Teenager facing prison for downloading unsecured files from government website

Post by CalRobert » Tue, Apr 17, 2018, 1:57 PM UTC

rootlocus wrote: post #398

rayiner wrote: post #186

Earlier quoted context omitted.

The computer is not a person and what it does only matters insofar as you may infer that the owner of the property programmed it to do what the owner intended. As you admit, the property owners did not intend those documents to be accessible. So the only relevant question is: would a reasonable person infer that documents which could only be accessed by editing a URL (by "tricking the HTTP server," if you insist on a…

> I think most people would assume that documents that can only be accessed by editing an ID were not meant to be accessed. And that really is the end of the analysis. You do realize HN provides an API that allows you to request any item by using an ID? [1] Stories, comments, jobs, Ask HNs and even polls are just items. They're identified by their ids, which are unique integers, and live under /v0/item/ . If you real…

Post by harryh » Tue, Apr 17, 2018, 1:58 PM UTC

fenomas wrote: post #360

harryh wrote: post #333

Earlier quoted context omitted.

Servers don't grant access. People grant access. People can make mistakes and set up servers to mistakenly allow access to things. Making a mistake doesn't revoke someone's property rights.

> Making a mistake doesn't revoke someone's property rights. This is a non-sequitur, nobody is saying anything about anyone's property rights being revoked. The teen asked for access, and the content owners, via the permissions they had configured, granted it. Sure they can later decide that this was a mistake, but that doesn't make it theft for the teen to have asked for access.

Post by harryh » Tue, Apr 17, 2018, 2:02 PM UTC

fenomas wrote: post #356

harryh wrote: post #278

Earlier quoted context omitted.

Dumpster diving is legal (in most places but not all) because the owners has, by putting something in the trash, expressed their intent to not own the item in question anymore. A website isn't a trash can though. If I accidentally leave a diamond ring (or personal files) in public somewhere and you take them that is absolutely theft.

A web server is a thing people use to make files publicly accessible - it has no other purpose. It has stronger expectations against privacy than a trash can. As such, your analogies to situations (locked houses, unattended jewelry) with the opposite expectation just disprove your point. Assuming a file is private even though it's publicly accessible on a web server is as nonsensical as assuming an object is free for…

Post by harryh » Tue, Apr 17, 2018, 2:07 PM UTC

Sean1708 wrote: post #459

harryh wrote: post #271

Earlier quoted context omitted.

The guy who found the problem or abused it is not accountable. This is clearly wrong. If I forget to lock my door when leaving my house one morning it's still trespassing if you enter the house without my permission.

I think that's a terrible analogy, a better (albeit not perfect) one in my opinion is: If I request access to your house (send a HTTP request) and you grant me access (give me whatever I was requesting), I don't think I should be arrested for trespassing.

Post by harryh » Tue, Apr 17, 2018, 2:12 PM UTC

phaemon wrote: post #397

harryh wrote: post #348

Earlier quoted context omitted.

Can you please send me a copy of your last 3 tax returns? My email address is in my HN profile. I don't know you have don't particularly care about your financial situation, so I'm not gonna read them or share them with anyone else. I'll just keep them on my hard drive.

> Can you please send me a copy of your last 3 tax returns? Options: A) Sure, here you go. Oh wait! I didn't mean to send you those. You tricked me and stole my information. I'm going to send 15 police officers round to arrest you and then you're going to prison for years. B) No, that's confidential. ^^ Which option do you think is more reasonable?