How Weev's prosecutors are making up the rules
blog.erratasec.com
How Weev's prosecutors are making up the rules
1–10 of 97 posts
Re: How Weev's prosecutors are making up the rules
#2One of our many lawyers can relate to us how meaningful the complaint about the word count in the prosecution's brief is. Maybe it's a big deal; I have absolutely no clue about that point.
But the central argument to me in this piece is that the DOJ is simply criminalizing URL editing. That is to me a gross oversimplification of what's happened. The CFAA is constructed not to criminalize accidental or reckless unauthorized access, but instead using a "knowing" standard. The DOJ's argument in the Aurenheimer case is that the defendant was aware that he shouldn't have had access to information tied to ICC-IDs, just as he'd have been aware had he tried to loop through Social Security Numbers in some other application.
There are plenty of sane arguments (see Orin Kerr† for a good survey) that what Aurenheimer did shouldn't have constituted unauthorized access. I don't actually happen to agree with any of the ones I've heard, but, more importantly, I have a hard time believing that those arguments are so dispositive that they indicate malfeasance on the part of prosecutors.
To me, the central problem with the CFAA isn't that it's easy to trip. Rather, it's that the sentencing is totally out of whack, in two ways: (1) that CFAA reacts in a particularly noxious catalytic way with other criminal statutes to accelerate minor infractions into significant felonies, and (2) that sentences scale with "damages", which have the effect of creating sentences that scale with the number of iterations in a for(;;) loop, which is nonsensical.
The problem is not simply that once prosecuted, defendants face unjust sentences. It's worse: the oversentencing creates a perverse incentive for prosecutors, turning run-of-the-mill incidents into high-profile vanity cases that lock the DOJ into pointlessly aggressive prosecutions.
To me, it makes sense that what Aurenheimer did should have been illegal, but it makes no sense at all that he's serving a custodial sentence over it.
(I did read the whole article; I didn't find the user-agent and responsible disclosure points particularly compelling, but maybe you did; I'm happy to opine about them as well. It's my judgement, not the article's overt wording, that the argument revolves around URL editing.)
† http://www.volokh.com/2013/01/28/more-thoughts-on-the-six-cf...
Re: How Weev's prosecutors are making up the rules
#3they returned the http code 200. that means good to go. there is another code for access forbidden.
Re: How Weev's prosecutors are making up the rules
#4[deleted]
Re: How Weev's prosecutors are making up the rules
#5But while they can edit the URL, most people don't. For that reason, prosecutors insists that it's illegal. On page 32, they describe a hypothetical "judicial law clerk" who is a "reasonably sophisticated computer user". They point out that this clerk would search in vain for hyperlinks, and thus, not be able to access the information since such hyperlinks don't exist.
This is a clever trick of the prosecutors. It exploits the fact that the way the judge is going to handle this case is to give the brief to the young clerk who spends a lot of time on Facebook, where "heavy Facebook use" is the proxy for "reasonably sophisticated computer user".
HN user Rayiner is a law clerk in a US appeals court, and he's pretty handy with assembler from wha tI recall. This is a ridiculous straw man argument what badly misrepresents the claims in the brief.
Overall, I think this article is terribly poorly written. An inability to handle basic grammar is not a good foundation for parsing legal arguments, and much of the author's argument is predicated on the assumption that lawyers and judges do not understand computers.
Re: How Weev's prosecutors are making up the rules
#6they returned the http code 200. that means good to go. there is another code for access forbidden.
Congratulations, you just immunized probably 1/3rd of all the SQL injection exploiters on the Internet.
Re: How Weev's prosecutors are making up the rules
#7God says...
vessel uman finite unsettled secret abandonedly deep-seated
----
God says...
Virtual-Notary.Org hereby notes that on Date: Saturday September 21, 2013 18:31.28 EDT (UTC-0400)
a random drawing in the range [1, 100000], inclusive, based on a hardware source of true randomness, yielded the following decision.
Random Value: 19343
3:12 Now therefore take you twelve men out of the tribes of Israel, out of every tribe a man.
3:13 And it shall come to pass, as soon as the soles of the feet of the priests that bear the ark of the LORD, the LORD of all the earth, shall rest in the waters of Jordan, that the waters of Jordan shall be cut off from the waters that come down from above; and they shall stand upon an heap.
3:14 And it came to pass, when the people removed from their tents, to pass over Jordan, and the priests bearing the ark of the covenant before the people; 3:15 And as they that bare the ark were come unto Jordan, and the feet of the priests that bare the ark were dipped in the brim of the water, (for Jordan overfloweth all his banks all the time of harvest,) 3:16 That the waters which came down from above stood and rose up upon an heap very far from the city Adam, that is beside Zaretan: and those that came down toward the sea of the plain, even the salt sea, failed, and were cut off: and the people passed over right against Jericho.
Re: How Weev's prosecutors are making up the rules
#8they returned the http code 200. that means good to go. there is another code for access forbidden.
Congratulations, you just immunized probably 1/3rd of all the SQL injection exploiters on the Internet.
+1. I get that the weev situation is a clusterfuck. Unfortunately the implication of Robert's argument is that SQL Injection is not hacking.
Re: How Weev's prosecutors are making up the rules
#9they returned the http code 200. that means good to go. there is another code for access forbidden.
Congratulations, you just immunized probably 1/3rd of all the SQL injection exploiters on the Internet.
Point taken, intent does matter. But there is a large difference between taking the information you used to the black market and taking it to a media organization.
e.g. Homakov's hack of github didn't deserve jail time as it was for publicity, not malevolance.
Re: How Weev's prosecutors are making up the rules
#10Earlier quoted context omitted.
Congratulations, you just immunized probably 1/3rd of all the SQL injection exploiters on the Internet.
Point taken, intent does matter. But there is a large difference between taking the information you used to the black market and taking it to a media organization. e.g. Homakov's hack of github didn't deserve jail time as it was for publicity, not malevolance.
I agree. I think the case against Aurenheimer is ridiculous and the sentence a travesty. But I don't think it's reasonable to take that conclusion and work it back to "anything you can do with a URL that doesn't say user/password is fair game".