Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

411–420 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#411

Post by simonh »

LoSboccacc wrote: post #390
realandreskytt wrote: post #363

Earlier quoted context omitted.

Think of it like so: you have a robot that anybody can ask anything and that will answer any and all questions truthfully. Whose fault is it if you deliberately tell the robot non-public information?

Still not a perfect analogy. If the robot spews copyrighted content, the robot, its owner and the content receiver are now in trouble.

Why the content receiver? That would be like a musician suing viewers for listening to their copyrighted music playing in the background of Youtube videos. It's the responsibility of people disseminating content to ensure they have the right to do so. That's why file sharing cases focus on the sharing, not the downloading per se.

Re: Teenager facing prison for downloading unsecured files from government website

#412

Post by simonh »

I've actually done a similar thing myself. When my wife was doing her Nursing degree she was downloading some documents she wanted to reference from an NHS web sites. The report for one year wasn't linked, so I checked the URL scheme, figured out what the URL for the report should be (only the date was different in the file names of reports for different years) and downloaded it directly.

It never occurred to me I might be committing a crime.

Re: Teenager facing prison for downloading unsecured files from government website

#413

Post by plopilop »

In France, we had a similar case, a computer guy with the pseudonym Bluetouff[0].

He downloaded loads of national agencies confidential documents, because they were available on Google.

However, he was sentenced (3,000€ fine), because when he explored the website, he arrived on a connection page, thus realizing he should not have accessed these files, but continued anyway.

I just hope for the teenager that he did not encounter any login page in his search (which seems unlikely because he used a script).

[0] (in french): http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut...

Re: Teenager facing prison for downloading unsecured files from government website

#414

Post by LoSboccacc »

simonh wrote: post #411
LoSboccacc wrote: post #390

Earlier quoted context omitted.

Still not a perfect analogy. If the robot spews copyrighted content, the robot, its owner and the content receiver are now in trouble.

Why the content receiver? That would be like a musician suing viewers for listening to their copyrighted music playing in the background of Youtube videos. It's the responsibility of people disseminating content to ensure they have the right to do so. That's why file sharing cases focus on the sharing, not the downloading per se.

I was under the idea that possession is still punishable, even if it is not given the same severity as infringeme

Edit: I mean not the act of listening, but the act of storing unlicensed material

Re: Teenager facing prison for downloading unsecured files from government website

#415

Post by JorgeGT »

fenomas wrote: post #356
harryh wrote: post #278

Earlier quoted context omitted.

Dumpster diving is legal (in most places but not all) because the owners has, by putting something in the trash, expressed their intent to not own the item in question anymore. A website isn't a trash can though. If I accidentally leave a diamond ring (or personal files) in public somewhere and you take them that is absolutely theft.

A web server is a thing people use to make files publicly accessible - it has no other purpose. It has stronger expectations against privacy than a trash can. As such, your analogies to situations (locked houses, unattended jewelry) with the opposite expectation just disprove your point. Assuming a file is private even though it's publicly accessible on a web server is as nonsensical as assuming an object is free for…

I mean, it's in the name, web server. It serves things to people when people asks:

   - Hey, can I GET this drink?

   - 200 OK, here it is pal. 
   - 204 Uh, the bottle appears to be empty
   - 206 I have only half the ingredients for the mix
   - 300 Stirred or shaken?
   - 301 That drink is now called this, but here it is!
   - 400 I can't understand what you say buddy, are you drunk?
   - 403 I'm sorry, but I must refuse to serve you that drink
   - 404 Oops, I can't seem to find the bottle
   - 411 How much do you want?
   - 413 That's too much drink!
   - 418 I'm actually a teapot 
   - 503 Too busy right now!

Re: Teenager facing prison for downloading unsecured files from government website

#416

Post by foldr »

rootlocus wrote: post #398
rayiner wrote: post #186

Earlier quoted context omitted.

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis. You do realize HN provides an API that allows you to request any item by using an ID? [1] Stories, comments, jobs, Ask HNs and even polls are just items. They're identified by their ids, which are unique integers, and live under /v0/item/ . If you real…

Sure, and the fact that HN has a note to that effect on its website is evidence that all of these items are intended to be publicly accessible. It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. In the case we're talking about here, it was far less obvious that the relevant documents were intended to be publicly available.

Re: Teenager facing prison for downloading unsecured files from government website

#417

Post by gtlondon »

ordu wrote: post #384
whack wrote: post #55

This might be a controversial opinion here, but intent does matter. If I see a bunch of stuff sitting the sidewalk and I take some because I think it's free, that's a reasonable thing to do. But going into someone's house and taking their tv is not. "It's their own fault for not locking the door" isn't a valid legal defense, and I would prefer not to live in a country where victim-blaming becomes a get-out-of-jail-fr…

There is one difference which makes analogy irrelevant. You can easily distinguish houses where you are allowed to come from houses where you are not. There are simple rules and we are all know them. URLs have no way to classify them to legal and illegal ones. You can propose a plan to w3c and to government to mark URLs with string 'illegal' in them, if they are illegal to visit without special permissions. It will m…

Yes, the house analogy is not accurate.

It would be logical to assume that as the files have specifically been made public via HTTP then no laws are being broken by viewing them unless a warning message appears saying otherwise.

Re: Teenager facing prison for downloading unsecured files from government website

#418

Post by evincarofautumn »

Someone1234 wrote: post #235
thisacctforreal wrote: post #231

Earlier quoted context omitted.

The document, from what I could glean they were PDFs. Edit: even if they aren't PDFs, you can feed the content to the hash function.

I suppose that might work but seems needlessly complex compared to just a long securely generated random number.

Yeah, randomly generated IDs are fine for most use cases IMO, and perhaps more importantly they’re easy to implement well enough—grabbing 256 bits from /dev/urandom isn’t bad.

With a hash it’s more expensive to compute the ID, but you get advantages such as content-addressability, data integrity without trust, and easily mergeable databases. It’s a good amount of bang for not much more buck.

At the cost of leaking more metadata in the ID, by including a checksum/namespace, you can recognise a valid ID or determine the type of object it refers to without fetching anything from storage, mitigating some DOS attacks.

IDs are a subtle thing, and in my experience, often overlooked as a design issue. A lot of times it ends up as something like “id integer primary key autoincrement” without any thought.

Re: Teenager facing prison for downloading unsecured files from government website

#419

Post by gtlondon »

harryh wrote: post #278
defined wrote: post #222

Earlier quoted context omitted.

I disagree, because the analysis is faulty. Computers always do what you _tell_ them to do, not what you want them to do. The onus for keeping computerized material private is on the owner, and the owner screwed up royally by wrongly allowing sensitive material to be placed unprotected on a _public_ web site. Whether or not it was indexed is irrelevant - it was on a publicly accessible site, permissions set to public…

Dumpster diving is legal (in most places but not all) because the owners has, by putting something in the trash, expressed their intent to not own the item in question anymore. A website isn't a trash can though. If I accidentally leave a diamond ring (or personal files) in public somewhere and you take them that is absolutely theft.

But...you would have left the diamond ring by accident.

Files don't "accidentally" become publicly accessible via HTTP. i.e. you don't return to your computer one day to find everything is public.

Someone specifically took the steps to make this data public. The fact they didn't realize what they were doing isn't the fault of people that then view the data.

Re: Teenager facing prison for downloading unsecured files from government website

#420

Post by rootlocus »

foldr wrote: post #416
rootlocus wrote: post #398

Earlier quoted context omitted.

> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis. You do realize HN provides an API that allows you to request any item by using an ID? [1] Stories, comments, jobs, Ask HNs and even polls are just items. They're identified by their ids, which are unique integers, and live under /v0/item/ . If you real…

Sure, and the fact that HN has a note to that effect on its website is evidence that all of these items are intended to be publicly accessible. It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public. In the case we're talking about here, it was far less obvious that the relevant documents were intended to be publicly available.

> It's also obvious in any case that stories, comments, jobs, ask HNs and polls are intended to be public.

> it was far less obvious that the relevant documents were intended to be publicly available

My browser and the respective HTTP servers consider them equally obvious publicly available.

Post reply on HN