Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

lofgren.house.gov

Post reply on HN
Print view View original

121–130 of 174 posts

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#121

Post by tptacek »

ScottBurson wrote: post #115
tptacek wrote: post #33

Earlier quoted context omitted.

Do I want a better sentencing system for computer fraud, so that it remains possible for companies to defend themselves without needing to spend hundreds of thousands of dollars every quarter finding every conceivable loophole an attacker might exploit, while not leading to a situation where simply using a computer turns a simple offense into a 6 year prison sentence? Yes, that is what I want, and I don't think it's…

Do you really think that any legal change would reduce the need for security auditing of apps? I'm afraid that seems awfully unlikely to me. Even if US-based attackers would be deterred, there are plenty of places in the world the Internet reaches but US jurisdiction doesn't.

I think the effort put into securing computers is an inevitable dead-weight loss. Laws against pollution don't make everyone stop polluting; some polluters will just find creative ways to conceal what they're doing. Definitely doesn't mean I think pollution should be legal.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#122

Post by Natsu »

tptacek wrote: post #7

Would Aaron's Law have helped Aaron? Both Orin Kerr and Jennifer Granick have said that his actions in evading filtering and shutoffs on MIT's networks would have created a plausible argument for the prosecution that he had been evading specific code-based authorization mechanisms and would have known his access was unauthorized. If you read Reason, you're immediately suspicious of laws with people's names on them; t…

My personal belief (which is significantly different from the law on the matter as I understand it) is that "unauthorized access" for computer crimes should require intentional, material deception. That means that they deceived someone (or their computer), that they did so intentionally, and that but-for that deception, access would not have been given.

I do believe that one could argue over whether changing one's MAC address (or IP) constituted that sort of deception. So in all honesty, it's possible that he would still be convicted by a standard like that, though I would like to think that he would not. Intention would seem to be hard to prove, though reasonable minds might differ.

Separately, I think that computer crimes have disproportionate penalties right now. I really don't see any reason why using a computer to steal money (or commit whatever other crime) should merit a greater sentence than stealing the same amount by other means. I am aware that it has been like this for some time, but hackers have had longstanding gripes with this state of affairs, dating back to Morris & Mitnick.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#123

Post by tptacek »

tedunangst wrote: post #100
LiveTheDream wrote: post #95

Earlier quoted context omitted.

> There is no federal law against cyber-bullying, so the prosecution in that case used these same computer and wire fraud laws to go after Drew for her role in Megan's suicide. This is the thing that's strange to me. Seems as though existing laws against harassment would apply. What is so different about this activity online than offline?

As noted elsewhere, CFAA has suped up mega penalties, so it's the hatchet of choice when the public demands blood.

Perhaps less that it has amped up penalties and more that it has a careless and capricious standard for mapping alleged damages into sentencing categories. It's not necessarily that the CFAA on it's face is unreasonably harsh; it's that it's attached to a stupid scheme from which harshness is an emergent property.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#124

Post by rayiner »

ericd wrote: post #118
rayiner wrote: post #104

Earlier quoted context omitted.

Lots of places are unlocked that you're still not supposed to go into. How hard it is to get into somewhere you're not supposed to go is completely irrelevant, as is how hard you have to work to evade someone trying to get you off their network.

MIT has a pretty open unofficial policy when it comes to trespassing, as one would expect from any school with a dominant hacker culture. People used to go into network closets, pick locks, go into maintenance tunnels, etc. There's a very visible/popular student club on campus devoted to this.

That doesn't mean there aren't limits, and MIT clearly thought those limits were violated here.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#125

Post by jacquesm »

tptacek wrote: post #119
jacquesm wrote: post #116

Earlier quoted context omitted.

> I'm a little harsh on how I interacted with Aaron online --- not on the prosecution threads, but you know, on threads about "hollywood launches" and stuff like that. Those prosecution threads should give you pause just the same, and Aaron is absolutely not the only person that you've acted like that with. I respect you tremendously for your technical knowledge, but for someone who reminds people to 'stay classy' an…

You're definitely the same Jacques I remember. I haven't come around on this case; I have the same opinion of it I always had. Like Aaron's own lawyer, I was confident he was at no real risk of serving time --- first time offender, no commercial purpose, no co-conspirators, minimal attempt to hide, no damage. It was hard to fathom that he'd do worse than credit card thieves. Unlike his lawyer, who was privy to all so…

> I haven't come around on this case; I have the same opinion of it I always had.

I'll take your word for it but I'm getting a different impression.

Aaron was fairly clearly being made an example out of, and I think that after the expansion of the indictment (http://news.ycombinator.com/item?id=4528083, a thread in which you commented, and which came before the thread about Aarons friends setting up a defence fund) that would have been pretty obvious even to those not already of that opinion.

Maybe I'm slightly more sensitive to this stuff because of some of the things that happened in the wake of reocities.com but let's just say that if Aaron had charges worth a few decades thrown at him for TOS violations and unauthorized access I should probably be in jail for at least several decades because of that little gig.

I know everybody is shocked at what happened, but I'm far more shocked at Aarons' suicide than at the travesty of justice perpetrated there, there are lots more examples of such things happening on a daily basis.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#126

Post by tptacek »

jacquesm wrote: post #125
tptacek wrote: post #119

Earlier quoted context omitted.

You're definitely the same Jacques I remember. I haven't come around on this case; I have the same opinion of it I always had. Like Aaron's own lawyer, I was confident he was at no real risk of serving time --- first time offender, no commercial purpose, no co-conspirators, minimal attempt to hide, no damage. It was hard to fathom that he'd do worse than credit card thieves. Unlike his lawyer, who was privy to all so…

> I haven't come around on this case; I have the same opinion of it I always had. I'll take your word for it but I'm getting a different impression. Aaron was fairly clearly being made an example out of, and I think that after the expansion of the indictment ( http://news.ycombinator.com/item?id=4528083 , a thread in which you commented, and which came before the thread about Aarons friends setting up a defence fund)…

I think my mentality about the law is different enough from the one that prevails on HN that I appear much more conservative or authoritarian than I am. I say something anti-authoritarian and I sound like I've done a 180.

We should stop talking about us, or at least, about me. This isn't about me/us.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#127

Post by [deleted] »

btilly wrote: post #58
tptacek wrote: post #7

Would Aaron's Law have helped Aaron? Both Orin Kerr and Jennifer Granick have said that his actions in evading filtering and shutoffs on MIT's networks would have created a plausible argument for the prosecution that he had been evading specific code-based authorization mechanisms and would have known his access was unauthorized. If you read Reason, you're immediately suspicious of laws with people's names on them; t…

I am not a lawyer. Or even close. However the fact that he had to commit physical trespass in order to place his laptop giving him access to the network tells me that he was not merely in violation of the terms of use, and therefore he actually was unauthorized under the terms of the amended act. Thus it would not have helped Aaron. But it would help others. It is a step in the right direction. I support it.

[deleted]

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#128

Post by jacquesm »

tptacek wrote: post #126
jacquesm wrote: post #125

Earlier quoted context omitted.

> I haven't come around on this case; I have the same opinion of it I always had. I'll take your word for it but I'm getting a different impression. Aaron was fairly clearly being made an example out of, and I think that after the expansion of the indictment ( http://news.ycombinator.com/item?id=4528083 , a thread in which you commented, and which came before the thread about Aarons friends setting up a defence fund)…

I think my mentality about the law is different enough from the one that prevails on HN that I appear much more conservative or authoritarian than I am. I say something anti-authoritarian and I sound like I've done a 180. We should stop talking about us, or at least, about me. This isn't about me/us.

> I say something anti-authoritarian and I sound like I've done a 180.

That's probably it. I couldn't help but notice.

> This isn't about me/us.

Agreed.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#129

Post by rsingel »

tptacek wrote: post #81
jlgreco wrote: post #77

Earlier quoted context omitted.

Exactly. Even if it was "so no one else would see it" , for all we know that "someone else" to Aaron was the homeless person that kept his stuff in that closet.

I wouldn't have thought that hiding his face with a bike helmet would have mattered. After all, I do weird things any time I know I'm being watched by a camera; there's one on the elevator at the garage that I habitually cover. Orin Kerr said that stuff matters at trial.

Yes, it does. Things that make you seem like you are being a criminal hurt. The hard thing is that sometimes either option looks bad.

For instance, IIRC, Weev deleted the download script that pulled data from AT&T and the data itself, once publicity had been gotten. That was construed at trial as deleting evidence.

But part of the prosecutors' case was that Weev et. al. planned to exploit the data. In that case, keeping the data would have been used against them as well.

Re: Rep. Zoe Lofgren Introduces Aaron's Law [pdf]

#130

Post by tedunangst »

mindslight wrote: post #110
eru wrote: post #107

Earlier quoted context omitted.

> Which gives me another idea - fungible jail time. I'd have spent a day in jail for Aaron. Not a good idea. Well connected people will get off lightly.

Connected in what way? Bernie Madoff isn't going to find any friends to do time for him. Monetary compensation though? That's a whole nother can of worms. Although I've got to wonder if the incentives are aligned such that it would encourage better prison conditions.

Gangs? You already get promoted for doing time, providing opportunities for volunteering seems unwise.
Post reply on HN