Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This hacker might seem shady, but throwing him in jail is bad for everyone

washingtonpost.com

Post reply on HN
Print view View original

21–30 of 213 posts

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#21

Post by legutierr »

derleth wrote: post #17
msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

> Or is it like walking into someone's private home because they left the door open? Or merely unlocked?

It's more like if you were to walk into a retail establishment where the employees left the door unlocked after heading home for the day.

You can't buy anything because the cash register is locked, and taking something would clearly be stealing, but if sign posted says "we're open", can you be faulted for looking around?

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#22

Post by dopamean »

msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

> You can't be unauthorized if there is no authorization.

This is really the main point to me and I'm really confused as to how the law doesn't agree with this. How can you claim unauthorized access to something when there are no systems in place to grant or deny authorization? Comparing this to walking into someone's home who left the door unlocked (as someone in this thread has done) is bogus to me. Private property is private property and social norms (as well as the law) dictate that you don't just stroll into someone's home even if the door is open. The internet does not work that way and never has.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#23

Post by msandford »

derleth wrote: post #17
msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

Yeah that's the immediate counter analogy to what I'm suggesting.

I think the way I would go about arguing against it is that people on the street/sidewalk have no expectation of privacy. There are literally no access controls of any kind. Anyone can walk on the street; billionaires and homeless alike. There are no societal conventions that privacy is assured on the street and if you end up in someone else's picture it's your fault, not theirs.

Houses are not the street. They are private property. We do have a reasonable expectation of privacy there (NSA notwithstanding) and a part of privacy is access control. So the right of the owner of a house to control access to his house is fairly well understood and accepted even in the case where a house might be unlocked or a door left open.

The real question is this: Is the internet like the street or a house? The answer, in my opinion, is that "it depends" because websites can act both ways depending on how they are designed and implemented.

HN is basically a street in that it has no access controls to view content. Very nearly every page on HN can be accessed by the public (linked to or not) without being logged in. The URL of your comment is https://news.ycombinator.com/item?id=6434945 for which I didn't have to type in a password. What about comment https://news.ycombinator.com/item?id=6434944 or https://news.ycombinator.com/item?id=6434946? Should they be "protected" by virtue of them not being displayed on the webpage right now?

My credit union's website is a bit of public street and a lot of house. I can view their promotional materials without any authorization but in order to get to the good stuff I have to enter both a username and a password, then pass a captcha. That is an access control.

What is the case with the AT&T website? Did they do anything to secure the content with a technological access control like a username/password? Did they filter the service such that the webservice would only return an email address if it was accessed by the same MAC address of the iPad that was sold to the customer? No, they did none of these things. Their only "access control" was a user-agent string which isn't guaranteed ANYWHERE to be accurate.

EDIT: changed a couple of words

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#24

Post by mayanksinghal »

sneak wrote: post #16
austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Weev's a right shithead, you're absolutely right. I still bailed him out of jail for the time leading up to and during his trial. Why? Because UNPOPULAR SPEECH SHOULD NEVER BE CRIMINAL, no matter how revolting. Indeed, it is the unpopular and revolting stuff that needs the most defending: "The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundr…

I have no information of the case at hand, but that could the reason why the prosecutor went for hacking charges instead of harassment.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#25

Post by CamperBob2 »

austenallred wrote: post #2

Reading this article http://www.theverge.com/2013/9/12/4693710/the-end-of-kindnes... makes me feel not too terrible that he's being thrown in jail.

Popular people -- and popular rights -- can be defined as "the ones that don't need defending."

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#26

Post by forgottenpass »

computer wrote: post #20
nym wrote: post #6

Earlier quoted context omitted.

I was with you up until wishing another human dead.

I may have not formulated that as subtle as I meant, since English is not my primary language. So my apologies for that. I do not wish him dead. I mean that I'll fight for him in this case since it's important for society, but since he's such an awful person I would lose all interest in him after he's out of court. Read it as a figure of speech, since we technology people always speak about people who might get hit b…

No, your meaning was clear. That guy was either trolling by deliberately misinterpreting you, or needs English lessons himself.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#28

Post by mangoman »

I love the use of analogy to describe the situation to those who may not understand exactly what Weev did. But can we decide law simply on analogy? Which analogy is a more accurate tale of what Weev did? What I like about this article is it explains what Weev did and how incredibly common his techniques were, without too much analogy. Analogies may be much more effective, but a direct explanation feels a lot more genuine.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#29

Post by tikhonj »

derleth wrote: post #17
msandford wrote: post #12

If you visit and internet cafe and someone's forgotten to log out of their bank account and you fiddle with it, that's probably a crime. Since in nearly all cases they probably didn't intend to do such a thing. We can surmise this by observing the banking website had a password to protect the account holder. This is evident by virtue of the "log out" link that's clearly visible and that the website is served over HTT…

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access" Or is it like walking into someone's private home because they left the door open? Or merely unlocked? The law likes to operate on analogies, because analogous situations are ones for which we ha…

I think it's more like walking onto your neighbor's private land when they don't have fences or a "keep-out" sign, but also don't have any obvious sign allowing people in either. Still a crime, but not particularly severe or abhorrent; whether it merits serious punishment probably depends on particular details.

Re: This hacker might seem shady, but throwing him in jail is bad for everyone

#30

Post by nonce42 »

It's worth reading the criminal complaint and indictment (https://www.eff.org/cases/us-v-auernheimer) to get some background. In particular: the discussions of using the email addresses for a phishing scheme, using them for spam, shorting AT&T stock and profiting off the data release, setting up WiFi routers so they can blame it on a third party, discussing how this was a federal crime, and how to spin themselves as a legitimate security organization. These things make it really hard to view weev as a genuine security researcher who was prosecuted for no good reason.
Post reply on HN