“The AT&T Hacker” Sentenced To 41 Months In Prison • Hacker News Board

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#141

Post by danielweber » Mon, Mar 18, 2013, 8:08 PM UTC

matthewnolandev wrote: post #139

jbooth wrote: post #134

Earlier quoted context omitted.

I was about to post a similar comment to yours until I clicked through to the linked AMA below and saw some of his GNAA history. Given that history, it's really easy to claim that he was intending to do harm with that list of emails, and it's also pretty easy to think of ways for him to do harm. Idendity fraud might be a bit of a reach, but computer abuse with malevolent intent? Not too hard to get there from his pub…

Those emails we're exposed to the public. Weev's security company exposed "gaping holes". AT&T are at fault for exposing their customers information in the first place. Anybody COULD have done harm with those emails. He didn't. He used them as a fodder for public discussion about internet security. AT&T should owe him a "thank you". AT&T customers owe AT&T a boycott for being irresponsible with their information.

Finding a security hole is not a get-out-of-jail-free card.

I think the question of AT&T having responsibility for inadequate controls is very interesting. I would like to see AT&T face some repercussions for it. Not _instead of_ weev receiving punishment, but _in addition to_.

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#142

Post by chc » Mon, Mar 18, 2013, 8:13 PM UTC

pessimizer wrote: post #130

chc wrote: post #100

Earlier quoted context omitted.

Does the First Amendment make a distinction between a person in a crowded room shouting "I love U2" and the same person shouting "Fire"? I'm going to go ahead and suggest that the answer is "No, but we as a society make a distinction." Same princple here. I believe the general principle is that you have freedom of speech, but you do not have indemnity from the harmful consequences of your speech.

The judge who said that the 1st amendment doesn't cover shouting fire in a crowded theater used it as an argument to jail people for handing out anti-war fliers. So it's not even appropriate for me to say that it's a slippery slope, because it started at the bottom.

Although the application is questionable, I think most people agree with the principle — you are free to speak your mind, but when your speech ventures into the realm of action, that action is not necessarily protected. For example, ordering a hit on someone is not protected even though it is technically just speech.

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#143

Post by [deleted] » Mon, Mar 18, 2013, 8:13 PM UTC

sneak wrote: post #116

smsm42 wrote: post #28

Earlier quoted context omitted.

I think somebody that publishes this: http://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may... a day before his sentencing is either completely sure for some reason he gets away with it or is an idiot. Nothing more effective to prove you're not a criminal that saying in public "I only regret I didn't do more harm to whoever they accusing me of harming, next time will be worse". It's like saying "no, I didn't b…

Watching the prosecutor butcher pronouncing "regexps" in federal court was worth it. (Seriously, they read his AMA responses in court this morning. Weev's a shithead, but still: 't'was glorious. )

[deleted]

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#144

Post by matthewnolandev » Mon, Mar 18, 2013, 8:14 PM UTC

sneak wrote: post #116

smsm42 wrote: post #28

Earlier quoted context omitted.

I think somebody that publishes this: http://www.reddit.com/r/IAmA/comments/1ahkgc/i_am_weev_i_may... a day before his sentencing is either completely sure for some reason he gets away with it or is an idiot. Nothing more effective to prove you're not a criminal that saying in public "I only regret I didn't do more harm to whoever they accusing me of harming, next time will be worse". It's like saying "no, I didn't b…

Watching the prosecutor butcher pronouncing "regexps" in federal court was worth it. (Seriously, they read his AMA responses in court this morning. Weev's a shithead, but still: 't'was glorious. )

Technological ignorance from the law makers and the judicial system is in part why that law exists and why Weev is locked up. It's funny to hear them butcher technical words and to see the word "Goatse" on CNN.

..But I've stopped laughing. It's time that technologists step up efforts to change things in the favor of communication and free speech.

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#145

Post by smsm42 » Mon, Mar 18, 2013, 8:21 PM UTC

DanBC wrote: post #89

smsm42 wrote: post #39

Earlier quoted context omitted.

If he doesn't care why should I? I know many security researchers who aren't trolls and they are doing fine. When it happens to somebody who isn't purposefully self-destructive, then it may be a better case for concern.

> If he doesn't care why should I? If you pay US taxes you're paying to keep him in jail. I think he's a vile idiot. I don't think he should be in prison. There's a bunch of stuff that I think he did wrong, but I'll have to read the court documents to see if I agree with them. For example: He could have written a proof of concept script, and only downloaded a sample 10 pages, rather than grabbing as many as possible.…

I don't know if it prevented him from going to jail, but I'm sure if he'd behave responsibly there would be no way he'd get 3 years. But then he'd not be him, and the whole matter would be different. The whole point here is that he is him, and if he'd get a slap on the wrist he'd probably just decide he's invincible and nobody could harm him and proceed to do more harmful things with a full sense of impunity.

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#146

Post by smsm42 » Mon, Mar 18, 2013, 8:24 PM UTC

sneak wrote: post #117

smsm42 wrote: post #39

Earlier quoted context omitted.

If he doesn't care why should I? I know many security researchers who aren't trolls and they are doing fine. When it happens to somebody who isn't purposefully self-destructive, then it may be a better case for concern.

Because living at the mercy of the government only not prosecuting you simply because they think you're not a dick doesn't scale to 100% of a free society. This is why the ACLU defended the Klan.

Show me the case where somebody is prosecuted solely because "they think you're a dick" - as opposed to actually doing something criminal while being a dick - and you'd have much stronger case. I'm not aware of ACLU defending any criminal actions of the Klan. If we talked about Auernheimer's freedom to express his views, however vile may they be, it'd be completely different case.

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#147

Post by thaumaturgy » Mon, Mar 18, 2013, 8:33 PM UTC

rayiner wrote: post #137

sneak wrote: post #132

Earlier quoted context omitted.

Possessing email addresses should not be a crime. Identity fraud for a list of emails? Really? It's insane even if you assume they were pristine and never received any spam before weev came along and "stole" them. Furthermore, the list was never sold, distributed, or published. An excerpt was sent to the media. They kicked around the idea of spearphishing, of spamming, of pastebinning it, of selling it. In full knowl…

> Possessing email addresses should not be a crime. Collecting lists of e-mail addresses from private databases without authorization should be. > Identity fraud for a list of emails? Really? Weev said in IRC conversations that he was going to sell the e-mail lists. Maybe you don't believe him, but it's hard to argue that no reasonable person could have believed that he was going to do what he said he might do. > Fur…

> Collecting lists of e-mail addresses from private databases without authorization should be.

Unauthorized I can see, but "private"? What was "private" about this database he accessed? It was a public API on a public server with no authentication required.

> Weev said in IRC conversations that he was going to sell the e-mail lists.

Yes, but he didn't. Is he being prosecuted for doing something he said he would do, but did not do? That seems dangerous.

> If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.

This is death by bad analogy. He wasn't breaking into a house, no safe-cracking tools were required (nor, probably, on his person).

Why not argue to the actual point? The list was not sold, distributed, or published -- why is it necessary to fall back to analogy there?

> I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.

Death by bad analogy, again. Surely you don't think that downloading publicly available data is analogous to B&E? And if the email addresses are so precious as to warrant a 41-month prison sentence merely for accessing them, shouldn't the idiots at AT&T be held at least partially responsible for making the data publicly accessible?

> Obviously this is too high of a bar for people like Weev.

Ah: guilty people are lesser people?

I'm not even sure what Weev's crime was here, in layman's terms. Was it accessing the public API in the first place? Was it sending the list of email addresses to Gawker? Was it talking about doing nefarious things with the list of email addresses? Was it not contacting AT&T first?

If I had to describe this case to someone who knew nothing of computer systems and explain why the 41-month prison sentence was justified, how would I do that?

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#148

Post by josh2600 » Mon, Mar 18, 2013, 8:34 PM UTC

rayiner wrote: post #137

sneak wrote: post #132

Earlier quoted context omitted.

Possessing email addresses should not be a crime. Identity fraud for a list of emails? Really? It's insane even if you assume they were pristine and never received any spam before weev came along and "stole" them. Furthermore, the list was never sold, distributed, or published. An excerpt was sent to the media. They kicked around the idea of spearphishing, of spamming, of pastebinning it, of selling it. In full knowl…

> Possessing email addresses should not be a crime. Collecting lists of e-mail addresses from private databases without authorization should be. > Identity fraud for a list of emails? Really? Weev said in IRC conversations that he was going to sell the e-mail lists. Maybe you don't believe him, but it's hard to argue that no reasonable person could have believed that he was going to do what he said he might do. > Fur…

Is there not some level of basic accountability? I mean, shouldn't AT&T face penalties for hosting consumer data in such an egregiously unsafe fashion?

While I think the responsible disclosure could've happened in a better way, I don't think this is akin to walking into an unlocked house. This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.

What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time. It just doesn't sit well with me and I don't think the boundaries are obvious.

I'm not a hacker if I increment a URL by 1. I wouldn't even call you a hacker if you used DNS reflection attacks. To identify cheap parlor tricks as hacking is offensive to the professional breakers and ludicrous in the larger scheme of things.

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#149

Post by DanBC » Mon, Mar 18, 2013, 8:42 PM UTC

smsm42 wrote: post #145

DanBC wrote: post #89

Earlier quoted context omitted.

> If he doesn't care why should I? If you pay US taxes you're paying to keep him in jail. I think he's a vile idiot. I don't think he should be in prison. There's a bunch of stuff that I think he did wrong, but I'll have to read the court documents to see if I agree with them. For example: He could have written a proof of concept script, and only downloaded a sample 10 pages, rather than grabbing as many as possible.…

I don't know if it prevented him from going to jail, but I'm sure if he'd behave responsibly there would be no way he'd get 3 years. But then he'd not be him, and the whole matter would be different. The whole point here is that he is him, and if he'd get a slap on the wrist he'd probably just decide he's invincible and nobody could harm him and proceed to do more harmful things with a full sense of impunity.

There are some things he deserves serious punishment for. Some of the things he has done have affected other people directly.

So why do those behaviours escape punishment, while this thing gets a prison sentence?

Re: “The AT&T Hacker” Sentenced To 41 Months In Prison

#150

Post by rayiner » Mon, Mar 18, 2013, 8:42 PM UTC

josh2600 wrote: post #148

rayiner wrote: post #137

Earlier quoted context omitted.

> Possessing email addresses should not be a crime. Collecting lists of e-mail addresses from private databases without authorization should be. > Identity fraud for a list of emails? Really? Weev said in IRC conversations that he was going to sell the e-mail lists. Maybe you don't believe him, but it's hard to argue that no reasonable person could have believed that he was going to do what he said he might do. > Fur…

Is there not some level of basic accountability? I mean, shouldn't AT&T face penalties for hosting consumer data in such an egregiously unsafe fashion? While I think the responsible disclosure could've happened in a better way, I don't think this is akin to walking into an unlocked house. This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability. What m…

> Is there not some level of basic accountability? I mean, shouldn't AT&T face penalties for hosting consumer data in such an egregiously unsafe fashion?

That's a separate issue.

> This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.

The protection was the fact that the information therein was obviously sensitive and not intended for public disclosure. In a civilized society, that's all that should be necessary.

> What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time

He's not being sent to jail for "exposing this lack of attention." He's being sent to jail for exploiting this lack of attention tens of thousands of times more than was necessary to prove his point and for talking smack on IRC that led people to believe that he might sell those e-mail addresses for profit.