Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

351–360 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#351

Post by EamonnMR »

hunter2_ wrote: post #218
xexers wrote: post #85

Earlier quoted context omitted.

I think someone's house is "private by default"... even if the door is unlocked, you know you shouldnt go in there. The internet is public by default.

I agree with you but I don't think the law does. The CFAA says that if access isn't authorized, it's no good. Now we can say that if the system was programmed to give it up (200) instead of telling you you aren't authorized (403/401) then you are authorized, but I think the law is more about whether a human intended to authorize you. Accidentally programming the authorization is (however stupid it may be) not what it…

How is someone supposed to determine that one unauthorized thing is hidden among many authorized, similarly named things?

Re: Teenager facing prison for downloading unsecured files from government website

#352

Post by catern »

rayiner wrote: post #186
iak8god wrote: post #149

Earlier quoted context omitted.

These analogies are not helping. Here's what actually happened: the accused allegedly sent requests to a web server asking "may I please look at the document with id X?" for various values of X. Each time the web server had the option to say "no, you may not", or even "no, that document doesn't exist." Instead, it responded each time by sending the requested document. That's all that happened: someone used HTTP in th…

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

Just curious, not trying to trip you up: In your perspective, would it be trespassing to make a new website which has links to the original site with the edited URLs, without actually accessing those edited URLs? If such a website with links containing edited URLs already existed, would it be trespassing to follow those links?

Just curious about which one, or both, of those are trespassing in your perspective.

Re: Teenager facing prison for downloading unsecured files from government website

#353

Post by mayniac »

bowmessage wrote: post #9

Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

It doesn't actually matter, unless he's KNOWS he's downloaded something illegal and KNOWS how to find it on his computer, or has opened it already and not deleted it.

Basically all possession laws (really all laws in general) require some sort of knowledge and intent. Just like you can't be convicted for possession of drugs if they were stuck to the bottom of your shoe when you came out of a club (don't actually try this), you can't be convicted with possession of illegal digital material if you weren't aware you were in possession of it.

I did digital forensic work at an old job and one of the cases was someone who liked to indiscriminately download huge amounts of porn off dodgy p2p applications. We found gigabytes of indecent images of children, but no searches in the p2p application for commonly used IIoC terms, and no evidence that he'd either opened the folders containing the IIoC or actually viewed any of it. Police gave his hard drives back (after wiping them ofc) and let him go.

I wouldn't be concerned about his 4chan backups, any lawyer will be able to get him off the hook for anything illegal in there provided he hasn't actually opened it.

Re: Teenager facing prison for downloading unsecured files from government website

#355

Post by flashman »

This is crap. Late last year I found a public S3 bucket with 23,000 JSON files in it, which I used to make a visualisation: https://vimeo.com/249970399

The reason I felt confident to do this was because there was no access control on the files and I'd reported it to PUBG Corp, with the bucket remaining public weeks later.

Before people are punished for downloading unprotected information, the person who left it like that should be hauled up in front of the courts.

Re: Teenager facing prison for downloading unsecured files from government website

#356

Post by fenomas »

harryh wrote: post #278
defined wrote: post #222

Earlier quoted context omitted.

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

Dumpster diving is legal (in most places but not all) because the owners has, by putting something in the trash, expressed their intent to not own the item in question anymore. A website isn't a trash can though. If I accidentally leave a diamond ring (or personal files) in public somewhere and you take them that is absolutely theft.

A web server is a thing people use to make files publicly accessible - it has no other purpose. It has stronger expectations against privacy than a trash can.

As such, your analogies to situations (locked houses, unattended jewelry) with the opposite expectation just disprove your point. Assuming a file is private even though it's publicly accessible on a web server is as nonsensical as assuming an object is free for the taking even though it's an unattended diamond ring.

Re: Teenager facing prison for downloading unsecured files from government website

#357

Post by politician »

drew-y wrote: post #43
politician wrote: post #18

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?

If the information is supposed to be private wouldn't you want to use token based auth or something similar? I wouldn't feel comfortable exposing information publicly even if it was behind a UUID.

Sure, but remember the lowest-bid contractor here used an integer. Baby steps.

Re: Teenager facing prison for downloading unsecured files from government website

#359

Post by [deleted] »

rayiner wrote: post #139
newfoundglory wrote: post #125

Earlier quoted context omitted.

Whether it is common knowledge or not has no bearing on whether it’s criminal, so I wasn’t using ordinary to mean “of normal computer literacy”. If you want to use some specific definitions that turn your claim into something trivially obvious, please define them ahead of time.

But lots of things are legal or not based on what typical people would do or think. "Battery" is contact a normal person would find offensive. So touching someone's shoulder to get their attention is not battery, but poking someone in the rib might be. More relevantly, implied licenses to access property are defined by reference to what a normal person would consider implied. So an invitation to enter a store implies…

[deleted]

Re: Teenager facing prison for downloading unsecured files from government website

#360

Post by fenomas »

harryh wrote: post #333
bwbw223 wrote: post #331

Earlier quoted context omitted.

Sorry- I edited. What I’m saying is that the server represents its owner, so when the server grants someone access in normal operation it’s not intrusion.

Servers don't grant access. People grant access. People can make mistakes and set up servers to mistakenly allow access to things. Making a mistake doesn't revoke someone's property rights.

> Making a mistake doesn't revoke someone's property rights.

This is a non-sequitur, nobody is saying anything about anyone's property rights being revoked.

The teen asked for access, and the content owners, via the permissions they had configured, granted it. Sure they can later decide that this was a mistake, but that doesn't make it theft for the teen to have asked for access.

Post reply on HN