Reuters Accused Of Hacking For Typing In URL

Aexia writes "Intentia International, a company in Sweden, is suing Reuters for publishing an earnings report posted on their website prior to its official release. The catch? The report couldn't be accessed through 'normal channels', you had to know, or guess, what address to type in order to retrieve it. The precedent this case sets will be interesting. If you don't use a hyperlink on a website, are you committing a crime? You can also read Intentia's take on the situation."

Comments

Stating the obvious

[Bartmoss]

It could have easily been protected by .htaccess or whatever. So, they have no case. Let's hope Reuters won't budge, and the judge will have a clue.

Re:Stating the obvious

[MalleusEBHC]

A store can easily be protected by purchasing video cameras. That doesn't make it legal to burglarize a store that just uses lock-and-key.

The problem with your analogy is that they didn't even use a lock and key. Their doors were open for business and now they are getting mad that someone came in before they could put up the big neon "OPEN" sign.

Re:Stating the obvious

[SmallFurryCreature]

The analogy is I think fundamentally flawed. It is more like peeping. Did reuters go to extra ordinary lengths to peep in on data that the plaintive could reasonably have expected to remain hidden?

People walking by in the street can not be charged with peeping if they see you walking naked in youre house. Not even if they have to turn their heads to do it. Simply claiming that since you are doing it in youre own house you are supposed to have privacy is not valid. You have to draw the curtains for the expectancy of privacy to be granted.

Now the question is, did they have the curtains drawn. I personally think not. It will be intressting to see what the law has to say about it.

Re:Stating the obvious

[Anonymous Coward]

Yeah sure... the God_Almighty_Law should enforce what lazy admins don't...

Note: this post wasn't mean for being read. If you've read it nonetheless, prepare to be sued.

Re:Stating the obvious

[Pastis]

The analogy with a store is completely incompatible.

A web site is not a store. A web site is like the window of a store.

If you go and look at the window and see something half hidden in a corner, something that was not supposed to be left seen to all, at least not yet, you shouldn't be blamed.
If the shop owner doesn't want you to see it, it lets it in the storage room.

'nuf said.

Re:Stating the obvious

[dpt]

It's not really a question of security.

They published the document by putting it in a directory that the web server could access. They made it available. They took an action to release it.

Re:Stating the obvious

[evbergen]

data that the plaintive could reasonably have expected to remain hidden?

He could not. If you put something on a /public/, passwordless directory of a webserver, then he has no grounds whatsoever to believe that it would remain hidden.

It has nothing to do with peeping either. There's no 'smaller hole' you have to go through technically in order to obtain the requested document from the server. http://www.company.com/secretreports.html is just as available as http://www.company.com/index.html. Site portals are just yellow pages that help you find those URLs. Am I forbidden to dial a phone number that I didn't find in the phone book?

If you want to protect a secret and assume that something will remain hidden, you need to take /reasonable/ measures. /Any/ person with /any/ knowledge of computers and networking will say you /at least/ need username/password protection.

Re:Stating the obvious

[Sancho]

This case is actually symptomatic of a much larger problem that the US (and the rest of the world, from the looks of it) face: using the courts and your clout to cover up your mistakes. It seems like it's gotten to the point where if something happens that you don't like, you sue someone. Doesn't really matter who. Filing a suit has become a method of saying "We did nothing wrong, in fact we were wronged." even when in many cases this is simply untrue.
This company clearly messed up. A news agency got some information (and not by hacking!) and published it. The information wasn't fraudulant. If it was false, it wasn't with a disregard for the truth--after all, it was in a document on the company's website. But the company in question didn't like the fact that the information got out, so they sue the news company.

Forget terrorism and its effect on "free speech and free press" (right now a mostly US-centric concern) the real danger is big budget corporations who have the money and time to spend taking you to court because they didn't like what you had to say. It's scary, folks, and it's not getting any better.

Re:Stating the obvious

[catfood]

The plaintiff did not have the metaphorical curtains drawn. There was no realistic way to know the report was supposed to be hidden. The lack of a hyperlink to that report could mean a million different things--they forgot to add the link, they were publishing the report's URL in meatspace media, the link was in a place the defendant didn't know about, the link was propagated via email (hence not visible on any website), or whatever.

But there's only one good way to tell people to stay away from a given web document--the 403 response code.

The simplest common-sense defense would be to remind the court that the plaintiff's server gave a 200 response code. Defendants asked for a document and plaintiff provided it, where is the tort?

Stupidity

[e8johan]

Quotes are from Intentia's press release concerning the investigation.

"Reuters News Agency Broke into Intentia's IT Systems"

I would not call it breaking in to surf on someones homesite.

"there was an unauthorized entry via an IP-address belonging to Reuters"

What do they mean, do I have to call them and ask for permission before accessing files publically available on their homesite?

As Reuters didn't steal anything, but simply pointed at on open window (that they found) I would have to say that their act was not illegal. What they should investigate is their internal safety policies, because they need a revision or two (IMHO).

Re:Stupidity

[Jezza]

Well yeah that's right, if you don't protect the information (and "not making the URL public" isn't protection) then you have to realise that people can look. I can't see what they're expecting to gain by this. All they have done is make the information MORE visible and highlight that they have NO CLUE.

Once this information was in the puiblic domain then I think their best policy would have been to do nothing, perhaps just issue the information with the best spin they could.

Taking them to court seems like a REALLY BAD idea.

Nothing to do with links.

[tunah]

If you don't use a hyperlink on a website, are you committing a crime?

It's not about the existence (or not) of the link, but the source of the URL. While I don't agree with it, I think what they are saying is that if a site doesn't publish a URL (usually through a link, but could be in print, etc) it is not public information and accessing it is unauthorised access. This is the same attitude (if not specific issue) that has a problem with deep-linking too.

that's cold man.

[xirtam_work]

anybody who strays from the 'garden path' of links provided shouldn't be deemed a criminal.

However, it depends upon what you do with this so-called unpublished material.

What Reuters did exposed the company to a situation before they were ready. Seems to me like the company should have taken more adequate security such as using htaccess passwords, etc.

I court I hope Reuters don't get busted for accessing the information, but for publishing details about it. After all I'm sure that the company in question had a copyright notice on all their pages, right?

Re:that's cold man.

[dipipanone]

What Reuters did exposed the company to a situation before they were ready.

Which is precisely what you'd expect them to do, Reuters being a press agency and all.

I court I hope Reuters don't get busted for accessing the information, but for publishing details about it.

Damn straight. If it weren't for those goddamned financial journalists, I bet Enron would still be trading today. The freedom of the press has got no business interfering with our right to earn a dishonest dollar.

After all I'm sure that the company in question had a copyright notice on all their pages, right?

So what? Do you really believe Reuters breached their copyright in the report?

Get a jar of glue, man.

There are technical solutions

[toriver]

In my opinion, any HTTP GET request is exactly that, a request. "May I have that resource, Server Sir?". And if the server (which is the thingy that is responsible for allowing or refuseing the request) actually sent the requested resource/document back to the client, it has answered "Yes, you may" by responding with the resource.

If the publishers of the resource wanted to limit access to the resource they could add authentication, referer checking, or a timestamp check - anything, really. Since they did not, I fail to see how they can have a case.

"Security through obscurity", like having a non-linked but available resource, is self delusion.

Re:There are technical solutions

[sco08y]

"Security through obscurity", like having a non-linked but available resource, is self delusion.

That's one of those mantras that get repeated until people believe they're true.

Fact is, all security is obscurity. Security rests on the notion of a shared secret. Some key that both you and the other guy know.

In my opinion, any HTTP GET request is exactly that, a request. "May I have that resource, Server Sir?".

So if I add a login header, is that just another GET request? It's the difference between http://root:12345@www.0wn3d.com/ and http://www.0wn3d.com/.

Or what if I add an obscure folder name to the URL like sf908h234ff98hs9f?

You might argue that the actual crime was in obtaining the password, and I agree that (for example) fraudulently claiming to be an employee (psychological hacking) is criminal, but it's a seperate offense.

That's why breaking into someone's house is "breaking & entry." Even if you don't have to break in, entering is still criminal.

The problem with "ah well, these guys were just poking around, the publishers should have used proper security" is that it raises the bar of what security is to what we experts think it ought to be. Many people don't have the capability to employ such measures, so we're denying them legal recourse.

It would cause the same kind of division in society as if we had a law that said burglary doesn't count unless you have an expensive security system.

Re:There are technical solutions

[Twylite]

There are a couple of points being argued in these threads. You make a good one: it is a request, but it has undesirable side effects.

I would say that, legally, this situation could be viewed as some sort of cold caller. You may be offered a free holiday, or you may be offered an investment. Here, "you" is the web server. You get asked for your name, some information about you (content pages), etc, which you're happy to give.

Now you get asked if you want a free holiday. That's okay. You get the holiday, subject to terms and conditions you don't like, but there was no criminal misrepresentation. But what if you get offered an investment, which happens to be a pyramid scheme? Its offered as a sound investment, but its not -- that is fraud.

I would liken your example to fraud: it is a deliberate and malicious attempt to use a request/offer in a damaging way.

The original example (Reuters), however, is a more difficult case. In some ways its like asking someone what they earn, or what their social security number is, or their credit card number. Asking is not illegal, and if they give you the information you have obtained it legally. However, the manner in which you USE that information may be illegal! Having been given information does NOT give you the right to (re)publish it.

As such I would argue that what Reuters did is not hacking. They did not bypass any protection mechanism, they just asked intelligent questions. On the other hand, using such information may have been illegal (I don't know how they made use of it).

Re:There are technical solutions

[avajadi]

A very good way of describing the situation

Furthermore, it should be noted that the act of putting a document on a webserver inside the publicly accessible part of the file tree is an active measure.

An analogy to the physical world:

Let's say you run a library. It doesn't work like a normal library that lets people browse the shelves themselves, but they can go to a librarian and ask for books. Some books can only be given to people with certain credentials while others are available to the public. Would anyone find it acceptable to get sued for reading a book given to you by the librarian in this context? Probably not.

The only situation in such a context where I as a reader could find it reasonable to accept any liability for accessing any book would be if I had given false credentials for a book with limited access.
If I haven't done that, the fault lies with the librarian or his/her manager for not fulfilling their task properly.

/Eddie

Re:There are technical solutions

[j7953]

So if I add a login header, is that just another GET request? It's the difference between http://root:12345@www.0wn3d.com/ and http://www.0wn3d.com/.

No. In that case, you're trying to circumvent (by having illegally obtained or by guessing the password) a security measure. (Also see below.)

It would cause the same kind of division in society as if we had a law that said burglary doesn't count unless you have an expensive security system.

No. There is a difference between trying to receive information (i.e. trying to have it delivered to me), and trying to actively enter someone else's property. The breaking-in analogy is fundamentally flawed, at least as long as we're not talking about trying to circumvent any security that is installed (e.g. trying to guess passwords -- that would be trying to actively enter).

Also note that houses (and physical locations in general) usually make it quite obvious whether they're supposed to be public or private. All private houses, even if they have no locks or security systems, have an implicit security mechanism: doors. Even if they're unlocked, closed doors tell most people not to enter unless invited by someone opening the door, or by a sign that tells them it's public. Why do you think most stores have doors that allow you to look into the store, that have obvious "open" signs, and that sometimes even open for you automatically? It's a way of telling people that the door is, unlike most other doors, not intended to keep them out.

URLs, however, are all designed the same way, there is no obvious difference between private and public resources. The only way to recognize them as private is to request them and see if a password request will show up. And experience suggests that most URLs are public.

Making it potentially illegal to try an URL will get you into the same legal problems as trying to make a difference between precise links ("deep links") and generic links (links to front pages).

Some of the questions you'd have to answer are:

• If you have requested, by following a link, the resource /some/path/document, and get a 404 Page not Found error, is it legal for you to try accessing /some/path/ by changing the URL in your browser's URL field?
• Is it legal to type some domain name into your browser, even if it is not published anywhere? (E.g. you're looking for Foo Corporation's web site and try www.foo.com.)
• If you're currently reading /2001/some-report, and you think that the year 2002 record would be more interesting, would you not try to type /2002/some-report into your browser?
• If you're reading a structured document, e.g. an online book or a howto article, and you're currently reading /3-1, and you realize you'd like to skip chapter three but the "Next" link points to /3-2, is it legal for you to type /4 into your browser?
• If you follow a link and get a 404, and the URL looks like the webmaster simply made a typo, is trying to correct the URL illegal without permission?
• If any of the above is illegal, but someone did it anyway and then published the URL on his web site, without telling how he found it, is it illegal to click? To copy and paste?

I am a webmaster myself, and I do agree that there are some requests that are sent with obviously malicious intentions (e.g. requests for cmd.exe etc.). But I am also a web user, and I don't want browsing the web to become a legal risk simply because I know how URLs work and make use of that knowledge. Some web site operators seem to believe that simply because they intended their visitors to behave in a certain way, and didn't provide any means for the users to behave differently, that anything but what they expect you to do should be illegal.

There is a difference between an author telling you that it makes sense to read chapter four of his book before reading chapter five, and an author trying to put you in jail for reading chapter five first anyway.

Re:There are technical solutions

[nahdude812]

I'd like to draw an analogy here.

Some might say that a server is like a house, a proper house has a security system and locks. People are free to stand around on the sidewalk, and have a look at your lawn flamingo's, but they may not try to enter the house unless they have been given specific permission to do so, which would be implied with the giving of the security code and a key to the front door.

I prefer to think of a server as more of candy at someone's desk. Some candy may be sitting in a bowl on the edge of the desk where all may freely partake of it. Other candy may be locked up in their drawer, or failing drawers, at least hidden from view. Unless you've been given specific permission to have candy locked up in someone's drawer, you may not have any. Someone wishing to protect their candy needs to do this. Simly placing a blank sheet of paper over the "protected" candy bowl is *not* sufficient to indicate that you don't want people to partake of that candy.

What that breaks down to is that having an easily guessed URL as the only obscurity to protect sensitive information (eg, http://server/2001-report/ with the sensitive one at http://server/2002-report/) is only a blank sheet of paper, it does not indicate that the information in 2002-report is sensitive. If they wished to protect their information, they should use whatever security means are at their disposal, which you're right, may not include technical know-how, but it *does* include the common sense know-how of at least making the URL http://server/randomstring/.

In my mind, the real issue here is that the "attacked" company failed to sufficiently indicate that the information was sensitive. It's very easy to imagine that Reuters was browsing for the report, couldn't find the link, so did what I myself have done countless times, assume that the information is intended to be public, but that some error has prevented it from being displayed that way (a sheet of paper fell off the shelf on top of the candy bowl), and so simply changed a 2001 to a 2002, and removed the sheet of paper.

Re:There are technical solutions

[Tokerat]

The very design of the web lends itself to such flexibility and open-ness with regards to URLs. As such, the technology that drives the web also allows for these sort of situations to be accounted for. In fact, under current law (erm, the DMCA i believe, at least in part :-\ ) it is illegal to do anything on your list if and only if the administrator of the server took actions to prevent you from doing it.

• If you have requested, by following a link, the resource /some/path/document, and get a 404 Page not Found error, is it legal for you to try accessing /some/path/ by changing the URL in your browser's URL field?

By all means it should be. The URL is just a location. Any use of the URL for "security" purposes isn't really much of a solution, as there are better/less revealing methods for implemeting security checks, such as HTTP Auth. and Cookies. If you wish for a directory to not be listed, add an index.html to it with a "denied listing" message, or better yes, switch auto-indexing off on your server, which will result in a 404 error every time if this is attempted.

• Is it legal to type some domain name into your browser, even if it is not published anywhere? (E.g. you're looking for Foo Corporation's web site and try www.foo.com.)

Once again, it very well should be, unless that domain is restricted somehow. Any website that leaves access open and free to all is just that: open and free to all. It's like a big, open field anyone can walk into. If you want your site to be restricted, web browsers and servers provide the capability to "put a fence aroudn that field", i.e. authentication methods and sessions, again through HTTP Auth and Cookies.

• If you're currently reading /2001/some-report, and you think that the year 2002 record would be more interesting, would you not try to type /2002/some-report into your browser?

If the site owner woudl not liek to allow this (i.e. you must pay for each report, or maybe you must view them in some order so as not to get the wrong idea about something, who knows) once again sessions and auth methods are availible, and also check the HTTP_REFERER, make sure the page in question is being accessed only from an authorized source. This also prevents deep linking, and through the use of logging can even report "offenders" to the webmaster. Of course, if they can't access your site, there is no need to take legal action against them, a nice friendly e-mail explaining not to deep link will sufice for most.

• If you're reading a structured document, e.g. an online book or a howto article, and you're currently reading /3-1, and you realize you'd like to skip chapter three but the "Next" link points to /3-2, is it legal for you to type /4 into your browser?

As long as there is no reason for the site to be restricting you from chapter 4, again the responsibility of the webmaster. If you want to keep people out of a room, you should lock it. It doesn't matter if it's illegal for people to go there, at the very least someone will wander in on accident. We dont' depend on laws to tell people not to rob our houses, we lock the doors so people can't get in.

• If you follow a link and get a 404, and the URL looks like the webmaster simply made a typo, is trying to correct the URL illegal without permission?

I would certianly hope not...

• If any of the above is illegal, but someone did it anyway and then published the URL on his web site, without telling how he found it, is it illegal to click? To copy and paste?

It's illegal for him to tell you, and if the webmaster took any precautions to keep the URL save other than "obscurity" then your actions are illegal too. However, if the URL is simply open for the taking, there is nothing that can be done about your clicking or copy + pasting. This is where the web differs from real life. If someone trold you "Hey, go through this hidden door and take what you want!" it's illegal. By the very nature of the web, any door left open is an invitation to the public. Webmasters need to be less lazy and realize this is the way it is, and they need to take protective measures for sensitive data.

Hope that all made sense, I am late for class so no time for revision! *runs*

if Intentia prevails, it would be very bad

[g4dget]

Many people truncate URLs to avoid dealing with broken site navigation systems. Mozilla and Galeon even have an "up" button. Other pages may become unlinked but may still be linked from a log or search engine. Some files, like /robots.txt, are almost never linked to, yet everybody knows they are there. And more than once, I have mistyped a host name along with a URL and gotten a web page that looked not entirely public (logs, etc.).

In some areas of law, it's unavoidable drawing fuzzy boundaries and considering intent. However, in this case, anybody who wants to protect their information on the web easily can, using standard web access control schemes; they don't need to rely on using obscure URLs. Let's not burden the courts with this.

This is part of a more general and disturbing trend, where lazy system admins don't spend the time set up their systems correctly, or management hires incompetent and cheap staff, and then try to use the court system and police (i.e., taxpayer money) to make up for their own shortcomings.

Mantra

[RAMMS EIN]

Repeat after me:
If you don't want people to read something, don't put it on the Internet.

of course not

[ferrocene]

It's not hard to crawl a website, such as search engines do all the time. Yet I bet they're not going to sue google which undoubtedly had a cache of the site before it went public (robots allowed, of course).

And if your server is set to list directories, then it's already "serving" away all of it's pretty little files without much prodding (funny, how a server...serves...files).

http://www.intentia.com/w2000.nsf/pages/PR_5BBD3 A

" The investigation has shown that there was an unauthorized entry via an IP-address belonging to Reuters. The entry took place at 12:51 pm on October 24th 2002, prior to the publication of the interim report for the third quarter of 2002. At approximately 12:57 pm, Reuters published the first news flash giving information on Intentia's third quarter result, without prior confirmation from the Company..."The incident has severely damaged confidence in us as individuals and in Intentia as a company," says Björn Algkvist, CEO of Intentia International AB.

"We question the methods used by Reuters, and our judgement is that we cannot rule out the possibility of illegal actions. As a consequence we will file criminal charges regarding the incident," says Björn Algkvist.

"We will disclose to the Stockholm Stock Exchange all technical details on how the intrusion was made, which will allow them to share this information with other listed companies, so that actions preventing similar events in the future can be made," concludes Björn Algkvist. "

Tip for the Swedes over there at Intentia International:
"chmod --help" -or-
"mv --help"

If an unauthorized page isn't met with a 404 or 403, you did somehting wrong.

url's are like phone numbers

[phr2]

Deep linking has the same issue. URL's are like phone numbers.

The company homepage, www.corp.com, is like the main switchboard number, say 555-1000.

URL's reachable through the home page (www.corp.com/foo/bar) are like internal extensions you can find through the voice menu system (555-1357).

The link with the earnings report is like an extension (555-2468) not on the voice menu, that came off somebody's business card or answering machine or some unknown channel.

That's it. Reuters is being sued over something very much like calling an unlisted direct phone number inside some company. How they got the phone number is, well, irrelevant. They're a news organization, they have reporters, whose job is digging up info like phone numbers.

Deep linking works the same way for anyone else too, of course. Like duh, if you don't want something to be reachable without going through the switchboard, don't give it a direct number exposed to the outside world.

Definition... and metaphorical example...

[httpamphibio.us]

It depends on how you define hacking... if they had no inside information about the URL, then yeah, guessing the URL would be a type of hacking but, I don't believe, one that could be punishable by law. For example, if I put an object I own in a public place... say, some place where the object is hidden but could be found if somebody was looking for it. Then a couple days later it's gone... is that theft? Sure, but, again, I don't think it can be punished. One of those "you should have known better," examples.

Mod parent up

[JanusFury]

A very intelligent point. They didn't hack anything, they asked for the document, and the server gave it. They have absolutely no case.

Look! A snake!

[adolf]

Funny stuff, this.

I'm going outside, right now, with copies of some of my own financial statements.

I'm going to throw them onto the Main Street sidewalk, and stand just near enough to the pile that I can serve hastily-drawn lawsuit papers to anyone who dares to look.

The documents are undeniably my property, after all. Nobody has the right to see them unless I erect a big fucking sign pointing them out, even if they are scattered about a public walkway.

[Moral for the sarcasm-impaired: If you don't want your information to be public knowledge, now or ever, don't let it be publicly available. At all.]

Re:As the adage goes

[trezor]

In the news-business it's allways about speed. Beeing the first one bringing the news. Getting authorised the rights to publish something thats allready on the web would seem like a waste of time in any case in this business.

If I found a page on the net, which seemed relevant to my news-page, I'd link it and not check if it's ok. It's allready on the web, right?

And anyone clueless enough to put sensitive documents accessable to the public should suffer the consequences. Maybe he'll learn.

unlisted numbers

[cosyne]

In other news, dialing unlisted phone numbers without the express written consent of the number's owner is now a criminal offense.

Krikey. I just don't know where they find people this stupid. Same goes for this deep linking crap. Maybe people should have to pass some sort of test before they get to use the Internet. Otherwise the have to use AOL until they at least understand that anything you post to the web could be publically accessible.

email i sent the webmaster and investor relations:

[ferrocene]

From: "ferrocene"
To: ,

Subject: Re: Lawsuit @ http://www.intentia.com/w2000.nsf/pages/PR_5BBD3A

If an unauthorized page isn't met with a 404 or 403, you did somehting wrong. You have an incompetent webmaster. The proper way to remove a book from the library isn't to remove the card catalog, it's to remove the book.

-erik-

Intentia's mission statement ...

[ukryule]

Our mission is to pursue the perfect partnership, providing security in our customers' transformation to collaborative business models.

Which roughly translates to: 'we want to use the internet securely'.
They then put some confidential information on their public website, and sue the first people to read it ... Doh!

The Web is not a magazine!!

[Mnemia]

All these companies seem to think that the Web is like a magazine: their neat little layout is all anyone should be allowed to use. But they forget that the Web was intentially designed to facilitate deep linking and URL-typing for the purpose of transparent information exchange. They don't get to decide the layout and presentation of the data once they publish it so that it is accessible through an URL.

There is nothing about implicit permission to view here. I assert that they are EXPLICITLY granting permission to any and all to view the document when they publish it via a non-password protected URL.

That is the very foundation of the Web...without it we have interactive television.

Re:Related: what about referer logs

[isorox]

If their webserver is attached to the internet in any way, then anything it is "serving" is fair game, and should thus be protected appropriately.

While I'd normally agree, if its protected by some kind of protection (htaccess) - even if its really weak, accessing in would be cracking, same as if a door in a house is open, you still cant nick the TV.

Of course in this case google would have spidered the report before long and they cant prosecute an automatic robot can they?

better analogy

[sjanich]

The correct analogy to use here is not "it was an open window" or "a door that wasn't locked".

The correct analogy is the free information handout kiosk. Somebody put somthing at the Kiosk sooner then they meant to, but behind a different handout.

Completely disagree - form is the key...

[bildstorm]

I completely disagree.

From what I gather from the posts on here, it seems that these guys have a webserver with little to no security on it. If you use a basic webcrawling program, it likely jumps from link to link, which is what we expect AOL users to do online. However, a good web crawler will also check the directory by default as well, to see if there is an index (I've seen some of this in MY referrer logs).

Given that this was sensitive data, it should have been protected. Claiming that it was by not publishing the URL is like sticking it in a window of a building with thousands of windows. Eventually someone may see it.

Your analogy of the credit card numbers would be valid IF they had swiped a password to get to that point. But the server didn't ask for authorisation by any means. It was happy with a basic URL. There's nothing ultra-special about the URL to suggest that it's attempting to be hidden either. I doubt the location was intended to change, but to just be linked to.

Basically, Reuters has provided good reporting using the skills available to anyone with a decent wewbcrawler who has a set list of websites to follow. And if they didn't get it that way but got it through an anonymous tip, that's classic reporting.

Re:Raises some interesting ideas

[pubjames]

I could see a moldy old judge siding with them, saying that using "www.intentia.com/~a2eslcf/info/docs/hidden883/fin ancial reports.html" for example would constitute an attempt at placing some level of security on the data for the time being, almost a password....

Dumbass:But your honor, that man has stolen a hundred dollars from me! I think I made a reasonable attempt to hide it by keeping it in an old shoe in a hedge at the local park. Who would think to look there? ...what do you mean I'm a dumbass?

Re:analogies

[Anonymous Coward]

Exactly. This is equivalent to leaving a document pinned under a table on a street cafe (or under another note on a notice board). You're not advertising it's location, but if you find it, there is nothing stopping anyone from reading it.

A public web server is a publically accessable location, if you give out your "private" documents without access control, no matter how obscure your filing system, then you have no expectation of privacy.

How about another example:
I place an unmaned, unguarded, unlocked filing cabinet in times square. This filing cabinet contains information that I encourage members of the public to access. My bank account pin is stored in this filing cabinent under (SKGAKYG@&^KJH). Do I have any right to expect my bank pin to remain private? Does it matter if the filing cabinet is in a publically accessable area of my company? I would say no and no.

Re:Ridiculous!

[Anonymous Coward]

That Denmark case sounds very interesting, you have a link to details online about it?

Re:Related: what about referer logs

[gazbo]

No, Googlebot needs a link. If it is inaccessible through hyperlinks, Googlebot won't even know it existed. Of course, if it followed Reuters link then it would have found the report, but then that's the whole point of the legal action, isn't it?

Other possibilities?

[ctar]

Isn't it possible that Reuters had a bookmarked link to this URL? I know they say that it was unpublished, but maybe they had done redirection in the past, and Reuters bookmarked the redirected URL?

While it may not be illegal to actually view and read this information, its potentially creating a conflict of interest for investors. If this was an earnings report published before its intended publication date, people will trade off that information. This could create a situation similar to insider trading.

And regardless of this, if it is proved that Reuters did this intentionally, they are totally at fault. They know this information affects the markets, and that the information gives their clients a (potentially unfair) competitive advantage.

If Intentia had an obvious Earnings Report or financial press release procedure, Reuters should know they will potentially be held responsible for releasing false information.

What if this wasn't the final Earnings Report? Than Reuters would potentially affect the trading of Intentia stock based on false information...

Re:Related: what about referer logs

[sheriff_p]

OK, so in fact you're saying hacking is legal where not all the security precautions have been taken. And I'm allowed into your house to browse around if you forget to lock your windows. Get a grip.

Flawed Analogy

[Anonymous Coward]

That's why breaking into someone's house is "breaking & entry." Even if you don't have to break in, entering is still criminal.

Except a public webserver is nowhere near a private property. The page was put on a webserver in order to be published.

The best quote from Intentia's website

[bobdotorg]

"The incident has severely damaged confidence in us as individuals and in Intentia as a company," says Björn Algkvist, CEO of Intentia International AB.

Yeah - no shit Sven, IT blunders with sensitive information tend to do that.

But hey, just to make sure that everyone's confidence in your company is shattered, why don't you do the American thing and file a 'It can't possibly be my fault' lawsuit.

Re:Double standards?

[archeopterix]

It is funny how the Slashdot crowd can use double-standards. It is ok to get the files that are publically avialable from an internet-site, but it's NOT ok when direct-marketeers get their e-mail-addresses from their public websites. Funny that is... Of course... This *IS* slashdot..

What? As far as I remember, the general consensus (If there is such thing on Slashdot) was that if you don't want to be spammed it is your responsibility to protect your webpage from harvesting bots - use a fake e-mail address generator, robots.txt violation detector, whatever. Noone said it is bad to get email addresses from a webpage. Using them to spam is quite a different thing, but comparing spamming to getting an unlinked document is a bit far fetched.

Re:Related: what about referer logs

[D iz a n k Meister]

And I'm allowed into your house to browse around if you forget to lock your windows. Get a grip.

No, but I'm allowed to see in your house if you leave the curtains/blinds open.

Re:Raises some interesting ideas

[pubjames]

If you kept it in a hedge in your garden (i.e., on your property as this report was), and someone took it, they would still technically be guilty of theft.

Except (to streach the anology to its limits), a public web server is like putting a sign on your garden gate saying "Open to the public".

Public viewing

[plumby]

The closest 'real-world' situation that I can imagine is someone sat in a public place reading a document with "Top Secret" written on it. Would this document be considered "public property" as the person was reading it in a place where anyone could easily read it over there shoulder?

Re:Related: what about referer logs

[chrispycreeme]

I agree. I would add that Intentia International should have the burden of proving that there wasnt a link anywhere on the internet to the report. This is just silly.. If you put things on a public webserver, its public.

They published it!

[dpt]

This is clearly ridiculous.

They published it by putting it into a directory from which the web server could serve up documents. End of story.

The arguments about "but that means burglarly is allowed if you have no security" are completely specious. This has nothing to do with security. Through deliberate action, or even accidentally, they made the document publically available. It's as simple as that.

Re: Related: what about referer logs

[Black Parrot]

> While I'd normally agree, if its protected by some kind of protection (htaccess) - even if its really weak, accessing in would be cracking, same as if a door in a house is open, you still cant nick the TV.

No, the correct analogy is "if you stand naked in your doorway you can't complain about everyone seeing your naughties".

Like a badly run library

[Anonymous Custard]

you had to know, or guess, what address to type in order to retrieve it.

Does not listing a library book in the card catalog mean the book is classified, private information? What if someone released movie to the theaters, but didn't advertise or put the show times in the newspaper?

This is just a silly company wanting laws to cover their idiotic mistakes. It's easy enough to store your unreleased earnings report somewhere besides your live webserver.

Re:It is Lotus Domino...

[AlecC]

I went to their site, and I looked for the (now visible) results. The URL looked like this:

http://www.intentia.com/w2000.nsf/(files)/Intent ia _02_Q3_us.pdf/$FILE/Intentia_02_Q3_us.pdf

The previous quarters reports are also available under ...02_Q2_us.pdf and so on. This URL is a lot more than 40 characters, but it hardly takes a rocket scintist to guess where Q3 is going to be when you know where Q1 and Q2 are. You really cannot call such guesswork "hacking".

Re:Related: what about referer logs

[Xentax]

I'm not an expert on Search Engine Backends (IANA...ahh screw that).

But, wouldn't most search engines also at least try to grab index.html on directories in which they've found other files?

Of course, I doubt that's what happened here. From what I can tell on the "victim" website, Reuters just guessed what the URL for the report would be. Who hasn't done that before, in some way or another (e.g. guessing what a broken URL was supposed to be)?

There's clearly NO access control here, except a shining example of how security through obscurity is NOT security at all.

Xentax

Re:Compare to "Peeping Tom"

[AlecC]

> Reuters knew that it wasn't Intentia's intent to release that information (yet) but still persisted in obtaining and releasing it to the general public.

Unproven assumption. Reuters knew the URL it would be posted at, and kept looking at that URL until it appeared. Pecause it appeared on a public web server, they assumed it was published. Wrong, but how were they to know that?

This is illegal? Google/et.al. watch out...

[Veldcath]

I used to work at a company which used (at that time) a particular dynamic-content-management system (the name escapes me just now). At one point, one of the emails we received from a site visitor informed us that one of the big search engines had somehow (though no link existed to it ANYWHERE) managed to spider the admin page for that system... which was completely unprotected and included such information as our license key for this very expensive software.

To this day, I have no idea how that URL ended up on the search engine, but it just goes to show - if you want something protected, put a PASSWORD on it. Sheesh.

Or should we have sued the search engine for finding that link? Or the user who kindly reported it to us? Sorry, Europe. It looks like 'our' enjoyment of frivolous technology-lawsuits is starting to rub off...

Freedom of action on internet.

[too_bad]

When I type in an URL like www.comics.com I am essentially
"guessing" that this URL exists and contains what I want. If
it doesnt I move on. Essentially any URL I type in is similiar
to this. Now, www.comics.com cannot put their most confidential
stuff at this page and then sue me for not following links.
(links from where?)

There is no rule that accessing pages that are available to my
web-browser are violation of privacy because the web server is
present exactly for that reason: sharing what you dont want to be private.

The bottom line in this case is very simple. Its _my_ freedom of action
to type in _any_ goddamn URL I want, in _my_ browser.
If some moron in their company doesnt know the difference between
their web-share drive and the company private drive, they need to fire him/her.

The company site quotes: "The incident has severely damaged confidence in us as individuals and in Intentia as a company" and I am amused by this. YES thats perfectly true.
Any company that handles up such a vital information in such a careless manner
DOES NOT deserve much confidence or credibility and they are just proving
themselves that they are morons. But instead of accepting their shortcomings
they are raving like an infant.

I think the key to their charge is the allegation: "The investigation has shown that there was an unauthorized entry via an IP-address belonging to Reuters."
Which pretty much sums it up. Is it illegal to type in any url I want in my browser and
view the contents ? I just hope that the verdict is a slap in their face
and doesnt set any idiotic precedents.

They made it world readable - end of story

[MrByte420]

By defintion putting a file in a "world readable" directory and setting the permissions to allow world access kinda implies that you don't care who reads this. Otherwise - why in the world would you allow this kind of access? If you place it in a world readable directory, you have no businness complaing the world can read it.

Re:Related: what about referer logs

[Ponty]

Because it's more interesting to see an argument refuted than simply discarded. The people who simply reply with 'wrong' really annoy me: From interaction and conversation come knowledge and learning. A binary rejection system discourages interaction.

Re:Related: what about referer logs

[schon]

Thing is, Reuters didn't just "look". They published. Which, using the same analogy, would be looking into your house, and reporting to any and all passers-by what was going on inside.

Except that my house isn't a public place.

The report was put in a PUBLIC location. Therefore it's up to them to restrict access. Simply "not telling anyone" isn't restricting access.

The question is, "was it malicious?"

[StupidKatz]

Think hard about AC's question... they are both URIs that are typed in, and both produce undesirable (for the server owners) results.

True, AC's might exploit a flaw with the server itself while the one in the posted story simply access unlinked content, but how would one explain that to a non-technical user like a typical judge/jury?

Either way, this could turn into a bad, bad precident.

Re:Related: what about referer logs

[blueroo]

Wrong. You've had several of your published but unpublicized directories found. Once its on the webserver and capable of being served to the public, its published.

Hence the term "publish to the webserver".

Re:Related: what about referer logs

[shiflett]

A better analogy is whether it is illegal for someone to call me if I have an unpublished number.

Whether someone finds me in a phone book, gets my number directly from me, gets my number from a friend, or guesses my number, the actual phone call is the same.

These anlogies about open doors are misleading, because it is intuitive to think that one should not simply walk into a stranger's house, even if the door is open.

However, if the open door were to a store in a mall, you would probably not think anything was wrong with just walking right in or even telling others about what you saw inside (or where the store is located). Just because the store wasn't listed in the mall directory doesn't make it illegal.

You are all missing one piece about press releases

[Anonymous Coward]

It's a PR fact that all press releases have a "Do Not Release Before" such and such a date and time. No one, normally, would violate that. Press releases are typically sent out in advance, with that caveat. It's just normal courtesy to abide by the restriction.

So what Reuters did was smarmy, if guilty as charged. And the Swedish company didn't file a lawsuit against Reuters themselves, as the writeup claims. They reported the event and a criminal action is now pending, which means it isn't just between the two companies now. It's a government thing. What Sweden can do against a non-Swedish company depends on other, currently unknown (to us) factors.

In short, it's a morals thing. There's lots of things we can do, but we don't because it's wrong, even if technically possible. That's the real missing piece in the analysis: thinking that it's OK to do anything, if you know how and can.

Re:Related: what about referer logs

[Klaruz]

No, this is like walking into a company's public library and finding a book on a shelf in the corner that wasn't in the card catalog.

Whine and moan all they want, they still stuck it in a public place. They should have stuck it behind a locked closed door. Then it's secure. If you bust open the door, that would be a crime. Finding something sitting in a public place that's not advertised is not a crime.

Re:Related: what about referer logs

[5KVGhost]

No, Intentia published the information when they put it up on their web site. Reuters just reported what Intentia made publically available to anyone who thought to look.

Anyone who has a web site probably has unlinked pages hanging around, or directories excluded from indexing with robots.txt. The difference is that most of us are smart enough to realize that those pages aren't private or secure, just out of the way and unlikely to be seen. Intentia apparently has trouble grasping this concept.

If You Don't Want To Get Run Over...

[istartedi]

...don't play on the interstate.

If you don't want people to see your internal company data, don't put it on the Internet.

Got it boys and girls? Yes? OK, now we can have milk, graham crackers, and naptime.

What URLS did they use?

[Jump]

if they named urls like:

www.my.com/report2000.pdf
www.my.com/report2001.pdf

and the world is waiting for 2002 report, would it really be a surprise when millions try to download www.my.com/report2002.pdf one day before the actual release? Come on, _everybody_ would do that. Perhaps one should sue Intentia for violating some stock exchange rules by not protecting the data.

HTTP is a two-way conversation

[Anonymous Coward]

A store can easily be protected by purchasing video cameras. That doesn't make it legal to burglarize a store that just uses lock-and-key.

True. But people from Reuters didn't physically enter Intentia's offices against Intentia's will, and carry away paper documents. That's clearly illegal. What happened doesn't appear to be illegal, to me.

Reuters communicated with an automated system, called a web server. Intentia made this system publicly accessible through a system of computers collectively known as the Internet.

Using the internationally recognized communication language of that system, called HTTP, Reuters then conveyed a request to Intentia's system that Reuters wished to be sent information about Intetia's sales reports. Intentia had configured their automated system to grant that request to anyone who asked. The automated system then sent Reuters the requested information, just as Intentia's administrators had designed it to do. Intentia had the option configuring the system to refuse the request, but configured it instead to grant the request.

There is no evidence to suggest that Reuters misrepresented itself to the system, or tried to take something from the system that Intentia had not configured it to grant. In short, the sole claim of "hacking" rests upon the fact that Intentia didn't expect anyone outside the company to ask for that document. But as far as I know, asking for something isn't a crime.

It's not burglary if you ask the salesperson if they will give you something, and they choose to give it to you.

Disclaimer: I Am Not a Lawyer. I Am Not A Police Officer. I Am Not a Alien from Mars. I am Not a Flying Fish. "Mod Me Down If You Must, But..." Natalie Portman. Hot Grits. All Your Base. Karma. Insert Standard Slashdotism Here.

Score -5, Silly Disclaimer.
--
AC