Slashdot Mirror
Adrian Lamo Charged With Hacking
retro128 writes "Drifting around the US from state-to-state, Adrian Lamo has been making news for some time with his 'White Hat' hacking exploits. His highest-profile hacking has included Excite@Home and Yahoo. After he would break into a network, he would call up those in charge of it and help them fix the holes. So far, it has earned him praise from the administrators of those systems, but now SecurityFocus is carrying the story that the FBI has filed charges against him, and currently has his parents' house staked out. The records are sealed, so nobody knows who is responsible, but Lamo suspects the New York Times initiated the investigation when they found out how deep into their system he got."
Adrian : Rule #1 : If you seek credible, first hack your own personal details to requisition a new surname.
Maybe the real problem that the New York Times has with Lamo is that he was able to read stories without having to register for a free account. (Hell, that stupid registration requirement make me want to hack them too.)
By fark.
Who needs more greyhats running around testing security without so much as permission?
Maybe I didn't install a deadbolt and an alarm system, but who made this guy the "helper" of my problems?
There are no white-hat, gray-hats or black-hats. Only criminals and law-abiding citizens.
SIG:Slashdot: indymedia for nerds.
He could atleast have the decency to knock. pity for him, i have not little wanker.
He was violating the law. He did not have prior authorization when he hacked into these systems. While some companies may have been happy to be warned of the vulnerabilities they had, and were glad to have them fixed, what he did was still illegal. He should deserve to be arrested, but given his motives will hopefully be given some leniency when it comes to sentencing.
A slip of the foot you may soon recover, but a slip of the tongue you may never get over. -Benjamin Franklin
Here's a link to The Screen Savers (on Tech TV) that has some information about what Adrian had to say when he called in live to speak with Leo.
-- Never monkey with another Monkey's monkey
Well, zero tolerance. The thing here is that to an awful lot of people, and especially those who make the laws, hacking is hacking is hacking, who cares what someone says they were doing it for.
I can realy understand how someone could consider that they're doing a service for admins and all of that, but the point is that you are still breaking into a system and then turning around and saying, "hey, this is a security hole, you should fix it" is kind of like G. Guido coming down to your house, breaking in through a window with a golf-club and then saying, "Hey, I can break into your house, better listen to me or I'll do it again."
I'm sure that Adrian has some noble goals, but fundamentally when a company decides that they don't like people creeping into their system and then presses charages against those who do, it's their right to feel that their security was violated. Good luck to him really, but there are other ways you can help people protect their network security than by breaking into them.
Heheh... when the agents wanted to come into her home, she told them to get stuffed and come back with a warrant...
That's love, folks.
It would be ironic if this was set up by the NYtimes. I thought investigative/secret camera/sting operation reporting was supposed to be agressive journalism... couldn't his "hack" be considered the same sort of thing? "Unsporting" doesn't begin to describe it, particularly if he was up-front and honest about helping them out. If the NYtimes can investigate, blow the whistle on others, and embarass them into action, I'd say the same card can be played against the Times. "Sour Grapes" anyone?
Yes, he was likely technically in the wrong, no doubt about it, particularly if you adhere to the letter of the rule, rather than the spirit of the rule... even so, this seems a bit heavy-handed.
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
If he's going to hack websites, even with the best intentions he's still breaking the law. It seems it would be better for him to work at a security firm (or open his own) and at least get paid for all his troubles. Then he'll be rich and he'll be praised for basically doing the same thing.
Lamo's hacked Excite@Home, Yahoo, Blogger, and other companies, usually using nothing more than an ordinary Web browser
Is this hacking functionality part of the kitchen sink in Mozilla ?
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
Yes, he did something illegal.
He did something wrong.
He might be able to prove or suggest no criminal intent, which would give the lenient sentence.
But really why was he doing this? it was dumb.
I am not sure what he did at the New York Times can even be considered hacking.
So far as I can tell he set his web proxy to the address of the company infranet, surfed around that, downloaded some documents and used the information contained in these to get some more.
Whilst I don't approve of hacking per-se, I'd have to say that here, this is very little more than exposing a badly designed web site.
Imagine that you go to you Gas company's online web site, look at the URL and see your account number in it. You think to yourself, I wonder what would happen if I changed one of the digits. You do and lo and behold up pops all the information to another customer.
Now you can go for your 15 minutes of fame and ring up SecurityFocus or you can have a quiet word with the Webmaster of the Gas company - either way, you are not a hacker.
This lame weasel has been publicly boasting about his escapades for over a year now. It's about time the authorities caught up with him. I suppose that they will use this as another reason why Andy Griffith and Barney Fife need the Patriot Act.
He must have been living under a very large big rock for a long time, if he thought this kind of behaviour has ever been accepted by the authorities and most sysadmins.
And by the way, hacking systems without permission have never been white-hat. At best, I would call it grey-hat, although black-hat is certainly also fitting.
If we start judging people on intentions instead of what they do, I think most people will start complaining. "No, I was only trying to help the sysadmin, so I haven't done anything illegal", is about as stupid as "You thought about stealing that car, so you should go to jail for that".
Slashdot's first reaction to VMware
Wow so I'm not alone in this world. (for those who know me) Anyway, I wrote up an article about the Blaster scapegoat, guess I'll do another one. The ONE THING TO NOTE (I will not rant on about this too much) is how supposedly he accessed information on federal agents. Not to start a conspiracy theory thread or flame war, but shouldn't this be the obvious reason why they are going after this guy. Think about that for a bit. Sure he accessed their site, but they should also go after the vendor if they're sincere about being pissed off at the actions of this guy. If a car salesman sells you a car and states it has an alarm, yet the alarm doesn't work who do you blame the thief? Or would you go back to the salesman. Shit, sorry I have no time to finish this
MoFscker
Give me a freakin' break here. The guy obvious knows his stuff, why don't they just hire him. the New York times should have fire the idiots who setup their system.
Information wants to be free! [sic]
--fetch daddy's blue fright wig, i must be handsome when i release my rage
Give me an axe and I can hack a network too, and call up those in charge of it and help them fix the holes.
And assuming the NYT servers have wooden casings, I can hack deeply into their system as well.
The better approach would be to ask them beforehand, or notify them of potential security holes first. Similarly, walking into someone's house and telling a petrified mother the left their door open probably isnt a good idea.
OK , I get your point, But think about this one... If he had gone to them and asked them. They would be on a Hightened sense of security. Using Your example lets say i was going to break into your house to "test" the security. I told you i was going to do this. Guess what you would do for the next weeks. YOU would make sure you lock your doors and windows at all times. but if i would not have told you / asked you . mybee you leave for work in a hurry and forget to lock your door ! mybee sometimes on a cool night you open your window a little and forget to close it. I think you get the point.. Even if the Corp. does not actively tighten security for the "test" hack they are still going to be watching there logs more actively and such. The point is simple you can't do a true Test of Security by letting them know it has to be random and un planned.
I suggest, from this day forward, we replace lame in speech and word with Lamo! (Or for the Arizona Slashdot readers, perhaps Slashdot could give out Lamo Bags from a new Wallace and Lamo show.)
that he knew he did not have permission to access, by his own admission.
Any way you slice it, that breaks the letter of the law.
If you want to test the secrurity of my network without getting charged if you break in, then I suggest you obtain myh persmission to do so in the first place.
Analogy: You find a guy walked in your front door cause it was open, snooped around your house, your bedroom, your closet... then told you "You shouldn't leave that box of money in your closet, and you should leave your door locked".
Is he guilty of trespass / unlawful entry? Damn straight. Would you feel violated? Damn straight.
If you break into someone's house, telling him after the fact how yo got in does not automatically pardon you from the crime...
Had Adrian simply notified the New York Times in a timely manner about the open proxy servers, he would have been fine and probably accomplished his mission.
Instead, he took his time cracking the system, widening the holes so to speak, and then went to a reporter(!), of all people.
There is nothing inherently wrong with his desire to improve security. There is nothing wrong with him looking around the public spaces on the internet for chinks. What was wrong was that he failed to tell the people maintaining the chinks directly about them, widened them until he got at valuable data, didn't tell the affected people about the data he had received, but then went to a third party and told them about the wanging big hole he had made. I'm sure he views himself as a knight in shining armor, but in this matter he behaved like a publicity-seeking self-promoter.
Yes, shame on the NYT for misconfiguring their systems, but even more shame on Adrian for doing something so illegal and counterproductive.
It does not matter if a person thinks he's a good guy, he still does not have carte blanche to do whatever he wishes.
I know what happens next...the "good guys" will try to save him from the agents.
Remember Lamo, choose the red pill.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Disclaimer: the Man owns me.
Hey, ya know, I remember when when I got my CISSP and NSA training way back when that I had to sign off on a code of ethics about these kind of things. Since then, I've heard two very good interpretations of the code by two interesting sources:
An old friend from TKE:
Ya don't touch the booty til the booty invites you in.
Jack Nicholson:
Never rub another man's rhubarb.
Seriously, though. Pick your government or private sector security standard. Access Control, Authentication, and Accountibilty are atthe forefront of all of them. The corporations in question have no way of knowing what he did inside their networks, what he saw, and who he told. All three of the standard elements of information criticality -- Confidentiality, Integrity, and Availablility -- could have been breached. Would you prosecute?
I would. And my father taught me something relevant -- a man who believes he's innocent is rarely found on the run.
Except maybe Harrison Ford. Man, he's getting old.
M
trustedworlds.net - gaming, security, and the gunk that lives in between
from the techtv site...
"Lamo hacked into the website of The New York Times in February 2002 and took the Social Security numbers of several people. He then added his name to the list of contributors to The New York Times and notified the paper of what he'd done."
kind of like this....
middle-aged man #1 (Lamo) - "hey, i screwed your 16 year old daughter. i took her virginity, but i have to tell you she wasn't very good."
Lamo expected this...
middle-aged man #2 (NYT) - "oh hey thanks! i'll get her some literature and make sure she's up to speed!"
But instead he got punched in the face and sent (pending) to jail.
do you really think he had the "good" in mind? "i'll just take a few socials cuz thats harmless." what a putz.
From the article:
"'I hope there will be a time when Adrian can do positive things that everyone agrees are positive,'"
This service analogy, or the positive light of the grey hacker's actions, does have some weight, as the hacker can inform the admins about the specific flaws of their system security.
But then again, any service should be prompted or invited. And a larger problem is this isn't just washing windows, these are problem areas, flaws, and security flaws at that. These might even give access to a company's dirty laundry. So not only is this service uninvited and not approved, it gives access to private company resources and information, and uses the security holes to get in.
Yes, I assume if security is the only dimension that your job entails, then this is all worth it. But to most people in charge, and arguably the general populace at large, this is an intrusion by illegal means.
I personally value my private virtual space. If you get on my computer and get into my root account, it's an intrusion. Yeah, I will listen to how you did it, but for your troubles you'll never use my computer again.
What if I just leave a signed note on the inside of your car that says "follow these three easy steps, and then no one else will be able to break into your car again"? Do you say "hey, thanks, buddy!", or "hey, someone broke into my car!"...
pb Reply or e-mail; don't vaguely moderate.
that the FBI has filed charges against him
If the FBI has the resources to throw into this kind of thing, then it must mean they've got the whole terrorism thing solved.
Son, DON'T COME HOME! They are staking out the house! Thanks Slashdot!
To sent this one to the top. I agree entirely. For the past year I have turned the tables and gone from creating overly complicated web applications for other people to running my own business. When I was working for an ISP, I would have probably appreciated a call like that--but now that it's my sensitive data at stake, it's a big no no. I mean, admitted his motive was good, but he still gained access to sensitive data. It's like breaking into a bank vault to prove the money isn't safe--somebody is totally going to take you away in handcuffs.
-----
jonathan barket
OK, white hat cracking someone is still cracking their system, no matter how benevolent the intent. But this part just makes my blood boil:
French did not know what the specific allegations were, because the charging document is sealed.
Especially in light of this part of another article that people need to spend more time reading:
In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial, by an impartial jury of the State and district wherein the crime shall have been committed, which district shall have been previously ascertained by law, and to be informed of the nature and cause of the accusation; to be confronted with the witnesses against him; to have compulsory process for obtaining witnesses in his favor, and to have the assistance of counsel for his defense.
Excuse me, what part of cracking the NY Times is a threat to national security? Why are so many court documents sealed these days? There is NO legitimate reason for securing this sort of charge. Even if the prosecutors were to go as far as claiming he were a terrorist, there's still no nuclear weapons secrets (which we all know by now anyway, despite being classified) in the NY Times payroll database.
He should use that in his defense; because the case was sealed, it's unconstitutional and therefore he can't be found guilty.
I don't support this sort of vigilante white hat hacking, but I oppose ignoring the constitution even more.
--GrouchoMarx
Card-carrying member of the EFF, FSF, and ACLU. Are you?
If he was hired to test security it would be a different matter. But he allegedly broke into those systems without permission. That puts him in violation of Cybercrime laws.
I feel sorry for him, because he did allegedly report the weaknesses to the admins and he could have just read the data and not told anyone and used the information for his on purposes. So his intentions were good, to plug security holes by finding them and telling the admins about it. But he is doing it the wrong way, without permission.
He may want to think about pleading guilty and making a deal to get reduced charges. This will make him famous and when he gets out of jail and ends probation, he can become a security consultant. Otherwise they may try to make an example out of him and charge him with a full pentalty and any other charges they can think of.
But then the places he broke into didn't use good security practices and didn't apply the latest updates. Personally, I wouldn't put a machine on the Internet that contains sensitive data on it that only my company should have access to like contact information, credit card numbers, etc.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
I wonder how much trouble he would be in if he had asked the companies' permissions before plying his trade
He wouldn't be in any trouble at all. Most responsible CIO/CFOs regularly contract with third parties to test their security. These usually involve full on intrusion attempts including social engineering attempts. They pay a hefty sum for such services and usually feel a little better if something(preferrably minor) is actually found. That way they have something to fix and feel even more secure than when they are told that they are completely secure from the outset.
What Lamo does is simple, straightforward, black hat cracking that he feels is justified and made legitimate by not causing damage and then reporting his findings to the appropriate people. What it really is is bragging on his part in an effort to boost his pathetic ego.
"but Lamo suspects the New York Times initiated the investigation when they found out how deep into their system he got.""
Ah. This will lead to the perfect explanation of the Jayson Blair problem and other NYT prattfalls:
"It wasn't us. Lamo hacked our personnel files to make sure Blair was hired and employed. He also altered our articles so they were not longer factually pristine."
Don't blame Durga. I voted for Centauri.
There is an interesting follow-up thread in the Power Tech Forums's message boards. Check it out.
Lamo broke into the NY Times computer and found out that all their news stories are ghost written by the CEOs of Haliburton, Bechtel and Enron.
Mr. Lamo did operate http://www.inside-aol.net (or was it .com ?) for a while. Maybe AOL wants revenge.
I know what many of you are thinking. Why not tell these companies BEFORE you break in?
Because IT'S NOT FUN, that's why. Or perhaps more accurately, it's not stimulating.
Hacking these sites takes time, and the payoff is getting inside and saying, "WOO-HOO! I DID IT!" The fact that he does nothing malicious afterwards and even calls and helps the sysadmins unfuck their systems is a testament to his character.
For those who would compare his antics to breaking into your home, but not stealing anything, it's a poor analogy. Why? Because your house is your personal meatspace. And if he went inside, he would see many things personal to you, such as family pictures, your kid's toys, or if he was REALLY unlucky, your fat, naked ass sitting in a Lazy Boy with a bowl of chips balanced on your ponderous belly, flipping through the channels.
"Uhhh... hey dude. Your lock is vulnerable."
See? Just not the same.
Getting past a computer's defenses is not the same as physically entering a home or bank vault, though I would find the latter far less intrusive than home invasion, especially if he never even touched the money.
Now, if he LOOKED at personal/confidential files once inside, that is a different story. But beating a system's defenses, with the only ambition of proving you can do it, then calling the responsible party and helping them fix the security flaw SHOULD NOT be punished.
Misdemeanor, at most.
It doesn't matter what he could have done while inside, it matters what he did, or more specifically did not do while inside the system.
"That bastard! He saw my FILE NAMING SCHEME!"
Yeah, he should fry for that...
Knunov
Why do users with IDs under 100,000 or over 700,000 usually have the most worthwhile comments?
If NYT wanted a security audit of their system, they would have paid someone to do it. Since they did not, they obviously didn't want one. Good intentions or not, Lamo broke the law and deserves to face the consequences of his actions.
I realize that it's "chic to be geek" here with the whole "white hat" hacking stuff, but be realistic. After all, you don't see people doing the physical analogue of white hat hacking. That's B&E.
So he's a gray hat hacker who has fallen into shadow. Will he come back as a white hat hacker, more powerful than before?
"We'd like to see the market decide who the winners are in the software industry,"
A typical American Business failure; to realize not every country wants a Republic governments backed by a capitalistic economic system. I think MS is just pissed because they haven't found a way to buy off the governments in Asia yet.
This SIG pulled due to lack of funding. (This damn war is costing too much!)
If you're in the United States, get out now. In this country, "hackers" are branded "cyberterrorists" and anything you do with a computer is treated worse than many rapes and murders. Get out. There is no sense dealing with these people... you will be treated like an animal by a bunch of animals and there will be no justice.
I should know. I had a little bout with the FBI from some messing around with computers in college. They nearly destroyed my entire life. A felony for such a minor offense? Insane.
Join Tor today!
Everyone enjoys comparing hacking to breaking into someone's house or trespassing on private property. It is not. You cannot be 'inside' someone else's server. (It is doubly impossible given the girth of most hackers.) The physical definitions fall apart. And the metaphorical analogies do not mesh physical property and Turing machines so well.
We can begin with what we do know for sure about hacking. A hacking incident is when someone sends packets of information (in some form and by some medium) from a computer or computers to someone else's computer or computers. Which packets are illegal and which are not? Any exact definition raises problems. You can say that any packets that change the functioning of the target system in an unintended way is hacking. So the ignorance of the owner becomes the limit of what is or is not hacking. Faking an email address on a badly designed sign up page (or using mailinator) might be hacking under that definition. Other definitions are similarly problematic. Currently our legal system tends to default (once it actually gets to jury trial) to the above definition, but (in effect) adds that the act must be highly technical and use specialized tools. (Other definitions exist, and I am of course willing to bust holes in any particular one you care to suggest--so go ahead and suggest them.)
But there is such a thing as computer hacking. Everyone knows that. Even if we cannot have an exact legal definition, we know that some things are clearly computer hacking. What is the best way of creating law (which is now inexact) to deal with this behavior? I would suggest making the motive of the hacker one of the main considerations of law. It is always hard to for legal systems to judge guilt based on motive--and they should not if they can avoid it--but in this case, they must either judge the motive of the victim or the perpetrator. If the motive is vandalism or theft, then the act should be punished. Adrian Lamo's motive appears to have been an act that should not have been punished--though it is highly important to state that we do not yet know the facts.
If a person is caught *while* doing this sort of hack how can you explain all you wanted was free publicity ? If i see a person going around my house the first thing that would come to me is a baseball bat !
"But if someone noticed that you can see into your bathroom and bedroom from the street, do you get them busted for being a peeping tom?"
In order for your analogy to be complete, you have to remember that he entered and altered things.
So, it is not a peeping tom you can compare it to. It is someone who busts in, pees on the floor in the bathroom, and drops pizza slices on the bedspread in the bedroom.
"The guy's not threatening anyone, nor is he stealing or endangering anyone's life."
The same can be said of someone who breaks into your house while you are gone and rapes your wife. Hey, he didn't take anything or threaten anyone's life, so it must be OK, right?
"The "Housebreaking" metaphor doesn't realy apply."
Yes, it does, since he entered. Your "peeping tom" analogy would only have worked if the guy was looking at material mistakenly put on public web sites.
Don't blame Durga. I voted for Centauri.
1.) He will write a book
2.) Make a movie
3.) Profit
you
But anyway he clearly violated the law, so it is mostly fair (albeit pathetic) that he gets prosecuted. He must be either very brave or stupid (or both) to do such things knowingly. Once I want to blame the law, but anyway there is already plenty of ethical ways to break the law badly.
Maybe the law should be amended so that the cracker will not have jailtime if he can prove that his intentions are good, and no actual damages are done.
Come on. This guy has been breaking computer laws for years. Entering a system without prior authorization is against the law, period. Two things amuse me about Adrian Lamo: 1) He has never demonstrated significant or diverse knowledge of computer networks. The methods he uses to enter systems are trivial and repetitive. His ego is the only thing that can't be replaced by a simple script. 2) He brags about not accepting or extorting money. It's just as sickening that Adrian Lamo is all about fame. As the article points out "In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter." As usual, Mr. Lamo talks to the cameras before talking to his victims. This is how this guy gets paid: national press coverage. To any security professional, this guy is a complete joke. Let him slide back into obscurity.
isn't it funny when one goes to a restaurant one never orders "mutilated beef with a side of some green plants recently killed" or "recently slaughtered hen with a side of some rare mushrooms you're helping tmake extince". Everything is an opinion in this world to think otherwise is deadly, remember this youngling.
crisis @ politrix dot org
He might be able to prove or suggest no criminal intent, which would give the lenient sentence.
No intent means no mens rea which means no imprisonment.
Will I retire or break 10K?
Here in the US we do not tolerate these activities. He knows too much which makes him a potential terrorist. Using his skills without a license, without the authorization of the government, without legal protection, will land his ass in prison.
That a homeless guy is a better hacker than you.
I think it's great that he's been arrested. Hackers can't use telling the administrators as a shield, legitimizing their crimes. Hacking is illegal, plain and simple. Adrian Lamo is no different from the script kiddies that hack cable users for use in zombie networks. It's still hacking, he just went for a "bigger" prize. Then, to justify the crime he committed, he tells the administrator how he got and how they can fix it. It's still illegal, it was still wrong.
Thank God he's been arrested.
I realize this will be an unpopular point of view with 98% of Slashdotters, but...
If you can't do the time, don't do the crime. Its that simple.
Regardless of if you agree with it or not, the law is the law, and it is currently illegal to hack in to a system without permission. If you don't like it, then work to get the law changed. And in the meantime, don't expect sympathy if you get busted for breaking it while knowing full well you could be prosecuted. Any man with brains enough to hack in to a system should have brains enough to know he can get busted for doing so.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
Lamo broke into the NY Times computer and found out that all their news stories are ghost written by the CEOs of Haliburton, Bechtel and Enron.
It would be more likely that Lamo found evidence that the NYT really is run by former Soviet "useful idiots". We are talking about a paper that has its own Pulitzer prizewinning apologist for Stalin.
Though in all fairness the NYT is likely just another bunch of leftist hypocrits. They complain about high prision populations, police "brutality", the Patriot Act, AG Ashcroft, etc., but when some kid makes them look stupid they go running to the FBI. Pathetic.
and which letter? I never knew there were so many attorneys reading and posting on this forum.
Think about this example:
I walk though a college parking lot, at night. I see a car with its lights on, unlocked. I open the door and turn the lights off, and maybe leave a note telling them to be a little more careful in the future.
Does that make me a criminal?
There needs to be an independent 3rd party who vulnerabilities in _deployments_ can be reported to.
Then they can contact the vulnerable organization, give them time to fix it and if they don't, publish the vulnerability. This protects the White Hat.
I can't tell you how many web sites I have found with various vulnerabilities that once I tried to contact someone to notify them they totally ignored it.
We are paying the costs for their insecurity in various ways already (credit card fraud comes to mind) yet we have no way to help prevent it!
That needs to change.
Wax on, wax off baby!
Drago - you are a fool. If you are hacking people's systems without their permission, YOU ARE BREAKING THE LAW. PERIOD. END OF STORY. If people were allowed to say "Well, I was doing it so I could help their security", then you would have all sorts of Blackhats hacking systems, and then claiming, "I was going to help, but you arrested me first." No.
Look, there are ways to do security checks like this, without the security teams knowing that you are doing it. Get permission, make sure that no one is tipped off, and then test the systems.
If there is one thing I can't stand it is people doing illegal actions and then claiming they are doing it for the greater good. This type of action cannot be condoned. Sure, you might be doing help, but you also might not.
It is human nature to take shortcuts in thinking.
and that's ethical vs not, whether it's hacking, or journalism.
Journalists are supposed to operate by an ethical code, and the vast majority do so. Journalistic ethics would say that you cannot break the law in order to get a story... though that's not say it hasn't been done. Check out this link. It would seem that ethical standards in journalism are quite flexible, and that there is no set rulebook. Instead, as in ethical dilemmas in many disciplines, one must weigh competing evils. The evil of impersonating someone, or operating under a false identity, veruse letting a politician go on with corrupt, harmful actions... which weighs more, and who decides?
By the same token, one might make the same argument for Adrian's actions. He intended no harm (as an investigative reporter might intend no harm in impersonating someone else to get a story), so the Mens Rea AKA "guilty mind" did not exist. Reporters often argue, when investigating and digging into the lives of public figures and officials, that those officials have less of an expectation of privacy than regular citizens... and to some extent they're right. Yet, how does the watchdog presume to waive the privacy of others in the pursuit of a story, while immediately running to the FBI? The media also argue that they have the right to dig, based on the fact that they are defending the public's "right to know." (how many times have we heard that?) The media assumes that power as society's watchdog... but who's watching them? Apparently, Adrian was, and they are NOT happy about it.
It's doubly ironic that an organization dedicated to exposing the truth (ostensibly in a transparent, above-board, and for-the-greater-good fashion), is getting their panties in a bunch over someone showing them some truth in a like manner. Apparently the old grey lady doesn't have a problem airing the dirty laundry of others, but is awfully sensitive about her own problems... and from an ethical standpoint, Adrian's actions are probably arguable either way.
I'm sorry, but I find this whole thing incredibly funny.
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
I have no sympathy for him. Regardless of his intent, he willfully violated the law when he infiltrated these corporate systems. The other companies whose systems he hacked were certainly under no obligation to express gratitude when he informed them of what he did. Am I supposed to thank a burglar who breaks into my house then tells me how he did it afterward?
If he is actively contracted by a company to attempt to exploit weaknesses in their IT infrastructure, that's one thing. But if no such agreement existed, his actions constituted a crime no matter what his intentions were.
Funny/Insightful
'nuff said.
Read, L
maybe he can use his superior social engineering skills to talk his way out of a friendly encounter with bubba and his two cell mates...
one can only hope...
We should just forget about crimes that are going on in our country and focus solely on those that *might* be perpetrated by the evil desert rat in the hat.
"Dear concerned Citizen, We know we live in a country with laws but we're too busy to enforce them. Good luck. The FBI"
Gimme a break.
Ben
Work Safe Porn
Gay means happy. Only in the last few decades has it been used to refer to homosexuals. You obviously don't read much.
If it is correct that all Adrian used was a common web browser to access this information for the NYTimes web site, I relate his actions to something that I have done in the BBR.
Take the fact that you have pulled into and parked in a public parking lot of a department store. Upon exiting your vehicle your notice that the car next to you has a set of keys in the door and no one is around. You check the engine and notice that it is cool and has been parked for quite some time. You check the doors to make sure they are locked and if not, lock them. You write a note stating that the owner of the vehicle had left they car unsecured and should check with the manager of the department store for details and after leaving the note on the door, you take the keys and give them to the manager of the department store telling him/her that one of their customers had left their keys in their car door along with the details about the car to verify who the owner is when they come to claim them.
Are you not at this point guilty of illegally entering the property (the vehicle), and theft of personal property, even more egregiously, security measures for such property?
I am curious as to why those whose information was easily available on the NYTimes site are not suing the Times into oblivion? I see the bigger crime as stupidity on the NYTimes part.
But hey, I wasn't looking over Adrian's shoulder as he was doing this so I could be blowing hot air out my ass....
My server, my property.
There is no confusion. It's only confusing to people who can't get past the "it's on the internet" part.
Property Laws can easily be applied to cases like these.
You have no more right to dick around on my lawn without my permission as you do to dick around with my server. You've entered physical property and used my physical lines which cost me physical money to get there.
I don't care if you physically stomp on my garden or fly your radio control airplane through it to damage it. It's the same thing.
People like you would probably demand a "damage caused by remote" law on the books for such an occassion.
Current laws suffice.
Ben
Work Safe Porn
No, this is more like telling someone they left their keys in the door. No gratitude.
-=- Many seek good nights and lose good days.
Another well-known periodical, the Wall Street Journal was quite cordial when these kids cracked the Journal's session authentication scheme. I can see how exposed SSNs and address books could spook a company a lot more than a cracked online subscription system, but it's still a disparity worth keeping in mind if you're one of those folks who's keen on voting with his consumer dollars...
I understand most of the arguments against what Lamo did, but there are a few points I want to get off my chest:
1. To all those saying, 'Its like he broke in your house': No it isn't. The machines were connected to the internet, which is a public medium. A house is a physically closed space where courts have rules one can have an expectation of privacy. Nobody can claim that the internet should provide an expectation of privacy - by its very nature of using shared resources it flies in the face of such an argument.
2. I don't know how it needs to be done, but truthfully do you (the collective Slashdot you) trust companies to secure their networks, perform audits and be upfront and honest about their failures? If I were a NYT partner I would be furious that my information may have been publicly accessible, yet I would never have known about its vulnerability without Lamo. How many companies have been hacked, had credit card or other info stolen, and just not said anything about it? When Acxiom was hacked, personal information on individuals was stolen over 8 months before they "discovered" the hack - and the hack was found by Hamilton County, Ohio Prosecutor's office when investigating another case that had come forward. What are the chances that Acxiom KNEW they had been hacked, compromised personal information, and said nothing? I am guessing with the current climate of corporate ethics, a pretty high chance exists that a lot of information is being disseminated by people who stole it and consumers have no idea because the company in question is sweeping it under the rug.
Hacking into someone else's system is bad. Nobody can disagree there, but the bottom line is a tradeoff of negative impacts - for what Lamo did I see a lot fewer negative consequences than today's corporate irresponsibility with personal information and computer security.
is not that he broke into the system to helpsecure the system . Adrians problem is that while he was there on his noble quest to help secure the network he accessed Social Insurance Numbers that were stored on the NY Times internal network.
.Don't as me WTF somone would give their SIN to the NY Times that is just plain stupid.
One notable SIN # belonged to actor Warren Beatty (according to Tech TV's show last night)
This kid is going to jail for a long time whether he knows it or not !!
I say, "Why did you have to break into my car to write me a note?"
"Sufferin' succotash."
Finally, a sane analogy. Prosecute him, fine - but the punishment should be no more than a trespassing charge. You can only prosecute him for what he did, not what he could've done.
The problem I have with this analogy is that most people can determine on their own whether their house/car is reasonably secure against break-in. Most people cannot do this with their computer.
You know those boys over at the New York Times are not too bright. First they can't control writers printing false stories, now they can't secure their own systems.
And now they're going to air their dirty laundry by charging the messenger. They'd be better off taking the high road and by employing Adrian Lamo to help fix their problems.
I wonder how many people are going to trust NYT with their personal information from now on?
I also wonder if they've closed their security holes. If not, hackers with less honest intentions then Lamo may run with this story.
-=- Many seek good nights and lose good days.
How many security experts have found exploits and have contacted the network department of the exploited network only to get a ho hum or nasty response of "whatever there are no problems"? Only when the systems are hacked and proved to management that things are ordered to be fixed. The security administrators nautral reactions are usually to blame the hacker even though the hacker had good intentions to help them he also probably cost someone their job. So it's no wonder the security admins probably in a effort to cover their collective arses asked law enforcement to go after the hacker.
I believe this is the case with NYT here. Yahoo and @home are understandably grateful becuase of the potential of lawsuits due to people's computers being hacked and they also would lose business accounts if those businesses perceived that the network was insecure. Even though all ISP's have a disclaimer I have yet to see something happen to where it's brought to court so it's a untested method of deniablilty of responsibility by the ISP.
Hopefully this guy can get out of the mess he's in and some security company will snatch him up or he can become a independent contractor for larger companies.
Either way it takes a security breakin to find the holes as many audits can also miss things. NYT should be thanking this guy.
Looks like the cliche has once again been proved correct.
So, I guess his crime was being in the U.S. . . .
Yeah that is it. He should have moved to China and done his friendly exploits from there. That's the answer! OK!
Seriously, why do you think that because we have less legal course of action against someone on the other side of the globe that we should not enforce laws for people who live here? I do not get this logic, and only see it as a big excuse for people to break the law and feel good about themselves.
No, not all laws and punishments here in the US are just. As I said in the original post, I do hope that he is given some leniency because it does seem like he only had "good" intentions. Good intentions does not totally excuse him, however.
A slip of the foot you may soon recover, but a slip of the tongue you may never get over. -Benjamin Franklin
If he did the so-called 'hack' just by changing proxy settings - I think the prosecution is going to have a hard time arguing that he 'broke' in.
If I have an http server sitting where anyone on the internet can touch it - and I expect no one to visit it, and I want to try to charge someone criminally who does, then I must be smoking crack.
If you don't want someone to have access to something, block all access to it (ports) from outside - or set up a proper VPN 'hole' so that access from outside to those critical systems is properly secured. Use a DMZ for those systems that must be accessed by the public.
It sounds like the network admins at the Times are the real criminals, by lying on thier resumes about thier abilities...
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
The problem is mostly the media themselves...They don't know, and for that matter, their semiliterate consumers don't know the difference between a hacker and a cracker/script kiddie, etc. Another aspect of this is symptomatic of the current political situation...Everybody high and low is paranoid...Regular people, because their media outlets are leading them by the nose, and corporate entities for fear that they'll be exposed for the liars/cheats/manipulators they are...NYT should get their heads out of their ass...It sounds to me like a guy with skills who should be getting payed is getting hammered down...
are lamo.
He didn't alter files, he put his Name and contact information in the editorial database to prove to the Nytimes that their system was vulnerable. You make it sound like he corrupted stuff.
I remember back in the 80s and 90s when youd see a car has left its lights on you would open the doorn and turn them off for the owner.
There's a huge difference between scanning a few ports and having root on a system. That would be your analogies for looking through the window and standing in the lounge.
... and if he didn't have a can of gas and some matches well you can only count yourself lucky.
This guy was *inside* the system with the power to wreak havoc. That *is* the same as someone standing in the lounge
I guarantee that if I find someone standing in the middle of my lounge without having been invited I will fuck him up even if he introduces himself as One Of The Good Guys.
You want real honesty?
Imagine this: Jayson Blair interviewing Bill Clinton, featured in the National Enquirer (I know all about it because it was mentioned in G.W. Bush's State of the Union address, in the section about Iraqi nuclear weapons).
Now, that's bound to be totally factual, isn't it?
Don't blame Durga. I voted for Centauri.
I would really like to see a slashdot interview with this guy.
A Multiplayer Strategy Game for Mac OS X, Windows, and Linux
If it was really as easy as the article states, then NY Times should be held accountable. Seriously, should they not be punished for making sensitive data so insecure. It's not all the kiddiots faults. If there was some sort of punishment for companies using losing security policies, maybe the CEOs would invest a little more money in security measures, and SSN, Credit Card numbers, etc..would be a little safer. Before I ever buy anything online, I always nmap out their server and check for blatant security flaws. If I find one I don't give my card number. ..since it's idiotic they can't disable useless open ports, configure proxy services, patch systems, and whole plethora of other crap that seems like basic measures to insure I don't get screwed when some 14 year old gets bored. Granted breaking into computers is wrong, but not fixing your problems is just as bad.
God people arent we talking about Companies here? They certainly dont care about your information leaking out of their systems, why do you all care if someone breaks into them? He should have broken in, wiped all their servers and posted all their internal emails to the web. Then we would see how "innocent" they were. Companies are not people. Dont compare the two.
This is not a Sig.
...if the compuer in on the internet???
Think of this issue in terms of the web page deep linking argument. There are companies that have placed content on a public network that then object when people link directly to their content (as opposed to going through their interface). The argument is that since they put it on the WWW and made it accessible that they have no right to complain when people use it in ways that they do not approve.
Apply the same thinking to internet cracking. Does a company have a right to complain if the system that they placed on a public network gets cracked? Aren't they granting a tacit permission for someone to look at their computer by giving access to the public?
If they truly valued security, they could take steps to insure that their computer is not cracked - they could place set up a private network, or not put the system on a network at all.
Some will bring up the metaphore of the house. They will compare a computer to a house: You can look at the outside, but don't go in. Is that metaphore valid in the context of the internet? A house is a real world object, an owner has no choice but to place the house in the real world location where real people can get to it.
From the perspective of a cracker, a computer operates in the virtual world - the owner can decide not to make the computer accessable at all. The computer still exists in the real world, but by not putting it on a public network it does not exist in the virtual world of the cracker.
Since there is such a simple means of protecting the information store on the computer, should there be any penalties for accessing it in a way that the owner didn't intend? and if there should be penalties, shouldn't the be less severe than an equvalent real world penalty?
And at what point does accessing a computer become cracking? If they leave a directory shared, can anyone look at it? If they leave telnet open and don't put a password on the guest account, is that considered cracking? What if it is the root account that isn't password protected?
Anyway, those are just a couple of questions I ahve running around in my mind. In writing this I think I've answered them for myself. But I'll go head and post this anyway, maybe it will stimulate discussion.
I will go out today and do something illegal. Lets see... shoplift some fruit from the super market. I'll bring it back in a few hours and tell the manager that they have been robbed by myself and offer my services in helping prevent the same event in the future.
I guess it really matters what kind of mood the manager is in at the time. He could have me arrested. After all, I did break the law by stealing, even though I brought the items back. Or he could let me go and perhaps hire me.
If I am foolish enough to take those chances, I deserve whatever I get. Hopefully he gets some jail time. That will teach him to stay off of my property. If he wants to sell me a service, he should inform me beorehand what he is planning on doing, and let me opt out. that jackass.
I personally think whithats are great, but this guy is walking a fine line. He is using an illeagal talent to profit. He could just as easily blackmail the company he is hacking if they refuse to accept his help in sealing the holes. Either way, he can profit, and both are brought about by a inllegal activity.
I personally am of two minds about this whole thing. I understand that if he really was meaning to be honest and helpful with his exploit of their shoddy system, that he was doing a good thing in helping them correct it. Better someone who would be nice about it than someone who would not tell. but, at the same time, regardless of the intent, he did do something illegal. And regardless of your intention afterwards, it was a violation to their system and property to do so in the first place. So, in all fairness to his intentions, he should be prosecuted after due process. **What IS wrong, however, is that he has not been allowed to see the charges against him. He has said that as soon as he sees the charges against him, as is his Constitutional right, that he will turn himself in, so long as those charges are reasonable. Remember that Kevin Mitnick reportedly had inflated wild charges brought against him in a hacker hysteria and had reportedly had a lot of his rights violated in captivity. If I were him and pending jail time, I would be very nervous in light of this and other previous cracker captures.
Consider this:
You see an open door at your neighbors house. You know the guy is on vacation.
Do you call the cops? Probably not, you just go over and check out the place for him. Most of the time the door was not securely latched, or the kids watering the plants forgot to close it.
But what if you discover that the place has been trashed and stuff presumably stolen. I would call the cops, and my neighbor. Would they be suspicious of me? Yes probably at first, but in the long run they'll more likely be grateful.
Obvisously, there are good reason for laws, tresspassing is one of the fundemental laws throughout history. But, I'm willing to give up a little privacy if and when someone goes out of their way to HELP me protect my property. I'd much rather a neighbor walk through my house in my absence if they think something is wrong.
I also happen to own a tiny hosting company, and I would definately rather have a white hat let me in on specific exploits my system is vulnerable to rather than leave it alone and let the script kiddies do their thing, if I have screwed up.
Unfortunately for Mr. Lamo a law is a law, and with the overzealous (at least on high profile cases) FBI on the case, they'll probably try to make him into another Mitnick.
It is a sad world, everywhere we go policies, principles, and even laws try to dissuade people from working together and co-operating. Capitalism, democracy are great in principle, and can be in practice, but even the best ideals can be bastardized by people in power.
Free software is said to be communism by its critics, sharing code in a CS course is bound to get you expelled, make a backup copy of a CD and face the rather of the RIAA, the world will probably end if the same DVD Can be played in europe, japan and the USA.
This is in my opinion another example of moral decay. We have all these rules and laws that do not promote morals, but rather promote some arbitrary standard of "rightness".
It is the principles of openess, and co-operation that have drawn me to Linux, and free speech software. I'm trying to raise my children right, to teach them to help others for the sake of helping. When something needs to be done, if you can do it, do it. I try to instill them with team values, that together they can accomplish more than they can by themselves.
Its just ashame that the way things are going I'll likely end up looking like a bad parent...
NYT: "We sue you because we want you to know that we can sue you. It's called white sueing. :)"
Correct me if I'm wrong (IANAL) but don't you need an element of intent to commit damage etc to be labelled as a potential criminal?
In other words, if you are hacking with intent to commit credit card fraud etc, you get done under credit card fraud laws because your intent was to steal the numbers and use them in a manner contrary to law.
On the other hand, if your intent is to do a public good for the company (especially if you state this in a sealed and notarised letter held by your attorney prior to the event) then surely you cannot be found guilty of criminal intent?
Visceral Psyche Films
Now back to the real world. If someone called up Yahoo, and said something to the extent of: "Your system is insecure, there's potential for exploitation here and here using bla and bla." They are unlikely to be taken seriously. That is, if they can even get a phone number of someone who will understand them. I think you can guess what would happen if they call the typical customer support. Of course there are exceptions where there are intelligent sysadmins who will listen to someone who knows what he's talking about, and invest 10 minutes to see if they might be correct.
Just so you know, I think it's really not worth anyone's time to go around checking other people's/companies' security. If large companies such as Excite@Home and Yahoo don't have tight security, that's their own fault. They should be the ones looking for consultants to make sure their systems are unassailable. I seriously wouldn't care if they got hacked, especially if they care so little about their customers that they don't make absolutely sure they will be able to offer their service without interruption. To think some people pay for Yahoo Mail...
I thought it would be interesting to see NTY's take on the story.2 68.html
http://www.nytimes.com/cnet/CNET_2100-1023_3-5072
-=- Many seek good nights and lose good days.
...at about 2am and I saw a light on in a jewelry store. I walked up to the door and peered inside, it looked like no one was in there. I gave the door a little tug and it moved a bit. It must be stuck I said so I gave it another tug. something clicked and the door opened. No alarm went off, nothing. I walked around and called for an employee but no one answered. I looked around and saw no one. I went in back, found a pen and piece of paper wrote a note for the guy at the store that his alarm was off and his front door was open or the door lock wasn't working. I shut off the lights and locked the door from the inside so as not to attract thieves, and left.
The next day I found out that the FBI wanted my head and had surrounded my parent's house. Wait, what?
The NYT is one of the most hypocritical organizations today. They sue to get 9/11 tapes of people dieing - all in the name of "openess" and "public information", yet they have a network connected to the public network - which is open and transparent through their own doing - and thats bad/illegal? PLEASE - The NYT's proxy servers were so misconfigured that it was akin to them posting information in the window of the downtown offices and then getting pissed if people read what they posted.
You can bet your rear quarters that if our hacker had been a reporter on a story for the NYT that they would be vigorously defending his actions. Like most large corporate entities the NYT has no moral basis for anything it does, in the end it's about money, not honesty, truth or enlightenment. It sure as hell isn't about the times mission statement which is "The Company's core purpose is to enhance society by creating, collecting and distributing high-quality news, information and entertainment."
Perhaps our hacker should have "enhanced society" by distrubiting the inromation he found to the world. It would have been high quality news to see how one of the most influtential papers is really run.
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
Long story made longer, I left no note and somebody's old hooptie didn't have a dead battery when they got out of their night class.
You gonna come beat me up now, Mr. Internet Toughguy?
It seems pretty obvious to me that hackers doing this sort of thing are simply trying to draw as much attention to themselves as possible, in order to boost their ego and enhance their career options.
Plenty of self-proclaimed "white hat hackers" are low-key individuals, who draft up lengthy "codes of conduct" that they agree to follow, as they discuss security holes and exploits on mailing lists or newsgroups. They generally report holes privately, via email, first - and only (hesitatingly) release details on the flaws if the vendors don't respond in sufficient time.
I really don't think Lamo fits in this category at all!
Besides, if he was so confident his activities were legal and ok, why is he running around from state to state, in hiding? If he felt he had a strong case in his favor, you'd think he'd just turn himself in to the FBI right away, so he could show their folly in court and walk away righteous.
This guy just wants to stir up trouble, and was banking on the mass media portraying him in a positive light the whole time, so he'd land a high paying job doing security consulting. It backfired on him, and now he's on the run.
why not take the chance to re-examine the status quo. i say decriminalize all victimless crime.
not many intelligent gay guys I know say "fag" unless they're mocking an idiot's use of the word. By the way Adrian is gay. His "boyfriend application" is still around from 2000.
- "Hear that?! The percolations are imminent! Cease your ingress!"
so next time you go 5 mph over the speed limit i think you should be executed mafia style cause after all you're a criminal and there is no gray area whatsoever it's a perfectly black and white world just like The Beaver had.
Such a non-issue and so not worth a story here. He broke the law and will go to jail; simple really. Who cares if he's "homeless" or living in the lap of luxury. Let's pile on some more hype to this idiot, shall we?
*Fortitudo, aequitas, fidelitas.*
You're absolutely right, however - I find even this to be frustrating.
Some years back, I was working at a small computer store in a quiet part of town (no crime to speak of, etc.). It was a hot summer day so I purposely left my car window rolled down about half-way, parked it behind the store, and went in to do some work for about 20 minutes.
When I got back, I had a note sitting on the driver's seat from the county police. (It was even on their letterhead.) Basically, it was a hand-written warning from the cop that was patrolling the area, saying my car was an easy target for theives and I should make sure not to leave my window down like that again.
Did it harm me in any way? No, of course not... But I still felt like it was stepping on my rights. Who was this guy to tell me what I should or shouldn't do with my car? I was fully aware of the risks involved with leaving my window rolled down. I surveyed the situation and made a willful decision that I'd rather take the (small) chance of theft, vs. the 100% probability my car would be steaming hot when I got back in it.
As far as computer hacking attempts go, I think respectable "white hat" hackers should stick to exchanging information amongst themselves on what flaw they find, using their *own* systems - and go through proper channels to report issues and bugs. If that fails to get results, publish the exploits if they like. But let other people do the illegal hacking using them. Companies that don't do security patches are on their own, as far as I'm concerned. It's not anyone else's responsibility to harass them into compliance. After the "black hat" comes along and screws them over - they'll learn (or maybe even go out of business from the incident).
They were worried he knew just how much of their news was faked.
----- LoboSoft specializes in Digital Language Lab
As far as I know, John Ashcroft has not yet been able to completely eliminate the distinction between these two distict components of the administration of justice.
Most of the arguments that I've seen here are the sort that Mr. Lamo can make in court. If the court finds that his actions were justified, it has the opportunity to acquit, or to give some other form of discharge.
In my neighbourhood, I would like the police to arrest people they find in jewellery stores late at night, or in my home while I'm on vacation, or on my computer without permission. If the prosecutor or the judge decides that no charge should be made, or that the charge should be dropped, fine.
While I feel some sympathy for this self-appointed security checker, I can't immediately fault the police. Especially without access to the facts of the case, which will be exposed in the judicial process.
One might argue that Mr. Lamo is being punished by having to go to court. I think not. He must have been well aware that his actions were provocative and that this was a likely outcome. Now he will have the opportunity to justify his actions.
If you leave your front door open and I take a look inside your house, what crime have I committed? At most, I am told, trespass. If you left the keys under the mat and I opened the door, it's breaking and entering.
Similarly, if I take your car with the clearly stated intention to return it when I am done (e.g. if I desperately needed to drive someone to the hospital), I haven't stolen it, I've borrowed it -- with or without your permission.
Theft, burglary, etc. are crimes defined in part by the intention of the alleged perpetrator and the damages suffered by the alleged victim.
OTOH we live in a world where one of the first "terrorist" groups targeted by the government after 9/11 were Environmental Activists who destroy machinery but have been careful never to hurt anyone.
But I'm no lawyer.
I know it was rude of me to look there in the first place, but now that I have, would you prefer me to keep this info to myself?
What about the NY Time's liability? They can't just let people access their system against their will knowingly without doing damage to themselves.
Suppose another hacker came along and was not a white hat and there was damage? The NY Times would be asked if they defend their site against known intruders.
I'm sorry this is happening to him - but I also know he's got enough places to hide that they'll have a hell of a time finding him.
This is how we do it in America:
1. find a stupid law (cybercrime, euthenasia, sodomy)
2. break it
3. get arrested
4. rally your support group behind you via the media
5. abolish stupid law
The way I see it, Adrian Lamo has accomplished 1 and 2, is about to accomplish 3, and we're working on number 4.
Go Adrian!
The cure for cancer is coming: Reovirus
This makes me think the solution is this: make an agency that goes around trying to unobtrusively hack certain sites (I guess the biggest ones with more money involved). Lamo did fix some holes relating to banks! So he did some good, only illegally. If it seems important though, make an agency. I read about the idea initially at the Don Lindsay archive. I thought about how much it *could* work after reading this.
Everyone is drawing up all kinds of analogies... but let's be serious.
Did he knowingly access computing resources he knew he had no permission to use, and that he suspected the organisations in question thought were secure and not for public use - Yes, he admittedly did this.
That, sorry, is illegal.
You can go on and on about how he didn't hurt anything, how it was insecure anyway, how his intentions were noble.. but it was still against the law, and he KNEW, or should have known it was against the law, he just banked on not getting charged.
Do I think he should be in jail? Heck no.. but neither should we pretend he did nothing wrong... we drew a line, made some laws that say you can't go poking around in other people's computers without authorisation, and we expect people to follow them.
This isn't a civil rights issue. This isn't a good-guys-vs-bad-corporation issue. This is a guy who knew the risks, and did it anyway.
Accessing someone elses system is irresponsible, despite noble intentions. You don't know what damage your actions will cause, even if you are intelligent, and know the technologies you are using. You don't know what customised systems they may have that your intrustion will interfere with... they have a right to expect you not to be there.
it's fairly clear that NO damage was done whatsoever, and could not have been.
Furthermore, it is up to the owner whether or not to charge him.. he COULD have been charged with trespass.
Of course, it could be argued he didn't knwo if the door was supposed to be open or not, and went to check if anyone is okay.. a store is a semi-public place. This is different than using an open proxy to surf an internal network..
Once again, this is nothing new or mind-bending. It's just another self-made computer hacker with high intelligence and a surprising lack of common sense (which, based upon many of the talkbacks, is shared by too much of the readership here).
The basic principle at play here is stupefying simple: if it's not your property, don't touch it.
Your intentions are completely and absolutely irrelevant. The fact that a business poorly secured its system(s) is also completely and absolutely irrelevant.
If you accidentally stumble upon an open sensitive link that you suspect shouldn't be open, and if you want to be nice, call or email the site operator and explain what happened. And then don't use the link again!
Discovering and using, without permission, a private internal proxy server to snoop around a site you know full well is not intended for you is quite obviously wrong.
The proxy setting did not just spontaneously set itself within this guy's system (due to a virus, trojan, or whatever). He explicitly set the proxy with the express purpose of breaching the private property of another, without that other's prior permission. And to make matters worse, he then intentionally rummaged through the system and much personal information.
There is nothing in this story that makes Adrian Lamo out to be anything other than a retarded crook.
My personal opinion is that he should be sentenced to 60 days in the county (or city) jail and fined a few thousand dollars. Maybe after having to shit with unsavory witnesses in a tiny enclosed space for a couple months, he will discover a stronger sense of respect for the privacy of others and of their property.
As part of my job, I have to frequently enter and move about the county jail. I don't know the exact dimensions of each cell, but it's close to 5x9. The toilet sits in a corner tucked between the bunk beds on either side of the cell and faces the surveillance camera. There is not even the illusion of privacy, and there are no ventilation ducts in the cells. To ventilate the cell from the stench of feces requires the steel, computer controlled door to be opened. And the doors are only opened periodically (for meals, scheduled exercise, inspections, etc.). The shower (most pods have only one) faces the public area of the pod, again eliminating any sense of privacy. And this all applies to the low security pods. The high security pod is a totally different (and much worse) story.
All county employees were given a full tour of the jail before opening day (the jail is less than two years old and is quite technically advanced), so I was able to inspect all areas of the jail, and I witness its daily operations on a daily basis as part of my systems support role. All things considered, it's an awful place to live.
It seems to me that Adrian's sense of values could only improve with a short stay in such a facility.
From related story http://www.securityfocus.com/news/358
[Li]mited amnesty for hackers was too much for NFR Security CTO Marcus Ranum, who signaled his dissent by applauding alone from the back of the room at the mention of a legislative proposal that would make some hackers eligible for life imprisonment. "You guys are a bunch of security professionals and you're sitting here making apologies for hackers," said Ranum. "That's the lamest thing I've never heard of."
In an interview later, Ranum called Lamo a "sociopath," and said his hacks are indefensible. "It's against the law, how much more cut and dry can you get?" said Ranum. "If society was comfortable with what's he's doing, they'd change the law."
Perhaps he doesn't like the fact that Lamo is doing this for free instead of making the NYTimes pay through the nose?
Well, the big reason he was taking his sweet time was that the federal prosecutor sealed the charges. When you see sealed charges today, you know that's the thing that goes hand-in-hand with being disappeared and threatened with charges of terrorism if you don't plead guilty.
Sorry, but I don't think I'd do anything different in those circumstances.
"You're never ready, just less unprepared."
So what? The end result is positive. If a person points out critical security flaws in your system, he's doing a service for you. True, it's obnoxious and even a little scary that the person could stick his/her nose that far into your system,
Being confident that what you're doing is okay doesn't mean necessarily that you trust that the legal system/government won't fuck you over. Ruby Ridge or Waco anyone?
What's the point in driving white-hats underground? What they do is good for the internet community. And the NY Times is being a bunch of wrongheaded dicks for fucking with that.
Let them know that they're doing a disservice to the internet community.
t te rtoeditor.html
Give their public relations guys a call and let them know they're making a bad move.
http://www.nytco.com/contact.html for phone
Or via email:
http://www.nytimes.com/ref/membercenter/help/le
I'm surprised at how many "good ridance, the jerk shouldn't break the law" posts I've seen, especially when breaking and entering, in the context of computer security, is defined so vaguely. From the context of the article it sounds like the hack in question, of the New York Times, involved accessing data by "anyone capable of properly configuring their Web browser." If someone accesses a page on your website that you didn't mean for them to see, heh, they can't read your mind. And, might I add, the metaphors of someone "breaking" into your house or car don't quite fit. The nytimes.com is a huge publically accessible website (duh). A more appropriate metaphor would be someone going into a department store and walking into a room meant for, but not listed as, authorized personel only. If he had used some social engineering to obtain passwords, exploited a software bug, or used a trojan or virus to hack the NYTimes, I'd agree that the guy is at fault, but using your web browser to access data wasn't illegal the last time I checked.
All they have to do is keep on punching the 'Fear' button. The general public doesn't see the Adrian Lamo case through the same lense that Slashdotters do. They see "Hacker" "FBI" "House Surrounded".
Even if there is a rational understanding of the situation, those key 'fear' words still sink into the subconscious. The campaign against the web by 'SOMEBODY' has been reaching a fever pitch of late; security holes and viruses and large scale spam blasts. .
This train isn't going to stop until finally the general public cries out for Big Brother to protect them. --And guess what? The big company which connects all the cute little www.name.coms into to all the right I.P. numbers is owned by. .
Who do we think is perpetrating all of this horseshit? Do we really believe that Windows was made this vulnerable and shoddy by accident? Like all those bombings by the Palestinians which do NOTHING for their cause, and only give the Zionists more reason to bulldoze people's houses in their ongoing ethnic cleansing campaign. Go look at the news archives; right when the 'Road Map' or whatever fake peace initiative is about to gain some ground, right at the worst possible moment, that's when a 'suicide bomber' goes off. Look at the actions; Who do they benefit, time and time again? Certainly not the Palestinians. And in the case of the internet, all this virus nonsense and fear mongering. . . That only serves those who have a vested interest in placing draconian controls on the web, one of the few true sources of real, global news and communication.
Remember; Bill Gates is now working with Homeland Security. The lockdown will use Microsoft solutions, Bill will gain even more money and personal security via gratitude from the 'winning side', and we will all get screwed. (Bill has certainly proven himself to be the most Machavellian asshole in every twist and turn of Microsoft's life right from conception. This is exactly in line with how that bastard thinks. Just another damned sociopath).
Can't afford to have the web up and running when America makes the BIG grab. What can you do? For starters, learn as much as you can NOW while there is still free flowing information. Develop personal connections and methods, because face to face communications are going to be the only reliable ways to resist when the time comes. Learn about energy. Learn about the sorts of forces you're going to be faced with.
-FL
Comment removed based on user account deletion
Lie on the registration form. I generally try to portray an 80-year-old hooker. (Though I have to admit that your exploit is more technically interesting.)
FREE ADRIAN
Comment removed based on user account deletion
"without requiring any specific agreement from them before use"
This is just another example of why our world is going to shit. Too many retarded people that think I have to make you sign something before you can't damage something I own.
Didn't sign an agreement that you can't egg my house on holloween? Guess you can then huh? What are you, stupid?
Our society has become so braindead that unless you tell someone specifically not to do some specific act, they assume they can regardless of the fact general laws exist.
Property laws exist that say you can't damage other people's property. Why? Because common decency has gone out the windows thanks to an abundance of retards that have engulfed our society.
"Therefore you wish him punished as a tresspasser?"
Listen, idiot. You don't need to sign an agreement that you won't damage my property before you're not allowed to.
Unf-in believable. Do the Slashdot community a favor. Pack up your computer and send it back to HP where you got it from.
Ben
Work Safe Porn
"There are no white-hat, gray-hats or black-hats. Only criminals and law-abiding citizens." Don't forget the undermenchen and auslanders. Scary.
Honestly, i find amusing people wanting to differentiate from a "black" hat. Unless the security audit is -requested- by the target company, it sounds somewhat coward to mask yourself behind a "white" or "gray" hat...
Or maybe it's like nothing in the real world at all, and we have different expectations of real privacy and security vs electronic privacy and security.
The only change I'd make to that statement would be to add the word should (or can) between we and have.
So maybe, we should stop with the analogies as they are all strained.
'nuff said.
Read, L
US Law states differently, they call it unauthorized access. He wasn't given access to the whole system, just parts of it. He used the holes to exploit security to get around it to access parts of the system that the public is not meant to see.
But yes you do have a point that they didn't do anything to plug those holes. Sort of like blaming someone for walking into your shop at night because you didn't put a lock on your door or have a security system working. One could argue that you were inviting them in. At least the Police say that to people who left Windows open at night and a robber used the Window to get into the house and rob it.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
"Simply obtaining information is not covered under your definition,"
That's called stealing.
Think. Or do us all a favor and pack up your computer and mail it back to HP.
"You didn't tell me I couldn't come in through the unlocked window and photocopy files in your file-cabinet so it's not illegal! No physical property was taken!"
What are you stupid? Yes.
Ben
Work Safe Porn
But the guy standing in your lounge poses a physical threat to you. He can start your house on fire, rape your wife or kill your kids. The worst thing a hacker can do is screw up some of your files that you should have backed up in the first place.
Yawn.
It seems pretty obvious to me that hackers doing this sort of thing are simply trying to draw as much attention to themselves as possible, in order to boost their ego and enhance their career options.
Not at all like, say, teen athletes, who play sports for the sheer fun of it.
Besides, if he was so confident his activities were legal and ok, why is he running around from state to state, in hiding?
Well, according to the article, he's in California working on a documentary. Not exactly the kind of thing you'd do if you were "in hiding".
If he felt he had a strong case in his favor, you'd think he'd just turn himself in to the FBI right away, so he could show their folly in court and walk away righteous.
This just tells me he's not an idiot. Talking to a lawyer before the cops is good sense, and perfectly legal. Nothing in the law requires him to turn himself in, so he can take his own sweet time and make sure his rights are protected.
You got some kinda grudge against this guy, or did you just not read the article?
Because that means other people can use the same way to break in, obviously.
White hat hackers don't actually break into anyone elses systems. They discover exploits on their own boxes, and they report them for the benefit of others. They might notify a company that they are vulnerable to a particular exploit, but they never actually exploit that security hole without permission first (in order to demonstrate that flaw).
This guy, at best, is a grey hat. If he was reading private memos or anything along those lines on the NYT system, then he probably does in fact deserve to get busted (Note: He deserves to get busted, not jail time. The laws against hacking are entirely too punative. There is no financial damage to speak of in this situation. Too often companies will report the cost of patching their system as the financial damage -- as if the money they spent fixing the hole was somehow the fault of the person who pointed the hole out).
First they will come for the scientists, then the artists, and the poets, then whoever else is left to shatter the world-view of the people in power...
At first glance, the concept of history repeating itself is a casual amusement...now its becoming a scary reality
PAX AMERICANA
RATBASTARDS.
But what your not considering is that in order for your analogy to fit, you would have had to have kept a briefcase on the passenger seat containing the personal information of about 50000 people with big letters on the front saying "Confidential".
Whether he was stepping on your rights or not is relative... he could have been looking out for the rights of the 50000 individuals whose information you so carelessly left laying in your passenger seat with the window down.
User logging on... 300 baud... 300 BAUD?!? (Click!) NO CARRIER
King TJ, you should read a bit on Mr. Lamo before you go casting stones.
1. He has repeatidly turned down anything from the companies he's helped.
2. He has always agreed to sign whatever NDA's are required of him. 3. That hardly fits the profile of somone trying to "bolster" his profile.
4. He has done this for *years*.
5. He has (A far back as I can remember hearing him speak) been aware that one day someone would not take too highly of his efforts.
6. He's hardly on the run, he's trying to get in touch with his Lawyer to setup the details of turning himself in.
7. He has NEVER released (as far as I can remember) the exact details of ANY of his corporate hacks.
Want proof? Go seach SecurityFocus, he hangs out on BugTraq and a few of the other lists. For heavens sakes man, quit trolling without at least reading about the guy.
Bugs Bunny was right.
Well, they need a new story after Kevin Mitnick. Even if they have to conjure one out of thin air^H^H^H^H^H^H^H^H FBI case.
Talk about ethics...
Suppose after geetting the warning from the police you decide to continue to leave your window down and it gets stolen and used in a drive-by shooting.
You were willfully negligant in protecting your car from being stolen, so are you partly responsible for letting your car be used for the crime? You were willing to take the risk for it being stolen, so does that mean you are willing to take responsibility for it?
Should you even be able to make a claim for the stolen car to your insurance company? You were doing something that made you an easy target, knew about it, and did it anyway. Or should the dangerous behavior be reported to your insurance company so they can raise your rates to compensate for the added risk?
Why bother when others have done all the the hard work for you?
Yeah, right.
I should not (and do not) care unless I were a paying customer for said site, or if I had some other interest in it.
this is what I've been seeing, the people in power going after the easy targets, I've seen it in my own life as well, when I would go to school, some kid would do something, but since I was around and that kid was a known threat, I was the one punished because I was less likely going to set their cars on fire later if they did anything. same goes with the government and the RIAA, they find the people who do these things, but with innocent intent because it's an easier job and these people are less liekly to create revenge... well, in their little simple minds, this is true, in reality, it only causes these people to get revenge in the future. and hell, that one principal who punished me for what that one kid did once, wondered why all her car windows her broken and the tires were slashed, etc. ;)
My point is that the only reason the good people get hit harder is because of ego and cowardice.
They dont wanna hit the badguy too hard or hit them at all because they have friends who will lash back or they'll lash back in the future, and they cant just let the problem go... that's when they need to find a scapegoat.
this is what Adrian Lamo is. a scapegoat for all the black hats out there. yes he did berak the law, but, no one complained or pressed charges. What the government also might be afraid of is him hacking them, so they'll prolly arrest him, call him a terrorist and he'll never be seen again, while a black hat hacker hacks them and destroys valuable records, while Adrian might have never even thought of doing that. That's politics for you. even if they dont make sense. one of these days someone will get wise. doubt it, but hey, it's a thought.
-said the teekid.
Fuck Beta. Fuck Dice
A very poor analogy.
My house is not securable, nor do I expect it to be. So a person entering my house, or temporarily taking my car is not doing me a service - I already *know* they are insecure, and I expect people to stay the hell out.
By contrast who gave NYTimes their confidential information expected that their information would be kept secure. But the NY Times left that information available to anyone with modest hacking talents. Bad news. What if someone other than Adrian Lamo found that information first?
If someone finds a security hole in any site that stores my credit card information and then reports it, then I'm happy, whether or not it was an official security audit or someone like Adrian Lamo. The bank/merchant will be forced to close a hole that a malicious person would *not* report and instead use for nefarious purposes.
The New York Times did not "find" Adrian Lemo "rummaging" through their - he directly reported what he did to them. I'm not an elite hacker, but I'm guessing what he did would have gone unnoticed had he not done so.
So your analogy is wrong, twice. Either try again or realise that, embarrasing to the NY Times it may have been, Adrian Lamo was actually providing a public service. The FBI's wrongheaded actions, though in compliance with the law, hurts us all.
Bottom line: if there's a security flaw in an important system that keeps confidential information, no-one should go to jail for reporting it. Period.
He only did this because the "bully's" in school always called him "LameO"
D
of Mens rea has to do with culpable mental states (I am not a lawyer). Knowingly, recklessly, negligently, etc, etc (depending on the state's law) could be a couple of examples. You are exactly correct that he must meet the elements of the offense... and the corresponding culpable mental state must also be met, assuming that is one of the elements.
I haven't read the particular statute they are charging him under, since the FBI won't release any information... but depending on the elements required, including culpable mental state, he may or may not meet them. I wouldn't be at all surprised if this is all a bluff on the FBI's part. I've known them to bring people into a room for questioning, with walls stacked with boxes, maps/pictures of the subject's home, work, etc... a virtual room full of "evidence" that really makes it look like they've got the goods on you. Know what? I've known of cases where those boxes were totally EMPTY... the FBI are masters at playing mind games to get you to spill your guts. It helps a great deal if you have an attorney who knows the game; I hope Adrian's attorney is sufficiently well-versed.
I'm curious to see how they handle this... otherwise, we are in total agreement about the lack of media accountability. They wield an incredible amount of power... but are really only answerable to their editorial boards.
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
Alpha and Beta. Computer hacking is legal in Alpha and illegal in Beta. But the Alpha government will extradite their own citizens if they hack Beta networks, so Alpha citizens pretty much exclusively attack Alpha networks.
Alpha is swarming with script kiddies, so connecting a machine with known vulnerabilities to the internet is totally useless. It will be hacked within 30 seconds. Therefore the habit of connecting such machines just doesn't exist in Alpha. Security is as natural and mandatory as the power and network cables.
In Beta, the enforcement against hackers and hacker-enabling software has become so aggressive that hacking attempts are rare, and make front-page news. The last hacker was sentenced to life in prison. Nobody really knows the state of network security. There are highly paid consultants who look after it. It's unwise for anyone not professionally accredited to show interest in such matters.
In Alpha, while the sysadmins have managed to fend off the script kiddies, they have a very hard time keeping up with college and graduate students specializing in computer security. It's the most popular specialty in Alpha's comp sci departments. Alphans develop numerous techniques to inherently harden a system so a programming mistake can't make the machine vulnerable. They begin where our current ideas of GRSecurity, SELinux and Mandatory Access Control leave off.
Ten years go by. Reliance on the internet increases to the point where any advanced country would collapse if it disconnected its international links.
The Betans with the strongest interest in hacking emigrate to Alpha, where they can pursue their calling freely. If the remaining computer security establishment of Beta is a bit second-rate, nobody notices. Alphan children sometimes romp innocently through Betan banking, telecom and defence systems, but by the age of 12 they know it's not just illegal, but lame and childish - like shooting fish in a barrel.
The government of Beta announces that in light of the massive loss of life and property that a network outage could cause, hacking tools such as nmap are banned and subject to the same rules as nuclear weapons.
Most Alpha software is written with new languages, paradigms and OS's that have adapted to the challenging security environment. Beta sticks with C, Linux and Windows, and few Betan techies even try to read the flood of Alphan security papers. If you weren't in an Alphan school at the age of 14, you have a ton of catching up to do. And why bother, when hacking is illegal in Beta? Beta security researchers have an easy time of it: they just crib from ten year old Alphan papers.
Which country do you think has a better chance of survival?
Still doesn't make it right. You try something like this in the physical world, you are likely to catch a bullet with your teeth. In the US we have the concept of personal property and teh concept of not messing with personal property that isn't yours. Hence, these concepts are codified into law. He is now facing those consequences. The whole "ends justify the means" argument is a load of crap and is the same shit you hear from facisits that would like to have the ability to monitor everything we do and arrest us without cause.
My shit is my shit and it is mine to do with as I wish, including be insecure. It is not your right to poke around to prove that insecurity, unless you first ask permission.
Hackers seem to have this false notion that if they CAN do something they SHOULD be allowed to. Not how it works. I bet you that all but a very few of them have shitty physical secutiy on their houses that me and a couple firends could bypas in less than a minute. Doesn't give us the right to do that. The fact that they have a private residence with a lock is enough to indicate that we are not to go in there.
Now don't get me wrong, all people should have good virtual security since, unlike physical, you don't ahve to spend money on it, just take a little time to patch your system and run a firewall. However, just because they don't doesn't mean that you should be allowed to break in, even for bening purposes, legally. It is and should be illegal.
If I run up to you, tear off your clothes, and shove a nice cold implement up yer arse, it's okay, right?
Just checking for colon cancer, my friends!
I'm providing a great service to the public! You should thank me!
(Disclaimer: I do not actually run rampant through the streets, probing people.)
Yes, I believe in this (far fetched) scenario, I would have some responsibility. I don't think any reasonable jury would feel I deserved to be punished for the drive-by shooting though. Whether I leave my car's window rolled up or not, I have a reasonable expectation that my vehicle shouldn't be tampered with by others. Those who do are committing the crime, not me.
I would accept the fact that my vehicle was stolen at least partially because I made it a relatively easy target. In fact, if I did file an imsurance claim in this situation, it's likely my imsurance company would decide not to give me the full value of the car after reading the police report. (There's a real good chance the report would mention something about the vehicle having the window rolled down when it was stolen. They'd wonder why no windows were broken or no doors damaged trying to pop them open otherwise, right?)
hackers giving taped interviews on the local
NBC station defies logic
He is no criminal he is a hacker! He helped comanies! It is people like him that are in charge of companies, that write the software we use, that make this world function. If anyone is a criminal it is the times or even the government. I dont have anything against the government but if they put him away they are the ones committing a crime. Adrian has been thanked by companies, he has helped them defend against possible attacks. Yet the times Slanders they put the blame on hackers without even knowing what a hacker is! We are all hackers in one way or another! They blame hackers for what phreakers, crackers and script kiddies do. We hackers make this world go round. Charging him and putting him away would be setting a president that would take us back to the stone age! Hackers of this world created the companies that made this world what it is! They created the digital revolution. Without hackers we would not be where we are today! There are some black hats but Adrian is not, all he did was help. The times is in the wrong! He tried to work it out with them but they would not have it! Adrian hang in there you did no wrong! We support you. Adrian you are a hacker a true white hat, you seek knowledge and how to better society. Hackers of this world, we are in trouble if he goes to jail, what is next being put away for trying to get the most out of your computer? Oh i know using Linux and patching your kernal or compileing a program. Where is justice! The governemt even uses hackers like Adrian. This should be stopped. The times has no right to file aginst him theyt are more criminals then He! ~The Lone Wolf
~Ricky
This is such a intresting topic to me. Close to three months ago I gained access to an online newspaper from the local newspaper company here in my city.(www.newsherald.com) I gained many passes in 20 minutes. I informed them after the crack with a anom. email. Here is the intresting part. I knew now that I had access to my local news at any time illegally. What did I do? Nothing. I thought about the issues surrounding me logging on and getting caught. All the above is true! Whitehat hackers and blackhat hackers does not mean nothing to feds and cia. We are all hackers in plain english that may pose as a threat to the nation. There is something about that statement that makes me continue to do what I enjoy to do. To me it is just like the area 51 mystery. People are just going to have to get closer. Hacking is the ultimate human curosity adventure today for intelligent and imaginative people. I doubt that Lamo,Adrian will be sentenced to max punishment for hacking a newspaper provider. Although, this topic has made me more aware of my cyber activities. I guess I'll stop hacking when I here Adrian Lamo is sentenced to firing squad.
I'm sorry, I think it a very good analogy. You have said nothing to convince me otherwise. How strong the security is of the house or the server is not the issue. The issue is that this guy is essentially guilty of "breaking and entering", regardless of his intent. Also, it doesn't really matter whether they found him or he notified them himself, what he did was wrong. Now, if he did the equivalent of "jiggling the lock" without going in and told them "did you know your door is unlocked", that might be a different issue. But from what I heard, he penetrated deeper into the system than that.
It's also irrelevant what's inside that he found. Using the house analogy again, it wouldn't matter whether you had dirty socks or the crown jewels in your dresser drawers, if I was even in the house then I have committed a crime.
Granted the FBI, prosecutors and the courts will probably go overboard, such as keeping him away from phones, etc.
I'll also admit that the NY Times should secure sensitive information. But I still don't believe that gives anyone the right to engage in "vigilante good-samaritanism".
How on Earth is that a bad thing??? Stepping on your rights??? Good lord, man. It was a cop trying to be a nice guy...It's not like he went in and closed your windows or ticketed you or punished you in any way.
Frankly I'm surprised more cops don't start beating people on the street given the abuse they get from the public for any little thing they do...
Here's a little background info on Adrian Lamo:1 377,508 11,00.html
http://www.wired.com/news/infostructure/0,
What's the difference between Mr. Lamo and Richard Feynman. Obviously, one is willing to flagrantly break the law. However, the insatiable curiosity is the same.
I remember as a kid I used to go exploring. I was too stupid to realize this exploring was trespassing. Sometimes people suffered my curiosity. Once, a very nice older couple managed to humor such a spoiled little brat. They gave me a tour of their entire house. Incidently, they seemed to make the mundane entertaining. I'm sure I'd be labeled with ADD now. I also (like most of you) began to play with computers because I was curious. However, I don't have the patience to MISCHEVIOUSLY hack.
Unfortunately, no one managed to reach this guy before it was too late. I hope they don't throw the book at him. If you read the article, you'll realize that he isn't malicious, just stupid. I really do pity him.
What do you mean my sig is repetitive? What do you mean my sig is repetitive? What do you mean....
You might want to adjust your tinfoil hat, it's a bit too tight.
Watch out, that's circumvention! :)
It's using an exploit to gain access without authorisation.
...what this is like is someone who talks to a really dumb secretary, and, with a combination of wit and cleverness manages to get her to reveal confidential information. He did not "break into" anything. He coaxed a supposedly secure device into telling him secrets.
Besides, why should the sysadmins have OUR GOVERNMENT covering their asses for not having done their job properly?
But there is another kind of evil that we must fear most... and that is the indifference of good men.
The problem here is that people who like to break into computer networks don't see the harm in their actions. They view it like a little kid, it's theirs and no one has a right to take it away - it's their game/toy/fantasy.
In the case of Adrian Lame-o, the neeping lemmings put him up on an altar and bow down before his mighty web browser. They cannot see anything else but his brilliance.
They do not see the network as property. They can't comprehend the concept of breaking and entering because the net is free!
But here is the truth of it. The NYTimes paid for the servers, routers, firewalls, wiring, fiber, storage devices. This is property. They collect subscription fees from people who want to use this property. That is their right.
They paid people to collect information, stories, lists and data. This is property. They sell this property. That is their right.
They built a store front to allow people to enter their property and conduct business with them. That is their right.
They have security in this building to prevent people from going beyond the ground floor where normal business is conducted. That is their right.
They have paid for all of this.
Now, along comes Lame-o. He sneaks walks into the storefront, looks around and notices that one of the security devices is not turned on.
Does he notify anyone? No. When no one is looking he makes his way past security and away from the first floor.
(The security people have their hands full with people trying to get past the first floor and their budget is cut, not enough people to patrol, not enough in the budget to repair, new devices for circumventing security coming out everyday. Can't keep up with training.)
Lame-o is now on the second floor. Does he notify security? NO. Is he supposed to be there? NO He rifles some desks, file cabinets, scans lists, checks out credit card numbers. Does he stop and notify security? NO
At this point we know that he alters some data, effectively using resources that the NYTimes has paid for (Property!!) without authorization or permission.
Now he sneaks back out of the building. Does he notify security? NO
He notifies the press.
Does he pay the NYTimes for the resources that he pilfered? NO
But that is okay, the public opinion of a bunch of sheep/lemmings will bouy you out of troubled water. Lame-o will be a god unto them!
You haven't done anything wrong!?!?! YOU WEAR THE MANTLE OF THE WHITE HAT!!! Your press clippings say so! Your adoring admirers don't care about property! They want a free and open system where they can gambol and despoil the landscape making it impossible for the average user to get anything done.
Bullsh*t
Oh yeah, and about those sys admins that are always getting bashed, the ones who missed that one hole out of a gazillion. Let's heap steaming trash on their heads too. After all, new exploits happen all of the time. There are so many fingers in the web pie that it's difficult to find all of the openings that vermin can come in through.
Let's see these white/black hat lemmings/sheep set up web servers that cannot be broken into while conducting a business similar to the NYTimes. Oh yeah, and with very little money. And let's see them keep it running for a year without anyone breaking into it. And if someone does break in then these same lemmings can get their asses canned.
White hat. Black hat. It's all bullsh*t.
Criminals. (Yeah, this stuff pisses me off!)
Do any of them set up a security business and try this stuff legitimately? The ones who stop being neeping sheep do. But white/black hat dittos don't. They can't. They don't have the strength. They just want to be dittos who aren't responsible for their actions. They just want to have fun. Or see their faces in the press clippings like Lame-o.