7 ms·

I walk up to a grocery store with automatic doors. The lights are all on. The doors open. I walk in. It's 8am. This grocery store has two sets of doors, ab

I walk up to a grocery store with automatic doors. The lights are all on. The doors open. I walk in. It's 8am. This grocery store has two sets of doors, about 200 feet apart. At the other set of doors there is a sign that says that the store doesn't open until 9am. Am I trespassing?

gph 11y ago
Again IANAL and trespassing is a different law than the CFAA, but if the prosecutors could reasonable prove that it wasn't an honest mistake and you were knowingly going into the store when you're aware it's not allowed, then yes I think you could be charged with trespassing. Like say you're an ex-employee who for some reason wants to go look at the schedule (maybe your stalking one of your old co-workers). If you walked in knowing the store was closed and you shouldn't be there, then I have to imagine you'd be arrested and charged with trespassing amongst other things.
- msandford 11y ago
  Both deal with unauthorized access and intent don't they? The point I'm trying to make is that it's VERY difficult to divine intent in the absence of any kind of access control. In other words, given my above example and that's all the information you have, you can't prove that I intended to trespass. Now if the doors didn't open automatically and there was a broken lock, it's much easier to determine intent. But in Weev's case, there was no broken lock because there was no lock at all! Going strictly from the evidence we can surmise that AT&T didn't INTEND to prevent unauthorized access because they did nothing to prevent it.
  - res0nat0r 11y ago
    We always delve into ridiculous analogies on this site for some reason when it comes to this case, trying to somehow justify that someone, knowingly, was accessing a system they, again knowingly, knew they should not have been accessing. Status codes, locks, no locks, these silly analogies aren't really useful. Proving intent is.
    - msandford 11y ago
      So prove the intent. Prove what was going on inside his head. Prove that he didn't merely SUSPECT that he shouldn't have had the information, but that he KNEW he shouldn't. The reason that things get so silly is that it's very difficult to prove intent in the absence of any kind of access control. If he had bruteforced an admin password, the intent trail is there to be found. If he had done SQL injection, again, it's easy to argue intent. If he had physically broken into the building and stolen paper documents, again the intent is easy to discern. I would argue that it's akin to finding an unmarked binding lying in the street with absolutely no way of telling whose it is, and what it contains. You open it and don't see anything that says "AT&T confidential information" and start paging through it. How could you possibly be convicted of a crime for that? I know there's criminal "finding" whereby you don't try hard enough to return something to someone that's obviously lost it. But that doesn't apply in this case because the binder in question isn't marked in any kind of meaningful way. Even if it had a header or footer or cover or something that said ANYTHING then I'd be persuaded differently. But leaving a web service with confidential information on the internet with no access control, I might argue is criminal negligence.
      - res0nat0r 11y ago
        You can keep arguing the semantics which sound great on a discussion forum, but it really has no bearing when it comes to the law. Intent matters, and he was found guilty of accessing a computer with authorization. You wouldn't be found guilty of such if you stumbled upon such system by accident and then turned around and left it along. Comments here keep clinging to some black/white technical reason to decide this case due to willful ignorance, or hope that it can be true, but really it isn't like that at all.
        msandford 11y ago
        > Intent matters, and he was found guilty of accessing a computer with authorization. Right and a lot of people are saying that it's a miscarriage of justice to prosecute someone based on implied knowledge or assumed knowledge. It wasn't proven the same way you can prove a great many other things. A jury was convinced of something, and that doesn't constitute actual proof. Just because the government says something is true doesn't make it so. https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
rhino369 11y ago
That is a poor analogy. I'd say it's more like walking into the back room of the store even though the door was wide open, and then snooping around in there. That is trespassing.
- msandford 11y ago
  I actually think it's the perfect analogy. It's a robot that does exactly what you tell it to do. If you apply power it'll open for ANYONE and if you don't apply power, it doesn't. I can't see a better analogy for the webserver that revealed confidential information as someone who accidentally left the automatic door on. It opened when the owner didn't want it to, but you can't blame the user of an automatic door for taking its working as some kind of implied permission. If the owner of said automatic door didn't want it to open he or she had only to switch the door off to make their desires translate 100% into real action. Where things get dicey is that there are certain customs and tradition and clues regarding whether a store is open or not. If the lights are off and it's the middle of the night and there are no cars in the parking lot and etc, it's probably not open and the door opening is probably a mistake, not on purpose. The internet does not provide any kind of context clues like this, except perhaps for robots.txt and that doesn't apply to humans!
jMyles 11y ago
You've been too charitable. The site gave a 200 status code. It's more like the store having a huge sign that says "OPEN, COME ON IN!"
- tptacek 11y ago
  This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. Obviously, outside the airless void of a message board argument, this isn't how things work.
  - jMyles 11y ago
    > This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation and just happened to be the first (or the first noticed) to use applications in a way unintended by the designers.
    - gph 11y ago
      >This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.
      - jMyles 11y ago

gph 11y ago

Again IANAL and trespassing is a different law than the CFAA, but if the prosecutors could reasonable prove that it wasn't an honest mistake and you were knowingly going into the store when you're aware it's not allowed, then yes I think you could be charged with trespassing. Like say you're an ex-employee who for some reason wants to go look at the schedule (maybe your stalking one of your old co-workers). If you walked in knowing the store was closed and you shouldn't be there, then I have to imagine you'd be arrested and charged with trespassing amongst other things.

msandford 11y ago
Both deal with unauthorized access and intent don't they? The point I'm trying to make is that it's VERY difficult to divine intent in the absence of any kind of access control. In other words, given my above example and that's all the information you have, you can't prove that I intended to trespass. Now if the doors didn't open automatically and there was a broken lock, it's much easier to determine intent. But in Weev's case, there was no broken lock because there was no lock at all! Going strictly from the evidence we can surmise that AT&T didn't INTEND to prevent unauthorized access because they did nothing to prevent it.
- res0nat0r 11y ago
  We always delve into ridiculous analogies on this site for some reason when it comes to this case, trying to somehow justify that someone, knowingly, was accessing a system they, again knowingly, knew they should not have been accessing. Status codes, locks, no locks, these silly analogies aren't really useful. Proving intent is.
  - msandford 11y ago
    So prove the intent. Prove what was going on inside his head. Prove that he didn't merely SUSPECT that he shouldn't have had the information, but that he KNEW he shouldn't. The reason that things get so silly is that it's very difficult to prove intent in the absence of any kind of access control. If he had bruteforced an admin password, the intent trail is there to be found. If he had done SQL injection, again, it's easy to argue intent. If he had physically broken into the building and stolen paper documents, again the intent is easy to discern. I would argue that it's akin to finding an unmarked binding lying in the street with absolutely no way of telling whose it is, and what it contains. You open it and don't see anything that says "AT&T confidential information" and start paging through it. How could you possibly be convicted of a crime for that? I know there's criminal "finding" whereby you don't try hard enough to return something to someone that's obviously lost it. But that doesn't apply in this case because the binder in question isn't marked in any kind of meaningful way. Even if it had a header or footer or cover or something that said ANYTHING then I'd be persuaded differently. But leaving a web service with confidential information on the internet with no access control, I might argue is criminal negligence.
    - res0nat0r 11y ago
      You can keep arguing the semantics which sound great on a discussion forum, but it really has no bearing when it comes to the law. Intent matters, and he was found guilty of accessing a computer with authorization. You wouldn't be found guilty of such if you stumbled upon such system by accident and then turned around and left it along. Comments here keep clinging to some black/white technical reason to decide this case due to willful ignorance, or hope that it can be true, but really it isn't like that at all.
      - msandford 11y ago
        > Intent matters, and he was found guilty of accessing a computer with authorization. Right and a lot of people are saying that it's a miscarriage of justice to prosecute someone based on implied knowledge or assumed knowledge. It wasn't proven the same way you can prove a great many other things. A jury was convinced of something, and that doesn't constitute actual proof. Just because the government says something is true doesn't make it so. https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill

rhino369 11y ago

That is a poor analogy. I'd say it's more like walking into the back room of the store even though the door was wide open, and then snooping around in there. That is trespassing.

msandford 11y ago
I actually think it's the perfect analogy. It's a robot that does exactly what you tell it to do. If you apply power it'll open for ANYONE and if you don't apply power, it doesn't. I can't see a better analogy for the webserver that revealed confidential information as someone who accidentally left the automatic door on. It opened when the owner didn't want it to, but you can't blame the user of an automatic door for taking its working as some kind of implied permission. If the owner of said automatic door didn't want it to open he or she had only to switch the door off to make their desires translate 100% into real action. Where things get dicey is that there are certain customs and tradition and clues regarding whether a store is open or not. If the lights are off and it's the middle of the night and there are no cars in the parking lot and etc, it's probably not open and the door opening is probably a mistake, not on purpose. The internet does not provide any kind of context clues like this, except perhaps for robots.txt and that doesn't apply to humans!

jMyles 11y ago

You've been too charitable. The site gave a 200 status code. It's more like the store having a huge sign that says "OPEN, COME ON IN!"

tptacek 11y ago
This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. Obviously, outside the airless void of a message board argument, this isn't how things work.
- jMyles 11y ago
  > This is logic that says that SQL Injection is fine, so long as the HTTP request bearing it elicits a 200 response. For my tastes, this is actually a reasonable configuration of things. Nobody is forcing you to use HTTP. If you decide to, and you provide access to your database via HTTP, and you allow me to submit a payload which makes changes you don't like, you are welcome to stop me and issue a 403. It's your database, after all. This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation and just happened to be the first (or the first noticed) to use applications in a way unintended by the designers.
  - gph 11y ago
    >This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.
    - jMyles 11y ago