Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

341–350 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#341

Post by dgudkov »

phnofive wrote: post #14

Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere. http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-bein...

>"Unfortunately, what had happened is someone went in through the URL and just sequentially went through every document available on the portal," she said.

It's not clear if the links to the documents with sensitive information were public or not. Yes, it's absolutely stupid to have security by obscurity, but from a legal point of view abusing someone's stupidity may look like a crime. The story, while sad, doesn't look black and white to me as CBC tries to paint it.

Re: Teenager facing prison for downloading unsecured files from government website

#342

Post by pdonis »

rayiner wrote: post #251
defined wrote: post #222

Earlier quoted context omitted.

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

> The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit t…

> The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors.

And how, exactly, is this "sanitization" going to occur? Are you saying that having 15 police officers raid a home and confiscate multiple computers (all but one of which had nothing to do with the incident in question), arresting a completely uninvolved person on his way to school, and taking no action at all against the stupid contractor who set up the website, is an acceptable form of "sanitization"?

> The Internet is for ordinary people now, not curious teenager hackers.

That's not what the police action described in the article is saying. It's saying the Internet is for government and corporations, and God help the ordinary people who get in their way. (Btw, I include "curious teenager hackers" in "ordinary people". Perhaps the fact that you don't is part of the problem.)

Re: Teenager facing prison for downloading unsecured files from government website

#343

Post by dgudkov »

eboyjr wrote: post #64
dustingetz wrote: post #48

Earlier quoted context omitted.

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

>I'd argue that the kid was entering through an open window of a public building.

Given that he tried to sequentially download all possible documents by sequentially incrementing document ID in URL it's more like trying to open every window in the public building and see what happens.

Re: Teenager facing prison for downloading unsecured files from government website

#344

Post by pdonis »

harryh wrote: post #326
bwbw223 wrote: post #325

Earlier quoted context omitted.

But there’s a near infinite supply of straws and it didn’t damage the dispenser.

It did, however, damage the privacy of various Canadian citizens.

> It did, however, damage the privacy of various Canadian citizens.

Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard drive, and left it there; it never went anywhere else.

Re: Teenager facing prison for downloading unsecured files from government website

#345

Post by pdonis »

rayiner wrote: post #198
gowld wrote: post #127

Earlier quoted context omitted.

This is absurd. This is not private property. Ordinary law-abiding people do walk into government offices and ask questions, and when they get answers, do continue asking questions and getting answers. Ordinary law abiding people to browse all the products on display at a store. Ordinary law abiding people do flip through all the pages of a catalog that is sent to their home. This Orwellian attitude that looking at a…

Government documents and web servers are private property. (The information within might be public, but it's illegal to access private property in an unauthorized way to get public information). Ordinary law-abiding people do the things that property owners expect them to do (or what they reasonably infer the property owners intend them to do). If there are signs (literal or figurative) that the property owner doesn'…

> If there are signs (literal or figurative) that the property owner doesn't want you doing something

But there weren't in this case. The express purpose of the site was to make that information publicly accessible. If you leave stuff out at your curb with a sign that says "Free to all takers", and someone takes something you didn't mean to put there, how are they supposed to know you didn't want them to take it?

Re: Teenager facing prison for downloading unsecured files from government website

#346

Post by pdonis »

rayiner wrote: post #139
newfoundglory wrote: post #125

Earlier quoted context omitted.

Whether it is common knowledge or not has no bearing on whether it’s criminal, so I wasn’t using ordinary to mean “of normal computer literacy”. If you want to use some specific definitions that turn your claim into something trivially obvious, please define them ahead of time.

But lots of things are legal or not based on what typical people would do or think. "Battery" is contact a normal person would find offensive. So touching someone's shoulder to get their attention is not battery, but poking someone in the rib might be. More relevantly, implied licenses to access property are defined by reference to what a normal person would consider implied. So an invitation to enter a store implies…

> If you asked your mom, "hey, do you think they meant to have people be able to access those documents, where you can only get to them by editing numbers in the URL," she would say "no."

No, she would say "I don't know what you're talking about, can you put that in plain English?" And then you could get her to give any answer you wanted by phrasing the plain English appropriately.

Re: Teenager facing prison for downloading unsecured files from government website

#347

Post by EamonnMR »

adanto6840 wrote: post #65

I agree with many of the comments here, along the lines of "intent?" and "bad law", etc... How can I provide material assistance to either this kid and/or to the problem at large? I'm looking for something other than "donate to the EFF [or equiv.]" ideally though; I'd prefer to donate directly to his legal fund, or even do some legwork myself that will help, etc. And ideally in a way that not only helps him, but that…

I'm not an expert in Canadian law, but are there any elected officials in the chain of the decision to conduct a raid? If so this ought to be severely career limiting. If it was an elected judge who approved the warrant, for example.

Re: Teenager facing prison for downloading unsecured files from government website

#348

Post by harryh »

pdonis wrote: post #344
harryh wrote: post #326

Earlier quoted context omitted.

It did, however, damage the privacy of various Canadian citizens.

> It did, however, damage the privacy of various Canadian citizens. Did it? I understand that the stupid contractor who put this data on the website did (potentially--but note that nobody is saying that anyone has actually suffered harm because of that data being accessible). But did the teenager who got this bomb dropped on him damage anyone's privacy? As I understand it, he downloaded the data, put it on his hard d…

Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile.

I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.

Re: Teenager facing prison for downloading unsecured files from government website

#349

Post by EamonnMR »

Hasz wrote: post #263
bowmessage wrote: post #9

Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

On a differnt note, is this level of backup a common thing? 30TB is a stupid amount of anything for any one person -- I've always used wayback if I wanted to see an old page

Here's an entire forum of them on reddit, it's called /r/datahorder.

Re: Teenager facing prison for downloading unsecured files from government website

#350

Post by jessaustin »

rayiner wrote: post #267
ShroudedNight wrote: post #242

Earlier quoted context omitted.

>I posit that a reasonable person (not an HN reader) would infer from a document being only accessible by editing a URL that it was not intended to be publicly accessible. Do you view 'a HN reader' as a reasonable representation of someone skilled in the art [of creating and serving websites]? Unless I'm missing something, the only conclusion that I can see following this line of reasoning is that skill in the art is…

Except in certain limited areas (e.g. “the reasonable doctor” standard for medical malpractice), the standard is the “reasonable person,” not the “reasonable person skilled in the art.” People on HN are not representative, because they know about computer security and HTTP access codes. We don’t live in a world where those people get to make the rules. We live in a world where the rules are set by reference to ordina…

How about a "reasonable mechanic", "a reasonable grocery clerk", or a "reasonable carpenter"? Dare we imagine a "reasonable web developer"?
Post reply on HN