Slashdot Mirror
Busted for (L0pht)Crack Possession
TaoJones writes, "Seems like the city of Hopkins, Minn. has declared L0phtcrack illegal. The story from Channel4000 details 11 felony charges against one David Thomas Bell, including two counts of "possession of burglary or theft tools"... namely L0Phtcrack.
" What next? Debuggers?
When I was in my lockpicking phase (anyone have a link to the MIT Lockpicking Guide?), I learned an important point:
Having lockpicks isn't illegal. Using them in conjunction with a crime (breaking and entering, robbery, etc.) is illegal and a separate charge.
There is no difference in having cracking tools. If I'm not cracking anything, then it doesn't matter. A quick look at the article indicates they were using those tools to crack machines. Thus, a separate charge.
-- Ever notice that fast-burning fuse looks exactly the same as slow-burning fuse? I didn't... (Edgar Montrose)
They were NOT busted just for possessing lophtcrack, they were busted for stealing usernames, passwords, and customer lists.
Just like there's nothing wrong with owning a crack pipe until you get caught with crack, there's nothing wrong with owning crack() until you get caught cracking.
--
blue
i browse at -1 because they're funnier than you are.
I think this is akin to carrying a screwdriver. You can use it to fix a lock, or you can use it to break a lock, enter a building and steal the contents.
Let's not get too sensationalistic here..
ekk
Read closely and you may not feel so sorry for them. They used L0phtCrack as a tool to commit a crime, rather than to secure their own networks.
L0phtCrack is a legit tool and is legal, HOWEVER, should you use that tool, it could be called a tool to commit a crime. If he had done a physical entry they would have called his power tools, should they have been used to break in, as theft tools. Its a way to add on years (or the threat of) to their possible sentance. Somehow this is supposed to deter other criminals. Don't ask me if it works or not. I don't have a clue.
"These crimes were the high-tech equivalent of physically breaking into a business and stealing valuable documents from a locked file cabinet..."
People need to learn that the two simply don't equate. Stealing means that a victim does no longer have what was once theirs. Breaking into something means physically harming a device intended to prevent entry for the purpose of extracting data.
Neither of these things apply in this case. I understand that IP works differently, but we're going to have to work on the laws to make them apply. "[P]ossession of burglary or theft tools" just don't cut it.
-Waldo
The summary of the article provided as the blurb here on slashdot, right down to the very title of the article itself "Busted for (L0pht)Crack Posession" is extremely misleading, and I have to wonder if it's deliberately so?
I'm not usually one to come out and accuse the
The article says they were arrested and charged with 15 felony counts not for posession of L0phtcrack, but for repeatedly hacking into the computers of their former employers to steal lists of usernames and passwords. This is illegal, and no new news.
If we could moderate the articles themselves, I'd moderate this one down as Flamebait or Troll.
Anthony
"I think any time you expose vulnerabilities it's a good thing." -Attorney General Janet Reno
I realy get tired of seeing claims like this from companies "They said that the user IDs and passwords provided access to proprietary information valued in millions of dollars, and they estimated the cost of issuing new user IDs and passwords at approximately $12,500. " Explain to me how in god's fucking name can someone justify that much to reissue new id's and passwords? The only way I could see this being an issue is if this also required email addresses to be changed and there was lost business messaging. Maybe costs related to notifying people of new email addresses? Some please explain to me how this number can be justified.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
The problem comes because there is a level at which something isn't dangerous enough that it needs to be illegal. Obviously we can't use the argument that something MIGHT be used to harm someone, therefore it should be illegal to possess, since just about any piece of matter in the universe could be used to hurt someone in some way. (Ban books, because big heavy ones can be dropped on people from ten stories up!)
The point is that we eventually do draw a line somewhere. However I don't think that, in general, things that aren't intended for causing injury to other people should be illegal. (Burglary tools, for example, or cracking programs.) I say SHOULD because, in general, things that aren't intended for harming people are NOT illegal. So why should software be any different? The only way I can see this being justified is if the software is designed to circumvent safety locks/overrides on, say, an elevator, or the air traffic control system, or a nuclear reactor -- things that, if they break, will almost certainly cause injury. And much as I appreciate and agree with the old saw about cracking to show that the security is weak, when people's lives are at stake, I don't think it holds up any longer.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
Okay yeah, Rob went a bit nuts with the summary so we need to give him a collective good kick in the ass. Someone set a date/time in Zulu time and I'll be there.
anyway, I'm puzzling over the fact that the company states that it will cost US$12 500 to issue new logins and passwords? WTF? Depending on the size of the company, it's going to be an administrative bitch, but it's nothing terribly difficult and is basically a time is money issue.
Are they embellshing for effect, or are they just morons?
----
----
Am I the only one who thinks Microsoft is a misnomer? Perhaps Macrosoft would be a better fit?
after reading the article, these people were not just busted for possesion of l0phtcrack. they were busted for illegal activities and for the possesion of the tools that they used to commit those illegal activities.
this is not only irresponsible, but sensationalistic on the part of cmdrtaco.
That depends on where you live. Where I live having 'paraphernalia' used to be legal. Then they made it so that it was legal until it was used (IE contained 'residue'). Now it is illegal to posess at all. Technically zig-zag type rolling papers and old-man type tobacco pipes are illegal under the current laws. Of course those items are sold openly at tobacco shops and drug stores, etc. Old geezers would never get bothered about possessing such things. The law isn't applied uniformly of course. If someone who is say under 40 had such items, they would likely be considered dangerous contraband. The owner of a local t-shirt/music store was busted on drug paraphernalia charges for selling the same zig-zag papers that are sold openly at the local Walgreens drug store.
Back on topic: While in the case at hand, the person getting busted may have actually used the tools for unlawful purposes, it may be only a matter of time before someone else is charged with only possession of tools. Not every jurisdiction makes sane judgements about such things, even ones who might on other issues. Heck, sometimes such things are strictly related to election year politics (the 'head shop' crackdowns tend to happen in years the county prosecutor is up for re-election). Coincidence?
The point is, this is one of those slippery slope issues where once things start downhill, it is very hard to get back up again.
If I murder somebody with a rock, I should get charged with murder, not possession of a rock.
The issue that I see is that many many programs can be exploited manually. What if you have a vulnerable network daemon and the attacker uses nc to feed it input. Is nc illegal then? How about if somebody writes a trojan in C, is the compiler illegal? the linker?
I'm not attempting to be difficult, I just fail to see the point of criminalizing a particular password recovery tool moreso than other methods of attack. If the alleged crimes are true, then I have no problems with them going down for what they did, but I don't see the how as being particularly relevant.
----------------------------
This comparison of murder with a rock was covered elsewhere (look for someone talking about crowbars).
The point is that you're also charged with murder. Should you get out of the murder charge for some reason, there's still use of a deadly weapon. I'd bet there would be a string of charges should you kill someone with a rock.
L0pht crack when used to steal passwords is illegal. This doesn't make the compiler illegal, much like using a grinder to make lockpicks doesn't make the grinder illegal. It's the picks and using them in a crime that is.
It's just that the laws in this jurisdiction are probably broad enough to cover this. See my earlier comments for the laws in MA (which appear to be tighter). The DA/prosecutor is probably savvy enough to know cracking technology.
-- Ever notice that fast-burning fuse looks exactly the same as slow-burning fuse? I didn't... (Edgar Montrose)
"when it gets down to specifics the police that I know personally err on the side of caution"
I have to concur. When a police officer recieves a complaint or sees something suspicious, the first thought is to take care of the situation as quickly as possible by using whatever methods they have at their disposal.
These include:
Speaking to the subject(suspect)
Confiscation of item(s)
Arresting the subject(suspect) or taking the subject into custody (these are different things, of course).
Shooting or disabling the subject (almost always a last resort).
Anecdote:
In the State of Illinois, all knives are legal besides switchblades and ballistic knives (knives which shoot the blade). Butterfly knives are (and contrary to popular opinion), last I checked, legal. So, by extention, swords are legal. So, standing out in your front lawn with a sword, chopping on your own tree is legal.
A friend of mine did this.
And when the police officer came by, she confiscated the sword. The reason the officer was called was because an elderly person across the street called and complained.
After some hassle, including threatening legislation, he got the sword back.
So, the sword is not illegal.
However, if he went over and threatened the elderly person who called with the sword, that would be illegal, and the tool would be rightfully confiscated. Same thing if he chopped her head off.
I hope this wasn't that confusing.
later
Dan