4 ms·

http://arstechnica.com/security/2013/05/reporters-use-google-find-breach-get-branded-as-hackers/ http://arstechnica.com/security/2013/05/reporters-use-google...

http://arstechnica.com/security/2013/05/reporters-use-google-find-breach-get-branded-as-hackers/ http://arstechnica.com/security/2013/05/reporters-use-google... http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30/the-free-web-program-that-got-bradley-manning-convicted-of-computer-fraud/ http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30... > That Manning was convicted of computer fraud seems to suggest that using wget on a U.S. government computer to download large numbers of files can be considered the digital equivalent of trespassing – even if it's on turf you're otherwise allowed to access. I think is what he means.

ethanbond 12y ago
What the... This is a simple distinction. Computer fraud means using a computer to do something you're not authorized to do. He was not authorized to use wget, he used it, thus he committed fraud. He was authorized to access that "turf," but not with wget. Why? Specifically for the reason he did it: it's a risk. Whatever your opinion on whistleblower protections, this is not a risky judgment.
- Crito 12y ago
  Does any American website enumerate in their terms of use the software that you are allowed to use to access them? Could they?
  - ethanbond 12y ago
    No, but I'm almost certain that the DOD's filesystem likely includes a "using any unapproved software to access this system is considered unauthorized." It's almost as if there's a difference between DOD classified file storage and google.com.
    - Crito 12y ago
      Could it be done with a non-DOD site? If not, why not? Could I make a website that immediately drops you onto a landing page that says "The rest of this website may only be accessed using Safari. Use of Firefox, Chrome, or any other software constitutes unauthorized access."?
      - snowwrestler 12y ago
        Yes, you could make such a website, but I doubt that it would mean anything in court. Manning was active-duty military, accessing classified military systems. There are all sorts of duties, laws, and regulations that apply to that situation that don't apply to a civilian accessing some random website on the web.
- duaneb 12y ago
  > He was not authorized to use wget I'd be interested in seeing the exhaustive list of programs they are authorized to use.
  - ethanbond 12y ago
    Get a job at the DOD and I'm sure they'd be glad to share it with you. Is it really that unbelievable that the Department of Defense would have a strict set of software that's allowed to utilize their network, for a variety of reasons, including Manning's usecase or just simple security concerns? Is your employer comfortable with you sharing encryption keys via post-it notes stuck on your monitor? Should the DOD be comfortable with people accessing classified filesystems with any software they please? This is simply a non-argument. I think it's a tacked-on charge meant to take down a maybe-legitimate whistleblower, but it's not like you can say it's actually unreasonable/unrealistic.
    - duaneb 12y ago
      For one thing, I'm pretty sure a browser already contains everything necessary to do what manning did with a few lines of javascript.
      - ethanbond 12y ago
        A lot of government computers have VERY limited capabilities. No right click, no JS, no modifier keys, no copy/paste, etc. These are the real limitations of the real world and they're there by design. Manning skirted them, and he got hit for it.
    - DrJosiah 12y ago
      About 10-11 years ago, I was contacted by an employee at NOAA who needed sha1 checksums of open-source software I released. He needed it so that it could go on their whitelist of usable software, but he couldn't generate them himself due to policy. Whitelisting acceptable software really isn't a bad idea, especially for organizations that care about safety and security of data. The next step is to lock down the platforms to only execute whitelisted software (similar to how Apple tries to lock down iPhones, iPods, and iPads).

ethanbond 12y ago

What the... This is a simple distinction. Computer fraud means using a computer to do something you're not authorized to do. He was not authorized to use wget, he used it, thus he committed fraud. He was authorized to access that "turf," but not with wget. Why? Specifically for the reason he did it: it's a risk. Whatever your opinion on whistleblower protections, this is not a risky judgment.

Crito 12y ago
Does any American website enumerate in their terms of use the software that you are allowed to use to access them? Could they?
- ethanbond 12y ago
  No, but I'm almost certain that the DOD's filesystem likely includes a "using any unapproved software to access this system is considered unauthorized." It's almost as if there's a difference between DOD classified file storage and google.com.
  - Crito 12y ago
    Could it be done with a non-DOD site? If not, why not? Could I make a website that immediately drops you onto a landing page that says "The rest of this website may only be accessed using Safari. Use of Firefox, Chrome, or any other software constitutes unauthorized access."?
    - snowwrestler 12y ago
      Yes, you could make such a website, but I doubt that it would mean anything in court. Manning was active-duty military, accessing classified military systems. There are all sorts of duties, laws, and regulations that apply to that situation that don't apply to a civilian accessing some random website on the web.
duaneb 12y ago
> He was not authorized to use wget I'd be interested in seeing the exhaustive list of programs they are authorized to use.
- ethanbond 12y ago
  Get a job at the DOD and I'm sure they'd be glad to share it with you. Is it really that unbelievable that the Department of Defense would have a strict set of software that's allowed to utilize their network, for a variety of reasons, including Manning's usecase or just simple security concerns? Is your employer comfortable with you sharing encryption keys via post-it notes stuck on your monitor? Should the DOD be comfortable with people accessing classified filesystems with any software they please? This is simply a non-argument. I think it's a tacked-on charge meant to take down a maybe-legitimate whistleblower, but it's not like you can say it's actually unreasonable/unrealistic.
  - duaneb 12y ago
    For one thing, I'm pretty sure a browser already contains everything necessary to do what manning did with a few lines of javascript.
    - ethanbond 12y ago
      A lot of government computers have VERY limited capabilities. No right click, no JS, no modifier keys, no copy/paste, etc. These are the real limitations of the real world and they're there by design. Manning skirted them, and he got hit for it.
  - DrJosiah 12y ago
    About 10-11 years ago, I was contacted by an employee at NOAA who needed sha1 checksums of open-source software I released. He needed it so that it could go on their whitelist of usable software, but he couldn't generate them himself due to policy. Whitelisting acceptable software really isn't a bad idea, especially for organizations that care about safety and security of data. The next step is to lock down the platforms to only execute whitelisted software (similar to how Apple tries to lock down iPhones, iPods, and iPads).