Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 54 posts

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#31

Post by giantg2 »

otterley wrote: post #14
theli0nheart wrote: post #13

Earlier quoted context omitted.

This is a little different. This is akin to knocking on the door, asking if you can be let in, being invited in by the homeowner, and then having them give a tour around the house. It's entirely up to the owner of an S3 bucket as to who they serve their static assets to. If the policies are so lenient that anyone can request the resources, then that is a configuration error—not unauthorized access.

You are falsely assuming that allowing public access and serving the requested object constitutes an intentional act of invitation by a bucket owner. If the alleged victim sought the FBI's assistance, it seems pretty clear that they did not intend to extend such an invitation, regardless of the bucket's configuration. Or, to extend the metaphor I made earlier, just because I left the door unlocked, it doesn't mean I…

Most of the time trespassing (which is more akin to this than burglary) requires the owner to post obvious notice or ask the person to leave. I did not see that intentional act here either.

So there's no intentional act by the owner either way. In the physical world, no crime would be committed. It seems this is further reinforced by the fact that AWS documentation repeatedly states that buckets can be accessed publicly or secured depending on the settings. Kind of like the government (in most states) saying people can walk through your property unless you take steps to prevent it.

Yes, judges will laugh at a defendant bringing this up, but will eat up whatever comparisons a prosecutor makes.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#32

Post by c22 »

otterley wrote: post #24
titusjohnson wrote: post #22

Earlier quoted context omitted.

Please don't attempt to equate internet traffic to door locking. It's a tired old argument that fails the moment critical thought is applied. > Unauthorized access can occur whether the bucket is public or not. The law does not require that sufficient measures (or any measures, really) be taken to protect the assets in question. We can disagree as to whether it should, but that's not how it's written today. Citation…

> Please don't attempt to equate internet traffic to door locking. It's a tired old argument that fails the moment critical thought is applied. It's a useful metaphor that gets people convicted. You might not like it or agree with it, but that's the way it is. > Web scraping is most certainly legal. Everything involved in the ridiculous "breaking and entering an unlocked residential door" is done a billion times a da…

I agree that the metaphor has some use, but I think most of these open access cases are more akin to trespassing in the woods at the far end of someone's large property or going through an unmarked door in a public building and finding oneself accidentally in a private space than breaking and entering into someone's home.

That is, if there are no signs posted and you have not received notice that trespass is prohibited you should be given a healthy benefit of the doubt. It is obvious that homes are intended to be private, but not so for files being publicly served on the internet. This whole 'treat the absence of notice as a lack of consent' is a non-starter for me.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#33

Post by titusjohnson »

vgeek wrote: post #12

As little as 10 years ago, the most common solution to hotlinking was swapping out the hotlinked images with something different/offensive to shoo away the hotlinker. Or various anti-hotlinking scripts. Or maybe even check request headers against your own domain at the server level. Now the solution is a 7 figure cry of foul enforced by the FBI? Was the offense more egregious and involved hotlinking of novel IP, lead…

If you don't have money you spend a few evenings setting up referrer protection of some fashion and serve goatse to unauthorized clients. Problem self-solves over time. I was on the receiving end of this a few times, back when I was young and had no way of paying for my own legit image hosting.

If you have money you may also have scale and a public image, so this solution is not so palatable. And since you have money and lawsuits are socially acceptable, you go that route.

If sending security to your house with baseball bats were socially acceptable that would be the route utilized.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#34

Post by titusjohnson »

ffhhj wrote: post #23

> Instead of communicating a copy of the image, Google provides HTML instructions that direct a user’s browser to a website publisher’s computer that stores the full-size photographic image. https://en.m.wikipedia.org/wiki/Inline_linking It seems Google saved its butt with that explanation. Can you do the same?

Mostly true, image search results are shown to the user using a base64 encoded thumbnail representation of the source. Focused view results in a request made to the source image inline with Google's site. They definitely store & process copies. Color search, subject search, none of that is possible without storage of some kind. Freshness searches require polling resources with modest frequency, too.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#36

Post by otterley »

c22 wrote: post #32
otterley wrote: post #24

Earlier quoted context omitted.

> Please don't attempt to equate internet traffic to door locking. It's a tired old argument that fails the moment critical thought is applied. It's a useful metaphor that gets people convicted. You might not like it or agree with it, but that's the way it is. > Web scraping is most certainly legal. Everything involved in the ridiculous "breaking and entering an unlocked residential door" is done a billion times a da…

I agree that the metaphor has some use, but I think most of these open access cases are more akin to trespassing in the woods at the far end of someone's large property or going through an unmarked door in a public building and finding oneself accidentally in a private space than breaking and entering into someone's home. That is, if there are no signs posted and you have not received notice that trespass is prohibit…

No metaphor is a perfect fit for the situation. It's a didactic device, nothing more.

Nevertheless, nobody's getting criminally prosecuted for accidentally fetching a file. Even someone who accidentally downloads child pornography once is unlikely to get in trouble for the mere act itself, provided they delete it as soon as they receive it.

Acts that are getting people in trouble are intentionally downloading files they have no good reason to access, clearly aren't authorized by the owner, and the circumstances surrounding the activity indicate an illicit purpose. All the facts that indicate guilt are going to be argued by an AUSA to a court and possibly a jury; no judge is going to hang someone (metaphorically speaking) for a mere accident.

C'mon, people. Use a little common sense.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#37

Post by otterley »

tinus_hn wrote: post #25
Canada wrote: post #5

Why are you facing any liability whatsoever for linking to public resources? If the owner of that S3 bucket is facing losses from serving files to the public, why don't they revoke public access? S3 prints big warnings that you are making things public, so it's unreasonable for a company to claim "We didn't mean to make this public" What was in the bucket? In any case, sounds like you need a better lawyer, I don't se…

It’s probably not about the contents being public but more about paying the bandwidth costs.

I think this is highly unlikely. That would be grounds for a civil suit, but probably not a criminal prosecution.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#38

Post by otterley »

giantg2 wrote: post #28
otterley wrote: post #24

Earlier quoted context omitted.

> Please don't attempt to equate internet traffic to door locking. It's a tired old argument that fails the moment critical thought is applied. It's a useful metaphor that gets people convicted. You might not like it or agree with it, but that's the way it is. > Web scraping is most certainly legal. Everything involved in the ridiculous "breaking and entering an unlocked residential door" is done a billion times a da…

"It's a useful metaphor that gets people convicted. You might not like it or agree with it, but that's the way it is." It's a blatantly false metaphor. Burglary requires intent to commit a crime once inside.

Indeed, and the crime is stealing (unlawfully copying) the data within.

Admittedly it is an imperfect metaphor -- as all metaphors are -- but it is not "blatantly false."

Data is not fair game for the copying just because it's in a place you can reach it with `curl` without having to pass an authorization check. That's not the law, and it's not common sense.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#39

Post by pyuser583 »

psygnisfive wrote: post #10

Contact the Electronic Frontier Foundation. This is literally what they do. I don't know if they'll take up the case, but talk to them.

Sadly the EFF is not usually in a position to serve as a technical witness in criminal cases.

Re: Help: FBI criminally charged me with $6MM loss for hotlinking. I didn't do it

#40

Post by giantg2 »

otterley wrote: post #38
giantg2 wrote: post #28

Earlier quoted context omitted.

"It's a useful metaphor that gets people convicted. You might not like it or agree with it, but that's the way it is." It's a blatantly false metaphor. Burglary requires intent to commit a crime once inside.

Indeed, and the crime is stealing (unlawfully copying) the data within. Admittedly it is an imperfect metaphor -- as all metaphors are -- but it is not "blatantly false." Data is not fair game for the copying just because it's in a place you can reach it with `curl` without having to pass an authorization check. That's not the law, and it's not common sense.

Eh, you're not depriving a person of their property like in the physical world. It would be like trespassing and reading something. Again, a failed metaphor. What would really be common sense is for people to stop trying to fit bad physical metaphors on technology concepts. They don't work and they obscure the real points.

Frankly, tons of stuff is illegal on the internet. You've likely committed felonies by violating a site's terms of service. That's how the DOJ applies the CFAA. It doesn't get enforced, just like that MO reporter didn't get arrested. Should they have been? It was unauthorized access which you claim is enough under law and common sense...

It's my belief that intent alone is not sufficient. Actions speak louder than words. Who cares if you say "no one is allowed to access this" and then leave public access enabled to something? It's common sense that you didn't secure it and you have no expectation of privacy. Look at traditional cell calls and radio. You're putting your information in public and others can view it. DNA you leave on trash can be collected without a warrant - and with no intent/consent on your part!

The law is a mess and full of contradictions. Even when the statutes are sound they become perverted by activist or impartial judges as well as law enforcement or prosecutorial discretion. Rule of law is a joke when individuals have the power to decide not to enforce it.

Also, I believe there was some case law recently that stated that publically exposed or unsecured data can be accessed without it being a crime, but depended on the details. I don't remember the jurisdiction and I can't seem to find it now either. Oh well.

Post reply on HN