5 ms·

One multi-million dollar business franchise gained illegal access to the computer network and private data of another multi-million dollar business franchise. S

by mdm_ 11y ago

One multi-million dollar business franchise gained illegal access to the computer network and private data of another multi-million dollar business franchise. Sounds right up the FBI's alley to me.

themartorana 11y ago
I'm not sure where the legal line gets drawn. There was no hacking. There was an attempt to use a password that worked. Right now, "unauthorized access" is any after-the-fact declaration that someone didn't want someone else looking at something. If there had been broken encryption, 0-day exploits, SQL injection attacks, etc... THAT is hacking. Not accessing a public endpoint that lets you in.
- tptacek 11y ago
  This kind of hair-splitting is why the legal definition of "exceeding authorized access" is so general. There seems to be a very popular misconception that the law criminalizes "hacking", as in "0-day exploits" and "SQL injection". No: thankfully, the law doesn't so much care about how you get access. It cares that you knowingly access things without permission, no matter how you do it.
- iancarroll 11y ago
  Accessing a public endpoint has been prosecuted before. http://arstechnica.com/tech-policy/2013/03/auernheimer-aka-weev-sentenced-to-41-months-for-attipad-hack/ http://arstechnica.com/tech-policy/2013/03/auernheimer-aka-w...
  - themartorana 11y ago
    True. And many, many people had trouble with that decision - many of them members of HN. Just because it's been prosecuted doesn't make the outcome any less right or wrong.
    - iancarroll 11y ago
      Of course - I think it was probably wrong too, though this isn't realy the place. But OP was talking about the legal line.
- prawn 11y ago
  "any after-the-fact declaration that someone didn't want someone else looking at something." I think putting password protection on something isn't "after-the-fact", it's pretty obvious they didn't want someone else looking.
- RogerL 11y ago
  So by your lights I could make a copy of a key on your key ring, enter your house, take stuff, and that is fine because your locked door is a public endpoint? Or if the fact that the key is physical gives you pause, let's say you nave a numeric keypad lock, and at work one day you commented that you had it set to the same setting as the lock at work to make it easy for you to remember. Do I get to take your stuff?
  - themartorana 11y ago
    It's funny, these arguments weren't top of mind with regards to the hacking charges against weev or Aaron Swartz. In that case, HN was clear fault lay with AT&T or MIT and the abuse of the word "hacking" was a horrible miscarriage of justice.
GFK_of_xmaspast 11y ago
Since when does the FBI care about corporate wrong-doing?
- jordan0day 11y ago
  Another way to phrase "corporate wrong-doing" is "crime." So that's probably why the FBI would care.
  - cmdrfred 11y ago
    Except when it involves bankers... RE downvoters: http://www.nytimes.com/2014/05/04/magazine/only-one-top-banker-jail-financial-crisis.html http://www.nytimes.com/2014/05/04/magazine/only-one-top-bank...

by mdm_ 11y ago

One multi-million dollar business franchise gained illegal access to the computer network and private data of another multi-million dollar business franchise. Sounds right up the FBI's alley to me.

themartorana 11y ago

I'm not sure where the legal line gets drawn. There was no hacking. There was an attempt to use a password that worked. Right now, "unauthorized access" is any after-the-fact declaration that someone didn't want someone else looking at something. If there had been broken encryption, 0-day exploits, SQL injection attacks, etc... THAT is hacking. Not accessing a public endpoint that lets you in.

tptacek 11y ago
This kind of hair-splitting is why the legal definition of "exceeding authorized access" is so general. There seems to be a very popular misconception that the law criminalizes "hacking", as in "0-day exploits" and "SQL injection". No: thankfully, the law doesn't so much care about how you get access. It cares that you knowingly access things without permission, no matter how you do it.
iancarroll 11y ago
Accessing a public endpoint has been prosecuted before. http://arstechnica.com/tech-policy/2013/03/auernheimer-aka-weev-sentenced-to-41-months-for-attipad-hack/ http://arstechnica.com/tech-policy/2013/03/auernheimer-aka-w...
- themartorana 11y ago
  True. And many, many people had trouble with that decision - many of them members of HN. Just because it's been prosecuted doesn't make the outcome any less right or wrong.
  - iancarroll 11y ago
    Of course - I think it was probably wrong too, though this isn't realy the place. But OP was talking about the legal line.
prawn 11y ago
"any after-the-fact declaration that someone didn't want someone else looking at something." I think putting password protection on something isn't "after-the-fact", it's pretty obvious they didn't want someone else looking.
RogerL 11y ago
So by your lights I could make a copy of a key on your key ring, enter your house, take stuff, and that is fine because your locked door is a public endpoint? Or if the fact that the key is physical gives you pause, let's say you nave a numeric keypad lock, and at work one day you commented that you had it set to the same setting as the lock at work to make it easy for you to remember. Do I get to take your stuff?
- themartorana 11y ago
  It's funny, these arguments weren't top of mind with regards to the hacking charges against weev or Aaron Swartz. In that case, HN was clear fault lay with AT&T or MIT and the abuse of the word "hacking" was a horrible miscarriage of justice.

GFK_of_xmaspast 11y ago

Since when does the FBI care about corporate wrong-doing?

jordan0day 11y ago
Another way to phrase "corporate wrong-doing" is "crime." So that's probably why the FBI would care.
- cmdrfred 11y ago
  Except when it involves bankers... RE downvoters: http://www.nytimes.com/2014/05/04/magazine/only-one-top-banker-jail-financial-crisis.html http://www.nytimes.com/2014/05/04/magazine/only-one-top-bank...