Should the punishment for the latter depend on the sophistication of the lock-picking techniques the intruder uses? Web servers are other peoples' property, and there's no "right to tinker" with them. All you have is an implied license to use the site in the way the owner expects you to use it, the same as with a physical storefront.
- guelo 12y ago
  A better analogy than lock-picking: the door has a sign that says "turn knob to the right to enter", he was arrested for unsuccessfully turning the knob to the left to see if it would opened into another room.
- orclev 12y ago
  Yes but there are degrees with these things. If you attempt to open a locked door they don't charge you with armed robbery, even if that door has a sign that says "employee's only". I'm not suggesting attempting a SQL injection should just be ignored, but it should clearly be at worst a misdemeanor and not a felony, about on par with trespassing in terms of severity. Now, if you then use that SQL injection to steal protected data, gain further access, or delete data, then yeah you're talking about moving into felony territory. Web servers are other peoples property, but they're also a public space when you open then up to the public by hosting public services on them. A private server is different from a public server in the same way private property is different from a public storefront. By making your server accessible to the public you lose some of the expectations of privacy and implicitly allow a certain degree of access.
  - rayiner 12y ago
    If you try to break into a building under the cover of darkness, you're going to get hit with more than a trespass charge.
    - sillysaurus3 12y ago
kw71 12y ago
Uh oh. I might be in trouble for finding out the entire list of people in the local jail by looking up Mr. %

LordKano 12y ago

It also reminds me of Randy Weaver. Fortunately, in this case, no one died.

hga 12y ago
He may be too young to have a family for the Feds to threaten and murder. Otherwise sounds identical except for the entrapment angle. Weaver specifically refused to become an informant against the targeted white separatists because they knew and completely loathed each other. The offer made to Salinas sounds like one that could very easily result in his getting tortured to death. For that matter, do some of these cartels go after their target's families?
- LordKano 12y ago
  In Weaver's case, it seems that even the judge was in on the pressure. If I remember the details correctly, he was erroneously informed that if he was convicted, his property would be seized because he had used it as bond collateral.

dreamweapon 12y ago

A little background on Rachel, from that fine New Yorker article, "The Throwaways" (12/09/03): By the time Rachel was twelve, she had been a ballerina, a Brownie, an equestrian, and a Weeki Wachee Springs Little Mermaid contestant; by eighteen, she had learned to play the flute and the piano, gone skydiving, and hiked the Grand Canyon. By twenty-three, she had completed an undergraduate degree in psychology, interned at a mental-health institute, and travelled internationally. She loved to cook—she’d prepare elaborate multicourse meals for friends and deliver homemade matzo-ball soup to an ailing classmate. She was given to hatching big plans: She had initially dreamed of going into counselling, but decided to apply to culinary school. She would invent a new form of therapy, she told her dad; perhaps troubled kids who hated talking to a therapist from an overstuffed couch would open up as she taught them how to bake cakes and make spaghetti carbonara.

user_0001 12y ago
and the police who arranged the sting, mishandled the situation, resulting in her kidnapping and eventual murder? I will hazard a guess, not guilty on all charges. She was a druggy after all and got everything she deserved. That is some serious messed up state of affairs that allowed this to happen.
- dreamweapon 12y ago
  Per the WP article: The officers involved in the operation were suspended with pay, and the family filed a wrongful death lawsuit against the city. Message to the officers, and to their brethren colleagues in the profession being, in so many words: "Aw shucks, it was just a little misunderstanding. After all, she didn't follow instructions, did she? Don't beat yourselves up over it."
- classicsnoot 12y ago
  Can you please define 'druggy', in this context and in general? Also, would you be comfortable listing all of your medications and past experiences so i can fit you into a generalized subgroup and decide what you deserve? k thanks