Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Weev's prosecutors are making up the rules

blog.erratasec.com

Post reply on HN
Print view View original

91–97 of 97 posts

Re: How Weev's prosecutors are making up the rules

#91

Post by throwawaykf02 »

aestetix wrote: post #90
throwawaykf02 wrote: post #72

Earlier quoted context omitted.

He accessed data belonging to other people that he should not have, and knew he should not have. (And then went on to make very unwise statements about his intentions of how to handle that data.) That's all that really matters to the judge and jury. The technical aspects don't matter much to them. Also: If ease of access to information means anyone can take it, do you mean to say the NSA should take whatever they wan…

If that information is so valuable, then shouldn't some burden be placed on AT&T for negligence? If this had been health care records, AT&T would have been required to notify users and possibly pay a fine. Perhaps it makes sense to have similar laws in place to protect all data, as Europe does (see ECHR). The point here is, if we want to nail weev to a cross, AT&T should be nailed up right next to him.

Some blame should surely be placed at AT&T's feet too, but IMO not as much. Going back to the door analogy, whoever leaves it carelessly unlocked will definitely get less sympathy (e.g. insurance may decline to cover the loss), but that does not mean they're anywhere as guilty as the thief who actually committed the burglary.

Re: How Weev's prosecutors are making up the rules

#92

Post by ericd »

anigbrowl wrote: post #54
ericd wrote: post #49

Earlier quoted context omitted.

I agree with your opinion of law clerks as generally competent people, which probably extends somewhat to technology with the younger set. That said, I know a lot of young, competent engineers and scientists who know next to nothing about the workings of computers and networks. They could figure out a lot if they had the time to put into it (I've seen a couple switch into development successfully), but usually they d…

I get where you're coming from, but I'm not willing to join you over there - I honestly think your position is flawed and that programmers are terrible at judging such issues. I may just not be seeing the value in the judges' attempts at finding consistency, though, and I'm curious as to why they strive so hard for it versus trying to find the correct interpretation. This is very much an epistemological question. I'm…

Thanks for the suggestion, it's on its way to my Kindle for later.

Re: How Weev's prosecutors are making up the rules

#93

Post by mjn »

tptacek wrote: post #2

One of our many lawyers can relate to us how meaningful the complaint about the word count in the prosecution's brief is. Maybe it's a big deal; I have absolutely no clue about that point. But the central argument to me in this piece is that the DOJ is simply criminalizing URL editing. That is to me a gross oversimplification of what's happened. The CFAA is constructed not to criminalize accidental or reckless unauth…

Have you seen Kerr's full appellate brief on Aurenheimer's behalf? Imo it's more compelling than the post you link, at the expense of being considerably longer: http://www.volokh.com/wp-content/uploads/2013/07/WeevBrief.p...

Re: How Weev's prosecutors are making up the rules

#94

Post by Dylan16807 »

throwawaykf02 wrote: post #84
legutierr wrote: post #23

Earlier quoted context omitted.

I think there is a clear distinction that you can make between an SQL injection attack and the unsecured API that weev accessed. SQL injection attacks depend on inserting malicious code into an application in order to traverse that application and access systems that stand behind it. The point of SQL injection is to circumvent restricted permissions that the owner of the server has attempted to impose. What weev did…

> What weev did was quite different in that he accessed this web service in exactly the way it was intended. So is a thief who walks through a door carelessly left unlocked "accessing it exactly in the way it was intended." It's what he does afterwards that makes the difference. > What is the difference, under the law, between someone accessing a private Google API and the private AT&T API that weev accessed? As a we…

>So is a thief who walks through a door carelessly left unlocked "accessing it exactly in the way it was intended." It's what he does afterwards that makes the difference.

If he takes some pictures and leaves he certainly isn't guilty of breaking and entering.

Re: How Weev's prosecutors are making up the rules

#95

Post by PhasmaFelis »

thaumaturgy wrote: post #78
wavefunction wrote: post #75

Earlier quoted context omitted.

PhasmaFelis is being perfectly reasonable in noting that Weev's current prosecution seems inappropriate and dangerously precedent setting, while still noting that Weev is vile scum (by his own admissions) who should have instead been prosecuted for other more real crimes.

But that's not relevant. At all. And, it weakens the criticism of the prosecution: "I hate to defend this guy, but ..." It's akin to saying, "Alan Turing is gay, but he's done some good work in cryptography anyway..." ... that example only seems ridiculous now because social mores have changed. Weev's character would have relevance in a discussion about whether or not he deserves a Great Justice award, not whether or…

It's relevant because I've seen more than a few people try to advance Weev as some sort of Aaron Swartz-style culture hero. As a part of this culture, I don't want that to happen. I don't want anyone to ever cite Weev as a personal inspiration, I don't want to see his name listed alongside people like Swartz or Bradley as an innocent hacker victimized for trying to do the right thing. If you want to use him as a test case for an unjust and poorly-interpreted law, that's fine, but don't tell me that the discussion has never been about whether Weev is a great guy, because I've seen it happen; and don't try to tell me that the truth is not relevant.

Weev is proud of hurting innocent people. He brags about it. He wants us to know. And I'm sure as hell not going to try to cover that up on his behalf, or tolerate those who do.

Re: How Weev's prosecutors are making up the rules

#96

Post by aestetix »

throwawaykf02 wrote: post #91
aestetix wrote: post #90

Earlier quoted context omitted.

If that information is so valuable, then shouldn't some burden be placed on AT&T for negligence? If this had been health care records, AT&T would have been required to notify users and possibly pay a fine. Perhaps it makes sense to have similar laws in place to protect all data, as Europe does (see ECHR). The point here is, if we want to nail weev to a cross, AT&T should be nailed up right next to him.

Some blame should surely be placed at AT&T's feet too, but IMO not as much. Going back to the door analogy, whoever leaves it carelessly unlocked will definitely get less sympathy (e.g. insurance may decline to cover the loss), but that does not mean they're anywhere as guilty as the thief who actually committed the burglary.

I don't think the door analogy entirely works here. Here's why:

For a typical burglary, person A leaves their door unlocked, and person B walks in. The items clearly belong to person A, and when person B takes them and walks out, theft has clearly occurred.

In this case, person A walks near person B's house, and sees that person B has laid the possessions of person C all over the sidewalk. Person A brings out their duplicator machine, creates mirror images of all person C's items, takes those mirror images, and walks away.

While there is a question of whether person A should have duplicated those items, person C is sitting across town clueless as to what's going on. There's also the question of whether person B should have left things all over the sidewalk, or should have placed the things behind the door.

If we begin comparing accessing a website to opening a door, that creates a lot of legal confusion. IANAL, but IIRC, the current legal understanding is that a computer on a network falls under the jurisdiction of the network. If that's the case, and we consider the Internet to be a public place, then a web server placed on the internet becomes public, unless there's a password on it. If, instead, we consider web servers to be like doors, where you need permission to access them, then anyone who spiders a website might be considered guilty of attempted breaking and entering. For another example, does it make more sense to allow allow smartphone apps to have full access to your phone by default, or should permission be granted for special capabilities? AFAIK, consent in this area is not very well defined.

In the traditional sense of theft, there is an object that I once had in my possession and it has now been taken from me. That doesn't really work so well with digital media where the supply issue goes away.

There's a lot more to this discussion, but I'm curious what the next response will be :)

Re: How Weev's prosecutors are making up the rules

#97

Post by PhasmaFelis »

thaumaturgy wrote: post #78
wavefunction wrote: post #75

Earlier quoted context omitted.

PhasmaFelis is being perfectly reasonable in noting that Weev's current prosecution seems inappropriate and dangerously precedent setting, while still noting that Weev is vile scum (by his own admissions) who should have instead been prosecuted for other more real crimes.

But that's not relevant. At all. And, it weakens the criticism of the prosecution: "I hate to defend this guy, but ..." It's akin to saying, "Alan Turing is gay, but he's done some good work in cryptography anyway..." ... that example only seems ridiculous now because social mores have changed. Weev's character would have relevance in a discussion about whether or not he deserves a Great Justice award, not whether or…

And here's a bit from Kathy Sierra, one of Weev's actual victims, unlike you or me:

"His rise as a folk hero is a sign of how desensitized to the abuse of women online people have become. I get so angry at the tech press, the way they try to spin him as a trickster, a prankster. It’s like they feel they have to at least say he’s a jerk. Openly admitting you enjoy ‘ruining lives for lulz’ is way past being a ‘jerk’. And it wasn’t just my life. He included my kids in his work. I think he does belong in prison for crimes he has committed, but what he’s in for now is not one of those crimes. I hate supporting the Free Weev movement, but I do."

Post reply on HN