Cracker Endangered Astronauts

DAldredge was one of a huge number of people that wrote in with the news that the BBC has reported that a cracker(s) endangered the lives of astronauts in 1997 by "overloading NASA's communication system". Charming.

Comments

Re:Two recent examples from Colorado

[coyote-san]

In retrospect that phrasing was poor. She was charged with felony murder, but the DA was pushing for the death penalty. The reasoning was that the gunman would have faced the death penalty, and since felony murder means all actors are equally guilty it follows that *she* should face the death penalty as well. So it was a capital "felony murder" case.

I find that reasoning dangerous... but I grew up in Florida (and had a HS classmate shot in the chest) during an era when the laws actually encouraged convenience store robbers to herd everyone into the freezer and execute them. Extending felony murder to include capital offenses for all is exceedingly dangerous - it means that instead of one person with nothing to lose you now have a carload of armed, desperate people with nothing to lose.

(My point stands, BTW. If the underlying felony was the burglary then the DA should have either charged all or charged none. To charge Lisl alone means that she and Mattheaus committed a felony that the others did not.)

Regarding "intent" - I don't disagree that intent is, and should be, irrelevant. My concern is the other half of the equation - casuality.

Nobody can dispute the causality of a death due to a stray bullet or fleeing (or pursuing) vehicle. I'm even willing to concede a causal connection between a bomb in a public space and a subsequent heart attack.

But I *don't* see a legally significant causal connection between someone helping to subdue a thief and a subsequent heart attack. I can't ignore the possibility that he was going to die that day regardless of what he did that morning, and that's enough to form reasonable doubt about the causal connection between the thief's acts and the subsequent death.

I might be willing to let this slide if the dead man was the victim -- but he wasn't. As I understand the situation he was a bystander who *choose* to get involved. He could have let the thief escape, or other men subdue the thief. What if he suffered a heart attack after chasing the thief (e.g., to get a description of his car?) What if he hopped into a car, pursued him, and died in an accident after blowing through a stop light or stop sign? At some point the victim *has* to bring on his own death by misadventure, instead of felony murder.

Finally, I know that suicide is *normally* an independent, intervening act that breaks liability... but that's not always the case. E.g., a recent case out of Orlando involved a woman who wanted to stop her daughter (IIRC) from refusing medical treatment (= a form of suicide) since the woman would then be charged with murder. (That also follows the ancient tradition that it's murder even if the victim survives, but dies from injuries within a given period - traditionally a year and a day.) My example was a bit more extreme, but that's the nature of slippery-slope arguments ;-)

Re:Involuntary Manslaughter

[TheCarp]

...but...as you SHOULD have known as a juror (which of course you arn't told)...the Jury makes final decision. It does NOT matter what the law says...if the Jury says Not Guilty...then not Guilty it is.

The Jury doesn't have to answer to anyone (unless it can be shown the the jury was tampered with). This is the whole reason a jury exists...it is the FINAL Check on the system.

In fact the Jury can even find a person innocent simply because they believe the law itself is wrong. This is a tradition that goes back to the very beginnings of the Jury system.

The law is simply a set of rules...luckily the people who made those rules realised that no set of rules will ever be perfect (too bad they didn't also realise that rules are a figment of our collective overactive imagination...just like power and order and authority...) and they built in a saftey catch (unfortunaly one that doesn't always work...partially because Jurors are not informed about the true nature of their charge).

In fact, these days I am sorry that I found a way to get out of jury duty. I refuse to vote (don't believe in it) or take part in most things,...but I realise now that the Jury *IS* the final check and balance. Its the one place where ordinary people, without the delusions of grandure and "con-artist" personalities needed to hold public office, can actually make a difference.

The next time I am up for it...I will serve proudly....I think. Actually...I have moral objections to the entire concept of sending people to jail...I don't know if I could find a person guilty knowing what was in store for them...stripped of their freedom to satisfy vengence, done in the name of justice.....sigh.

Two recent examples from Colorado

[coyote-san]

Two recent examples from Colorado:

1) Group burglarizes an apartment (supposedly one member recently moved out and was "retrieving" personal possessions - I don't recall details). Couple in one car is seen by police, pursued. Woman refuses to pull over when cop flashes his lights; male passenger fires gun at pursuing officer. Later, the woman is in custody when male fatally shoots a cop, then takes his own life.

I'm not sure what the underlying felony was (I though refusal to pull over was a misdemeanor),
but she was charged with CAPITAL felony murder. She was ultimately sentenced to life-in-prison, no parole.

2) A man attempts to rob a grocery store. A group of patrons subdue him and hold him for police. A few hours later one of those men suffers a fatal heart attack.

The DA makes noises about charging the would-be thief with felony murder since the man suffered a fatal heart attack as a direct consequence of the excitement and exertion he experienced that day. (I don't recall if the DA actually filed the charges.)

These cases have opened up a local debate on the felony murder statutes. IANAL, but the second case seems excessive - people die from heart attacks every day, and this sets a dangerous precedence. Could someone be charged with felony murder if a TV viewer suffers a heart attack after watching live TV coverage? What if a distraught victim subsequently commits suicide?

The first case is more consistent with the intent of felony murder statutes... but was strangely incomplete. The woman claimed that she was unable to pull over because the gunman threatened to shoot her if she did - and she had no way of knowing he would ultimately kill a cop. All she was trying to do was get some distance between them and the cops so he would stop shooting.

On the other hand, she did willingly participate in the burglary. On the gripping hand, none of the other people involved in the burglary (who were in a separate car) were charged with felony murder.

I didn't follow the case closely, so there may have been a legitimate underlying felony that applied to her alone. I, and many other people, are disturbed by the prospect she might have faced a possible death sentence because she offered a ride to the wrong person.

As for the scenario in question, the biggest issue seems to be jurisdiction. If one astronaut flips out and murders another, where is the trial held?

(Hint: the same problem occurs with aircraft and ships in international waters... and this "hacker" would be no different than someone on shore interfering with navigational gear that affects a vessel in international waters.)

Re:Two recent examples from Colorado

[brickbat]

1) Group burglarizes an apartment (supposedly one member recently moved out and was "retrieving" personal possessions - I don't recall details). Couple in one car is seen by police, pursued. Woman refuses to pull over when cop flashes his lights; male passenger fires gun at pursuing officer. Later, the woman is in custody when male fatally shoots a cop, then takes his own life.

I'm not sure what the underlying felony was (I though refusal to pull over was a misdemeanor),
but she was charged with CAPITAL felony murder. She was ultimately sentenced to life-in-prison, no parole.

This would be the Matthaeus Jaehnig case, from November 1997. The woman convicted of felony murder (not capital murder; they're two different crimes), Lisl Auman, enlisted Jaehnig's and a few others' help in grabbing her belongings from an ex-boyfriend's home. This was reported as a burglary (aka 1st degree criminal trespass, a felony), to which the cops responded. So it wasn't just the burglary, but the resulting flight from the cops that were used as factors in charging Auman with felony murder.

Felony murder law is nothing new; it has its roots in centuries-old British common law (though the UK dropped the statute many years ago). It holds that *anyone* involved in the commission of a felony that results in the death of a person is liable for that death, regardless of whether they were the murderer, or were even present at the time the murder occurred. Auman was already in custody before the cop was killed, but because she "initiated" the burglary and resulting flight, her hands were as bloody as Jaehnig's. As a result, Auman was convicted of first degree murder, and will spend the rest of her life in prison, without the possibility of parole. Did I mention she was just 21 at the time of her conviction?

Of course, the case isn't nearly as black-and-white as I've presented it here; you can go to a website set up by the Auman family to hear the other side.

IANAL, but the second case seems excessive - people die from heart attacks every day, and this sets a dangerous precedence.

Remember the bombing at the Atlanta Olympics? One of the casualties died from a heart attack. I'd say whoever set off the bomb is responsible for that death. There has to be a pretty direct cause-effect relationship between the crime and the death. Actually pulling the trigger is obviously the most direct. Fleeing from police, and putting them in the position of being shot by a lunatic with an automatic assault rifle, is not as direct, but the felony murder statute allows such connections to be made.

Could someone be charged with felony murder if a TV viewer suffers a heart attack after watching live TV coverage? What if a distraught victim subsequently commits suicide?

Last year, the mother of one of the victims of the Columbine massacre killed herself. Just recently, the star basketball player at the school also took his own life. Apparently he was a close friend with a couple of the victims. I won't be overly surprised if his parents sue the parents of Eric Harris and Dylan Klebold for wrongful death. Granted, that would be a civil and not a criminal action, but the issue of responsibility remains the same.

My view (and, usually, the law's) is that someone who initiates an action that is the direct cause of a person's death or injury is the person most liable. That would rule out most suicides--provided of course that you can show evidence of other factors that would indicate a person's suicidal intentions.

The woman claimed that she was unable to pull over because the gunman threatened to shoot her if she did - and she had no way of knowing he would ultimately kill a cop.

Prior knowledge is completely irrelevant in a felony murder case. There doesn't even have to be intent--if you're the wheelman in a bank robbery, you certainly have no intention of shooting a guard, but if one of them is killed, you're as guilty as your accomplices.

There are mitigating circumstances that should be considered, but that occurs usually in the sentencing phase, after a conviction. Apparently, in Auman's case, the mitigating factors weren't enough. And, in Colorado, the judge has little leeway in the sentencing guidelines--if it's first degree murder, the two options are death (if it's a capital case) or life without parole.

Murder?

[Uruk]

So, out of wild speculation just because I'm interested, if a cracker really screwed something up and the astronaut died as a result, is it murder? Manslaughter?

Cracking is all fine and good for 14 year old packet monkeys when they're doing it with each other's systems, but this is freakin' nuts.

BTW, why the hell are these systems even accessible in any way through the internet? I thought most of the government's really important systems had gotten hip to the fact that the only way to really be secure on the internet is to not be connected. And I can't imagine that the astronauts need yahoo stock quotes....

Re:Murder?

[levendis]

IANAL, but yes, this would be murder, or at least manslaughter, if someone died as a direct result of the hackers actions. What's the difference between hacking into a hospital computer and deactivating someone's life support, versus simply walking up to and clipping the cords with a bolt cutter? Just because the former was done with a computer doesn't make the action any less deadly.

Also, your question about why these systems were connected to the internet: first, you don't know that for sure, it may have been a dialup or even someone overriding the actual satellite link up. Second, its becoming more & more clear that everything is going to be on the internet soon enough. As we move to a fully "wired" and interconnected world, issues like this are going to become more & more serious. I have no doubt that pretty soon we will have to deal with the legal question of whether a cracker can be judged as a murdered.

Re:Involuntary Manslaughter

[spezz]

Perhaps we should have a new acronym to follow INAL. We could use BIWCS (But I Watch Cop Shows)

Just sayin' is all

Re:Involuntary Manslaughter

[TheNecromancer]

My guess, being a careful student of Law & Order and NYPD Blue (which makes me a legal expert, you know), is that he/she would be charged with Involuntary Manslaughter.

Sorry to disagree, but the hackers would be charged with 1st-degree murder, Party to a Crime. I was the head juror on a murder case where a guy arranged to rob his drug dealer, and in the process, killed him. The law read that if you intend to commit a crime, and another crime is committed as a result of your actions, you are responsible for both crimes. Since hacking into a government agency is considered a crime, if an astronaut died as a result of the hacking, the hacker would be liable for the death(s) of the astronauts.

It just goes to show that television courtroom shows are very inaccurate when it comes to the actual judicial system.

I knew it!

[gadwale]

A simple traceroute confirms two of my suspicions!

a. My ISP is far far away
b. NASA has definitely not isolated their systems!

1 gateway.cec.wustl.edu (128.252.21.249) 2.246 ms 2.006 ms 1.168 ms
2 border2-verio.wustl.edu (128.252.5.254) 15.746 ms 156.419 ms 200.945 ms
3 spaceship.nasa.gov (xxx.xxx.xx.xxx) 5.46 ms 16.41 ms 20.45 ms
4 controlcenter.nasa.gov (xx.xxx.xx.xxx) 3.27 ms 6.08 ms 3.12 ms
5 lifesupport.apollo13.nasa.gov (xxx.xxx.x.xxx) 15.746 ms 156.419 ms 200.945 ms
6 galileo.jupiter.nasa.gov (xxx.xxx.xx.xxx) 2.246 ms 2.006 ms 1.168 ms
7 206.220.243.49 (206.220.243.49) 16.222 ms 14.125 ms 16.237 ms
8 fullnet.okcity.good.net (209.140.161.2) 32.884 ms 34.316 ms *
9 edug.gadwale.com (216.226.24.76) 35.227 ms 60.082 ms 63.112 ms

Re:Isn't the shuttle comms system isolated?

[kzinti]

Yes, it is. All the data systems within Mission Control are isolated within a LAN that has only a couple of connection points to the outside world. These connection points are guarded by firewall hardware. The firewalls allow only outgoing connections, and only then on a couple of ports. The machines connected to the outside of the firewalls only have a couple of services enabled, and only allow connections out to a limited set of IP addresses.

Furthermore, all connections to the outside world -- both voice and data -- can be physically disconnected at the throw of a switch.

A couple of years ago, a group I work with wanted to enable a new "tap" into the MCC telemetry systems. We wanted to allow outcoming data only, and proposed the same kind of firewall protection used by existing connection points. It still took nearly an act of Congress to get our tap installed.

I've talked with NASA's information-security people, and they're nothing if not overcautious. They're not all technical geniouses, but they do employ some. For example, I know that they employ "white-hat" crackers to perform penetration tests of their systems.

So, are NASA's security arrangements foolproof? Certainly not, but I have a hard time taking that article at face value. The suggestion that a cracker from somewhere out on the net penetrated NASA's systems doesn't seem as likely as other explanations: That the reporter got the story wrong -- that the problem wasn't actually within MCC. Or that there was a problem, but NASA's technical people, unable to come up with the real explanation, invented a cracker to blame. Or even that the cracker existed, but came from within the MCC.

--Jim

Felony Murder

[sammy baby]

if a cracker really screwed something up and the astronaut died as a result, is it murder?

(IANAL)

It depends on how the perpetrator was charged. If charged with a felony (which is the likely scenario), then the "felony murder" rule is invoked. This states that any death which occurs as a result of the commission of a felony is automatically murder, not manslaughter. Examples:

• A shopkeeper catches you stealing a candy bar, flies into an apoplectic rage, has a heart attack, and dies. Since stealing a candy bar is a misdemeanor, you might be charged with manslaughter, but no prosecutor would bother taking the time to pursue it.
• A shopkeeper catches you stealing a candy bar, you pull a gun on him, and he has a heart attack and dies. Because armed robbery is a felony, and because your actions precipitated his heart attack, you can, and most likely will, be charged with felony murder.
• Same situation, but instead of having a heart attack, the shopkeeper flees out into the street, where he's hit by a car and dies. Because he was fleeing you and the big gun you pointed at him during the commission of a felony, you get charged with felony murder.

Re:Good thing...

[Cy Guy]

good. thing they aren't using NT...

Actually, per N etcraft they're running just about every OS you can name on at least one of their 456 publicly accessible webservers. A quick check of a few of them showed NT, Solaris, IRIX, and Linux.

When you put the sheer number of webservers they are running in perspective with 500k cyberattacks in a year, it means they are only getting about 3 attacks per day per webserver.

With all the possible points of entry, and inconsistent OS usage, I don't think it's surprising that a few backdoors were found.

Isn't the shuttle comms system isolated?

[luckykaa]

Wouldn't making sure the network was totally isolated from all other networks prevent this sort of thing from happening? I just don't see how this was possible in the forst place.

Is This Real?

[LaNMaN2000]

Astronaut Michael Foale, who was part of the 1997 mission, told the BBC he was not informed of the problems at the time but found the revelations intriguing.

You would think that the astronauts would be notified if there were sudden anomalies with their vital signs. At least an inquiry as to their status and a mention of the bad readings would be expected. I wonder if this is not just more PR designed to encourage stricter computer crime legislation and get NASA more funding for IT security.

Re:Involuntary Manslaughter

[rifter]

Interestingly enough, there is a group that proclaims a phone number, 1-800-TEL-JURY which prescribes the same thing. One important point made: if a jury believes the law to be unjust or unjustly applied, they can reach a not guilty verdict even if they believe without a doubt that the person in question committed the act.

Of course, juries are often instructed otherwise by judges and lawyers, and since they are often uneducated and rarely if ever legally educated, they are apt to listen. And for people with 1-800-TEL-JURY signs to be outside the courthouse has been counted as jury tampering in the past, and invalidated their rulings.

come next christmas...

[zyqqh]

Everyone, pick your favorite NASA official, and send him a little gift of "Firewalls for Dummies." Or "for Complete Idiots" -- did that come out yet?

Reuters Version

[Ex Machina]

The CNET version was the AP story. Wired has Reuters coverage of this.

Shouldn't have brought him

[dave]

Heh, I'm surprised that you left out the obvious parallel with the time Homer caused havoc by bringing potato chips into space with him.

Where's that Inanimate Carbon Rod when you need it? :)