Teenager facing prison for downloading unsecured files from government website

Post by consp » Tue, Apr 17, 2018, 7:36 AM UTC

dgudkov wrote: post #341

phnofive wrote: post #14

Seems like a move by the provincial government to shift blame from its poor security to an imaginary bad actor; this article also from the CBC goes into more detail and asserts that fraudulent intent is necessary for a conviction, so hopefully this goes nowhere. http://www.cbc.ca/news/canada/nova-scotia/concerns-teen-bein...

>"Unfortunately, what had happened is someone went in through the URL and just sequentially went through every document available on the portal," she said. It's not clear if the links to the documents with sensitive information were public or not. Yes, it's absolutely stupid to have security by obscurity, but from a legal point of view abusing someone's stupidity may look like a crime. The story, while sad, doesn't l…

Post by ordu » Tue, Apr 17, 2018, 8:02 AM UTC

whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

Post by ScottBurson » Tue, Apr 17, 2018, 8:06 AM UTC

rayiner wrote: post #251

defined wrote: post #222

Earlier quoted context omitted.

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

> The onus for keeping computerized material private is on the owner I don’t think that’s a sensible rule and at the end of the day, it’s not the one that’s going to prevail. The Internet will be sanitized and made safe for all the people who forget their passwords and write them in their monitors. The Internet is for ordinary people now, not curious teenager hackers. And ordinary people will make the rules to suit t…

Post by ecocentrik » Tue, Apr 17, 2018, 8:11 AM UTC

downandout wrote: post #195

sbarre wrote: post #4

This reads like the beginning of The Hacker Crackdown.. As a Canadian, reading this article made me angry. If the information is not supposed to be public, it should not be reachable without authorization or authentication. Never mind a curious 19-year-old, there are tons of crawlers and indexers out there that attempt to enumerate URLs where they think there might be other content. Shame on them for building a poorl…

If anyone deserves to go to jail in this case, it's the contractor that took government money to implement a system that relies on security through obscurity when they knew that sensitive documents may be stored in it, and then screwed that up further by allowing documents to be accessed through nothing more than incremented IDs. It should be a basic premise of the law at this point in all civilized countries that if…

Post by LoSboccacc » Tue, Apr 17, 2018, 8:17 AM UTC

realandreskytt wrote: post #363

rayiner wrote: post #259

Earlier quoted context omitted.

I have a view of the Internet where “protecting files” has nothing to do with whether access to files is authorized or not. I shouldn’t have to lock my door, and I shouldn’t have to lock down my web server. (It may be prudent to do those things, but a trespasser shouldn’t escape penalty just because I didn’t do those things.)

Think of it like so: you have a robot that anybody can ask anything and that will answer any and all questions truthfully. Whose fault is it if you deliberately tell the robot non-public information?