Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Weev's prosecutors are making up the rules

blog.erratasec.com

Post reply on HN
Print view View original

11–20 of 97 posts

Re: How Weev's prosecutors are making up the rules

#11

Post by rayiner »

tptacek wrote: post #2

One of our many lawyers can relate to us how meaningful the complaint about the word count in the prosecution's brief is. Maybe it's a big deal; I have absolutely no clue about that point. But the central argument to me in this piece is that the DOJ is simply criminalizing URL editing. That is to me a gross oversimplification of what's happened. The CFAA is constructed not to criminalize accidental or reckless unauth…

I think my thoughts on the CFAA have evolved. I agree it's not easy to trip. I agree sentences are the problem. But as far as I can tell, the US Sentencing Commission is full of crazy people. The Sentencing Guidelines are bizarre. And the whole process has caused judges to abdicate their good sense and anchor their sentences to this messed up document.

If we can't trust sentencing as a process, and I'm beginning to believe we can't, maybe sensible laws can nonetheless be ultimately unreasonable in context.

Re: How Weev's prosecutors are making up the rules

#12

Post by tptacek »

rayiner wrote: post #11
tptacek wrote: post #2

One of our many lawyers can relate to us how meaningful the complaint about the word count in the prosecution's brief is. Maybe it's a big deal; I have absolutely no clue about that point. But the central argument to me in this piece is that the DOJ is simply criminalizing URL editing. That is to me a gross oversimplification of what's happened. The CFAA is constructed not to criminalize accidental or reckless unauth…

I think my thoughts on the CFAA have evolved. I agree it's not easy to trip. I agree sentences are the problem. But as far as I can tell, the US Sentencing Commission is full of crazy people. The Sentencing Guidelines are bizarre. And the whole process has caused judges to abdicate their good sense and anchor their sentences to this messed up document. If we can't trust sentencing as a process, and I'm beginning to b…

Oh, let me be clear: the law has to change. I just don't think the definition of "unauthorized access" needs to be so dramatically narrowed as Robert Graham does.

Re: How Weev's prosecutors are making up the rules

#14

Post by revelation »

tptacek wrote: post #10
jhales wrote: post #9

Earlier quoted context omitted.

Point taken, intent does matter. But there is a large difference between taking the information you used to the black market and taking it to a media organization. e.g. Homakov's hack of github didn't deserve jail time as it was for publicity, not malevolance.

I agree. I think the case against Aurenheimer is ridiculous and the sentence a travesty. But I don't think it's reasonable to take that conclusion and work it back to "anything you can do with a URL that doesn't say user/password is fair game".

Certainly the conclusion can't be that the legality of your actions depends on the reaction of an automated system at the other end of a pipe that you don't control?

I have no problem with basing it off intent, but the focus should be on prosecuting whoever put that data out there in the first place with gross negligence.

Re: How Weev's prosecutors are making up the rules

#16

Post by fnordfnordfnord »

tptacek wrote: post #6
jhales wrote: post #3

they returned the http code 200. that means good to go. there is another code for access forbidden.

Congratulations, you just immunized probably 1/3rd of all the SQL injection exploiters on the Internet.

So? It is still illegal to commit fraud, use stolen identities to purchase goods, and arguably still illegal to attack a database.

Re: How Weev's prosecutors are making up the rules

#17

Post by tptacek »

revelation wrote: post #14
tptacek wrote: post #10

Earlier quoted context omitted.

I agree. I think the case against Aurenheimer is ridiculous and the sentence a travesty. But I don't think it's reasonable to take that conclusion and work it back to "anything you can do with a URL that doesn't say user/password is fair game".

Certainly the conclusion can't be that the legality of your actions depends on the reaction of an automated system at the other end of a pipe that you don't control? I have no problem with basing it off intent, but the focus should be on prosecuting whoever put that data out there in the first place with gross negligence.

The legality of your actions depends on whether you know, as you interact with the automated system, that you have managed to find a path to data that you should not have had access to.

So, if by incrementing ICC-IDs, you found random technical data about AT&T provisioning, it would be very hard to argue that you were knowingly accessing it without authorization. But when the information you find is so personal that your first instinct is chat about selling it to spamming rings, you are on considerably less safe footing.

I am ambivalent about software liability. Vulnerable software is much more common than most people think it is, and it would be a shame if ill-conceived liability rules created a situation for startups analogous to that of medical malpractice insurance. On the other hand, liability laws would be hugely lucrative for me.

Re: How Weev's prosecutors are making up the rules

#18

Post by Volpe »

tptacek wrote: post #10
jhales wrote: post #9

Earlier quoted context omitted.

Point taken, intent does matter. But there is a large difference between taking the information you used to the black market and taking it to a media organization. e.g. Homakov's hack of github didn't deserve jail time as it was for publicity, not malevolance.

I agree. I think the case against Aurenheimer is ridiculous and the sentence a travesty. But I don't think it's reasonable to take that conclusion and work it back to "anything you can do with a URL that doesn't say user/password is fair game".

I have trouble agreeing with this. I know nothing of the law around this, but also realise given the international nature of the internet, the law probably doesn't mean much in perspective. Would Aurenheimer be prosecuted if he were Chinese?

The grandparent making the point about status 200 has a point, especially in regards to this case. If a website is returning 200s for a get request. Then you are implicitly 'authorized' to see that page. The counter point made of SQL injection is also valid, but SQL injection wasn't used here. Just plain old GET requests.

It's difficult to draw real world comparisons to things like this. So I don't think you can simplify it down to locked/unlocked doors, or public/private property.

If I go to cia.gov/supersecretfiles and it returns something... did I just "hack" the CIA? It doesn't make sense to me.

URIs that return 200s are public resources.

Re: How Weev's prosecutors are making up the rules

#19

Post by tptacek »

fnordfnordfnord wrote: post #16
tptacek wrote: post #6

Earlier quoted context omitted.

Congratulations, you just immunized probably 1/3rd of all the SQL injection exploiters on the Internet.

So? It is still illegal to commit fraud, use stolen identities to purchase goods, and arguably still illegal to attack a database.

Committing fraud: illegal.

Using stolen identities to purchase goods: illegal.

Attacking a database: not illegal without CFAA.

Re: How Weev's prosecutors are making up the rules

#20

Post by tptacek »

Volpe wrote: post #18
tptacek wrote: post #10

Earlier quoted context omitted.

I agree. I think the case against Aurenheimer is ridiculous and the sentence a travesty. But I don't think it's reasonable to take that conclusion and work it back to "anything you can do with a URL that doesn't say user/password is fair game".

I have trouble agreeing with this. I know nothing of the law around this, but also realise given the international nature of the internet, the law probably doesn't mean much in perspective. Would Aurenheimer be prosecuted if he were Chinese? The grandparent making the point about status 200 has a point, especially in regards to this case. If a website is returning 200s for a get request. Then you are implicitly 'auth…

No, he would not have been prosecuted if he were Chinese.

The point about "200" error codes is sophistry. We all know that every 200 code is not actually a deliberate authorization. If you believe otherwise, then any SQL injection attack that uses GETs and generates 200 must be authorized.

Post reply on HN