Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.
[deleted]
Teenager facing prison for downloading unsecured files from government website
191–200 of 502 posts
Re: Teenager facing prison for downloading unsecured files from government website
#192Earlier quoted context omitted.
"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.
There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.
The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.
Re: Teenager facing prison for downloading unsecured files from government website
#193This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…
Information accessible here was SUPPOSED to be all public, with sensitive information located elsewhere, however a handful of improperly redacted documents were also published to the site. Here's a more technical article: https://evandentremont.com/some-information-on-the-freedom-o...
So this is a classic case of a subcontractor doing substandard work, leaving a security hole big enough to drive a truck through, and then trying to sue someone to save face... Sigh.
If some of those documents weren't appropriate to be viewed by the general populace then the company was criminally negligent in their handling of the data, the "hacker" saw an open door with a sign reading "free information" on it and didn't know any better before running a crawler over the documents to grab them.
Re: Teenager facing prison for downloading unsecured files from government website
#194Earlier quoted context omitted.
No, it's much more like calling the government on the phone and asking a series of questions. Or like sending them a series of letters. Or entering a government office during business hours and conducting business there. We don't need a metaphor, there are already laws in place governing how we speak to our public servants and how they respond.
Computers are dumb machines. They have no free will, and cannot serve as agents whose actions bind humans.
If your car runs me over, I'm going to sue you.
Re: Teenager facing prison for downloading unsecured files from government website
#195This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…
If anyone deserves to go to jail in this case, it's the contractor that took government money to implement a system that relies on security through obscurity when they knew that sensitive documents may be stored in it, and then screwed that up further by allowing documents to be accessed through nothing more than incremented IDs. It should be a basic premise of the law at this point in all civilized countries that if you can access a document by submitting a normal HTTP request with no authorization headers or cookies, then the server's owners intended that document to be public.
Re: Teenager facing prison for downloading unsecured files from government website
#196Earlier quoted context omitted.
A consideration of real property illustrates nothing about URLs. Speech is a much more apt comparison, in that one host says one thing, and then another, if it freely chooses to do so, responds by saying something else. (In Canada, though, the speech comparison might not help much?) This comparison is much more cogent than anything involving a "trespasser". Of course, authoritarians prefer the stupid comparison.
Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech ), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical. The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly access…
Of course a computer doesn't choose to do anything, but its actions do represent the choices of its operator. If I put a sign on my door the onus is on me to check if it says "All members of the public are welcome here" or "No trespassing".
Re: Teenager facing prison for downloading unsecured files from government website
#197What is it about headlines involving charges that love to focus on “facing prison”. At the very least this should indicate the RANGE of punishments, and there is a hell of a range.
From the article, he’s been charged with “unauthorized use of a computer”. IANAL but there would seem to be at least two possible interpretations of this charge [1], and the “Summary Election” variant has a MAXIMUM punishment of $5000 fine or 6 months. The other interpretation “Indictable Election” is a maximum of 10 years.
As with any case, details matter. Judges aren’t just sending every hacker to prison for 10 years. He may be judged not guilty (evil intent must be proven; then there’s his age, etc.), or given a way, way, way smaller punishment than this “prison” he “faces”.
[1] http://criminalnotebook.ca/index.php/Unauthorized_Use_of_Com...
Re: Teenager facing prison for downloading unsecured files from government website
#198Earlier quoted context omitted.
The "older generation" does not use metaphors because they are limited in their thinking. They do it to illustrate the principles underlying law. A basic principle of private property is that you don't have to secure it. The burden is on the would-be trespasser to figure out what rights she has with respect to the property and act accordingly. Snooping around private property out of "curiosity" is illegal, whether or…
This is absurd. This is not private property. Ordinary law-abiding people do walk into government offices and ask questions, and when they get answers, do continue asking questions and getting answers. Ordinary law abiding people to browse all the products on display at a store. Ordinary law abiding people do flip through all the pages of a catalog that is sent to their home. This Orwellian attitude that looking at a…
Government documents and web servers are private property. (The information within might be public, but it's illegal to access private property in an unauthorized way to get public information). Ordinary law-abiding people do the things that property owners expect them to do (or what they reasonably infer the property owners intend them to do). If there are signs (literal or figurative) that the property owner doesn't want you doing something, then you don't do it--and you're charged by the law with heeding those signs.
That's not Orwellian or authoritarian--it's a basic part of "social" behavior in a society with private property.
Re: Teenager facing prison for downloading unsecured files from government website
#199Earlier quoted context omitted.
I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.
> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.
Its more like a bunch of books on a shelf at the library with one 'special' book, unmarked, in the middle where they charge you with theft if you grab it.
Re: Teenager facing prison for downloading unsecured files from government website
#200Earlier quoted context omitted.
If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.
Here's another change-up in the analogy: it's like a public library, and you ask the librarian on where a certain book is located. They direct you to the book. You notice the other books on that bookshelf also may contain information relevant to your interests, so you check them all out. Sure, it'd actually be like checking out every book in the library, but this is the age of the internet and it's an insanely useful…
Also, the library was called the "Free Information" library.
IMO this looks like a company that did a poor job trying to cover their mistake by blaming "those hacker folks". I don't think it's inappropriate to confirm the kid was acting without malicious intent, but the subcontractor who setup the security for this site needs to be investigated thoroughly.