Live data from Hacker News

Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

news.ycombinator.com

11–20 of 54 posts

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#11
post #6

This story doesn’t really make sense. What would you risk by truthfully telling us what company and what kind of assets you’re talking about? You shouldn’t be having this conversation with the FBI anyway, these details are figured out in courts.

Most likely OP cannot afford the team of comprehensive legal advisors which would be necessary to achieve a truly fair outcome. I imagine OP has been dealing with this situation mostly silently for approximately a year by now. The "wheels of justice" turn slowly but generally inexorably. Once the FBI decides to bring charges, they almost always have already completely made up their mind and get exactly the outcome they want.

OP's life has been and will continue to be thoroughly destroyed by the consequences of their poor judgement and there's likely no actions OP can take at this point to change the medium-term outcomes. Barring winning the lottery (in some form or another), OP would not be able to pay this debt if they lived to be 1,000 years old. And it's not dischargeable in bankruptcy. That's ignoring any potential jail time and consequences on OP's future employment options.

So, quite frankly, at this point OP is probably posting here in a state of pseudo-panic, because there's very little chance this post would make it worse now that he's already been criminally charged -- again, 99+% of the time, the main outcomes are usually decided at the time of charging, not sentencing.

Long-term, OP may be able to eventually build a life that they are happy with. But they will have many, many doors closed to them.

On an absolute scale, it's possible that OP's actions directly caused a response that wasted many, many man-years of labor even if the data leaked wasn't itself important (technical and legal investigation, management conversations/energy/time that could have been spent on other things, security containment and mitigation, FBI investigators times, the courts time). Its probably not possible for OP to "pay back" the time and energy to all those people that they've affected.

But on a relative scale, its likely that no individual or corporation was threatened with existential harm over this, while OP certainly is facing what feels like existential consequences. So that will be very very hard for them to deal with right now.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#12
As little as 10 years ago, the most common solution to hotlinking was swapping out the hotlinked images with something different/offensive to shoo away the hotlinker. Or various anti-hotlinking scripts. Or maybe even check request headers against your own domain at the server level. Now the solution is a 7 figure cry of foul enforced by the FBI? Was the offense more egregious and involved hotlinking of novel IP, leading to more aggressive enforcement?

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#13
post #9
post #5

Why are you facing any liability whatsoever for linking to public resources? If the owner of that S3 bucket is facing losses from serving files to the public, why don't they revoke public access? S3 prints big warnings that you are making things public, so it's unreasonable for a company to claim "We didn't mean to make this public" What was in the bucket? In any case, sounds like you need a better lawyer, I don't se…

It is no defense to burglary that the homeowner left their front door unlocked.

This is a little different. This is akin to knocking on the door, asking if you can be let in, being invited in by the homeowner, and then having them give a tour around the house.

It's entirely up to the owner of an S3 bucket as to who they serve their static assets to. If the policies are so lenient that anyone can request the resources, then that is a configuration error—not unauthorized access.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#14
post #9

Earlier quoted context omitted.

It is no defense to burglary that the homeowner left their front door unlocked.

This is a little different. This is akin to knocking on the door, asking if you can be let in, being invited in by the homeowner, and then having them give a tour around the house. It's entirely up to the owner of an S3 bucket as to who they serve their static assets to. If the policies are so lenient that anyone can request the resources, then that is a configuration error—not unauthorized access.

You are falsely assuming that allowing public access and serving the requested object constitutes an intentional act of invitation by a bucket owner. If the alleged victim sought the FBI's assistance, it seems pretty clear that they did not intend to extend such an invitation, regardless of the bucket's configuration.

Or, to extend the metaphor I made earlier, just because I left the door unlocked, it doesn't mean I meant to invite anyone in. And if they tricked my housekeeper to invite them in by falsely claiming I authorized them to come to pick up my broken laptop, they'd have no invitation defense, either. (Maybe they wouldn't be guilty of burglary, but certainly larceny.)

Unauthorized access can occur whether the bucket is public or not. The law does not require that sufficient measures (or any measures, really) be taken to protect the assets in question. We can disagree as to whether it should, but that's not how it's written today.

Before making comparative arguments here, it's a good idea to think about whether a judge would laugh at you or not. :-)

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#15
You shouldn't be posting on here, you should be looking for another lawyer.

Sounds like you have a good argument to lower the restitution you'd owe if convicted. Great. But a) ideally you're not convicted; b) somone has to take your argument and prove it in court

You need a solid lawyer. That is it.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#19

Murica is pretty fucked up country if you can get sued for linking to a public resource on the web.

America is a great country because we respect people's intent, even if they make inadvertent mistakes.

No post body was provided.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#20
post #5

Why are you facing any liability whatsoever for linking to public resources? If the owner of that S3 bucket is facing losses from serving files to the public, why don't they revoke public access? S3 prints big warnings that you are making things public, so it's unreasonable for a company to claim "We didn't mean to make this public" What was in the bucket? In any case, sounds like you need a better lawyer, I don't se…

It seems everyday web is turning into ask permission before you do anything environment. Companies instead of hiring competent technical person, spend money on lawyers and lawsuits.

It is scary for someone who grew up on 90s' Internet. Not sure what was in the bucket, but in 90s and 2000s, it was common to link to various resources on the web. My friend in college ran a popular forum where people shared direct links to video games, softwares, pdfs, etc. It, of course, facilitate piracy, but not everything linked there was illegal.

I run a blog where I curate and embed YouTube videos. Yes I am using their official embed code. Using standard http protocol to link to a resource on the web is official way to link. If they were bypassing url signature or something similar, then I can see how they were violating terms and conditions of that bucket owner.

Post reply on HN