Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

21–30 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#21

Post by freshmint »

sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.

Re: Teenager facing prison for downloading unsecured files from government website

#22

Post by winthrowe »

sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

Information accessible here was SUPPOSED to be all public, with sensitive information located elsewhere, however a handful of improperly redacted documents were also published to the site. Here's a more technical article: https://evandentremont.com/some-information-on-the-freedom-o...

Re: Teenager facing prison for downloading unsecured files from government website

#23

Post by sigstoat »

isostatic wrote: post #12

I wonder how they noticed. Perhaps the lowest-bid contract company that made the site decided to use something like amazon glacier for storage of boring documents nobody will ever need. Then along comes someone that causes them all to be extracted at great cost, some middle manager receives a bill for $millions and wants to blame the kid rather than his own failings.

(added: the link to evandentremont.com elsewhere in the comments discusses how this was supposedly discovered, and other details of interest.)

that would make its own interesting information request. you probably couldn't directly ask "how'd you find him out?" at this point, but you could ask for maybe IT costs per month over the last X months broken out by organization the money was paid out to.

also possible (probable, even, in my mind) he just crawled too hard, the machine was slow, and the folks in the office working on it complained. (god only knows how much processing the service does behind the scenes when a PDF is requested. for all we know it is being reassembled from tiffs of individual pages every time.)

Re: Teenager facing prison for downloading unsecured files from government website

#24

Post by daodedickinson »

bowmessage wrote: post #9

Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

Exactly. Why did this kid admit that? How astronomcally low are the odds there's nothing illegal to possess in there?

Re: Teenager facing prison for downloading unsecured files from government website

#26

Post by codefined »

dumbfounder wrote: post #7
swampthinker wrote: post #2

Am I crazy? Aren't FOIA requests, by definition, public information?

This happened in Canada. They might have a FOIA equivalent, but I wouldn't assume it has the same rules as in the US.

In the UK and most of Europe, you cannot request the personal information of anyone else via a freedom of information request, since it is likely to contain sensitive information to that person.

For the UK, you can find out more information about the specifics of this from the data protection act, which includes clauses about FOI requests.

Re: Teenager facing prison for downloading unsecured files from government website

#28

Post by drb91 »

udia wrote: post #16

The teenager was downloading publicly available records on a Freedom-Of-Information portal. Why law enforcement is involved, or why this is even remotely a criminal act, completely baffles me.

It’s easier to prosecute than to fix. More than that, the kid pointed out the service is broken. Pretty humiliating. It’s not at all unusual to prosecute to save face, especially rather than admit that your org gave the info to a teenager when that’s illegal.

Re: Teenager facing prison for downloading unsecured files from government website

#29

Post by Someone1234 »

politician wrote: post #18

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?

Many UUIDs aren't secure either and can be trivially enumerated. A better approach might be a long number generated using a secure random number generator and converted to a BASE-64 string.

Re: Teenager facing prison for downloading unsecured files from government website

#30

Post by fouc »

lurker456 wrote: post #15

perhaps we need an RFC that defines this type of approach (pages "secured" behind easily guessable urls) as public information.

That actually seems like a good idea to me. I wonder if there isn't already one? It'd be a good symbolic source of authority on issues like this.

There could also be other RFCs covering our usage of the internet, and our expectations of what our rights are as internet users. Or perhaps stick that all in one "definitive" RFC.

Post reply on HN