Slashdot Mirror
Appropriate Punishment For Crackers?
Cally writes "There's a Kevin Poulson article on SecurityFocus reporting that the US Sentencing Commission is seeking opinions about the appropriate punishment for convicted system crackers and other black-hat types. On one hand, it seems absurd to ruin the entire life of a foolish 15 year-old for committing the equivalent of graffiti. Then again, perhaps these people are cyber-terrorists who should be illegally imprisoned, indefinitely, without a trial, charges, or legal representation? You choose."
If I'm the accused, I want a nice short probation...if someone cracking my website, then I want 'em hung, drawn and quartered...
Hacking a website is much more than graffiti. If you spraypaint the outside of wal-mart, people can still go in and shop. If you hack walmart.com and replace it with "shout outz" then wal-mart will probably lose hundreds of sales per hour to their competitors. That is very real money to these businesses. Hacking (cracking is breaking copy-protection) a website should not have the same punishment as violent crime, but it is definitely a more severe crime than graffiti, and deserves a much harsher punishment.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
I wanna know something. If someone (attempts to) breaks into your home (in the USA), you are allowed to shoot that person in self defense. Are you likewise allowed to take out anyone attacking your network?
Stop the brainwash
Cyber-crime is no different to ordinary crime. If the 15 year old 'cracker' writes his name all over a site (i.e. graffiti) he should get the same as a 15 year-old who scrawls all over his local shopping mall (i.e. fuck all or a safari or something).
If however he goes and steals 10000 credit card numbers and uses them to buy every back issue of playboy he should be locked up for a long time. With lubricant.
How about referencing recent hacker cases, and the sentences that were imposed. How about some information on the ages of the black-hatters. No, that would be relevant to the discussion...
Force them to use DOS for a few years. That should be painful enough
Cheap UK and US VPS
Murder ... life in prison or death (by state)
... 10 years
... 5 years
... 3 years ( -1 year for good behavior)
... 6 months - 2 years
... 20 years?????
... especially when the damage can easily be undone with last night's tape backup within an hour or two in most cases ....
... and take a little more responsibility for their Internet presence .... they spend tons of money on swipe cards, cameras, etc .... why should the think they are going to do less on the Internet???
... everyone else pretty much says "SHIT! ... then stomps their feet for a few minutes, laughes when they discover how the hacker got in, then rebuilds their system or patches it, and then moves on with life ...
...
Grand theft auto
Assult and battery
Theft
Throwing eggs or spray painting a building
Hacking a computer a defacing a web site
Does that make sence????
I don't want to encourage people to commit cyber crimes, but it seems as though our society's values are a little out of whack
Perhaps some of these coorporations that are so worried about this kind of stuff shold place a little more of the blame on themselves
BTW: I am pointing at the corps. because it is their lobbiests that are pushing for these rediculous sentences for cyber crimes
Just my $0.02 cents
HallmarkOrnaments.Com
I'm not sure why you need new sentencing guidelines for old crimes (theft, extortion, fraud, embezelment, etc...) committed using new technology. Why is a crime different because a computer is involved?
$G
-- $G
Personally I think we should take a page from Singapore's book and explore the latest options in caning. Nothing drives a lesson in ethics home more quickly than being beaten severely with a bamboo stick by a martial arts master. I would also view caning as an appropriate remedy for spammers violating anti-spam laws, telemarketers ignoring do-not-call lists, as part of a comprehensive package for the last round of fraud-perpitrating corporate CEOs and companies who file frivolous patent lawsuits based on laughable patents.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Cyber-crime is no different to ordinary crime. If the 15 year old 'cracker' writes his name all over a site (i.e. graffiti) he should get the same as a 15 year-old who scrawls all over his local shopping mall (i.e. fuck all or a safari or something).
Hey, cleaning up a mall is expensive, cleaning up a web site should not take more than the time to restore a daily backup...
If you don't have one, then it's high time you started.
Trolling using another account since 2005.
Coming from a person who has both an interest in network security (me) and graffiti (again, me), I have to point out that graffiti and network intrusion don't really overlap and here is why:
When a person writes on a wall (or a "reach"), the owner of the shop might show up and go, "oh crap" and they might very well pay someone a few bucks to cover it up or perhaps do it themselves. The artists' intention is clear -- to throw up some paint and that's it. The paint isn't going to seep into the wall and ruin everything inside, however. It isn't going to pick up the cash register and run off. It isn't going to take every customer's credit information.
When someone breaks into a system -- regardless of their motivations -- the breakee does not know what the intruder has in mind. Maybe it is benign, maybe it isn't, but there is no room to "let it slide." It must be treated as a malicious attack and thus computers must be shut down, customers/students lose services, huge costs in time and effort can and will be expended to purge the system of the problem which often involves what might very well be overkill -- like reinstalling a system or a number of systems because you Don't Know and you can't afford to leave loose ends.
Graffiti and network intrusion would be analagous if and only if graffiti caused the same sort of response. It doesn't.
And in case you're curious as to why I'd be into graf, check out these sites.
My
Limekiller
http://www.andrews.af.mil/89cg/89cs/scbsi/images/p oster8.jpg
Ignoring for the moment the practicalities of killing somebody over the Internet(!?), doesn't the USA already have murder/manslaughter laws? Why does there need to be special legislation depending on the method employed? Do you have special laws for murder with a knife; with a gun; with a mango?
I'm sure I'll never understand this. In the UK recently, there was a big hoo-ha in the tabloids about the need for "special laws" governing journalistic integrity for material published on the Internet. Why? There are already defamation laws.
Having the punishment be the same as in the physical world will eliminate a lot of "Waah, it's not fair, look what they did to the poor 15 year old kid." It will take a lot of people to convince me that breaking into a computer and stealing personnel records is somehow less of a crime than different from breaking into a building and stealing the paper equivalents. By the same token, if a kid thinks it's not ok to spray-paint an office building, but it is ok to deface a website, well, then, that's a pretty stupid kid.
Of course, this is not a black and white issue. In the real world, spray painting a building can be done without breaking and entering. In the electronic world, that's usually not the case - the cracker must break into the system to deface the web page. (Unless, of course, the site has some sort of CGI-based web page update feature with no password set, but that's not too common I bet). Maybe we could make them do something useful, like 200 hours of community service. Or maybe we could have them write the following 1000 times: "L33t haxx0rs are actually dateless retards who, despite their bragging, don't actually drink beer or get pussy."
Short of the defacement of a website, everything else is analagous to real life. Whether you smash a window and steal a file cabinet, or use a root exploit and tar up some data, you're doing the same thing. And since you'll get the same punishment, you'll get (hopefully) thrown in jail for 2-3 years for breaking and entering. This means you'll have a big biker dude named Ripper for your roomate, and they find out that you did your "breaking and entering" not by using a baseball bat, but rather by sitting in front of a computer drinking Mountain Dew and eating day-old pizza, what they'll do to you will be much more punishment than what the government could ever do to you.
There is no sig, there is only Zuul.
The Amnesty "illegally imprisoned" link reguards a pare-military group as common burgulars, the Rense.com link invents another class. Both have been addressed by the US courts and neither is addressed in Kevin Poulsen's article.
All that aside, hell no a non-violent criminal should not be locked up. Some other punishment is much more appropriate, like restitution of *real* losses (no making the defendant buy a new security team) and community service, etc.
Jail *should* be for the people that are a physical threat to society, not a theoretical or financial one.
Before the thread runs off the topic, see my website for my position on the death penalty before assigning one to me.
Eve Fairbanks says I drive a hybrid!LOL
Make them do 1st level phone support for an AOL for a few hundred hours, that will teach them ...
Here's a story about a man who kidnapped, tortured and abused a girl then tried to kill her by injecting her with bleach. His sentence? 10 years - he'll be out in half that time.
Sure, give crackers jail time but make it appropriate for the crime. Maybe 3 months in jail, or probation. When I see someone like Kevin Mitnick get 7 years, and violent criminals who, in my opinion, should never be allowed out of prison get the same sentences, it pisses me off.
What is considered "cracking" under these laws though. As far as I understand, cracking your own cd/dvd/playstation etc... disks falls under this. Now, besides that issue, you have a various degree of things going on out there. Is doing a DDoS against the webs rootservers considered cracking? How about a host of other, non cracking related hacks and script kiddie things that would never EVER fall under the heading of pure cracking? With the laws as broadly written for cyber crimes if i accidenty ftp into the wrong ftp site because of a typo (ftp.netger.com) I could get slammed with all kinds of illegal activity charges that will now be legal to trump up to these unseen levels. I don't mind a law that actually helps to procute known crackers and black hats but we all KNOW that this will be used, like every other law lately, to pretty much put anyone who even thinks of doing something on the gray side of the internet into jail.
The thing is with the widespread of software and the internet and technology in general always brings in a high punishment. I think it comes down to you doing whats right. Now I am guessing if most of you see a car with the keys in the ignition you aren't going to hop in and steal it, but if you saw a website with a big vunrability more of you may be inclined to take advantage of the situation. I think the point that doesn't come home to a lot of people is computers are a part of everyone's lives now, and if we don't respect them, we will be punished.
But in general, technologists have always been risky with the law. If I created a nuclear device for the sake of doing it, even though I have good intentions and no feelings of using it, I would probably be jailed for a LONG time.
Hack Microsoft? Rewards and adulation...
Hack me? Nail the fucker to a tree...
This sig left unintentionally blank.
Congress seems to have asked a reasonable question, are there situations in which hacking sentences should be based on on other things? Are cases possible where it is closer to murder? There many obvious examples of this, such as hacking into a water dam's control system and flooding towns downstream. Congress asking whether the current guidelines are relevant to these other scenarios is pretty good question.
Why not put them in jail and improve the US world record in imprisonment statistics?
The Internet's Achilie's heel is it's awesome complexity and size. The result is that it's very east for a group to appear, do damage, and then disappear, and never be traced. Worse still, the ease with which this can be done is itself an incentive - a downtime of DNS, or of a Microsoft server, or of Yahoo, is seen as unimportant, easy, and untracable, and people - for whatever reasons, be they sociopathic, vengeful, curious, or egocentric - are attracted to perform these kinds of acts.
It's difficult for any reasonable person to know where to begin solving these issues. Traditionally, nailing down machines and networks so they are more secure has been seen as the best approach, but there's little anyone can do about having bandwidth used up by unaccountable "hacked" machines, as is seemingly more and more the modus-operandi.
Attempts to trace crackers are frequently wastes of time, and stiffer penalties for hackers are compromised by the fact that it's hard to actually catch the hackers in the first place. The situation is made worse that many of the most destructive hackers do not, themselves, set up anything beyond sets of scripts distributed to and run by suckers - so-called "script kiddies".
Given that hackers usually work by taking over other machines and coopting them into damaging clusters that can cause all manner of problems, less focus than you'd expect is put onto making machines secure in the first place. The responsibility for putting a computer on the Internet is that of a system administrator, but frequently system administrators are incompetent, and will happily leave computers hooked up to the Internet without ensuring that they're "good Internet citizens". Bugs are left unpatched, if the system administrators have even taken the trouble to discover if there are any problems in the first place. This is, in some ways, the equivalent of leaving an open gun in the middle of a street - even the most pro-gun advocates would argue that such an act would be dangerously incompetent. But putting a farm of servers on the Internet, and ignoring security issues completely, has become a widespread disease.
There is a solution, and that's to make system adminstrators responsible for their own computers. An administrator should be assumed, by default, to be responsible for any damage caused by hardware under his or her control unless it can be shown that there's little the admin could reasonably have done to prevent their machine from being hijacked. Clearly, a server unpatched a few days after a bug report, or a compromise unpatched that has never been publically documented, is not the fault of an admin, but leaving a server unpatched years after a compromise has been documented and patches have been available certainly is. Unlike hackers, it is easy to discover who is responsible for a compromised computer system. So issues of accountability are not a problem here.
Couple this with suitably harsh punishments, and not only will system administrators think twice before, say, leaving IIS 4 out in the wild vulnerable to NIMDA, but hackers too - for the same reasons as they avoid attacking hospital systems, etc - will think twice about compromising someone else's system. Fines for first offenses and very minor breaches can be followed by bigger deterents. If you were going to release a DoS attack into the wild, but knew that the result would be that many, many, system administrators would be physically castrated because of your actions, would you still do it?
Of course not. But even if you were, the fact that someone has been willing to allow their system to be used to close the DNS system, or take Yahoo offline, ought to be reason enough to be willing to consider such drastic remedies. Castration may sound harsh, but compared to modern American prison conditions, it's a relatively minor penalty for the system administrator to pay, and will merely result in discomfort combined with removal from the gene-pool. At the same time, such an experience will ensure that they take better care of their systems in future, without removing someone who might have skills critical to their employer's well being from being taken out of the job market.
The assumption has always been made that incompetent system administrators deserve no blame when their systems are hijacked and used for evil. This assumption has to change, and we must be willing to force this epidemic of bad administration to be resolved. Only by securing the systems of the Internet can we achieve a secure Internet. Only by making the consequences of hacking real and brutal can we create an adequate response to the notion that hacking, per-se, is not wrong, that it causes no damage.
This quagmire of people considering system administrators the innocents in computer security when they are themselves the most responsible for problems and holes will not disappear by itself. Unless people are prepared to actually act, not just talk about it on Slashdot, nothing will ever get done. Apathy is not an option.
You can help by getting off your rear and writing to your congressman or senator. Write also to Jack Valenti [mpaa.org], the CEO and chair of the MPAA, whose address and telephone number can be found at the About the MPAA page. Write too to Bill Gates, Chief of Technologies and thus in overall charge of security systems built into operating systems like Windows NT, at Microsoft. Tell them security is an important issue, and is being compromised by a failure to make those responsible for security accountable for their failures. Tell them that only by real, brutal, justice meted out to those who are irresponsible on the Internet will hacking be dealt with. Tell them that you believe it is a reasonable response to hacking to ensure that administrators who fail time and time again are castrated, and that castration is a reasonable punishment that will ensure a minimal impact on an administrator's employer while serving as a huge deterent against hackers and against incompetence. Tell them that you appreciate the work being done to patch servers by competent administrators but that if incompetent admins are not kept accountable, you will be forced to use less and less secure and intelligently designed alternatives. Let them know that SMP may make or break whether you can efficiently deploy OpenBSD on your workstations and servers. Explain the concerns you have about freedom, openness, and choice, and how poor security harms all three. Let your legislators know that this is an issue that effects YOU directly, that YOU vote, and that your vote will be influenced, indeed dependent, on their policies concerning maladministration of computer systems connected to the public Internet.
You CAN make a difference. Don't treat voting as a right, treat it as a duty. Keep informed, keep your political representatives informed on how you feel. And, most importantly of all, vote.
KMSMA (WWBD?)
If you Break into a website and vandalize it you already have laws to deal with that... if you break into a website and STEAL confidential information we already have theft laws for that.
why we have to treat it any different than in the real world I dont understand...
if a bunch of no-brain-punks smash in the front doors of saxs 5th ave. and spraypainted all over the interior... there are a nice set of laws in place to nail the little idiot bastards.. the same happens when you B&E a website and put your no-skills drivel in place of index.html.. and the same laws need to apply.
the hard part is when the punk is in Guana and the website that was vandalized is in Alaska.. how do you prosecute the little turd without acting like a global government enforcer?
if it happens in your state with a victim and victimizer in the same state... it's easy to prosecute... but 90% of these cases are never that way.
Do not look at laser with remaining good eye.
Illegal imprisonment? Nay, for they did pass laws allowing indefinite detainment. It is merely unconstitutional
Each case must be weighed to determine the proper sentencing. In many of these cases the companies who are the victim provide inflated estimates of potential loss of revenue. In actuality, there is no way to validate if the company actually lost any money at all.
Sending someone to jail for 20 years for doing the equivalent of petty larceny is a crime in itself. However, if someone brings a major network down and the loss is quantifiable - then they absolutely should pay the price - both in restitution and jail time if appropriate.
Each case has different circumstances, and each punishment should be allocated accordingly.
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
I still don't understand why we need some kind of special legislation for the so called "cyber crime." Don't the states already have laws punishing crimes of trespassing and/or fraud?
Bush Lies Watch
The *real* problem of the little guy having a global reach is that very quickly, it's possible to create costs to others that *far* outstrip a single person's ability to compensate everyone involved (given reasonable, non-Gatesian amounts of personal wealth). The Radicati Group estimates that "malicious code" will cost more than $54 billion in economic damage by 2006: this is not inconsequential activity.
Of course, graffiti isn't, either. The US costs are around $15 billion a year, which doesn't count things like lowered property values for folks in graffiti-filled neighborhoods. Both forms of expression are anti-democratic and exploitive, much as those of pseudo-anarchist bent would like to think otherwise.
Nothing. Let the punishment fit the crime. If you commit a virtual crime, you should get a virtual punishment. Maybe a ban from the internet for several years, at the worst.
On your state. In my state, NC, you can use deadly force on someone breaking in to your home. Once they get in your home you can't use deadly force unless they try to harm you or commit sexual assault. They can pack up your AV gear and walk out, but you can't shoot them.
A crime is a crime is a crime. Aren't there plenty of existing standards to base this on? Tie it to the harm done. Some will be misdemeanors, some will be felonies. If some 'graffiitti' splattered over a commercial site causes a relatively small financial loss, call it a misdemeanor and sentence accordingly. If the financial loss is large enough, call it a felony and give an appropriate sentence. E.g., defacing the brochure page of your local shoe store might cause them little or no measurable loss of revenue and be repairable within a single work day. Doing the same thing to Amazon or Yahoo is a different matter and calls for a much stronger sentence.
The important thing is to prevent and punish people who act criminally, and to counter the popular impression that many "geeks" don't take the issue seriously.
-- Slashdot: When Public Access TV Says "No"
Cracking refers breaking copyright protection, hacking refers to breaking into computer systems, as well as coding, using a computer in an advanced way. At least, that's the way it's always was until ESR began his ridiculous, orwelian redenotation campaign.
I mean, really. Does anyone remember hearing a Hacker referred to as a "Cracker" before a few years ago when ESR began his attempt to change the meaning of the words?
Reality isn't defined by what you would like it to be, people, and words are defined by their usage.
autopr0n is like, down and stuff.
Bring charges appropriately. Note that you might need to legislate to clarify the scale of the offense in the new setting. As others have already pointed out, defacing a web site in a way that stops it being usable is not just graffiti, it's (probably) nearer breaking and entering followed by deliberate (albeit relatively easily repaired) vandalism.
This can affect charges and sentencing.
If yes, charge those people, too.
A hacker shouldn't be responsible for costs incurred in getting a new security system. I mean, it's something they needed before they were broken into, but just weren't aware of it.
Like, if someone broke into a car and stole a CD, they shouldn't need to pay for a new Car Alarm (or something)
autopr0n is like, down and stuff.
If you have something valuable, it's your responsibility to take adequate measures to protect it, "adequate" being defined here as whatever it takes, under the circumstances.
Stop tarting up your website with complex new shit, it was better in the olden days without all this ratings bollocks. I used to be able to spend ages downloading stuff with me broadband link, now I only have 56k modem and I can download all the new links in about 5 minutes. More porn, less features!
On one hand, it seems absurd to ruin the entire life of a foolish 15 year-old for committing the equivalent of graffiti
More like breaking into your office to erase every whiteboard in the place and replace them with poorly spelled tags, changing the locks, or jus took the door off it's hinges, smashing the alarm system, and taking/destroying the gods know what else in the process.
Hacking a website doesn't just mean that the site was changed. Anyone with a lick of sense after an intrusion needs to take a hell of a lot of time and take stock of what they still have, what they might have copied or deleted, and if they left any backdoors so they could get back in and have their little fun. Calling is "just graffiti" shows a complete lack of understanding of information security. There is real damage done when someone "just" defaces a website. It can't just be painted over.
Are you saying being analy raped by huge, AIDS infested thugs is an apropriate punishment for someone who breaks into a computer system?
autopr0n is like, down and stuff.
Hemos didn't write that, 'Cally' did! Thus the "Cally Writes" at the begining of the artical.
How can people be so blind?!
autopr0n is like, down and stuff.
Make them all read Slashdot at -1.
Liberty uber alles.
Why do all the lawyers insist on creating new versions of every law and crime just because they happen to occur in the "digital" realm?
Let's see... hax0r kid defaces web-site.
1. Trespassing.
2. Breaking-and-Entering.
3. (possible) malicious destruction of private property.
If someone logs into your (wide-open, no password root shell) server without your permission, that's trespass.
If someone hacks your server to get in, that's trespass and breaking-and-entering.
If someone changes your web-site, etc., while they're there... that's destruction of property.
There are already well-established laws to deal with these crimes, and those laws have ranges of punishments appropriate for the severity of the offense. Why should special "digital" versions be created when existing laws already work?
This country needs fewer laws, and better enforcement of the ones it already has. More laws simply make more money for lawyers, and more loopholes for the rich and powerful.
Well I think white folks should get the same sentences as minorities commiting the same crime. What makes you think that honkeys have the-
Wait... what are we talking about again?
What is music when you despise all sound?
I'd say the only punishment appropriate for crackers, is to eat them.
If you don't get it, just move along.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
The problem is that unlike computer code you can't write a blanket "on criminal event X goto Y."
I would have to say that what you get punished would depend on what you broke into. Walking in a unlocked employee only door at the mall is technically a crime but I doubt you could be arrested for it. Walking into the open vault at a bank is also technically a crime but you almost certainly would be arrested for that.
Both events might cost the owner money. The mall might decide that in needs to upgrade to an autolocking door lock. The Bank would probably do a full and expensive security revue to correct its problems. In both cases you caused them to spend money.
In both cases you might argue that you got lost or was simply curious. It is up to a Judge and Jury to evaluate you and decide what is the correct punishment.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
A crime is a crime is a crime. Aren't there plenty of existing standards to base this on? Tie it to the harm done. Some will be misdemeanors, some will be felonies.
Except that just is not the case. Take a look at drunk driving cases - you know the ones where the guy does it ten times or more? It was a felony around number three (I think, long time since driver's test) yet these guys just do not spend quality jail time.
Even better? Way back in college, I worked at a home shopping network and did some of their security work. Set up the cameras, figured out how and where they were getting the loot out, and confronted them. It was well over 5K, so it was a felony at that point. They confessed, we called in the cops, they confessed and signed a statement there too. So how much 'time' did they do for the felony? None, zero, nada. The prosecuting attorney did not bother to do anything. This happened a couple times in my short career.
I'd say, lets make sure the crime fits the punishment... because whenever I hear these cases, the 'damage' is usually the entire retail price of Solaris, the development time for the entire site, or something along that line of thought. You know that is not what Amazon from their SLA's for hardware or net servivce...
I wish there were standards too...
+++ UGUCAUCGUAUUUCU
Make them use the software they broke into for X amount of time.
:)
Break into a Windows NT server? Use it for a year.....that'll teach'em
How about a nice, swift beating?
The mildest is the person who breaks into a system, just because he can. He (or she, after all) breaks in, looks around, and leaves before doing any damage, changing anything, or "taking" anything. It doesn't impact any services that the target is providing. True, after any break-in that is discovered, the admins of the site will spend time cleaning it up and making it more secure. And I wouldn't like it if someone broke into my house just to look around. But I don't think that the punishment should be too harsh in this case, perhaps on the same scale as graffiti, maybe a little harsher because of the more expensive "cleanup".
The worst case is the cracker who breaks into a system to destroy or deface it. He changes the way external sites look and destroys information that is vital to those systems and may not be able to be rebuilt. Even a DoS could fall into this category if it leaves the site offline long enough, and is clearly deliberate. These guys should get harsher sentences, both for the public nature of their crime and the potential for data to be lost without hope of recovery.
The middle case is the cracker who breaks into a site and doesn't change anything, but just copies information from the site. In this case, the nature of the information itself and the mindset of the cracker must be taken into account. If the information was something that the cracker would have no way of using, and doesn't pass it on, then that would fall under the "curiosity" end of the spectrum. If the information was something that the hacker could directly use or sell, like credit card numbers or confidential documents sold to competitors, that would fall under the "malicious" end of the spectrum and be punished more harshly. I don't think the cracker should have to actually use the data to qualify for harsher punishment, as long as he had plans to use it. Notice that in this case, it is not necessarily the object that is copied that dictates the severity, it is the cracker's intentions.
The main problem with the way computer crime is punished right now is that whenever an item is copied/stolen, there is the tendency to assign the highest possible value to that item, without taking what the cracker plans on doing with it into account. After all, a confidential document could be worth lots of money to the company it is taken from. But nobody takes the capabilities and intent of the cracker into question; if he doesn't know how to capitalize on the value of the document, how could he be liable for "stealing" that much value?
Yes, I know that someone who steals jewelery in real life and then hocks it for a tenth of its value still stole the jewelery, not 1/10th of it. But when physical objects are stolen, the victim doesn't possess it anymore. When documents are "stolen" but not deleted, the victim still has access to it. Therefore, I think it is proper to assign the "value" of the theft to be how much the value of the document is reduced, not the value of the document itself. And if the cracker doesn't know how to use the document or who to sell it to, how can its value be reduced?
Your entire argument seems to depend on legally defining computers as dangerous weapons as opposed to tools.
Tools are unregulated and the owner is not responsible if someone steals their tool and uses it in a crime. If I leave a shovel leaning against the side of my house and someone takes it and uses it to kill someone, I am not legally responsible. Even if I knew that risk existed when I failed to secure the tool.
Guns are regulated and the owners are (somewhat) responsible for the actions taken with them, even by others and even without the owner's permission or knowledge. However, the owner is never held fully responsible for the actions of the person who took and used their gun. And the level of responsibility is negligible unless bodily injury results and there was a minor who has legitimate access to the premises involved.
Somehow, I don't think anyone is going to agree to classify computers as deadly weapons and make the penalties for their unauthorized use greater than those for the unauthorized use of firearms.
How can we afford to ever sleep
So sound again
--ebtg
Judge: I have no idea what this guy did, but these other guys seem irate. What the hell, give him 30 years.
People fear what they don't understand.
I may be a little offtopic and negative about this, but it seems odd to debate the punishment of these crimes before seeing any real concerted effort to catching these people.
I admin a few servers, one of which had accounts comprimised through a fault in the network it was sitting on. Although the cracker/hacker/whatever couldn't escalate their privileges to root (at least the head admin and myself had set up the actual machine correct, shame about the network of the colocator) until we caught on they potentially had another stop-off point they could SSH from and maybe root another box or play with one.
After checking the server out and seeing to it that everything was ok, we checked where the attacker had connected from - a machine owned by CNET. Despite our best efforts we haven't got a word out of them (you think they would be bothered) OR Rackspace who they colocate from, so the buck stops here for the moment. We can't warn any other potential targets, or trace the attacker. Law enforcement probably won't help as there was no financial loss and we are based in the UK, so laws only apply to a few very high-profile attacks. I'm sure many other admins have suffered the same problems too.
I share, respect and applaud your assertion that the vast majority of cyber-legislature should be unnecessary, and that existing laws should be sufficiently robust that an inconsequential change. For example, interacting using computers as opposed to, say, over the phone should not require grotesque swathes of ill-defined additional laws, however I must oppose your view about "lesser punishments" where consequences are small.
Should the man who drove off at high speed after driving into my car be let-off because he hit a cheaper production car? His obligations to stop and exchange insurance details would be enforced if I had a specialist sports car particularly expensive to fix? That is silly. What should be the cut-off? Should we allow people to steal as long as they don't take more than $10 at a time, £100, $1000? Ridiculous -encourage criminals to commit a much larger number of small crimes... which in turn are likely to be far more difficult to police. Are we trying to launch a modern Fagin who can escape the long arm of the law hiding behind juveniles committing frequent but individually petty crime?
I admit that it is most difficult to address vandalism-like crimes - particularly in a virtual environment, but see too many distinctions between graffiti and ego-hacking. Would it be too much of a stretch to compare web-site defacement to placing an "I'm a bit twit who doesn't want my SUV" poster placed on the seat of an unlocked truck left with the keys in the ignition? Each of these causes anxiety (what else might have been done to the vehicle) - but only when it comes to hacking is it seen as valid to persecute someone based upon what the victim feels might have done. When the consequences of an electronic attack are so severe, surely it should be seen as necessary, responsible behaviour to ensure effective security against such juvenile behaviour?
This shirt has to be visable all the time. On this shirt would have the text.
"I though I was a Cracker but I was to stupid to do it correctly. So I Really suck."
Nothing is more hurtful to a cracker is to make them feel really dumb.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
But what is even more frequent is users with broadband access who lack the technical expertise and time to secure their Windows 9x/ME machines against the local hacker element. I don't mean to flame, but every time I've seen a DDOS attack on my servers, they've come from machines on the local class C running Windows 9x or ME. These aren't businesses - they are average users with broadband access. There are far more naive Windows users than incompetent admins, which gives hackers a never ending supply of zombie machines.
The society for a thought-free internet welcomes you.
It seems that this is going too far. Well I may agree that certains activities related to cracking should be punished. People and comapnies not only loose money but also precious information and reputation. Some cracks may lead to more serious situations when we may have not only material but also personal losses.
But creating an environment where cracking itself is utterly ilegal is the most stupid thing one can think of. First because it will create a situation similar to America in the 20's-30's where nearly all alcohol production was outlawed. By making cracking illegal, one will not stop it but feed the criminal hordes with experienced people and tool experts. What will come out of that is unpredictable. The future cyber-Scarface will not only stop by Chicago and not only restrict his doings in the waters of the Great Lakes.
Besides, making cracking wholly illegal will not give ground to capitalism. It will be the best show of feudalism in modern times, as all "good-netizens" will be utterly dependent of the wills and whishes of a bunch of corporations who will care or discare for the their security and/or privacy.
Also it will be a violation of our freedom. I can check up the engine of my car. I can try to fix my washing machine. I have the right to change a light bulb in my living room. But I have to go to jail because some jerk locked up any interactivity of his program with any other system and I need that for my everyday's needs?
These criteria should be used when deciding what the punishment should be:
See the Pictures of the Flood of '08
``What? You object to random stragners wanderring around your home...''
_O_
.|< The named which can be named is not the true named
Finding one "mad hot chick" that understands what "133t h04x0r" means
PROFIT!
HallmarkOrnaments.Com
I'd never seen that site before...
Angry Flower is schweeet!
You made me stop working... D'oh!
I see some posts so far about how these people are committing breaking and entering when they hack a site. I guess that floats, but what about deep linking? Am I trespassing? If I look at the source code on a site and learn from it, am I stealing intellectual property? Saving a picture to disk, theft? It's in my cache already, uh oh.
"I'm a leaf on the wind. Watch how I soar."
-Hoban Washburn
What about setting up a work program? After you are proven guilty and a short punishment (short jail, heavy fine, some sort of very strict probation, house arrest, etc) you enter into a "half-way" house with a mentor sysadmin who can put your cracking skills to good use, but also keep an eye on what you are doing. That way, you can crack legally (get your thrills) and positively affect society. Of course, this wouldn't work for every script kiddie, but for the few crackers that actually have and display true talent, it wouldn't be wasted in some jail cell. Do Poulsen and Mitnick do internships, or take volunteers? Maybe they should. They are heroes to a lot of people.
The punishment should be in accordance to the damage they caused, and if they stole or hurt anyone.
I believe that the penalties for merely defacing a website, or cracking into a machine and not actually doing much damage or "stealing" anything should be light. Sure, it is annoying, but it isn't that major.
If someone cracks into a database server and steals credit card information, that is another thing altogether. They should be charged with theft of credit cards (or whatever the actual crime is).
If someone (hypothetically) manages to crack into a computer that controls air traffic radar, and planes end up crashing because of it, they should be locked away for mass murder.
Some of the proposed punishments for computer crimes are quite harsh, treating the perpetrator like a terrorist or violent criminal.
However, someone who simply defaces a web site and writes "I 0wn j00!" on it doesn't deserve to be given more time than a rapist.
"You spoony bard!" -Tellah
Sorry if I am trolling a bit here.
In society we all have an expectation of privacy. That right is supported in common law.
For example if your neighbor puts up 15 ft solid brick fence and then sunbathes nude behind it and you put up a tower with a camera on it you can be arrested/sued for being a "peeping tom". A local TV station had an employee get busted for using the "skycam" weather camera to do just that. The courts held that the woman had a reasonable expectation of privacy and that it was violated by the man using the TV towers camera.
When someone puts up website they have a reasonable expectation that the back office parts of the site are to be private. Just because you CAN peer into the site (on into the backyard) doesn't mean you are allowed too!
The amount of effort required to circumvent them is irrelevant. The expectations still exist and are legally protected.
I don't consider break-ins, especially to insecure machines or business computers (but maybe I just value individuals more than businesses?), to be a very high crime.
That was the most stupid of your statements. Well I don't consider your dead-bolted door to be adequate security for your home. So by that logic I am free to break in and clean out the house. By God, you should have had a steel vaulted door.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
What he is wearing really has no matter in it as the other people who beat him up will still be charged with assault (maybe more). Society doesn't really think it is OK, that is why we have laws against assault.
Like many people, I don't want to see new laws created to cover every time someone uses a computer for some $CRIMINAL_ACTIVITY which was already illegal by itself.
However, there's a real limit to how far analogies can take you. We can't just say "it's like vandalism / theft / graffiti / spying / workplace disruption / copyright infringment" and expect applying the equivalent punishments to produce the best results for our society. There are ways that internet-based activities are completely unlike anything that's come before.
Lets focus on just one of the most important differences between "cyber-crimes" and the old-fashioned physical variety: it's now possible (and easy) for the victim and perpetrator to be in different jurisdictions when the offense is committed.
During the early popularization of the internet, most users were in the US (or its servant-states like the UK), so often enough the vic & perp were under the same set of laws. The FBI was able to haul in domestic hackers like of Cpt. Crunch, Bob Morris, Mitnick, and later Mafiaboy. (I think Jaegar was a notable exception)
But is arresting those guys really the best way to protect the US economy? The US government is using guns and handcuffs to protect US businesses' computers from tampering- can we expect that defense to remain viable in the future?
Physical force is not a lasting solution to an electronic threat
(It's like "security through obscurity"- it will work at first, and is easy to implement. But someday the enemies become experienced enough to circumvent that defense, and by then you need real protection)
Threat of arrest only works on perpetrators inside your jurisdiction. "Cyber-Crimes" can be performed by anyone with a PPP stack- which is everyplace with reliable electricity. The US has a powerful law-enforcement/military presence, and with extradition treaties can bump up their effective jurisdiction to cover a majority of the earth's landmass. (Although with reduced precision in the less-friendly or less-developed nations, or where local cops are too busy with violent crimes to go hunting down script-kiddies)
What about nations that are downright non-friendly?
If a Canadian teen can inflict billions of dollars of economic damage in 3 days (and only be caught after public bragging), what about government-sponsored agents in "The Axis of Evil"? Suppose China takes offense at "US imperialists", and assigned 200 CS PhDs to build innovative DOS strategies for e-commerce sites?
Unless we can rely on forming a durable "Pax Americana", with a single organization enforcing a uniform law code across the entire planet, there will always be places for hackers to hide beyond your reach. (The Bush administration wants to create such an empire, but they will fail.)
I would argue that so-called "cyber-terrorism" hasn't happened yet, and will never be a major concern (the small number of computer-operated systems capable of producing enough violent damage to evoke "terror" will be heavily protected, with much redundancy and human oversight).
But "cyber-economic-warfare" is a real risk in next 20 years, and so far the US government has been allocating serious funds to make the problem worse when it starts to hit.
All of the FBI efforts to strongarm and incarcerate computer pranksters is just reducing our resisitance to the eventual onslaught. The government subsidizes insecure software by arresting people who break it, relieving the developers from fixing their own products. Microsoft might not publish such dangerously insecure systems if they faced the traditional punishments that the free market unleases on inferior products.
Let's privatize computer security! Save tax dollars, and increase effectiveness at the same time. We could reduce the penalty for "hacking" type crimes (or DOS) to the magnitude of a traffic ticket. (Teens cannot commit them with impunity, but companies can't rely on arresting offenders as their sole defense).
(Naturally, using "hacking" perform any real crime- unauthorized fund transfer for instance, or copyright infringment- should be punishable just like that crime by itself)
If you think that a woman deserves to be raped because she is wearing a low-cut top or her pants are little too tight, then you have some serious problems and should be taken out of society immediately.
No, I don't think anyone should be assaulted for what they wear. I don't think someone should be mugged either, just because their wallet or cellphone is in their hand. Hell, I've seen on the news people getting mugged for their shoes!
But I am aware, as you should be too, that that viewpoint isn't universal. There are streets in London I won't walk down while talking on my phone. In some parts of town, I'm careful not to show a wallet full of cash. These are just basic precautions that everyone should take. But it's taboo to say that dressing so as not to draw attention is one of the basic precautions, and that is a double standard.
Everytime some idiot joyrider breaks into one of our systems
Everytime that happens, it means YOU failed to do your job of maintaining security. Be happy that you only have to wipe up a little mess, instead of getting fired like your incompetence deserves.
Maybe the failure came when the wrong product was selected, or when something was installed wrongly or incompletely- but someone in your organization caused the vulnerablity, and the boss should be free to put him on trial for it.
Am I "blaming the victim" here? Yes, but that's the only approach that will be productive. You can't ask the entire human population to respect your machines- you've got no influence with them. The only way to attack the problem is via the people your boss does control: his employees. Tell them to buy secure systems and use safe practices, and punish them when they fail.
If he/she is a minor, however, I think state of mind should have some sway over the consequences. You'd be surprised just how effective a simple visit by law enforcement personnel can be in "adjusting" the cracker's attitude.
In 1997 I was caught dorking around in school district systems. In my adolescent mind I thought it was all fun and games. Until I was hauled into a room by several very serious looking detectives and interrogated. Bad-cop-good-cop games, the whole works. This was quite possibly the fastest attitude readjustment I've ever experienced.
The detectives, I think, had some sympathy for my plight. His boss wanted to bust me hard and basically ruin my life. I was hauled before the head honcho (don't know exactly who he was or what his title was) and was given a stern lecture. I was asked if I'd ever used drugs or done anything violent. In the end, I was let go with 40 hours of community service to the school district and a warning to not get caught "so much as pinging" the district machines.
When my computer was returned to me from evidence, an entire year later, I found that the detective had upgraded the CPU and put 16 megs of RAM into it. I guess I made an impact on him, as well.
Now, on the other hand, if you've got a script kiddie, and he's whining and bitching and making life hard for investigators, and basically has a "fuck you copper" attitude, then I say... Bust him, throw him in the lockup, and let him think about how much of an asshole he is for a few months. Let him out, and if he does it again, hit him with the full force of adult penalties. Breaking-and-entering, defacement of property, theft of property, the whole works. Fuck up his life and let him figure out why it happened.
I was given a wonderful second chance, and I haven't wasted it. I was just being a stupid kid. People who scoff at the opportunities that law enforcement is trying to give them deserve prison.
What you meant to say is "Both events will cost he owner the money he should have spent in the first but didn't because he was cutting corners and trying to maximize profits."
No I meant exactly what I said. There is no LEGAL requirement that either the mall or the bank have proper doors. There is a legal requirement that you stay out of them!
Now from a practical point of view you are correct but this isn't about that. It is about what is legal and what is not. Just because you can break in to a computer or a bank doesn't mean that you shouldn't be punished for it. It also doesn't mean that you are not responsible for the damage done even if the only "damage" is forcing them to increase security.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
Your sentiment is pleasantly honest and common to most people, though maybe not consciously or quite as extreme (for example, to be drawn and quartered after hanging is unnecessary :).
"The punishment should fit the crime." Equally important, someone neutral (not indifferent) should pick the punishment.
*
However, few are aware that the federal judge actually has extremely little discretion in sentencing. In a nonviolent crime against strangers such as destructive hacking, setting aside criminal history, the amount of the losses essentially determines the sentence. Said damages are notoriously difficult to estimate and easy to inflate, as in the cases of Kevin Mitnick or Robert Morris, who were clearly culpable, but for what? State courts remain more flexible, but with the growth of federal law and the wire fraud aspect of computer crime, more cases are swept into federal court where the sentences are typically heavier.
Current federal sentencing guidelines, dating from Reagan era reforms designed to crack down on crime by constraining "soft" judges, and created by the Sentencing Commission, are purposefully wooden and mathematical in their determination of sentences. You literally add and subtract points based on different factors, then consult a chart to find the mandatory sentencing range. (In some cases, I think a minority, defendants do benefit from protection from excessively harsh sentences.) In certain drug cases, mere grams of a substance such as crack can add years to your sentence
At sentencing, the judge is given a presentencing report recommending a sentence plus or minus, say, 5% of a given fine or imprisonment or probation, a range from which it is very difficult to depart without breaking the law. What effectively happens -- and I hope this was foreseen -- is that sentencing authority is passed to prosecutor, whose decisions as to which offenses to charge or to drop, and amenability to plea agreements, set the outcome. If you believe the sentence unfair, it is the prosecutor or Congress, author of the ill-conceived guidelines, that needs influencing. The Guidelines long ago survived constitutional challenege.
I can tell you firsthand that many federal judges don't like the Guidelines, but if they depart from the prescribed sentences they are reversed on appeal.
I just had similar discussion over the weekend regarding virus writers and spammers. Truly, infecting somebody who doesn't understand the nature of virii/social-engineering, or doesn't adequately protect their system. Same with those who leave their servers to spamaholics, or easily cracked websites.
But the point is, these people are destroying the industry. When people get 15+ spams a day, and 3+ virii a day, email becomes a lot less productive. When companies to some extent depend on email to communicate with clients, it's costing a lot of money. When a company gets a quickly spreading virus, it can mean even more money down the tubes.
Not everyone is smart enough to use PGP-signed email, an intelligent spamfilter, etc. Virus writers are the worst of all, and frankly - whether it's a 15-yr-old kid in Canada or a 35-yr-old Russian guy with a 2 foot beard, I don't care. These people need to be caught, and punished to the extent that they become examples for all. If big companies stopped sueing those who aren't causing intentional damage (frivolous lawsuits, patent claims, etc), then everybody would do better in the long run.
Instead of building spamblockers and firewalls, we should be building tools to track these buggers down, and then either hand them in for justice, or formulate our own solution (not necessarily vigilante, but enough to get a message acecss) if the state/country isn't willing to properly take up decent action.
I f you consider "life in prison" to be a slap on the wrist...
There are, I think, at least two things at play here. First, the use of plea bargaining and related devices to clear the docket, rather than serve justice, contributes to the perception that sentences are often out of whack with the crime committed. Second, courts are probably less able to judge the veracity of a damage claim brought in by a cracking victim than from a victim of a more traditional crime.
However, we can't avoid giving fair sentences to IT criminals simply because other criminals get unreasonably lenient sentences. My sympathy for convicted criminals is limited.
-- Slashdot: When Public Access TV Says "No"
Some crimes cause more suffering and damage than others, and we treat them differerently. The use of categories like "felony" and "misdemeanor" don't, however, imply that some crimes don't merit punishment. If you're driving a junker, the guy that hits you and leaves has committed the same crime as he would if you had been driving a top-end model. A hit-and-run is a hit-and-run; the value of your car shouldn't come into it.
In the Internet arena, though, I think some way has to be found to keep punishment in line with the severity of the offense. Defacing a web site that consists of a single static page on a vanity server should not draw the same kind of punishment that taking down the home page of a major online retailer for days on end, or for mounting a successful DoS attack on important government sites. (Certainly, the differences would be brought out in the damages sought in any civil action.)
I'm not suggesting that a web page defacer merits no punishment, or is the equivalent of urban graffiti.
-- Slashdot: When Public Access TV Says "No"
Publish naked pictures of convicted crackers on the web with handle and real name.
If that doesn't act as a deterrent I don't know what will...
"On one hand, it seems absurd to ruin the entire life of a foolish 15 year-old for committing the equivalent of graffiti."
Sound harmless until it happens to you. Try owning a building that is the target of graffiti taggers. It get old and expensive and kills property values when you have to constantly have to clean up graffiti. Same with so called harmless crackers. See a system has been compromised the only safe move is to rebuild. Taking time that could be better used else where.
What sounds innocent causes companies to have to spend money on more security staff, hardware, and time rebuilding compromised systems. That cost gets passed to all of us in higher prices for the companies products and services. It is a no-win situation.
--there's no national law that exactly addresses your question beyond we have the born with "right" of life liberty and the pursuit of happiness. It gets incredibly complex after that of course.
Each of the 50 seperate states has laws that address self defense of life and protection of property, and there are significant differences. Some places you have little to no "rights", you are actually required to retreat from your home, not interfere, and call some "authority person" to "assist you". Other places it's not a good idea to break in as it's a tad saner in what the victim can do. Usually it revolves around if the victim has a "reasonable expectation of bodily harm" from the attacker, so it's a case by case deal. Example, someone breaks in, they have a weapon, threaten you, bang he's history. The perp is in the house, the weapon is there,most likely you won't be charged with anything-but it's still a variable. That's the hard part without getting into a state by state breakdown of the laws. If on the other hand someone breaks in, you surprise them, they flee out the door and you pop them in the back as they are running away in the yard, nope, you'll most likely get charged at least with manslaughter if not murder. It also really makes a difference if you as the victim are a member of the "elite class" or not, chances are-say-you are a cop or judge or some other "priveleged one" that your buddies will cut you quite a bit of slack over say joe sixpack in the same exact situation. this is just "practical law reality" as opposed to "strict letter of the law".
The main basic differences are protecting property as opposed to protecting your (or someone else's) life. There's wildcards as well, here's an example. In a state that "allows" you your right to self defense by being armed, say you are carrying a handgun. If mr. badguy approaches you on the street in any mugging attempt, you may blast them, but you DANG well better be prepared to show that what you allege actually happened. If mr badguy doesn't have a weapon on him, and it doesn't look credible to the local prosecutor that you were threatened with harm and robbery and other bad stuff, you could very well be en-screwed. Same inside your home. Some states just the fact of the bad guy being inside your home is enough evidence that they were up to some serious "no good" and that's enough, other states it's nothing, the bad guys have most of the rights still. It (victims self defense and related issues) goes from very good and demonstrably effective-say vermont, to absurd and ineffective-NYC, for an example.
It's something that to me is really a huge gaping hole in the self defense and property rights areas, as supposedly our constitution in theory is supposed to insure across the board to everyone our basic born with "rights" as outlined in the constitution (article 4, section 2), in practice it's completely bastardized and obfuscated across all the states borders one state to the next, and even municipalities have differing laws/rules that might conflict with the state outlines.
A pretty good basic rule of thumb is, in areas of the country that are run and codified closer to the english language version of "gun rights" instead of commercial code lawyerese language version as per the original intent of your basic born-with right to be armed, the more likely you won't be seen as the badguy in a home invasion defense. The two parallel each other fairly well.
As to your network, no, I don't think so. With that said you are free to google for references to "louisville slugger" and "ski mask". Although that bios blasting trick (passwords.exe)outlined in another post seems like a pretty nifty trick to zap the badguy network intruder, at least the stoopider ones. It's too bad there isn't an anti-spam variant
Harrr-umph
note to anyone, not trying to sidetrack the thread or have this evolve into a "pro-anti" deal here with the self defense of property/home/person commentary.
They went after the publisher because that is where the money is. I would have going after the photog. Ruin one of them and maybe the rest would be less likely to take the risks. OTOH it is one down in a forest of 'em.
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
. Bear in mind that the defenders have to take care of -every- vulnerability, while the attackers (dolts) have to just find one vulnerability - basically, it's worlds harder to defend than to attack.
Yes, that's the Fundamental Offense-Defense Inequality, which has diverse applications from warfare to philosophy and futurism ("psychohistory" - Asimov).
Trivially provable for simple domains- for a size N change to a target, there are N*N ways to break it, but only N to maintain it's status. In the physical world, N is measured as the amount of kinetic energy you can deploy ("War is just the directed exchange of kinetic energy" - Adam Selene). This gives an interesting result for the nature of warfare across history: As technology increases so does our ability to output kinetic energy, and by the (N*N - N) equation, our ability to inflict harm will progress much faster than we can learn to block it.
Thus a simple math formula predicts the Mutually-Assured-Destruction scenario which occured 50 years ago, and also suggests that the "National Missile Defense" program of the US administration will not be successful.
care of -every- vulnerability
Naturally 100% security (of anything!) is impossible (cheap trusim). Its true that can't close every vulnerabilty- for a sufficiently broad definition of vulnerability (such as wasting a secretary's time). But for those vulnerabilities which are significant (violate your privacy, redirect funds, extended DOS), you need to try to close them somehow. You can try technological means, or you can recruit armed guards (in the form of legions of police officiers)- neither will be 100% perfect, but either will help in some circumstances.
Outlawing something won't stop it from happening. At best it may reduce the incidence. So the question becomes, which approach will be cheaper? Physical force, or technical control? You need a some of both, of course, but which will be most cost effective? Which will be scalable to an eventually enormous number of internet users around the world?
I say the technical approach is more scalable. Secure software can be written once and infinitely replicated. (There's custom configuration needed too, but as time goes by it will become more well known and thus cheaply replicable). Cost is proportional to the number of kinds of systems in use (much lower than the actual number of systems). In 50 years, the software needed to secure (the vulnerable parts) of 99% of all business software will be commodotized and cheap (eventually its copyright will expire).
But for the physical approach, you need to have a X number of police officers for every 1000 humans on the planet, and Y district attorneys and Z jail cells also. (In addition to what you need for fighting traditional crimes). Costs proportional to the number of potential offenders. As a long time passes, it won't get cheaper. Retiring personnel will need to be replaced, and the population will keep on expanding. This sounds much more expensive than technological security measures, especially in the long run.
The number of potential offenders (all of humanity) is much bigger (>>) than the number of potential targets (remembering that identical kinds of computer systems count as one). Therefore, physical protections for our computer systems will be inherently more expensive than technological solutions. Any short-term actions (more stringent hacker arrests) which undermines the deployment of tech. fixes will threaten our future.
And when I write my congresscritters about how I'd like to see things handled, that's influence.
Yes, I have some influence. And I'll push for a computer solution to a computer problem. Seems like you'll try to cancel me out, oh well. I didn't have much hope anyway, these humans are too driven by emotion to see the big picture.
So I'm being a techno-optimist here. The rules of the computer world are artificial, defined by humans. The only limit to our control of the computer world is our ability to understand it- so far we change the cyberworld faster than we can catch up. But if we were, say, to define a specific subset of high-value operations (money transfers, personel privacy, encryption) as being fundamental towards future security, we could "feature-freeze" the software we use, and eventually study it so closely that it can be proven exploit-free.
That's a utopian vision, but it is partially attainable (and more feasible than creating a 3:1 cops:citizens ratio for round-the-clock physical enforcement). Partially attainable, that is, only if we decide to go that way, and really invest in securing our computers. Allowing system administrators to say "We were attacked by a criminal, it's a police matter, there's nothing I could've done to stop it" won't bring us down the right road.
Instead, it will supress outbreaks of computer intrusions long enough for the developed world to become 100% reliant on digital systems for day-to-day distribution of water, power, and food. Then you'll get a handful of kamikaze whackos with no fear of mortal punishment, and the age of cyber-terrorism will really begin.
some hackers really are hackers.
All hackers really are hackers. "hacker, n. A person who operates a complex system in a manner inconsistent with it's designer's intent."
mistake you've made in your claims about me
You're the one who admitted to have been repeatedly 0wned. If you were exaggerating, then so was I.
(rather obvious, really)
Maybe it was obvious because it was a generalized attack against a whole class of inadquate administrators. "You" is also a plural word, remember.
We don't have disaster recovery plans for nothing.
Part of the "safe practices" I mentioned.
No firing reasonable people who failed if they can reasonably learn from it is not sensible.
"Punish" can mean many things. The point is, defend yourself! Pay your vendor to defend you, or choose a new one. Don't expect the Feds to make it all OK.
mired in office politics that force them
In that case, those office-politicers doing the forcing are the ones whose jobs should be endangered.
No one in a supposedly free country should ever be imprisoned without due process and a trial by jury. In this country if the jury finds the law or circumstances absurd they have the right to acquit although most lawyers and judges won't tell you about that. The category of "cyber-terrorism" has been painted so broadly that I am sure at least one third of /. readers could be charged in one trumped up way or another. Before it can be called "terrorism" specific terrorist intent must be shown. Otherwise we are making excuses to rip off freedom. It is also cruel and unusual punishment to not only jail a cracker but prohibit them from using computers for some period *after* they have served their time. This should be patently illegal.
Haven't you guys heard? Graffiti is dead. You're going to have to do your hacking with a keyboard from here on out.
"Indeed, it may be possible to stop revolutions from happening at all - because a Republic cannot fuck up a country with all possible haste, it is more likely that those in power will see the discontentment of the people coming, and make subtle changes to avert general rebellion."
You could see this as a good thing or a very terrible thing, I suppose it depends on your perspective. You are right, however, the US government is after a certain level of complacency, if people get too pissed off, they are attentive, but the problem is, as soon as people stop paying attention, it goes back to business as usual.
I think that in order for either a functioning representative democracy, or direct democracy, to work in the US, we need to sort out the economic differences. I hesitate to say we should be required to reward people based on effort and hard work, since most Americans wouldn't understand this concept. However, if we at least added some checks and balances in our economic system, the way that we do in our government, it would do a great deal to keep wealth from becoming so incredibly concentrated in our country. No matter how much we think that a certain person "deserves" X billion because they did Y, we need to remember that allowing such huge amounts of power to fall into the hands of a few needs strong justification. Currently the top 1% of the US owns 40% of the wealth, that's up from 33% in the mid 80's. That's right, they added another 30% to their assets in 15 years. To contrast, the bottom 40% of the population owns 1% of the wealth. This hasn't happened by accident, it's what happens when a corrupt government sets up a nice gravy train of subsidies, which largely gets funneled into the hands of the upper class, and then lets them take this cash outside of the US and hire the cheapest labor possible in order to profit even more off the American public. This kind of direct market manipulation, otherwise known as cheating, is how they're doing it. Don't get me wrong, I'm not a petty person, I could care less if someone has a nicer car, house, more jewelry, etc. What I do get concerned about is the income of the majority of Americans getting worse and worse, while that top 10% keeps getting better and better.
When a 15 year old sprays graffiti on a corporate building, a janitor is called on to remove the offending tag or paint over it. He curses those damn kids, and usually removes it fairly quickly. The kid may have to remove it himself if caught.
When a 15 year old puts graffiti on a corporate website, a 1500 dollar a day security consultant is brought in. He tells the company those "damn kids" are cyber-terrorists who threaten the very existence of the company, but for a nice retainer he and his compatriots will keep the company safe from the evil predators lurking outside their intranet. Thanks to the media hype --fearmongering=readership=advertising-- companies buy right into the FUD, and when the VP plays golf with Senator Whasisname they talk about giving Johnny Cracker the chair for his 16th birthday.
While there's still big money to be made, don't expect the law to go easy on hackers and crackers, even the altruistic ones, if there is such a thing.
"fuck all or a safari or something"
I can't think of how I'd react to seeing graffiti like that. How nihilistic/apathetic is it that a graffiti-er wouldn't even have a statement to make? Or maybe it's surrealist art? I mean, commit to "fuck all" if that's your statement, don't waffle on about safaris and whatnot.....
How do you know which "specific" information you are allowed to look at? I'm at my home, why did their server send that information to me at my own home if I'm not allowed to see it? OK, let's bring the analogy back to the "real" world. Suppose I fill a coupon I clip from a magazine. Imagine that, due to some clerical error at their company, I get sent some confidential information. For instance, a director at that company might have the same name and my address is entered in his file. Did I commit a crime? If they voluntarily sent me something I wasn't allowed to get, they must prove beyond any reasonable doubt that I acted with the intention to commit a crime.
I do not want to condone illegal acts, but I think one must be careful or we will soon live in a police state, governed by a lynch mob. We should respect people's rights, even if we believe they are criminals. It may even look like a caricature, like the "Miranda rights", where the police must inform the criminals of their Fifth Ammendment rights, but even the most hardened criminals have the same rights as any of us.
Please substitute East India Tea Company for Boston Tea Company. My lack of sleep is catching up with me. Sorry about that. The concept still holds true.
I'm not quite sure I understand what this means. If you're saying that "most Americans" understand that rewards should be based on birth, or heritage, or race, or creed... well, I don't know about "most" Americans, but I wouldn't be surprised if many privileged Americans feel this way. But it's disingenuous to single out Americans in this way. America is worse than some, better than others, and probably about the same as most. Don't "most nations" have an imbalance of privilege? And don't the privileged of every nation justify their class system, while the destitute clamor for equality? America isn't alone, or even the worst, in this regard.
If, on the other hand, you mean that Americans understand rewards based on results, and not on effort, then that's something else entirely. Traditionally, Americans have been in favor of hard work--because it's associated with results, and it's the results that get rewarded.
If, on the gripping hand, you mean that America has developed a culture of entitlement, where every class asserts their right to the rewards, without any effort at all... that sounds about right, if quite stereotypical.
Anyway, I'm done nitpicking. Carry on :)
Any sufficiently well-organized community is indistinguishable from Government.
1. Publish their email addresses on the Internet and let the spambots send them 3000 mails a day.
2. Publish their IP addresses and let script kiddies run Sub7 on them 24 hours a day.
What if they die?
Lack of eloquence does not denote lack of intelligence, though they often coincide.
These days, of course, 6000 machines is a drop in the bucket - some of the popular viruses have infected millions of machines, and even the ones that only used them to send love notes to other targets often tended to lose useful email access for a day or two; destructive viruses can be a lot worse, especially for the vast majority of people who don't have adequate backups of their data.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Hypothetically, if my school uses WiFi for student laptops, can they legally stop me from listening to such traffic?
Physically, they are electromagnetically shaking me every minute I'm at that place and probably causing cancer at the same time.
Hypothetically, I can listen to everything that goes on in range (web traffic mostly, hypothetically). The system is mostly used for test-taking, hypothetically.
Hypothetically, how could suggest that they use SSL? My previous, non-hypothetical attempts at suggesting changes to their <sarcasm>security</sarcasm> measures were in vain. I was blackmailed and suspended as a result.
You can't judge a book by the way it wears its hair.
"If, on the other hand, you mean that Americans understand rewards based on results, and not on effort, then that's something else entirely. Traditionally, Americans have been in favor of hard work--because it's associated with results, and it's the results that get rewarded."
Yes, this is exactly what I mean. Unfortunately, we don't always notice that usually people acheive great results only with the help and hard work of others. So, for example, and this is just one example, Bill Gates would not be where he is without many hard working "microserfs" working under him. However, if you challenge the assumption that Bill Gates and others deserve the huge amount of power that they have, many Americans react in a very hostile manner. If you try to explain that there is no way that one could really work hard enough to have all that wealth, well, the concept is lost on many.
"If, on the gripping hand, you mean that America has developed a culture of entitlement, where every class asserts their right to the rewards, without any effort at all... that sounds about right, if quite stereotypical."
True, however, I think the unfortunate thing is that entitlement of the poor and middle class are under constant attack, and people don't even realize it. Furthermore, most people don't even know about how much the wealthy benefit from government intervention and support. The end result is that we have a society that constantly promotes the "entitlement" of the rich to own even more and more, while the rights and freedoms of ordinary Americans are ignored. To suggest that the poor and middle class are entitled seems to be heresy, even among those who would benefit. This, in my opinion, shows how much the media and ideology has caused the majority of people to ignore their own plight. In order to fight this, people need to understand how our propaganda works, and that it is real, and it does affect them. Then they need to start finding ways of promoting their own interests. A well functioning democracy requires this.
OK - so maybe I was guilty of flame-bait tactics, but I remain convinced about at least the core of my argument. In the UK, at least, we have something called the "Computer misuse act" (1990 - updated 1998) and this covers the vast majority of malicious activities with computers. In very simple terms, "stealing" computer resources, like graffiti (criminal damage), is a criminal act - though I guess the burden of proof would be increased for web-server attacks - since the misused machine has an implicit invitation for some form of public use.
In essence, I believe that these malicious acts should be treated as criminal rather than civil violations. As such, I can see no valid reason for leniency merely because the victim was able to recover cheaply. Similarly, I see no reason that punishment should escalate merely because the victim was incompetent at security - in many cases this security is already a requirement in law of anyone who stores personal data.
Morally, I believe that punishments should relate to criminal intent rather than criminal success. I recognise that offences committed by children, juveniles and adults are best dealt with differently - however I can see no reason to adopt a victim-driven penal system where punishments are determined by the consequences of the criminal acts.
1) spank 'em. Like they do in Singapore. Sell tickets to the event. Guaranteed to work, if anyone was brave enough to suggest it.
2) make their legal guardians pay a fine say $200 per event. They shoulda been teaching their kids not to be vandals. Then they can provide the spanking (see 1) at their own leisure.
Nah, I didn't see any flamebait in your post. I think we're coming at a similar position from different directions. I'm not suggesting that punishments should be victim-driven, or determined by the impact of the crime. But, I am suggesting that, as in other areas, some cyber crimes will be more or less serious than others, and their punishment should reflect that. E.g., murder is more serious than attempted burglary. We just need to follow this same paradigm re: cyber crimes.
-- Slashdot: When Public Access TV Says "No"
1. Re: "lesser punishments"
> That's unfortunate, because there already are examples of laws where the
> consequences have some effect on the punishment, or even the crime.
My argument isn't that there is no precedent - rather that I oppose the motion...
2. Re: Reduced punishment when the actual damage is easily corrected.
> In both cases, the crime is the same -- fleeing the scene of an accident.
> Driving into your car is not in itself a criminal act.
I, and thankfully the authorities, agree here. I still feel, however, that the similarities are worthy of consideration.
3. Re: value of damage ("what cut off point")
> No, but stealing a candy-bar should not be (and isn't) treated the same way as
> stealing a car, or going into a place with a "shoppiong list" and stealing
> thousands of dollars worth of goods.
Maybe we should? I can see a distinction between taking food - which could be regarded as necessary "for survival" and stealing luxury goods. For any crime the punishment should take into account the circumstances under which the crime was committed, however I do not see why this should be tied to the value of the goods taken or damaged. I want any punishment to be based on circumstance and criminal intent - not estimated cost to the victim.
4. Re: encourage criminals to commit a much larger number of small crimes
> That increases the chances of catching any given criminal, since they
> have to commit crimes more frequently.
I don't know your background, but I'd like to suggest - from bitter experience - that the vast majority of petty crime is never appropriately dealt with. Vandalism and theft from cars is commonplace - often the culprits are known to the authorities yet these matters are seldom resolved. As criminal activity rises, it becomes more difficult to police - not least of all because criminal behaviour becomes normal and culprits no longer stand apart from the crowd.
5. Re: Fagin
> Aren't there already offences that specifically address the issue of soliciting
> minors to commit crime ? Why not just hit this Fagin guy with multiple
> counts of this offence ?
There are a few practical snags:
I strongly suspect that it would be very difficult to prove beyond reasonable doubt that Neo-Fagin had solicited the criminal activity.
The most likely source of evidence would be the juveniles encouraged to act on Neo-Fagin's behalf - and I see no reason for them to break Neo-Fagin's trust by offering evidence - especially if by denying his existence there are no significant consequences.
I guess you are assuming Neo-Fagin is a prosecutable adult... I see no reason he might not turn out to be under age too - which I suggest would throw another proverbial spanner in the works.
remove the words this sentence :
"Believe me, the complete lack of evidence when it comes to linking Iraq with Bin Laden isn't without extreme lack of effort on the part of our government."
should be:
"Believe me, the complete lack of evidence when it comes to linking Iraq with Bin Laden isn't without extreme effort on the part of our government."
Sorry about that.
Get rid of the first three words in the above post and it will make sense. Again, sorry, this is what happens when you revise sentences as you type them. I must need more caffeine.
Consensus then :-)
The younger is Robert Tappan Morris, and he's at MIT http://www.pdos.lcs.mit.edu/~rtm/. Among other things he's done some stuff on high-performance routing and computer security.
The elder is Robert H. Morris, not sure the middle name.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks