Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI raids dental software researcher who discovered patient data on FTP server

dailydot.com

Post reply on HN
Print view View original

101–110 of 171 posts

Re: FBI raids dental software researcher who discovered patient data on FTP server

#101

Post by gist »

wtvanhest wrote: post #98
ghoul2 wrote: post #90

As a separate issue: why the "shock and awe" response to what is (even allegedly) a non-violent crime? Why the assault rifles? Why could he not have been arrested by just a couple agents walking upto the door, knocking, serving the search warrant, and then maybe having the techs step in to conduct the search and seizure? Why does US Law Enforcement so dramatically escalate every contact with a citizen? Everytime they…

Requiring the warrant to specify the level of force could be interesting. Are there good reasons why this could not be done?

I honestly don't think that being rude and/or hurting feelings (or scarring a baby) really enters into law enforcement of this type (also see my other comment).

Re: FBI raids dental software researcher who discovered patient data on FTP server

#102

Post by tobltobs »

rrggrr wrote: post #87
tobltobs wrote: post #78

Earlier quoted context omitted.

That would make me even more nervous, because if they would find some childprn it would have been justified.

You are being paranoid. There are over 13,000 FBI agents but probably 5x that number are needed to deal with organized crime, white collar crime, national security threats, public corruption, background investigations and other cases within their jurisdiction. You can bet there were/are a few agents shaking their heads in irritation over what appears to be a waste of resources.

That is even more reason for those FBI agents in charge to find something else to legitimate this waste of resources. For a real life example how this works you might google "FBI Keith Gartenlaub"

Re: FBI raids dental software researcher who discovered patient data on FTP server

#103

Post by gist »

gregmac wrote: post #55
jneal wrote: post #37

This reminds me of something that happened to me in high school back in 1999. I found an Excel doc in a public network drive that contained every single student's SSN, DOB, whether they had free/reduced lunch, address, phone, etc. I was admittedly snooping around, but this was all public stuff every student and teacher had full access to. When I found it, I told one of the teachers that I trusted and she insisted tha…

> I was nearly expelled for "hacking". They placed me on "academic probation" This reaction makes me very, very angry. I would love to push it back on them: it's unclear under what laws/regulations this would fall, but if you (as the student who found it) can get in trouble for finding this info, they can most certainly get in trouble for posting it in a location it can be found in. Further, because you were actually…

> This reaction makes me very, very angry.

You are hearing one side of a story (that doesn't mean there is another side that would change your mind or my mind of course) but keep in mind that the parent also said "I admit I was snooping".

Let's say for arguments sake someone enters a room that they are not supposed to be in and finds something in a desk drawer that shouldn't be there. Should the person snooping be commended for doing that? As if a reward saying "go anywhere anytime and as long as the end justifies you are off the hook". Are you allowed to enter your neighbors house in search of contraband or access his computer? I realize this was allegedly "public" but the devil is in the details of what that means exactly.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#104

Post by Zombieball »

gist wrote: post #100
ghoul2 wrote: post #90

As a separate issue: why the "shock and awe" response to what is (even allegedly) a non-violent crime? Why the assault rifles? Why could he not have been arrested by just a couple agents walking upto the door, knocking, serving the search warrant, and then maybe having the techs step in to conduct the search and seizure? Why does US Law Enforcement so dramatically escalate every contact with a citizen? Everytime they…

Two reasons perhaps. Publicity and safety of the officers. How do they know how this person is going to react (or anyone else in the house)? And the publicity is much greater with a greater show of force (hence a deterrent) as well with a shock and awe response.

I think you are right about the publicity and show of force. I can't imagine it takes more than a couple police officers to arrest a single suspect in a house in a safe manner.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#105

Post by tcdent »

ghoul2 wrote: post #90

As a separate issue: why the "shock and awe" response to what is (even allegedly) a non-violent crime? Why the assault rifles? Why could he not have been arrested by just a couple agents walking upto the door, knocking, serving the search warrant, and then maybe having the techs step in to conduct the search and seizure? Why does US Law Enforcement so dramatically escalate every contact with a citizen? Everytime they…

This is a culture that believes prosecuting to the "fullest-extent of the law" is the right thing to do, regardless of the actual human circumstances.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#106

Post by zbobet2012 »

gist wrote: post #100
ghoul2 wrote: post #90

As a separate issue: why the "shock and awe" response to what is (even allegedly) a non-violent crime? Why the assault rifles? Why could he not have been arrested by just a couple agents walking upto the door, knocking, serving the search warrant, and then maybe having the techs step in to conduct the search and seizure? Why does US Law Enforcement so dramatically escalate every contact with a citizen? Everytime they…

Two reasons perhaps. Publicity and safety of the officers. How do they know how this person is going to react (or anyone else in the house)? And the publicity is much greater with a greater show of force (hence a deterrent) as well with a shock and awe response.

Research on the subject says this is more dangerous for the cops then the calmer approaches.

The irony is cops do this to protect themselves, and statistically speaking it has the exact opposite effect.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#107

Post by ivl »

zbobet2012 wrote: post #106
gist wrote: post #100

Earlier quoted context omitted.

Two reasons perhaps. Publicity and safety of the officers. How do they know how this person is going to react (or anyone else in the house)? And the publicity is much greater with a greater show of force (hence a deterrent) as well with a shock and awe response.

Research on the subject says this is more dangerous for the cops then the calmer approaches. The irony is cops do this to protect themselves, and statistically speaking it has the exact opposite effect.

It makes it harder to feel much pity when things go 'wrong' for them, then.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#108

Post by wavefunction »

Zombieball wrote: post #104
gist wrote: post #100

Earlier quoted context omitted.

Two reasons perhaps. Publicity and safety of the officers. How do they know how this person is going to react (or anyone else in the house)? And the publicity is much greater with a greater show of force (hence a deterrent) as well with a shock and awe response.

I think you are right about the publicity and show of force. I can't imagine it takes more than a couple police officers to arrest a single suspect in a house in a safe manner.

Pretty sure you could send two officers to the door.

Knock.

Depending on the response from the inhabitant, either take them into custody or call for backup.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#109

Post by jlgaddis »

callesgg wrote: post #44

About a month or so a go i found a open public mongo database with about 12GB of records regarding peoples retirement founds of what i assume was hundreds of thousands of people, account numbers, how much money was in the accounts when they had moved them to various founds and so on. Thought long and hard about what to do but decided to not do anything, dont feel like risking my entire life just to help someone. This…

US-CERT

Re: FBI raids dental software researcher who discovered patient data on FTP server

#110

Post by Natsu »

cmdrfred wrote: post #5
AdmiralAsshat wrote: post #3

The FBI is going to have a hell of a time arguing that accessing a public FTP server with no password protection is a crime.

I believe that it is still considered unauthorized access even if they don't have a password set up. I think it goes back to law that existed before computers where if you entered someones home without permission you can't simply argue that there wasn't a lock on the door. Edit: ProAm above reminded me of the Andrew Auernheimer case that was nearly identical to this and was resolved as I describe.

Yes, the law on the subject is mostly nonsense. That said, I've thought a lot on the subject and this is what I think the law should have been -

For 'unauthorized access' to a computer system you (should) need to knowingly access a protected system in a way not permitted by the rights granted to you by the computer system, or by deliberate deception of either the computer systems or people.

So for 'knowing' we have to actually know (via banners, etc.) that we're somewhere we shouldn't be. For 'protected' it has to be actually protected (none of this "I found unprotected files lying around with no password" nonsense). The last two clauses cover privilege escalation attacks and social engineering. So it should matter if you're operating the system normally or if you accidentally just click/type something wrong and found your way in vs. you were deliberately hacking / social engineering your way in.

I'd also add a safe harbor for anyone who in good faith reported the issue to the site operators, police, or government regulatory bodies to prevent reprisal like this ugly case.

Sadly, I don't get to write these laws.

Post reply on HN