11 ms·

...the defense expert investigators wrote that they "do not consider the NIT to be 'hacking'" because the NIT "exploited a configuration setting that did not re

...the defense expert investigators wrote that they "do not consider the NIT to be 'hacking'" because the NIT "exploited a configuration setting that did not require offensive-based actions." But you'll get maliciously prosecuted for guessing a sequential URL and typing it into your address bar thanks to CFAA...

vog 11y ago
Indeed, these are double standards at its best.
RexRollman 11y ago
Do as I say, not as I do.
- user_0001 11y ago
  Which everyone who has ever had to take care of someone has said, in the history of caring, ever
  - a3n 11y ago
    I'm very explicit about telling my kid exactly that. I point out his behavior, I point out how I sometimes do almost exactly that, what's bad about it, and I remind him that just because I do something doesn't make it right. Because I'm not setting switches on my son module, I'm trying to influence a human being toward a good direction, despite my failings. I think it's working.
x5n1 11y ago
The law does not have to abide by the law, only has to appear to do so. Case in point, parallel reconstruction.
- dragonwriter 11y ago
  > The law does not have to abide by the law, only has to appear to do so. Given that weev's conviction was overturned for the prosecution not abiding by the law, while that may be true in some abstract sense, it doesn't seem particularly relevant to weev's case.
matthewmacleod 11y ago
But you'll get maliciously prosecuted for guessing a sequential URL and typing it into your address bar thanks to CFAA... Well, no. It's a bit more complex than that.
- halviti 11y ago
  I'm not sure if you're unfamiliar with the Weev case, or trying to make it sound like it was more complicated, but if you look at the reasons why he was originally convicted, it was specifically for typing in a URL and "gaining access" to data that was publicly available on a website. https://www.techdirt.com/articles/20130929/15371724695/dojs-insane-argument-against-weev-hes-felon-because-he-broke-rules-we-made-up.shtml https://www.techdirt.com/articles/20130929/15371724695/dojs-... Unless you're saying that because he changed his browser user-agent, that makes it 'more complicated', but I think most everyone here would disagree.
  - res0nat0r 11y ago
    he knowingly and purposefully accessing systems and information he knew he should not have been.
    - halviti 11y ago
      I agree, but that is not the issue. The issue was how the case was decided. He incremented a number in a URL, and that was his ultimate crime. Do you honestly think it's right to send someone to jail for several years because they were messing around with a URL? Of course he likely deserved to be charged with something, but not what he was charged with, and it hurts the rest of us when things like this set a bad precedent.
      - gph 11y ago
        >He incremented a number in a URL, and that was his ultimate crime. IANAL, but the way I understand it, it's not about the method that you used to access the system. Even if someone was highly incompetent and left their system open to being accessed, the fact that you accessed it knowing you shouldn't have is the actual crime. After all, even if someone leaves the doors and windows wide open to their house, it's still illegal to go inside if you don't have permission. In this case they left the URLs open to be accessed, but it was clear that that part of the website wasn't meant to be accessed by the general public and the prosecutors were able to convince a jury/judge that weev would have reasonable known that.
JustSomeNobody 11y ago
Wait, so my grocery store posts their add every week and as I get to the last page and I want to jump back to the front, I usually change the .../16.html to a .../1.html. I could go to prison for that? TF!? When are lawmakers going to learn how the web works?
- ewzimm 11y ago
  That's a little too extreme, but you could imagine a real example not far off. In the case where they used 13.html to list their secret cost of goods and omitted it from the button controls, skipping from 12 to 14, and you typed 13.html, then used that information to set prices for your own wholesale business, there's actually a chance you could actually get in trouble for it.
- skymt 11y ago
  The relevant part of the CFAA, chopped up for readability: > Whoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer ... shall be punished as provided in subsection (c) of this section. That requires both intent and access in excess of authorization. So since 1.html is a public page, you're authorized to read it. If 1.html was the personal information of the customer with ID #1, as in the AT&T case, that would violate CFAA. Also notable is the definition of a "protected computer." It's any computer "which is used in or affecting interstate or foreign commerce or communication," which is every computer connected to the Internet.
  - JustSomeNobody 11y ago
    Skeptic in me says this is just a nice way for AT&T to defer blame for not securing their customer's information. I've poked around websites, just to see what all is available, just by guessing URLs. I never had intention of getting anyone's personal data, of course. But, really, who hasn't done this?
    - deleted 11y ago
      [deleted]
rhino369 11y ago
The use of malware itself isn't really the legal reason why this is questionable. You can get a warrant to hack someone. Just like busting down a door and taking someone's stuff is burglary, but a cop can do it with a warrant. The legal reason for why this is questionable is because typically the judge can only issue warrants for people or places inside their state. The problem is that the rule was written before the internet. It totally falls apart with TOR because law enforcement and courts can't even figure out where the server is. So this leads to an interpretation of the law where no court in America can issue a search warrant on a .onion address. That is absurd. There is no policy or legal reason to justify giving someone like a child porn distributor a free pass merely because they use TOR. I'd actually argue that the search is valid if the state has a TOR access node located within it because the .onion address is what is being probed via TOR. It's essentially acting on behalf of the server. But many would disagree with such a broad reading of the rules. And it would be hard to draw a line between TOR and an old ISP network.
- tzs 11y ago
  This is a bit reminiscent of the situation with ships as discussed in this story submitted earlier today: https://news.ycombinator.com/item?id=9902057 https://news.ycombinator.com/item?id=9902057 If your ship sails under the flag of country X, then it is generally country X's navy that has the authority to keep you in line in international waters. So pick a country like the Bahamas (where the ship in the story was flagged) whose navy rarely leaves their territorial waters, and you can literally get away with murder.
dragonwriter 11y ago
> But you'll get maliciously prosecuted for guessing a sequential URL and typing it into your address bar thanks to CFAA... I don't know that you can say "thanks to CFAA" for a prosecution that was not -- per the appeals court that threw out the resulting conviction -- carried out properly.

vog 11y ago

Indeed, these are double standards at its best.

RexRollman 11y ago

Do as I say, not as I do.

user_0001 11y ago
Which everyone who has ever had to take care of someone has said, in the history of caring, ever
- a3n 11y ago
  I'm very explicit about telling my kid exactly that. I point out his behavior, I point out how I sometimes do almost exactly that, what's bad about it, and I remind him that just because I do something doesn't make it right. Because I'm not setting switches on my son module, I'm trying to influence a human being toward a good direction, despite my failings. I think it's working.

x5n1 11y ago

The law does not have to abide by the law, only has to appear to do so. Case in point, parallel reconstruction.

dragonwriter 11y ago
> The law does not have to abide by the law, only has to appear to do so. Given that weev's conviction was overturned for the prosecution not abiding by the law, while that may be true in some abstract sense, it doesn't seem particularly relevant to weev's case.

matthewmacleod 11y ago

But you'll get maliciously prosecuted for guessing a sequential URL and typing it into your address bar thanks to CFAA... Well, no. It's a bit more complex than that.

halviti 11y ago
I'm not sure if you're unfamiliar with the Weev case, or trying to make it sound like it was more complicated, but if you look at the reasons why he was originally convicted, it was specifically for typing in a URL and "gaining access" to data that was publicly available on a website. https://www.techdirt.com/articles/20130929/15371724695/dojs-insane-argument-against-weev-hes-felon-because-he-broke-rules-we-made-up.shtml https://www.techdirt.com/articles/20130929/15371724695/dojs-... Unless you're saying that because he changed his browser user-agent, that makes it 'more complicated', but I think most everyone here would disagree.
- res0nat0r 11y ago
  he knowingly and purposefully accessing systems and information he knew he should not have been.
  - halviti 11y ago
    I agree, but that is not the issue. The issue was how the case was decided. He incremented a number in a URL, and that was his ultimate crime. Do you honestly think it's right to send someone to jail for several years because they were messing around with a URL? Of course he likely deserved to be charged with something, but not what he was charged with, and it hurts the rest of us when things like this set a bad precedent.
    - gph 11y ago
      >He incremented a number in a URL, and that was his ultimate crime. IANAL, but the way I understand it, it's not about the method that you used to access the system. Even if someone was highly incompetent and left their system open to being accessed, the fact that you accessed it knowing you shouldn't have is the actual crime. After all, even if someone leaves the doors and windows wide open to their house, it's still illegal to go inside if you don't have permission. In this case they left the URLs open to be accessed, but it was clear that that part of the website wasn't meant to be accessed by the general public and the prosecutors were able to convince a jury/judge that weev would have reasonable known that.

JustSomeNobody 11y ago

Wait, so my grocery store posts their add every week and as I get to the last page and I want to jump back to the front, I usually change the .../16.html to a .../1.html. I could go to prison for that? TF!? When are lawmakers going to learn how the web works?

ewzimm 11y ago
That's a little too extreme, but you could imagine a real example not far off. In the case where they used 13.html to list their secret cost of goods and omitted it from the button controls, skipping from 12 to 14, and you typed 13.html, then used that information to set prices for your own wholesale business, there's actually a chance you could actually get in trouble for it.
skymt 11y ago
The relevant part of the CFAA, chopped up for readability: > Whoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer ... shall be punished as provided in subsection (c) of this section. That requires both intent and access in excess of authorization. So since 1.html is a public page, you're authorized to read it. If 1.html was the personal information of the customer with ID #1, as in the AT&T case, that would violate CFAA. Also notable is the definition of a "protected computer." It's any computer "which is used in or affecting interstate or foreign commerce or communication," which is every computer connected to the Internet.
- JustSomeNobody 11y ago
  Skeptic in me says this is just a nice way for AT&T to defer blame for not securing their customer's information. I've poked around websites, just to see what all is available, just by guessing URLs. I never had intention of getting anyone's personal data, of course. But, really, who hasn't done this?
  - deleted 11y ago
    [deleted]

rhino369 11y ago

The use of malware itself isn't really the legal reason why this is questionable. You can get a warrant to hack someone. Just like busting down a door and taking someone's stuff is burglary, but a cop can do it with a warrant. The legal reason for why this is questionable is because typically the judge can only issue warrants for people or places inside their state. The problem is that the rule was written before the internet. It totally falls apart with TOR because law enforcement and courts can't even figure out where the server is. So this leads to an interpretation of the law where no court in America can issue a search warrant on a .onion address. That is absurd. There is no policy or legal reason to justify giving someone like a child porn distributor a free pass merely because they use TOR. I'd actually argue that the search is valid if the state has a TOR access node located within it because the .onion address is what is being probed via TOR. It's essentially acting on behalf of the server. But many would disagree with such a broad reading of the rules. And it would be hard to draw a line between TOR and an old ISP network.

tzs 11y ago
This is a bit reminiscent of the situation with ships as discussed in this story submitted earlier today: https://news.ycombinator.com/item?id=9902057 https://news.ycombinator.com/item?id=9902057 If your ship sails under the flag of country X, then it is generally country X's navy that has the authority to keep you in line in international waters. So pick a country like the Bahamas (where the ship in the story was flagged) whose navy rarely leaves their territorial waters, and you can literally get away with murder.

dragonwriter 11y ago

> But you'll get maliciously prosecuted for guessing a sequential URL and typing it into your address bar thanks to CFAA... I don't know that you can say "thanks to CFAA" for a prosecution that was not -- per the appeals court that threw out the resulting conviction -- carried out properly.