Andrew 'Weev' Auernheimer Faces Jail

Didn't he try to extort money out of them after spidering all the information?

When everyone is a criminal all the time, with selective enforcement, it makes it easier to tax and control. When political winds shift, you can eliminate anybody you want, because you just make an excel spreadsheet of political enemies and then forward it by email to law enforcement for increased survallence, and whamo, felony convictions, how much you want? 1 year? 5 years? 10 years?

The government is just trying to maintain its power over the people, when federal reserve realizes there is no other alternative except to default on the US treasury, there is going to be a lot of unrest, and the internet will be a focus point of governmental rebellion, it's important everyone who accesses the internet is a felon. Especially the coders, like this one, who will be making the rebellion possible.

You got to put the fear in them. We may be the ones, like our founding fathers, who have to write up a new constitution, bill of rights, and spawn a new nation to break away from the defective one. Like the good men of old time broke away from Britain. The battlefield this time around will not be on the shores of Boston, the battlefield will be software, servers, clicks, and smart phones.

As with all battlefields, the side who wins is the one who prepares the most. This is why we are cracking down on website clicking by programmers, rather than cracking down on governmental corruption.

He talked about it, but I don't think that actually happened. The chat log was used against him at the trial anyway.

Firstly, the laws around this sort of thing are very stupid. But with that said...I'm not wholly sympathetic here.

The disclosure was totally botched. The IRC logs that came out during the case showed that Andrew and Dan (Spitler) talked about shorting AT&T stock (they ended up not doing this, but it's not the sort of thing you talk about), and going directly to news organisations, bypassing AT&T. They also considered (perhaps jokingly, but again, not something you joke about) selling the e-mail addresses to spammers.

Andrew also initially told Gawker he'd disclosed to AT&T, when in fact he hadn't (Ars has a good summary here[1]).

I am definitely not saying that a ten year sentence is warranted, or that any sort of custodial sentence is appropriate. In fact, I doubt he'll be given 10 years, more like 2-4 (since his fellow defendant, who plead guilty, got 12-18 months). But I do think the disclosure was handled really, really badly. I've found and disclosed very similar vulnerabilities - I would not leak the entire database out. That's just crazy.

Again, it's the old black/grey/white hat argument again. But to go public without even informing AT&T doesn't endear him to me.

[1]: http://arstechnica.com/apple/2011/01/goatse-security-trolls-...

I just listed the charges, I didn't say I agreed with them. And I didn't say anything about AT&T.

It seems clear that AT&T failed to protect their customer's personal details. Whether that makes them criminally liable depends on US law, about which I know almost nothing. This [1] article seems to imply that it is fairly weak compared to European data protection laws, so it may be that AT&T did nothing wrong in a strict legal sense.

While its tempting to think that he was just made an example of for embarrassing a corporation, he did write a script to harvest 120,000 email addresses from the AT&T server. I'd say that constitutes criminal intent, even if he had no intention of using the addresses for a criminal purpose.

There are two problems here: 1. absent or weak data protection laws, and 2. disproportionate sentencing guidelines (up 10 years) for what in this case is basically a victimless crime.

[1] http://www.nytimes.com/2013/02/03/technology/consumer-data-p...