Teenager facing prison for downloading unsecured files from government website • Hacker News Board

Re: Teenager facing prison for downloading unsecured files from government website

#211

Post by shkkmo » Tue, Apr 17, 2018, 12:39 AM UTC

systematical wrote: post #170

BadThink6655321 wrote: post #141

Earlier quoted context omitted.

If they're my door handles, then yes. If they're public doors, then yes. Why, just yesterday, I tried the door of my favorite coffee establishment where the Open light was on but, unbeknownst to me, they had closed early. The kid got documents on a public facing server. He did nothing wrong.

A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They…

I don't see any terms of use anywhere else, and it looks like the side is down now, but the official links to this site describes it:

"The Access to Information website allows you to submit, pay and receive FOIPOP requests online. The Nova Scotia Government also posts responses to formal FOIPOP requests online on the Disclosure log. This is a free public repository of FOIPOP responses that have been approved for publication and have met a specific set of criteria (PDF file 800 KB)."

I also have a huge problem with the stance that violating the "Terms of Use" policy of a website can result in criminal charges when accessing publicly available information.

Re: Teenager facing prison for downloading unsecured files from government website

#212

Post by munk-a » Tue, Apr 17, 2018, 12:39 AM UTC

Declanomous wrote: post #126

ljm wrote: post #90

Earlier quoted context omitted.

It feels like the reduction of a nuanced problem into a simple one with a single victim and a single perpetrator, and only one acceptable narrative. "It's not my fault I left my window open and you took advantage of it. I shouldn't have to keep my windows locked." "If you see an unlocked window it's not an opportunity for you to take advantage of." That's admittedly fairly obtuse, but you can see elements of this pla…

It's not necessarily a problem that the older generation can only think about technology in a metaphorical sense, the problem is that the metaphors they are using are idiotic. I think, by and large, people are constrained to thinking about things they can describe. To that extent, being able to accurately describe something is meaningful, and is therefore a linguistic issue. Semantics are very important when you are…

Maybe we need to shift the metaphor.

A situation like this (security wise) isn't like leaving a window unlocked and having someone rob your house it's like

1. Leaving a pie on the window sill overhanging the side walk with paper plates and plastic utensils beside it.

2. A man knocking on your door, asking you for your bank account number without impersonating anyone of authority, you offering it up freely, then suing the man because you forgot to ask who he was first.

Re: Teenager facing prison for downloading unsecured files from government website

#213

Post by iak8god » Tue, Apr 17, 2018, 12:41 AM UTC

rayiner wrote: post #186

iak8god wrote: post #149

Earlier quoted context omitted.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in th…

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

> "tricking the HTTP server,"

I don't think you understand the web. I'm not anthropomorphizing anything. He literally sent a request for each document he wanted to look at and the server sent a response.

You keep referring to this hypothetical "reasonable person" who doesn't understand the very basic facts about technology, but the opinion you attribute to the "reasonable person" is just one you invented that happens to match your own.

> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed.

How would anyone know if the documents could only be accessed by editing the URL? Others in this thread have pointed out that some of those documents were indexed by Google, so actually, editing the URL is not the only way to get to them.

Re: Teenager facing prison for downloading unsecured files from government website

#214

Post by insickness » Tue, Apr 17, 2018, 12:43 AM UTC

DonbunEf7 wrote: post #147

bowmessage wrote: post #9

Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

Ugh, this comment has reminded me of the disgusting dystopian fascist police state we find ourselves in; I immediately thought, "I'm sorry, but Mr. Deitrich's dead. I thought they'd arrest him, but when they found a Koran in his house, they had him executed."

I thought you were going to quote "Show me the man, and I'll show you the crime."

Re: Teenager facing prison for downloading unsecured files from government website

#215

Post by lopmotr » Tue, Apr 17, 2018, 12:44 AM UTC

judge2020 wrote: post #146

rayiner wrote: post #108

Earlier quoted context omitted.

The "older generation" does not use metaphors because they are limited in their thinking. They do it to illustrate the principles underlying law. A basic principle of private property is that you don't have to secure it. The burden is on the would-be trespasser to figure out what rights she has with respect to the property and act accordingly. Snooping around private property out of "curiosity" is illegal, whether or…

This is more to the likes of your friend inviting you over but telling you to not open a certain door in their house. It's not illegal to then open that door, but it would be to break or pick the door's lock and then open it.

It's worse than that. It's the friend saying "open any unlocked doors you want", then after you do it, he remembers he left some secret things in his unlocked bedroom and wants you arrested because he didn't know the lock was broken.

Re: Teenager facing prison for downloading unsecured files from government website

#216

Post by shkkmo » Tue, Apr 17, 2018, 12:44 AM UTC

rayiner wrote: post #178

gitgud wrote: post #174

Earlier quoted context omitted.

Obscurity does not mean security. Just because the link wasn't referenced does not imply it is sensitive information. Should you not have the freedom to type what you want into the address bar of a browser?

"Security" is irrelevant--there is no obligation to "secure" private property. Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

> Obscurity, on the other hand, implies that the property owner did not intend for people to access certain property. That is what matters.

It implies the exact opposite. The owner may have intended it to be private, but making it publicly available, without security checks on a publicly accessible server, implies the property owner intended for people to access that property.

Re: Teenager facing prison for downloading unsecured files from government website

#217

Post by c22 » Tue, Apr 17, 2018, 12:45 AM UTC

rayiner wrote: post #186

iak8god wrote: post #149

Earlier quoted context omitted.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in th…

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

Editing a url is not "tricking the web server", the web server is designed to respond to urls with the information they point to. Tricking the server would be doing something like sending malformed packets designed to cause the server to leak memory and display the contents of "hidden data" in an exposed field, ie causing it to behave in a way for which it was not intended.

Re: Teenager facing prison for downloading unsecured files from government website

#218

Post by hunter2_ » Tue, Apr 17, 2018, 12:45 AM UTC

xexers wrote: post #85

whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

I think someone's house is "private by default"... even if the door is unlocked, you know you shouldnt go in there. The internet is public by default.

I agree with you but I don't think the law does. The CFAA says that if access isn't authorized, it's no good. Now we can say that if the system was programmed to give it up (200) instead of telling you you aren't authorized (403/401) then you are authorized, but I think the law is more about whether a human intended to authorize you. Accidentally programming the authorization is (however stupid it may be) not what it's about.

Re: Teenager facing prison for downloading unsecured files from government website

#219

Post by jessaustin » Tue, Apr 17, 2018, 12:46 AM UTC

rayiner wrote: post #207

jessaustin wrote: post #194

Earlier quoted context omitted.

If your car runs me over, I'm going to sue you.

If my car runs you over, and you sue me, what does the court do? It tries to figure out my intent. Did I intentionally run you over? If yes, I'm guilty of vehicular assault (not my car). Or did the brakes fail and I had no intent to hurt you? If yes, I'm not guilty of anything. Likewise, what the computer does is irrelevant, except insofar is it tells you about the owner's intent. So the question is not "did the comp…

The car is still a dumb object that you own that hurt me, and as a result someone is still paying my hospital bills. You might blame your mechanic, if he did a poor job of brake maintenance. When he attempts to defend himself, how is this "intent" mishmash going to fly? "Your honor, please ignore that there are several RFCs defining how one installs calipers, none of which I followed! It was clearly my intent for the brakes to work!"

Also, I'm not sure your analogy works at all. In the first paragraph, you seem to analogize the car to the accused "hacker", while in the second you're talking about the supposedly "hacked" host. To be clear, the point of the car example is that a machine's intelligence has no bearing on how its actions affect the duties of its operators.

Re: Teenager facing prison for downloading unsecured files from government website

#220

Post by rayiner » Tue, Apr 17, 2018, 12:46 AM UTC

ShroudedNight wrote: post #208

rayiner wrote: post #153

Earlier quoted context omitted.

Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech ), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical. The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly access…

At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will? The answer, even in the realm of physical property, is clearly not 'never', so where is it, and what leads you to believe its threshold was not crossed here?

> At what point does the owner or their agents find themselves posessing the onus to clearly communicate their will?

The law is that the onus falls on the owner or their agents at the point where a reasonable person would not be able to infer the scope of the implied license from the circumstances.

I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL that it was not intended to be publicly accessible.