Teenager facing prison for downloading unsecured files from government website • Hacker News Board

Re: Teenager facing prison for downloading unsecured files from government website

#201

Post by corny » Tue, Apr 17, 2018, 12:31 AM UTC

rayiner wrote: post #175

hug wrote: post #151

Earlier quoted context omitted.

Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet. So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, si…

If someone told you that you could get a specific file from a filing cabinet, it would be antisocial of you to start flipping through the other files to see what was in there.

It's not just a single file that you have been invited to access. This 'someone' has told the world that all of their public documents are in this filing cabinet. And here is how to find a few specific files. It's not a stretch to think the every other file in the (unlocked) cabinet is also public.

Re: Teenager facing prison for downloading unsecured files from government website

#202

Post by lawnchair_larry » Tue, Apr 17, 2018, 12:32 AM UTC

rayiner wrote: post #111

clouddrover wrote: post #107

Earlier quoted context omitted.

But the difference is that a website is built to be publicly accessible on the public internet. Your car, presumably, is not offered as a public resource.

Except this data was obviously not intended to be publicly accessible, or else it would have been reachable from some public-facing portion of the site.

You’ve never heard of an API then?

This is silly. Your door analogies have no place at all.

A great many websites work this way.

Unless you’re injecting metacharacters into URLs, or requesting AAAAAAAA * 65535 followed by shellcode, changing paramter values is using HTTP exactly as designed, and a well-formed request has many possible error codes for the exact purpose of letting you know what you are allowed to access.

It’s perfectly normal for people to alter URLs. The fact that people who are unfamiliar with URLs don’t do that is irrelevant, and you could say the same for any subject. Just yesterday I changed lat= and lon= to get a NOAA forecast. Is that snooping or hacking? How about when we change the integer at the end of an XKCD comic to view another one without previously confirming there is a hyperlink somewhere?

At least in the Weev case, people could take his IRC logs out of context as well as argue the fact that it was plainly obvious that the server was misconfigured and he was seeing content that he should not. But getting a response when incrementing an integer, generally speaking, does not mean you are viewing something unintended for you. When you are downloading public documents, it would be entirely unreasonable to assume that the material was non-public.

Also, take a step back to really think about what you are advocating. Is society better off by ruining this kid’s life? It blows my mind that someone even remotely technical can think this particular case is a good use of the justice system, or can even compare it to someone snooping around their neighborhood and trying their doors.

Re: Teenager facing prison for downloading unsecured files from government website

#203

Post by defined » Tue, Apr 17, 2018, 12:32 AM UTC

rayiner wrote: post #153

jessaustin wrote: post #136

Earlier quoted context omitted.

A consideration of real property illustrates nothing about URLs. Speech is a much more apt comparison, in that one host says one thing, and then another, if it freely chooses to do so, responds by saying something else. (In Canada, though, the speech comparison might not help much?) This comparison is much more cogent than anything involving a "trespasser". Of course, authoritarians prefer the stupid comparison.

Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech ), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical. The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly access…

There was no sign that the supposedly private documents were intended to be private. I’ve often fiddled with URLs on public sites because I’ve had the intuition that something hasn’t been indexed that perhaps should have been indexed, or because of a dead link.

If those sensitive documents were on a _public_ website intended to be browsed by the _public_, who presumably did not require authentication, and the documents did not cause an “Authorization required” response when accessed, it feels rather totalitarian to treat that as a crime.

Most of the metaphors I’ve seen about this are not fitting. As excessive as the barrage of metaphors may be, allow me to add my own:

As part of a free treasure hunt, a person gives you the address of their house and says, “Whatever is not locked up is fair game for you to look over, take photos, or copy.”

You go there and have a great time. Then the homeowner has a fit because you discovered a hidden cellar full of pornography, which was apparently off limits but the door was inadvertently left unlocked. Now the homeowner is charging you with breaking and entering, saying you should have known better and it was common sense.

Re: Teenager facing prison for downloading unsecured files from government website

#204

Post by munk-a » Tue, Apr 17, 2018, 12:36 AM UTC

rayiner wrote: post #192

prophesi wrote: post #188

Earlier quoted context omitted.

There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.

The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.

You're correct, but I strongly suspect this is a case of the government trying to deflect blame from their horrendous security to "those young hackers" and that this whole situation could probably be resolved peaceably by ensuring the data in question is deleted from the dude's computer.

Re: Teenager facing prison for downloading unsecured files from government website

#205

Post by letlambda » Tue, Apr 17, 2018, 12:36 AM UTC

rayiner wrote: post #169

jopsen wrote: post #155

Earlier quoted context omitted.

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary. The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access. In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn'…

> In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal. The license to access private property is based on the intent of the property owner. Where the intent is made express (through a sign), that governs. Where the intent is not made express, we try to figure out what a reasonable pe…

Isn't the assumption always that accessing a web page programmatically is allowed unless specifically asked not to in robots.txt?

Re: Teenager facing prison for downloading unsecured files from government website

#206

Post by maddyboo » Tue, Apr 17, 2018, 12:36 AM UTC

systematical wrote: post #170

BadThink6655321 wrote: post #141

Earlier quoted context omitted.

If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early. The kid got documents on a public facing server. He did nothing wrong.

A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They…

Violating Terms of Use is not a crime [1].

1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-...

Re: Teenager facing prison for downloading unsecured files from government website

#207

Post by rayiner » Tue, Apr 17, 2018, 12:37 AM UTC

jessaustin wrote: post #194

rayiner wrote: post #189

Earlier quoted context omitted.

Computers are dumb machines. They have no free will, and cannot serve as agents whose actions bind humans.

If your car runs me over, I'm going to sue you.

If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything.

Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the computer let you access the file." But "what does how the computer let you access the file tell you about what the computer owner intended?"

Re: Teenager facing prison for downloading unsecured files from government website

#208

Post by ShroudedNight » Tue, Apr 17, 2018, 12:37 AM UTC

rayiner wrote: post #153

jessaustin wrote: post #136

Earlier quoted context omitted.

A consideration of real property illustrates nothing about URLs. Speech is a much more apt comparison, in that one host says one thing, and then another, if it freely chooses to do so, responds by saying something else. (In Canada, though, the speech comparison might not help much?) This comparison is much more cogent than anything involving a "trespasser". Of course, authoritarians prefer the stupid comparison.

Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech ), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical. The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly access…

At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will?

The answer, even in the realm of physical property, is clearly not 'never', so where is it, and what leads you to believe its threshold was not crossed here?

Re: Teenager facing prison for downloading unsecured files from government website

#209

Post by prophesi » Tue, Apr 17, 2018, 12:37 AM UTC

rayiner wrote: post #192

prophesi wrote: post #188

Earlier quoted context omitted.

There is an obligation to secure sensitive information of people. Obscurity is not security, and so Nova Scotia was improperly storing the data.

The fact that Nova Scotia might have violated a separate obligation to secure sensitive information doesn't make accessing that information not trespass.

I would agree if it took an actual exploit to obtain the information.

Re: Teenager facing prison for downloading unsecured files from government website

#210

Post by lopmotr » Tue, Apr 17, 2018, 12:39 AM UTC

rayiner wrote: post #108

dustingetz wrote: post #48

Earlier quoted context omitted.

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

The "older generation" does not use metaphors because they are limited in their thinking. They do it to illustrate the principles underlying law. A basic principle of private property is that you don't have to secure it. The burden is on the would-be trespasser to figure out what rights she has with respect to the property and act accordingly. Snooping around private property out of "curiosity" is illegal, whether or…

> Ordinary law-abiding people don't go fiddling with URLs

That's complete nonsense. I've often changed a URL because it didn't work and had a typo. It's right there at the top of the web browser asking everyone to fiddle with it. If you were right, the URL bar would not be editable in web browsers, so you should be complaining to Google, Apple, MS, Mozilla for leaving this criminal-use-only feature so prominently on their products.