Teenager facing prison for downloading unsecured files from government website • Hacker News Board

Re: Teenager facing prison for downloading unsecured files from government website

#451

Post by harryh » Tue, Apr 17, 2018, 1:00 PM UTC

c22 wrote: post #362

harryh wrote: post #317

Earlier quoted context omitted.

I hear what you are saying about the intent of the actor, but that's tricky. What if the actor doesn't believe in private property? What if the actor accidentally misreads "private" as "public."? These things aren't really mitigating. This is why the law tends to fall back on what a hypothetical "reasonable person" would think. I'm not as much of a hardliner as rayiner on this particular case as I think there are som…

But what if someone had just moved to Canada from Norway and didn't realize that tax return information was supposed to be private? I think it's fair to put most of the responsibility on those who have implemented a system that serves private data in response to public http requests. Presumably this is the party that has both been entrusted with the private data and has the technological and legal resources to unders…

Those that move from one country to another are responsible for learning the laws and customs of the place they are moving to.

Re: Teenager facing prison for downloading unsecured files from government website

#452

Post by tremon » Tue, Apr 17, 2018, 1:09 PM UTC

eboyjr wrote: post #64

dustingetz wrote: post #48

Earlier quoted context omitted.

i can see how the older generation is thinking though, they see it like leaving a window unlocked doesn’t mean you can the laws are interpreted and applied by powerful people in a way that suits the way they think - that much i think could have been predicted (but not by a teenager) did the weev ruling surprise anybody other than hackers?

Since it helps the older generation to think about digital content in metaphors, I'd argue that the kid was entering through an open window of a public building. Although a bit strange, no one would give this hypothetical person a third look.

The open window metaphor implies that the rest of the building's facade was a wall. I don't think that is an accurate description of a website.

If we have to resort to metaphors, then let's describe this section of the site as a ring binder, and each FOIPOP publication as a single page in the ring binder. What the kid did, then, is to take out the entire stack of pages and feed it to an automatic copier, put back the originals in the binder and left with the copied stack.

There is no indication that the "perpetrator" even looked at any page in that stack. And since the binder was clearly labeled as "free public repository of FOIPOP responses that have been approved for publication", the act of copying the entire stack is no reason to assume foul play.

Re: Teenager facing prison for downloading unsecured files from government website

#453

Post by framtk » Tue, Apr 17, 2018, 1:12 PM UTC

rayiner wrote: post #124

freshmint wrote: post #21

Earlier quoted context omitted.

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.

> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.

Let's say you are reading a free manual online and every page is stored as a different webpage with a common URL and only the last number changing (E.G. page 1 is book/1 page 2 is book/2 and so on). The only way to go to a certain page is with a "next page" link from the previous one. You read the index at page 1 and see that you cant find the information you need but page 500 is missing, a printing error in the index perhaps. Instead of clicking 499 times on the page links to see if the information you need is on page 500 you simply change book/1 to book/500. OH NO, the link on page 499 brings you to page 501 and it's not in the index because page 500 contains the truth about aliens so now you read it and are going to prison.

That's in a nutshell what happened

Re: Teenager facing prison for downloading unsecured files from government website

#454

Post by c22 » Tue, Apr 17, 2018, 1:13 PM UTC

harryh wrote: post #451

c22 wrote: post #362

Earlier quoted context omitted.

But what if someone had just moved to Canada from Norway and didn't realize that tax return information was supposed to be private? I think it's fair to put most of the responsibility on those who have implemented a system that serves private data in response to public http requests. Presumably this is the party that has both been entrusted with the private data and has the technological and legal resources to unders…

Those that move from one country to another are responsible for learning the laws and customs of the place they are moving to.

No doubt. I still would consider the implementors of said contrived-example-website to be far more liable than our hypothetical confused batch downloading Norwegian friend. Just like I don't yell at my toddler when she knocks over the glass of water I left on the floor.

Re: Teenager facing prison for downloading unsecured files from government website

#455

Post by rootlocus » Tue, Apr 17, 2018, 1:13 PM UTC

iamnothere wrote: post #437

loup-vaillant wrote: post #142

Earlier quoted context omitted.

You are saying that ordinary people don't know what a URL actually is. This is ridiculous. It takes a certain level of computer illiteracy to never notice that you can access stuff by typing into the address bar directly, or by modifying what's already there. It also doesn't take a computer whiz to use DownThemAll to enumerate URLs and download them all. They even have a dedicated function for this! Yes, one does hav…

Well maybe you shouldn't be using antisocial hacker tools like DownThemAll! An ordinary user would never use such tools. /s Incrementing URLs by hand is one of the ways I learned about how the internet works, as a young kid. Kids are curious. This is normal behavior!

Well, some people believe being curious and trying things out is not what "normal people" do so it's "antisocial" and you shouldn't do it.

I remember a teacher yelling at me for trying some slightly advanced features in a hardware design language. I was really proud I could implement something I didn't thought possible, but her reaction was along the lines "Do you want attention? Why can't you just stay quiet and do what the rest of the class does without showing off?".

Stifling creativity and curiosity, especially in children, encouraging them to be mediocre "like ordinary people" is disgusting and counter productive.

Re: Teenager facing prison for downloading unsecured files from government website

#456

Post by rootlocus » Tue, Apr 17, 2018, 1:19 PM UTC

rayiner wrote: post #139

newfoundglory wrote: post #125

Earlier quoted context omitted.

Whether it is common knowledge or not has no bearing on whether it’s criminal, so I wasn’t using ordinary to mean “of normal computer literacy”. If you want to use some specific definitions that turn your claim into something trivially obvious, please define them ahead of time.

But lots of things are legal or not based on what typical people would do or think. "Battery" is contact a normal person would find offensive. So touching someone's shoulder to get their attention is not battery, but poking someone in the rib might be. More relevantly, implied licenses to access property are defined by reference to what a normal person would consider implied. So an invitation to enter a store implies…

> But lots of things are legal or not based on what typical people would do or think.

Good thing computers use unambiguous protocols to communicate explicit intent.

> If you asked your mom, [...] That's what defines what is legal or not in this context.

I'm really terrified of a world where the law is made by asking laypeople what they think. Just like we don't define borders by asking random strangers on the street where countries are, I don't see how it's a good idea to define laws for technical services and protocols by asking people who barely understand computers what they think.

Re: Teenager facing prison for downloading unsecured files from government website

#457

Post by gnode » Tue, Apr 17, 2018, 1:26 PM UTC

maddyboo wrote: post #206

systematical wrote: post #170

Earlier quoted context omitted.

A bit more complicated than that but I am sympathetic to this persons plight. What complicates this is if the website had a Terms of Use policy, if not then outside of existing statutes I can't see how he is guilty. Even if their are terms of use, I think these are useless if I have not agreed before entering the site. All very confusing. The blame truly lies on the government for allowing such porous security. They…

Violating Terms of Use is not a crime [1]. 1: https://www.eff.org/deeplinks/2010/07/court-violating-terms-...

This example is not entirely equivalent. My understanding is that the opinion of the court was that authorisation (for the definition of "without permission") cannot be decided based on method of access. I.e. if you have granted a user access to data, you can't later say they accessed it without permission because they used a proxy or bot to access it (in violation of your TOS).

A terms of service can not define law, but it can make explicit what data a provider is authorising a user to access.

Re: Teenager facing prison for downloading unsecured files from government website

#458

Post by rootlocus » Tue, Apr 17, 2018, 1:29 PM UTC

foldr wrote: post #441

gtlondon wrote: post #439

Earlier quoted context omitted.

That's true. But as the person knows they are configuring a web server, I would say this is more carelessness / incompetence rather than an "accident" in the same way as losing a Diamond Ring would be.

Sure, but your carelessness doesn't absolve me of my crime. If you lose your diamond ring out of carelessness, it's still not ok for me to steal it.

> Sure, but your carelessness doesn't absolve me of my crime.

If his carelessness meant communicating that you could take the ring without stealing it (say placing it in the donation basket instead of his wallet), that would absolve you of your crime.

Re: Teenager facing prison for downloading unsecured files from government website

#459

Post by Sean1708 » Tue, Apr 17, 2018, 1:31 PM UTC

harryh wrote: post #271

ljm wrote: post #256

Earlier quoted context omitted.

I can see where you're coming from but you're also describing the purpose of an API, documented or not. Ultimately, if you want to secure the boundaries of your property (whether that's your app or your domain or your honest to god physical land) it's up to you. If you find yourself in the position where other people are revealing information you or your company should have protected then you are accountable. You hav…

The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.

I think that's a terrible analogy, a better (albeit not perfect) one in my opinion is:

If I request access to your house (send a HTTP request) and you grant me access (give me whatever I was requesting), I don't think I should be arrested for trespassing.

Re: Teenager facing prison for downloading unsecured files from government website

#460

Post by loup-vaillant » Tue, Apr 17, 2018, 1:39 PM UTC

rootlocus wrote: post #455

iamnothere wrote: post #437

Earlier quoted context omitted.

Well maybe you shouldn't be using antisocial hacker tools like DownThemAll! An ordinary user would never use such tools. /s Incrementing URLs by hand is one of the ways I learned about how the internet works, as a young kid. Kids are curious. This is normal behavior!

Well, some people believe being curious and trying things out is not what "normal people" do so it's "antisocial" and you shouldn't do it. I remember a teacher yelling at me for trying some slightly advanced features in a hardware design language. I was really proud I could implement something I didn't thought possible, but her reaction was along the lines "Do you want attention? Why can't you just stay quiet and do…

Reminds me the first time I got to touch a word processor. We were supposed to insert a picture with the "clip art" feature. I made a mistake and inserted a "graph" instead. An empty graph, with grey hashed borders, that I didn't know how to delete or undo at the time. So I asked for help.

> Aaahh, he crashed my computer!

Went the teacher. Which then swiftly closed my unsaved document. 15 minutes of work, gone. As well as any remaining trust I had for her. I had done something unexpected, and she was afraid.

I don't think I was quite able to articulate it at the time, but she would have made a fine witch hunter. I do recall a sense of unpredictability though, and reminded myself not to step on that tiger's tail ever again.