Teenager facing prison for downloading unsecured files from government website • Hacker News Board

Re: Teenager facing prison for downloading unsecured files from government website

#141

Post by BadThink6655321 » Mon, Apr 16, 2018, 11:52 PM UTC

rayiner wrote: post #124

freshmint wrote: post #21

Earlier quoted context omitted.

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.

> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.

If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early.

The kid got documents on a public facing server. He did nothing wrong.

Re: Teenager facing prison for downloading unsecured files from government website

#142

Post by loup-vaillant » Mon, Apr 16, 2018, 11:53 PM UTC

rayiner wrote: post #123

newfoundglory wrote: post #121

Earlier quoted context omitted.

> Ordinary law-abiding people don't go fiddling with URLs I’m an ordinary law-abiding person, and I fiddle with URLs. I know lots of people in that group.

You're not. Ordinary people don't even know that you can do that.

You are saying that ordinary people don't know what a URL actually is. This is ridiculous. It takes a certain level of computer illiteracy to never notice that you can access stuff by typing into the address bar directly, or by modifying what's already there.

It also doesn't take a computer whiz to use DownThemAll to enumerate URLs and download them all. They even have a dedicated function for this!

Yes, one does have to have some computer literacy to be able to do that. No, they don't have to be out of the ordinary.

Re: Teenager facing prison for downloading unsecured files from government website

#143

Post by jessaustin » Mon, Apr 16, 2018, 11:53 PM UTC

eboyjr wrote: post #64

dustingetz wrote: post #48

Earlier quoted context omitted.

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

No, it's much more like calling the government on the phone and asking a series of questions. Or like sending them a series of letters. Or entering a government office during business hours and conducting business there. We don't need a metaphor, there are already laws in place governing how we speak to our public servants and how they respond.

Re: Teenager facing prison for downloading unsecured files from government website

#144

Post by Declanomous » Mon, Apr 16, 2018, 11:53 PM UTC

rayiner wrote: post #120

losteric wrote: post #82

Earlier quoted context omitted.

I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.

That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

That's not true at all, for instance a number of the records that are part of the download were indexed by Google.[1]

So it's more like going in to your library, using the card stack, learning about a book, going to the shelf it is on, and then looking at all the books on the same shelf.

Somebody noticed that you were looking at all the books and called the cops on you. The cops break in and arrest you for looking at books. They tell you that the bookshelf is off-limits and has personal information.

Sure, the library creates it's own card stack and google is an external service; however if you design websites for a living you expect google to perform that functionality.

I mean, I designed a service where we wanted to make it easy to share private information, so we didn't use authorization. However I realized that if I wanted the data to be private I should use a suitably long non-consecutive random ID for the resource. If anyone is guilty of criminal misconduct, it's the person who designed this asinine system or the executive who allowed it to be used on the internet.

Hell, I'd go so far as to say that the fact that the exact same system is still being used across the US is a sign that the company who runs the system is criminally negligent.

[1] https://evandentremont.com/some-information-on-the-freedom-o...

Re: Teenager facing prison for downloading unsecured files from government website

#145

Post by Declanomous » Mon, Apr 16, 2018, 11:54 PM UTC

mikekij wrote: post #45

j32fun wrote: post #6

Since this is publicly accessible, what would be the chance that search engines indexed the files? In this case, would Google bot be charged? Or if this were, say, Equifax or Facebook. I mean, in those situations, the companies were blamed for "the leak". It seems rather convenient to cherry pick the law to apply on this poor teenager.

I think I read that Google had, in fact, indexed all of these pages.

Google did indeed index these files according to the following article:

https://evandentremont.com/some-information-on-the-freedom-o...

Re: Teenager facing prison for downloading unsecured files from government website

#146

Post by judge2020 » Mon, Apr 16, 2018, 11:55 PM UTC

rayiner wrote: post #108

dustingetz wrote: post #48

Earlier quoted context omitted.

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

The "older generation" does not use metaphors because they are limited in their thinking. They do it to illustrate the principles underlying law. A basic principle of private property is that you don't have to secure it. The burden is on the would-be trespasser to figure out what rights she has with respect to the property and act accordingly. Snooping around private property out of "curiosity" is illegal, whether or…

This is more to the likes of your friend inviting you over but telling you to not open a certain door in their house. It's not illegal to then open that door, but it would be to break or pick the door's lock and then open it.

Re: Teenager facing prison for downloading unsecured files from government website

#147

Post by DonbunEf7 » Mon, Apr 16, 2018, 11:57 PM UTC

bowmessage wrote: post #9

Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

Ugh, this comment has reminded me of the disgusting dystopian fascist police state we find ourselves in; I immediately thought, "I'm sorry, but Mr. Deitrich's dead. I thought they'd arrest him, but when they found a Koran in his house, they had him executed."

Re: Teenager facing prison for downloading unsecured files from government website

#148

Post by gowld » Mon, Apr 16, 2018, 11:57 PM UTC

rayiner wrote: post #139

newfoundglory wrote: post #125

Earlier quoted context omitted.

Whether it is common knowledge or not has no bearing on whether it’s criminal, so I wasn’t using ordinary to mean “of normal computer literacy”. If you want to use some specific definitions that turn your claim into something trivially obvious, please define them ahead of time.

But lots of things are legal or not based on what typical people would do or think. "Battery" is contact a normal person would find offensive. So touching someone's shoulder to get their attention is not battery, but poking someone in the rib might be. More relevantly, implied licenses to access property are defined by reference to what a normal person would consider implied. So an invitation to enter a store implies…

Google, that hotbed of criminal activity, is displaying links to and even accepting paid advertising for these illegal devices that can access telecommunications systems reachable only by editing numbers!

https://www.google.com/search?q=robodialer\

If you asked your mom, "Am I free to access all the public-facing information on the Government Freedom of Information server", what would she say? The technical details of how to make the connection are irrelevant. My mother doesn't know how to connect to a BBS, does that mean that anyone accessing a BBS is breaking the law?

Re: Teenager facing prison for downloading unsecured files from government website

#149

Post by iak8god » Mon, Apr 16, 2018, 11:57 PM UTC

rayiner wrote: post #120

losteric wrote: post #82

Earlier quoted context omitted.

I think the most precise metaphor is: a kid walked through the front door of a public library, borrowed a couple freely available books, then the government realized those books mistakenly included sensitive information. In order to address that error, 15 police officers raided the kid's house.

That would be an accurate analogy if these documents were linked to from a publicly-accessible portion of the site. They were not. This is more like someone walking into an unlocked back room and grabbing books that hadn't been shelved.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document.

That's all that happened: someone used HTTP in the way it's intended to be used, and inferred quite reasonably that the people who set up that web server knew what they were doing and meant to set it up that way. It turns out those people didn't know what they were doing, and they got embarrassed about it.

Re: Teenager facing prison for downloading unsecured files from government website

#150

Post by ljm » Mon, Apr 16, 2018, 11:57 PM UTC

Declanomous wrote: post #126

ljm wrote: post #90

Earlier quoted context omitted.

It feels like the reduction of a nuanced problem into a simple one with a single victim and a single perpetrator, and only one acceptable narrative. "It's not my fault I left my window open and you took advantage of it. I shouldn't have to keep my windows locked." "If you see an unlocked window it's not an opportunity for you to take advantage of." That's admittedly fairly obtuse, but you can see elements of this pla…

It's not necessarily a problem that the older generation can only think about technology in a metaphorical sense, the problem is that the metaphors they are using are idiotic. I think, by and large, people are constrained to thinking about things they can describe. To that extent, being able to accurately describe something is meaningful, and is therefore a linguistic issue. Semantics are very important when you are…

On reflection I think the metaphor itself is a red herring; we're always using them because they serve a great purpose. Tell an aspiring developer they can use goroutines to build a decently concurrent app, without much fuss, and they'll be delighted because the language provides a metaphor for it (way beyond a simple abstraction); tell them they have to understand mutexes, locks, processes, forks, and you've lost them.

What I see is a tendency towards the metaphor because that abstraction itself poses a challenge on top of the original one and the original problem itself is less interesting than the linguistic magic layered on top of it. You can talk at length about how bad the dog > animal OOP example is but you won't have much to say about OOP without that.

It's basically bike-shedding.