4 ms·

>This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the imple

by gph 11y ago

>This whole controversy seems like a way of shifting blame for security failures from the parties who actually failed to people who were uninvolved in the implementation. That's basically victim blaming though. If someone commits a crime against you, we don't let the criminal go free just because you were inept or negligent in preventing the crime. In a sense they committed a crime against all of society by breaking our laws. It would be ridiculous to start applying laws based on whether the victim did enough to prevent it. No one should be allowed to break the law no matter how easy and vulnerable a person leaves themselves open to it.

jMyles 11y ago
Obviously this raises a question about the moral limits and applicability of the law. If I make a server accessible and someone accesses it, even in a way I didn't expect, I don't think a crime has been committed against me.
- tptacek 11y ago
  This is basically a blanket decriminalization of all computer intrusions, since virtually all hacking boils down to access to a computer in an "unexpected" way. Again, that simply isn't how the law works. I see you all around this threat repeatedly trying to reason about half a criminal charge: the actus reus used to gain access to computer system. It makes no sense to think of this particular crime that way; you need the other half of the charge, mens rea, the knowing intent to do something with a computer that you aren't authorized to do.
  - jMyles 11y ago
    The problem is that, at least for the moment, AI doesn't have a discernable (or even arguably cognizable) mens rea. So how do we craft laws for a world where very nearly all the network traffic consists of machines talking to each other, learning, and talking again? You keep pointing me to "how the law works," but I've said in four different messages now that I understand that - I'm pointing out that the law, as written, doesn't work. I don't think there is a place for government as we know it - much less the completely shamed criminal justice system - on the internet. These institutions can go peacefully and with dignity or they can be stubborn and destructive, to the detriment of humans everywhere. The more people try to justify their behavior and normalize their insanity, the more likely the latter scenario becomes.
msandford 11y ago
OK so give me all your personal info to put on a public webpage that says "by CFAA using this info is a crime" and since intent and law are the absolute arbiters of justice no harm should come to you right?
- gph 11y ago
  Of course harm will come to me, the point is that those doing the harm should still be held accountable if they're caught. Yes the law is far from perfect and it's easy to imagine absurd scenarios like yours where the law falls apart. Certainly that should be fixed. But in this particular case Weev knew he was going onto a portion of the webpage that wasn't meant to be public, even if technically anyone could access it because of AT&T's ineptitude. There weren't any links to that exact URL, and in a sense it took some reverse engineering (ok basically just guess and check) for him to find it. It wasn't a public webpage in the sense that he stumbled upon it from some link or a google search. He put thought into purposefully discovering that exact URL and opening it, knowing as a computer security enthusiast that it wasn't meant for public consumption.
  - msandford 11y ago
    I'm afriad I have to respectfully disagree with the idea that "he should have known better". Most analogies fall flat because webservers do EXACTLY WHAT YOU TELL THEM even if what you tell them to do isn't what you actually want them to do. Our laws are generally organized around the idea of reasonable adults doing reasonable things and being understood by other reasonable people. The average, reasonable person can't comprehend a webserver. If you give a robot a gun and tell it to shoot anything that comes through that door and it shoots your wife/husband/child/parent, its not them who is at fault nor is it the robot. Its your fault and you should be tried for murder. I hope the comparison is clear.
    - gph 11y ago
      >The average, reasonable person can't comprehend a webserver. But weev could. We don't apply laws as if the defendant is some mythical "reasonable" person. We try each case based on it's unique circumstances. It's not that he "should have known better", it's that he absolutely did know better. The comparison is clear, but it has no relevance.
msandford 11y ago
> That's basically victim blaming though. Not really. Nobody's blaming AT&T's CUSTOMERS for doing anything wrong. They are the victims. They are the ones who had their personal information made available to people outside of AT&T. This might better be called perpetrator blaming. The perpetrator is the person who commits a crime. AT&T had an obligation to keep customer data safe regarding the privacy policy that they tell customers that they will uphold. They failed to uphold it in any kind of meaningful way, by failing to provide any kind of access control to said personal information. Calling it victim blaming is to fail to apply any kind of critical thinking to the situation.
- deleted 11y ago
  [deleted]

by gph 11y ago

jMyles 11y ago

Obviously this raises a question about the moral limits and applicability of the law. If I make a server accessible and someone accesses it, even in a way I didn't expect, I don't think a crime has been committed against me.

tptacek 11y ago
This is basically a blanket decriminalization of all computer intrusions, since virtually all hacking boils down to access to a computer in an "unexpected" way. Again, that simply isn't how the law works. I see you all around this threat repeatedly trying to reason about half a criminal charge: the actus reus used to gain access to computer system. It makes no sense to think of this particular crime that way; you need the other half of the charge, mens rea, the knowing intent to do something with a computer that you aren't authorized to do.
- jMyles 11y ago
  The problem is that, at least for the moment, AI doesn't have a discernable (or even arguably cognizable) mens rea. So how do we craft laws for a world where very nearly all the network traffic consists of machines talking to each other, learning, and talking again? You keep pointing me to "how the law works," but I've said in four different messages now that I understand that - I'm pointing out that the law, as written, doesn't work. I don't think there is a place for government as we know it - much less the completely shamed criminal justice system - on the internet. These institutions can go peacefully and with dignity or they can be stubborn and destructive, to the detriment of humans everywhere. The more people try to justify their behavior and normalize their insanity, the more likely the latter scenario becomes.

msandford 11y ago

OK so give me all your personal info to put on a public webpage that says "by CFAA using this info is a crime" and since intent and law are the absolute arbiters of justice no harm should come to you right?

gph 11y ago
Of course harm will come to me, the point is that those doing the harm should still be held accountable if they're caught. Yes the law is far from perfect and it's easy to imagine absurd scenarios like yours where the law falls apart. Certainly that should be fixed. But in this particular case Weev knew he was going onto a portion of the webpage that wasn't meant to be public, even if technically anyone could access it because of AT&T's ineptitude. There weren't any links to that exact URL, and in a sense it took some reverse engineering (ok basically just guess and check) for him to find it. It wasn't a public webpage in the sense that he stumbled upon it from some link or a google search. He put thought into purposefully discovering that exact URL and opening it, knowing as a computer security enthusiast that it wasn't meant for public consumption.
- msandford 11y ago
  I'm afriad I have to respectfully disagree with the idea that "he should have known better". Most analogies fall flat because webservers do EXACTLY WHAT YOU TELL THEM even if what you tell them to do isn't what you actually want them to do. Our laws are generally organized around the idea of reasonable adults doing reasonable things and being understood by other reasonable people. The average, reasonable person can't comprehend a webserver. If you give a robot a gun and tell it to shoot anything that comes through that door and it shoots your wife/husband/child/parent, its not them who is at fault nor is it the robot. Its your fault and you should be tried for murder. I hope the comparison is clear.
  - gph 11y ago
    >The average, reasonable person can't comprehend a webserver. But weev could. We don't apply laws as if the defendant is some mythical "reasonable" person. We try each case based on it's unique circumstances. It's not that he "should have known better", it's that he absolutely did know better. The comparison is clear, but it has no relevance.

msandford 11y ago

> That's basically victim blaming though. Not really. Nobody's blaming AT&T's CUSTOMERS for doing anything wrong. They are the victims. They are the ones who had their personal information made available to people outside of AT&T. This might better be called perpetrator blaming. The perpetrator is the person who commits a crime. AT&T had an obligation to keep customer data safe regarding the privacy policy that they tell customers that they will uphold. They failed to uphold it in any kind of meaningful way, by failing to provide any kind of access control to said personal information. Calling it victim blaming is to fail to apply any kind of critical thinking to the situation.

deleted 11y ago
[deleted]