Adrian Lamo Surrenders

clafarge writes "Three days after Adrian Lamo was charged with hacking, he surrendered himself to marshals at the federal courthouse in Sacramento. This according to a story on the AP's LiveWire. He's accused of causing 'more than $25K damage to New York Times Co.,' and performing LexisNexis searches on his own name to the tune of $300K! I always find it interesting that so little tinkering can cause so much 'damage' (if you didn't get that wink, read the article about the nature of the 'damage'). He's in his parents' custody on $250K bail." webmaven adds links to the same AP article carried by Wired, InfoWorld, and C|Net, and points out that more coverage can be found via Google News. He writes: "Adrian negotiated the terms of his surrender, which included the charges in the warrant issued against him being disclosed."

Comments

He boasted....

[ellem]

How good are the ones who keep their mouths shut and just steal shit?

Re:He boasted....

[Mononoke]

How good are the ones who keep their mouths shut and just steal shit?

We are absolutely incredi...

Aw crap.

Re:He boasted....

[CrashPanic]

He blew his cover and then surrendered?!

Boy what a Lamo

Re:He boasted....

[Anonymous Coward]

This looks like a clear case of 'Lack of Due Diligence' on the part of the New York Times Company and LexisNexis. New York Times Company did not secure their system to adequately protect the assets of the company. LexisNexis did not do proper "Due Diligence" ensuring the non-repudiation of the transactions.

Sounds like this would be an interesting Stock Holder case.

webmaven

[Anonymous Coward]

I must have missed something. What the hell is that webmaven link for in the article?!

Reasonable damage figures

[JohnGrahamCumming]

more than $25K damage to New York Times Co.,' and performing LexisNexis searches on
his own name to the tune of $300K! I always find it interesting that so little tinkering
can cause so much 'damage' (if you didn't get that wink, read the article about the
nature of the 'damage').

No I don't get the 'wink'.

These damage figures really don't seem very unreasonable, especially given what Kevin
Mitnick was accused of. It's pretty easy to rack up $25,000 in damage (i.e. in the
cost of the people of had to evaluate and repair his intrusion into the network). As for
the LexisNexis searches that cost is probably easy to calculate because they charge for
use of the service and he probably used $300,000 worth of the service without paying for it.

If he'd been accussed of millions of dollars of damage for these intrusions then I might be concerned
that the prosecutor was going overboard, but this seems pretty sane to me.

John.

Re:Reasonable damage figures

[sekzscripting]

Well, he apparently told them how to fix it (or did he not with the New York Times?) - so if he did it I wouldn't think it would cost anywhere near $25,000.

Re:Reasonable damage figures

[Trigun]

As long as they have to prove the damages, rather than having the judge readily accept them. In fact, who cares about how much damage is done, as long as it's over the $5,000. If he broke the law, he broke the law, he didn't break the law by $320,000. That would be essentially ridiculous, turning law from an ethical measure to a monetary one (well, more so).

Re:Reasonable damage figures

[Anonymous Coward]

No I don't get the 'wink'.

I don't get it either. If somebody (the New York Times?) got billed for those Lexis/Nexis searches then there WAS monetary damage.

Just because there are only filthy rich corporations involved doesnt mean it's OK to steal the money.

Re:Reasonable damage figures

[InsaneGeek]

I never quite got this... would you really trust a hacker to tell you everything he did? Some anonymous person on the internet breaks into your system and you will just take his word for it? A security incident is a security incident you have to do the same work either way:

offline the system
investigate the system to find intrusion
do a complete reload from scratch
identify other systems on the network with same vulnerability accessable by compromised system
make decision to roll dice and guess others were not compromised or rebuild those systems also

number of steps left out but you get the drift, the entire network is compromised and I don't trust my job let alone hundreds of fellow employees jobs, on a completely unknown person telling me they really didn't leave any back doors and didn't do anything at all after they intentionally broke into a system

Re:Reasonable damage figures

[Zachary Kessin]

Hey may have told them how to fix it, but that does not meen that they didn't spend a lot of time double checking *EVERYTHING*. Just becaue he tells you exactly what he did, does not mean you trust him. After all he just broke into your computers and messed them up.

Re:Reasonable damage figures

[digitalunity]

Considering what some people make and the number of people involved with a corporate security breach, this isn't unreasonable. I bet the labor costs for everyone involved is easily more than $25K.

Although he had good intentions, I can't agree with his methods. He may have just been having fun, but even he has to realize the legal implications for everything he has done.

Re:Reasonable damage figures

[nsandver-work]

The problem is, how do you trust someone who's just broken into your systems to tell the truth about how they did it? Or to tell you everything they did? You can't, so you must look over everything, and probably reinstall your systems.

Re:Reasonable damage figures

[kfg]

I do get the wink.

Look at it this way, if the lock on my house is faulty did someone who demonstrates this fact to me "damage" my property by "causing" me to have to buy a new lock?

Or is that maybe a capital expense that's my responsibility in the first place? Especially if I've taken on the responsibility for protecting the safty of other people's property and papers as part of a commercial operation.

Also, is this expense an actual additional one, or did I maybe already have a handyman on salary who simply did it as part of his normal duties?

For $25K the NYT could have hired me for a full quarter to go over their security systems. Did they really do something like that, or did a couple of guys on staff have to spend some of the time they normally would have spent goofing off actually doing their jobs?

Now paying someone $25k to audit security is a perfectly legitimate business undertaking. So, how is providing that service for free necessarily "damage."

( The answer, of course, is that Lamo made his audit public. Still, it's not the simple B&W issue you might think)

The Lexis-Nexis thing is clear theft of services. Given the white hat Lamo was wearing I can understand that he had to do that just to demonstrate that he ( and thus anyone else) could, but it might not have been the smartest thing to do. I'd sure as hell want to see the actual bill though before I'd assent to the fact that he actually used $300k worth of the service.

KFG

Re:Reasonable damage figures

[s20451]

I'm getting a little tired of the apologists for this guy saying that he did nothing wrong, he tried to help, and he did no damage.

If the sysadmin is aware of any unauthorized intrusion, he or she would be utterly incompetent to take the cracker's word for it that no damage was caused. Evaluating the integrity of the system is time consuming and causes major problems for the users.

Our e-mail server was once hacked -- the hacker caused no damage, but we were without e-mail for several days while our sysadmin made sure we were okay.

Re:Reasonable damage figures

[Proaxiom]

To start with, the damage figures in the Kevin Mitnick case were entirely unreasonable.

And cost to evaluate and repair are a little hard to get a handle on. If you keep good logs then the cost of making sure he didn't steal or damage sensitive data isn't all that difficult (provided, of course, he didn't steal or damage sensitive data). 'Repair' can have a much higher cost, but it also has a marked benefit. Spending money to fix the vulnerability Adrian exploited cannot really be considered a loss (it has an ROI, in fact). It's like accusing a building inspector of causing damage when he points out the crumbling foundation of your house. (The difference here, that Adrian's actions were illegal, is not lost on me, but we're talking strictly about damage computation).

LexisNexis is a little different. Since he would not have otherwise paid $300,000 for the service, he didn't really cost them that money. This is much the same as copyright infringement 'damages' where the RIAA claims you downloading 1000 songs costs them thousands of dollars, even though most people would have actually purchases only a small percentage of the songs they downloaded. Adrian may have incurred costs using system resources if he caused inconvenience to other customers, and again there are assessment costs as well.

Re:Reasonable damage figures

[badasscat]

No I don't get the 'wink'.

Nor do I. I don't know what's up with Slashdot lately; this is a tech news site, not a script kiddie site. We're not here to learn from famous crackers or to congratulate each other for taking big sites down. Crackers are criminals and they need to be punished. They do cause damage. The implication in the comments at the head of this are that this guy didn't really do anything wrong and so should get off... just like the 18 year old "kid" who got busted for the MSBlaster virus variant a couple weeks ago, at which time I read similarly ignorant and even stupid comments here.

The NY Times is 2 products; an offline and an online newspaper. You knock the online version out and you've killed half the products the company offers. Advertisers need to be repaid, workers have to be paid even though they can't do any work, etc. And you're going to lose a certain number of readers to other sites, some temporarily, others permanently. I agree that the numbers here do not seem unreasonable at all.

But then I shouldn't need to explain why crackers should go to jail. This is Slashdot, we should all understand this stuff already. There's no reason why a tech news site should favor crackers over commercial internet interests; it's all tech, it's just that one side of the issue here happens to be criminal.

My company's web sites have been the victim of numerous DoS attacks (no, I do not work for SCO - I work for a company you guys like, though I don't really want to say which), which while using different methods amount to the same thing this guy did - it's all denial of service, and it does cost companies money. I have absolutely no sympathy for this guy and hope he gets the book thrown at him.

Re:Reasonable damage figures

[hawkfish]

That is good for a first pass. But just trusting him is malfeasance, pure and simple.

Re:Reasonable damage figures

[dipipanone]

Well, he apparently told them how to fix it

If somebody hacked into one of my machines and then told me how to fix it, I'm afraid I'd be just the *teeniest* bit reluctant to take what they said at face value.

As a result, at the very least you've got to expect the NY Times had to pay for a forensic analysis of the network and a total rebuild of any compromised systems.

Would that cost $25,000? I dunno. It doesn't sound completely outlandish to me but I don't know anything about the NY times's systems.

Re:Reasonable damage figures

[Anonymous Coward]

But if they had discovered this on their own, they would have still had to have gone to the same expense.

Just because he's the only one that ever told them that he was able to do it doesn't mean that others weren't.

Re:Reasonable damage figures

[Morosoph]

It seems to me that engineers view security breaches very differently from most people; we're used to having to fix all bugs, and it becomes natural to think of someone who's managed to break a system as having done good; the clean-up costs are not the costs of the breach, but the costs of the bug, as yet unforseen.
I get the impression that this is not how the average person thinks at all. When something fails, the most obvious culprit is the person that broke the system. There might be secondary concerns, but the first thing to do is to find blame.
By contrast, the engineer is almost grateful, at least once the bug's been fixed!
My thoughts are that people who break things without malice, although they might be in some sense "trespassing", deserve some protection, as egos do not deserve the protection of the law. The law should instead be structured so as to make secure systems more probably, ie. intelligent cost/benefit analysis is the order of the day, not ideological moaning about property and tresspass.

Re:Reasonable damage figures

[e5z8652]

It's pretty easy to rack up $25,000 in damage (i.e. in the cost of the people of had to evaluate and repair his intrusion into the network).

So, how much are the sysadmins who left the original holes in the network being charged? One could easily make the case that it was their fault that Lamo could cause any "damage" at all.

NYT putting all the blame (and costs) on Lamo seems a little off base to me, especially considering that a lot of that "damage" was probably overtime payments to those same sysadmins.

At least the LexisNexis charges seem to revolve around actual services.

Re:Reasonable damage figures

[Anonymous Coward]

Look at it this way, if the lock on my house is faulty did someone who demonstrates this fact to me "damage" my property by "causing" me to have to buy a new lock?

Ok, what if they do this when you are not home and leave you a note? Then you are gonna call the police, go thru your house to see if anything is missing, tampered with, etc. This costs money and your time, which in business transalets to even more money.

Also, was the lock broken, or is it a design flaw. there is a difference. Reparing a design flaw costs money.

For $25K the NYT could have hired me for a full quarter to go over their security systems. Did they really do something like that, or did a couple of guys on staff have to spend some of the time they normally would have spent goofing off actually doing their jobs?

YOu hit the nail on the head here, but instead of saying they were goofing off, and they may well have been, but its not the point. The point is that they were pulled from whatever they were doing to do this. More than likely it was another project that will be delayed or need additional resources, i.e. money.

SO while the number may not be perfect, it is reasonable considering what companines spend on IT. Hell my company spends $500 million a year on IT, $25k is a drop in the bucket.

In the end he caused the companties time and money to recover from his unauthorized access, which BTW is illegal.

Re:Reasonable damage figures

[Evil Adrian]

Look at it this way, if the lock on my house is faulty did someone who demonstrates this fact to me "damage" my property by "causing" me to have to buy a new lock?

Now paying someone $25k to audit security is a perfectly legitimate business undertaking. So, how is providing that service for free necessarily "damage."

Unless someone gives you PERMISSION to break into something of theirs, IT'S ILLEGAL TO DO SO.

END OF STORY!

Hacking is illegal, everyone knows it, why are you getting pissed about it? Leave other people's shit alone unless they specifically ask you to fuck with it, or you will get in trouble! That is NOT a difficult concept to grasp!

Re:Reasonable damage figures

[Anonymous Coward]

If they did anything sneaky, Then Why Would They Tell You the Broke In At All???

Re:Reasonable damage figures

[kfg]

One of the first things you learn when you begin working in computer security, especially as an outside contractor, is that your customers don't trust you as far as they could throw the Empire State Building.

In fact, you will be reviled. You will have a hard time convincing many people to hire you because they're scared to death of you in the first place. Once they do hire you you will be assumed at some lizard brain level to be doing something nefarious.

This is one of the reasons why network security is so poor. Companies are loath to allow outside security experts anywhere near the place.

This is one of the reasons white hat hackers like Lamo do what they do. The companies aren't doing what they should, out of fear, thus leaving all the doors wide open. It's a deriliction of duty that the white hats expose to the public.

The companies don't always take kindly to the fact that their customers then know how poorly their personal data is being protected.

Obviously the way to handle the matter is to attack the white hat. Go figure.

Now these same companies don't hesitate a second to call in a locksmith to handle their physical security. They don't worry that when a lock gets changed the locksmith is secretly making a copy of the key so he can break in at night and clean them out, even though this occasionally actually happens.

Why not? Because physical locks aren't black magic beyond their understanding.

Rather than gain that understanding they'd rather fear. Again, go figure.

Computer security experts are like people who treat lepers. We aknowledge that they are needed, but we don't want them around our house.

God forbid they should marry our daughter or something. We'll never sleep at night.

KFG

Re:Reasonable damage figures

[gpinzone]

If I sold something for $25,000 that only cost me $25 to produce, you could argue that it's perfectly acceptable free-trade economics. Supply and demand. Fine. Now, if someone steals $250 of my product (in total cost to me), is it really fair to sue the thief for a quarter of a million? I'm not denying it's theft, just the scope.

Lexus-Nexus has value because they have information people want desperately. However, their operation is a lot less advanced than say, Google. If you expect me to believe those Lexus Nexus searches really cost them that much, then Google would have been bankrupted their first day.

Re:Reasonable damage figures

[greenhide]

Now paying someone $25k to audit security is a perfectly legitimate business undertaking. So, how is providing that service for free necessarily "damage."


Here's a harsh example: If I charged you for sex, I could easily get $100/hour. How about I have sex with you, without your consent, for free?

As someone who oversees a few websites, I can tell you that there is plenty to do already without having to worry about some hacker breaking in to my system.

The faulty lock isn't a good analogy. A better analogy is that you have a normal working lock, and the person is an extremely adept locksmith who also knows how to circumvent security systems. Don't think "This Old House", think "Mission Impossible".

These servers weren't left totally out in the open, otherwise people would be hacking into the NY Times *all the time*. I mean, wouldn't it be tempting to be able to put any message you wanted, up for viewing to many millions of people?

I'm sure the NY Times spends a whole lot on security, and does a pretty good job at it. This Adrian fellow is a really good hacker; that's all there is to it. Any system that must connect to the Internet is inherently insecure. The people at the NY Times have probably made a very careful balance between making their servers secure, and making it possible for employees to access it from the thousands of locations across the globe where they have staff, reporters, subscription offices, and distribution and printing centers.

I think anyone who blames the NY Times in this case is expecting too much. I'd like to see how *your* computers handle a hacking attach from this guy.

Re:Reasonable damage figures

[finkployd]

But how do you know all he did was break in to test the security? As a sysadmin would you take his word for it? Or would you spend a lot of time performing your own system audit to make sure this guy didn't put any backdoors or other malware in your system. That takes time and costs money.

Finkployd

Re:Reasonable damage figures

[glassesmonkey]

The trouble with this kind of thinking is that you are assuming they had to put new/extra resources into this activity. (leaving out discussion of legal fees)

So, are you saying they (NYTimes and Lexis/Nexis) have no network admins who are responsible for detecting and looking into security. Are you saying they have no one tasked to do network security of fix holes.

So, if I go into a store and shoplift, can they ask for $25,000 to review security tapes, hire security guards, buy a metal detector, etc.

Re:Reasonable damage figures

[Evil Adrian]

So, how much are the sysadmins who left the original holes in the network being charged? One could easily make the case that it was their fault that Lamo could cause any "damage" at all.

WHAT?! The sysadmin's didn't put the holes there on purpose!! (We assume.)

If someone leaves the house and leaves the door unlocked, and someone goes in and steals everything, the criminal is the person that stole everything -- not the one that left the door unlocked! DUH!

NYT putting all the blame (and costs) on Lamo seems a little off base to me, especially considering that a lot of that "damage" was probably overtime payments to those same sysadmins.

If they can prove that the sysadmins were willfully negligent, then fine, otherwise your argument lacks any solid foundation.

Re:Reasonable damage figures

[Anonymous Coward]

Our e-mail server was once hacked -- the hacker caused no damage, but we were without e-mail for several days while our sysadmin made sure we were okay.

It took "several days" to switch over to your backup email server?

Wow, your sysadmin must be... incompetent.

Re:Reasonable damage figures

[Vindicator9000]

But would you rather have someone break into your network and *not* tell you how they did it, or even that they were there at all? If some anonymous black hat had broken into the New York Times rather than Lamo, and the goes on to 0wnz their system, how much more damage would be done as a result of Andrian Lamo's not having been there? I think that, although it may have been illegal and unethical, he was still arguably doing them a favor

Everyone immediately running this guy down sounds a lot like Microsoft saying that the only reason people want to hack the xbox is so that they can pirate games for it. We all know that the only *real* reason is to install linux on it :) but MS can't stand the embarassment of admitting that. Likewise, the NYT can't stand the embarassment of admitting that they had a security hole in their network, so they try to competely discredit the guy who found the hole, and make it look like they wouldn't have had to fix it eventually anyway.

On the other hand, this guy was really naive to think that in this litigious country, someone wouldn't eventually press charges.

Re:Reasonable damage figures

[the_flatlander]

Well, yes, but if you'd undertaken, oh say half that work before he "intruded," well, then you'd have saved the other half. As in: if someone breaks into my house, may I add the charge for the new, good lock I buy to the cost of the burglary? Better still, if they catch the guy, can I get HIM to pay for it? I am un-moved by your argument.

Re:Reasonable damage figures

[Cirvam]

You do know he didn't take down the online version or modify that at all? He was accessing their internal network where they store stuff like payroll, employee info, etc. So all your comments about loss of revenue isn't really valid as he didn't deny anyone service. Now they did have to secure and check their internal network once they were informed about the intrusion, which would generate some cost, but the figures aren't loss of revenue they are cost of cleaning up.

Re:Reasonable damage figures

[Anonymous Coward]

If somebody hacked into one of my machines and then told me how to fix it, I'm afraid I'd be just the *teeniest* bit reluctant to take what they said at face value.


Why? You you REALLY think a 'Black Hat' is going to Trojan your system, AND THEN TELL YOU HE BROKE IN?!?!?!?!

Are you insane? A 'Black Hat' would just quietly slip away, NOT draw attention to himself.

Re:Reasonable damage figures

[lpp]

I agree the damage figures in Mitnick's case seem unreasonable.

Regardless of anything else, however, Lamo did not have authorization to access their system. To do so without that authorization is deemed illegal by the laws of the land. He is in violation of that law, or was when he committed the act. Will some good come out of it for NYT? You bet, once any security patches are completed. And when a burglar attempts to break into my house, exposing the weaknesses in my security system, but not actually stealing anything, he will be charged for breaking and entering and I will upgrade my security system. He still broke the law.

The repair costs? As others have pointed out, someone had to audit those systems, and unless their regular work load could be suspended, they are clocking overtime. That is additional money that is being expended that was not planned. So what if it would have been spent had the vulnerability been found internally. It was not a planned expenditure and the current expenses will affect the bottom line negatively.

LexisNexis is theft of service. Assuming he actually did use the service such that the charges involved ring up to $300k (which as another poster mentioned I too would want to verify by seeing the bill), it is charges that NYT is going to have to pay that they ordinarily would not have. Yes, he did really cost them that money.

I would be more likely to forgive the repair costs sans the LexisNexis issue, since technically the money would have been spent sooner or later and will definitely help the company. But no matter how you slice it, he has broken the law. Maybe the law should change, but he currently stands in breach of it.

Re:Reasonable damage figures

[Anonymous Coward]

Yes, there are many things suspect here, but I think the point is that there are a lot of lame, clueless administrators out there, underpaid and undereducated, and that the world's networks are suffering. Lamo blurted; others don't; the break-ins should never have happened in the first place.

Re:Reasonable damage figures

[Merk]

Am I nuts, or should the Lexis-Nexis damages be related to their loss of business because of the resources he was using? Damages should not be the same as "not realized profits", actually in this case it sounds like they're talking about revenues, not profits. In fact, if you took the typical profit they make on $300k worth of services and subtract it from $300k that should be the damages.

If I sneak into a movie and the theater is empty, I'm not costing the theater anything. Even if I sneak in with food and leave some wrappers behind, their cleanup people would still have had to clean up, it will simply take them slightly longer. If you want to put a price on this you couldn't possibly justify more than 25 cents. The only way in which my sneaking into the theater costs them money is if my presence keeps other people from paying for seats, and that's not likely unless the room is almost completely full. If they sue me for damages, the damage I caused them is not the price of a full-price ticket. That would be ridiculous.

Re:Reasonable damage figures

[Anonymous Coward]

Maybe not with the Times but he did with Yahoo.

Re:Reasonable damage figures

[ninthwave]

But he didn't mess them up. He just looked.
Only on Yahoo has it been shown that he changed Data.

Re:Reasonable damage figures

[diatonic]

The NY Times is 2 products; an offline and an online newspaper. You knock the online version out and you've killed half the products the company offers. Advertisers need to be repaid, workers have to be paid even though they can't do any work, etc. And you're going to lose a certain number of readers to other sites, some temporarily, others permanently. I agree that the numbers here do not seem unreasonable at all.

...but he didn't take down the NYT site, or make it unavailable. He trespassed. Would trespassing in the NYT building cause $25K in damages?.. even if he rifled through file cabinets? I doubt it.

.:diatonic:.

Re:Reasonable damage figures

[Anonymous Coward]

Leave other people's shit alone unless they specifically ask you to fuck with it, or you will get in trouble! That is NOT a difficult concept to grasp!

Next time you drop your wallet in the street, I'll be sure NOT to pick it up and return it to you.

After all, I should "Leave other people's shit alone unless they specifically ask [me] to fuck with it."

I mean, heck, I "will get in trouble!" if i try to help, so fuck you.

Re:Reasonable damage figures

[johnnyb]

I don't know the details of the case (this is Slashdot, so reading the articles is pointless), but what if someone found that your door is repeatedly left open, and then one day when you're out, walks in and leaves a sign that says "You left your back door open". Is that damage?

Re:Reasonable damage figures

[clafarge]

The cost of evaluating the damage is, in my opinion, built into the salaries of those people who's job it is to constantly look for such damage and intrusions. This should not be a cost associated with a specific incident... this should be a constant process to ensure the security of any network. Do they only take security measures when a known event has taken place? I don't think so.

Re:Reasonable damage figures

[dipipanone]

A 'Black Hat' would just quietly slip away, NOT draw attention to himself.

Right. No Black Hat ever used Social Engineering to compromise a system, did they?

Are you insane?

I would be if I was prepared to take the word of someone who had just penetrated my system, supposedly 'to help me out by telling me how to fix it.'

Re:Reasonable damage figures

[Elwood P Dowd]

No one, least of all Lamo himself, suggest that Adrian Lamo is a really good hacker. He goes after low hanging fruit. He finds b2b systems with default passwords. He finds unpatched systems.

The only reason he's famous is... wait... I can't think of any good reason why he's famous.

IMHO, the analogy should be that his crime was saying, "The NYT keeps your credit card information on their kitchen table, and they don't even have a lock on their back door."

Re:Reasonable damage figures

[Anonymous Coward]

To cover your ass in case they find any trace of your presence.

Re:Reasonable damage figures

[Martin Blank]

Because physical locks aren't black magic beyond their understanding.

No, but to most people they're certainly gray magic at best. Generally speaking, people don't know how a lock operates anymore than they can explain how a password works -- it just does. The difference is that there is a tactile mechanism for it. I've found that some people trust keypads less than they trust combination locks; some have good reaons, and some have not-so-good reasons.

Something that is usually far beyond the understanding of most people but which still engenders trust is a good combination lock. I'm not talking about padlocks -- I mean major vault locks. People trust them because they're complex, but also because part of the mechanism consists of thick bars locking into the vault walls. They can visualize significant parts of the system. Electronic security is an abstraction that many have difficulty following. Hey, sometimes even those of us in the computer security field have to scratch our heads sometimes as we try to envision what's actually happening.

Re:Reasonable damage figures

[buttahead]

testing lexis-nexus once would have ben enough... maybe twice. but lamo used the service for 3000 queries. hardly _just_ for proof that he was in the system.

Re:Reasonable damage figures

[Anonymous Coward]

"Hacking is illegal, everyone knows it, why are you getting pissed about it?"

Because hacking is not illegal. Certain acts that people perform while using their hacking skills might be illegal but hacking itself is not illegal. i.e. the difference between car theft and reposession, both involve people with skills that allow them to "steal" a car. In one case it's unlawful and in the other it's perfectly legal. I could hack all day long without ever leaving my own machine and without affecting anyone else - nothing illegal there. But as soon as I begin an attempt to crack someone else's security WITHOUT invitation or permission that's when it becomes intrusive and illegal.

In hacking there's a line to cross to be a criminal. It doesn't matter if you label yourself white hat or black hat or who agrees with what you did or how many people you helped. The law is unforgiving and the people who use that law often more so.

Re:Reasonable damage figures

[Anonymous Coward]

So you'd just trust the guy then? You are far too trusting to be in a posistion overseeing any sort of security.

Re:Reasonable damage figures

[Anonymous Coward]

And next time I steal your wallet out of your back pocket, I will remind you to keep your wallet inside your jacket when I return it. That is, after I look at everything you have in your wallet and see if there is any money in there.

Re:Reasonable damage figures

[511pf]

For the record, Lamo did not "knock the online version out" so I don't see how your argument is relevant to this case.

Re:Reasonable damage figures

[drinkypoo]

Nor do I. I don't know what's up with Slashdot lately; this is a tech news site, not a script kiddie site. We're not here to learn from famous crackers or to congratulate each other for taking big sites down.

Sorry; I am here to learn from famous crackers, in part. Mostly I'm here to polish my ego by spewing big rants and flames about shit, but when you're not learning, you're dead, or you might as well be. It's called stagnation, and it's bad, mmkay?

I agree that if he caused any actual damages, he should be punished. If he didn't actually damage anything, then why punish him? Or at least, why punish him to this degree? Trespassing carries a light jail sentence, bust him for trespassing if you must, but if he didn't break anything, then it's hard to see how to justify awarding any damages.

Re:Reasonable damage figures

[Anonymous Coward]

Unless someone gives you PERMISSION to break into something of theirs, IT'S ILLEGAL TO DO SO.

and if people minded their own business, there would be no need for security. breaking into systems under the guise of being a white hat is just cognitive dissonance.

Re:Reasonable damage figures

[Anonymous Coward]

to add to what you said. the only "real" reason MS flipped out so badly is not because of pirated games. its because it was a test of palladium and it failed with the hack. the hacking of the xbox took their research and crammed it up their a$$'s. though the hackers didnt know this part they just wanted linux on it. its really a good thing as long as it continues to get published that their security can be broken it keeps DRM from being fully implemented.

Re:Reasonable damage figures

[jkauzlar]

I have absolutely no sympathy for this guy and hope he gets the book thrown at him

Is it because he has embarrassed you by lessening your company's technical credibility? I'm not trying to troll, but I wonder if $300k really is a realistic fine to apply to someone who essentially is just spraying graffiti, breaking and entering and having a look around.

Slashdot is not supporting this behavior, only trying to keep the possible wild misuse of government and corporate power in check. Most 'script-kiddies', at worst, are just nerds who perhaps need a public playground for their talents. Let's keep some perspective. That's what slashdot is about.

Re:Reasonable damage figures

[buttahead]

minus the 300,000$ worth of lexis-nexus searches. minus the damage to the NYT image for being publicly embarrased by the security compromise.

Re:Reasonable damage figures

[Anonymous Coward]

"...I don't know what's up with Slashdot lately; this is a tech news site, not a script kiddie site..."

I suppose this warrants one of those obligatory "you must be new here" quips. I understand the sentiment, though, and I think you make some excellent points.

Re:Reasonable damage figures

[dipipanone]

Next time you drop your wallet in the street, I'll be sure NOT to pick it up and return it to you.

Jolly good. That way, it will still be there when I go back to look for it.

Re:Reasonable damage figures

[Anonymous Coward]

>> Here's a harsh example: If I charged you for sex, I could easily get $100/hour. How about I have sex with you, without your consent, for free?

cool, that's my masturbatory fantasy for tonight..

Re:Reasonable damage figures

[Hatta]

Think about it. If adrien had not hacked the site, would that make it any more secure? For all we know 20 other hackers have done the exact same thing without telling anyone.

Re:Reasonable damage figures

[InsaneGeek]

But the prior work isn't part of the issue here. The previous poster said the cost shouldn't be as much since he told them what he did. Obviously anybody who's going to just sit by and say "OK, that's it" is a complete moron. Analogies are terrible ways to put for an argument but here's mine in response to yours:

A completely new hack comes out, nobody in the white hat world knows about, and there isn't a known patch. What prior work can be done?

And sure you can get him the burglar to pay for it, if he used a master key to get into your house you could sue him for replacement, why would you think you couldn't?

Re:Reasonable damage figures

[gregbaker]

As someone who oversees a few websites, I can tell you that there is plenty to do already without having to worry about some hacker breaking in to my system.

Ummm... you should probably be worrying about that anyway.

I'd like to see how *your* computers handle a hacking attack from this guy.

So would I. It's hard to know about the flaws in your system--you pretty much keep things patched, watch the logs and hope. An email from a benevolent hacker that says "You really need to change..." would be appreciated.

Re:Reasonable damage figures

[gad_zuki!]

>These damage figures really don't seem very unreasonable

Skallas's law: All legal damages are unreasonable.

That's why its left up to the jury to decide damages and for them to decide whether the prosecution is being honest, for the most part. In a trial the defense could bring its own expert to testify that the damages are inflated.

Re:Reasonable damage figures

[InsaneGeek]

So what makes him exempt? What's so special about him that I should trust him over the 20 others? Why should I belive that he's not actually of the same vein as the 20 others and left me a small fix to make me feel safe but left an unknown backdoor?

That is why a complete and TOTAL teardown and rebuild of the system is absolutely required.

Re:Reasonable damage figures

[Anonymous Coward]

A brilliant pair of trolls.

Re:Reasonable damage figures

[kfg]

". . . part of the mechanism consists of thick bars locking into the vault walls."

Leading to the logical absurdity that many old time banks employed, having their vault in plain view with the door open so that their customers could feel reassured by being able to see the big bars.

There's no explaining people sometimes.

Computer networks are analogous to modern banks. Many people these days don't like modern banks because you can't even see the vault. This makes them uncomfortable because for all they know they're keeping all the money in an old pizza box or something.

Of course, when it comes to computer networks, sometimes they're right.

KFG

Re:Reasonable damage figures

[Merk]

Read the subject. The problem is the damage figures.

I haven't been following the story closely, but nothing I've seen has suggested that he attacked them in any way, DoS or other.

How did it cost the NY Times to have someone find a security flaw in their system? How much did it save them that the guy who found it didn't exploit it?

If someone tells me my shoe is untied, I can't sue them for the time it takes me to tie the shoe. Whether I was told or not, the shoe would have been untied. At least I now know the lace is loose and I can fix it before I trip and hurt myself.

Re:Reasonable damage figures

[_bug_]

Unless someone gives you PERMISSION to break into something of theirs, IT'S ILLEGAL TO DO SO.

Actually it may not be a clear cut illegal intrusion. If Llamo never encountered an "authorized use only" or "for NYT staff only" message then it can (as has been in the past) argued that Llamo had no reason to believe he was accessing an area of the NYT network he was not suppose to. Given that he was accessing it via the Internet which is a PUBLIC network.

That may be why the NYT is trying to put a dollar figure to the "damage" Llamo caused. Then they can argue property damage.

Re:Reasonable damage figures

[InsaneGeek]

How about I'd prefer nobody in my network without authorization to begin with.

I don't believe I ever said that I don't want them to tell me how they got in, I said that I'm not going to believe them. How can you take it at face value that a person who hacks into your system is going to tell you everything? Are you willing to risk your and everyone elses jobs on that? I'd be very happy for them to tell me, but you can be damn sure the first thing I'm doing is taking it completely offline, doing a full forensics disk duplication, rebuilding it and replacing it, no matter what he said. The fact that he "told" me how he got in, gives me absolutely no security at all, you'd be a complete fool to believe it.

Re:Reasonable damage figures

[Hatta]

Of course a complete and total rebuild of the system is required. What I'm saying is that a rebuild would be necessary in any case. Therefore adrian has not caused any extra expense. Either you get hacked by adrian or you get hacked by someone else. With the wide open proxy servers adrian exploited, there is 0 chance of not getting hacked. Adrian just did it in the least harmful way possible. This is a good thing.

Re:Reasonable damage figures

[Servo]

Considering it specifically says he altered data, $25k in "damages" is more than reasonable. They would not have had to hire people to audit their databases and other systems to check against modified/added/deleted records had it not been for this bozo pretending to be a hero.

The fact that he stole LexisNexis accounts and modified internal records just goes to prove that he was not doing this merely to help companies as so many hero worshippers keep repeating here on Slashdot.

It wasn't just breaking a law, it was damaging the credibilility of the NY Times internal records, racked up fees to fix his "graffiti" and cost them money in stolen accounts. I hope this guy goes to jail for a long time so he can think about how stupid he has acted. Stunts like this put real "hackers" in a bad light, and only further feeds the fire for scare tactics by the government to take away more freedoms of the law abiding citizens who work in the security field.

Re:Reasonable damage figures

[misterpies]

>>That would be essentially ridiculous, turning law from an ethical measure to a monetary one (well, more so).

In practical terms, that's exactly how it is.

Civil law operates by awarding damages to an amount that compensates your loss. (Punitive damages are an exceptional response to certain circumstances.) And if you don't have a claim for damages, then a judge isn't going to hear your case -- judges don't like being forced to spend days hearing a case simply in order to say "you were a bad boy!" at the end of it.

If you press a case and it turns out that you won on the law, but that you don't have a claim for damages, you'll most likely be awarded "nominal damages" -- a tiny figure like $1, but costs will be split so you'll still have a massive legal bill to pay. If the judge decides you were right on the law, but you never had a chance to claim damages and should have known it, he'll probably award costs against you.

You might think that there are very few cases where someone has broken the law but doesn't owe any damages, but in fact it's very common. Eg suppose I order a book from Amazon for $10, and it never arrives (and they never charge me). Clearly, Amazon are in breach of their contract, but the "damages" they owe me are the difference it price between what they charge and the book's market value. If they charge at or above the market value, they owe me no damages because I could have easily gone and bought the book somewhere else for the same price. (If however they're charging less than anyone else, then they owe me the difference.)

Re:Reasonable damage figures

[dipipanone]

IMHO, the analogy should be that his crime was saying, "The NYT keeps your credit card information on their kitchen table, and they don't even have a lock on their back door."

No, his crime was the break in. Exposing the Times's idiocy was what provided the motive to ensure that that crime was prosecuted to the fullest extent of the law.

To return to the house with the flawed lock analogy, what Lamo did was equivalent of opening your front door, and then announcing to everyone in the street that you have a taste for erotica featuring barnyard animals.

Re:Reasonable damage figures

[Davorama]

As someone who oversees a few websites, I can tell you that there is plenty to do already without having to worry about some hacker breaking in to my system.

Well, given this statement you better hope it's someone like Lamo who breaks in and not someone who's just going to take the data and run.

Re:Reasonable damage figures

[Jerf]

If you keep good logs then the cost of making sure he didn't steal or damage sensitive data isn't all that difficult (provided, of course, he didn't steal or damage sensitive data).

I disagree. One of the problem is that when a hacker attacks, you can't necessarily trust the logs. In fact there's a lot of people of the opinion (and I'm one of them) that unless you really know exactly which vulnerability was exploited and how it was exploited (like a common worm comes in that doesn't install a shell and there's no evidence that there was any other person actively involved in the hack), the only proper thing to do is completely re-install the system from either known-good backups (and labelling backups "known good" is itself an interesting challenge), or even from the original CDs.

Things like "tripwire" are just that... tripwires. They really shouldn't be used to help repair the system because once the system is compromised you can no longer trust the output.

For a business-critical machine, and well-paid admins (which you should have!), and counting downtime, $25,000 is entirely reasonable.

Spending money to fix the vulnerability Adrian exploited cannot really be considered a loss (it has an ROI, in fact).

Since fixing a vulnerability is typically a matter of applying a patch, odds are it does not account for more then $100 or $200 of the damage if it was computed rationally. Evaluation, analysis (which even if you re-install from scratch MUST be done, to see if any customer or private data was compromised), re-install, and lost business swamps that expense. Trying to talk the damage value of this down isn't really useful since it's such a small part of the value, in all likelihood.

$25,000 is quite reasonable.

Since he would not have otherwise paid $300,000 for the service, he didn't really cost them that money.

Yes, this is most likely absurdly inflated.

1 for 2 is actually a significant improvement for our system, and this is a good sign, IMHO.

Re:Reasonable damage figures

[WNight]

People always talk about this, but really, one of the things a sysadmin should do is perform backups. Not just drive images on a fall-over server, but copies of the data, that stuff you can't execute or stick a back-door in, and instructions for how to make it into a working website with a few install disks.

I end up building machines often enough at work, a third of which are different enough, or the requirements have slightly changed, that drive images don't work, so I've gotten to the point where I can rebuild, with redhat download disks, a backup CD of data, and a sheet of instructions, our production build server in ninety minutes, most of which is spent swapping disks. (I really have to host the disks on a local ftp site and do a net install, it couldn't help but be faster... Or, burn all of the files onto a DVD so I at least don't have to swap disks.)

If I suspect hacker intrusion I'd unplug the machine's net connection. (It hosts our source files, our only real product.) Then I'd write (or activate) very strict firewall rules, letting nothing except known safe machines connect, and plug the connection back in, filtering as much as possible, perhaps even making the website static and filtering incoming http form responses (to perhaps trojaned CGI scripts.) Then I'd grab a spare machine and rebuild the server, copying the data from the active server, and either do a fall-over if possible, or simply switch cables quickly. Time elapsed, two hours. If I know what the exploit or hole was, I'd either patch the server or firewall out that service or those packet contents. If I didn't, it'd take longer because I'd examine the old machine, looking for the hole.

Yes, this does take away from time I'd spend doing other things, but $100 worth, not $25k. It's like people look at the cost of the hardware and software on a comprimised machine, as if it's a total write-off, or something. Or, that they bill all their (obviously failed) security attempts and bugtraq reading to this one intrusion. Or, perhaps, they know that vandalism causing less than $1k of damage won't get the book thrown at a hacker the way inflated numbers will.

Re:Reasonable damage figures

[Trigun]

My point was that we are categorizing criminals by the monetary damage which they cause. Is a drunk driver more guilty of the same offense if he rear-ends a Rolls rather than a Buick?

Leave the monetary damages to the civil cases, that's what they're there for.

Re:Reasonable damage figures

[iabervon]

Sure, it's illegal, but does it cause monetary damages of any particular amount? If I pick your front door lock but don't do anything else, it doesn't cost you anything (unless I damage the lock or the door in the process). It may be illegal, but it's breaking and entering, not causing property damage. It doesn't seem like any of the charges are legitimately due to merely accessing the system illegally.

Perhaps he turned himself in when he found out that all of the charges against him were ones he could fight.

Re:Reasonable damage figures

[Eponymous Coward]

A little common sense can go a long way...

I seriously hope that you see a difference between returning a lost wallet and breaking in to a site to show security holes.

If you want a principle to follow, how does this sound: be courteous. Return a lost wallet and if you want to test someone's security, ask first.

Re:Reasonable damage figures

[ziriyab]

IT'S ILLEGAL TO DO SO. END OF STORY!

He's talking about what's right and wrong, and all you can say is what's legal and illegal? Slavery was legal. People who rescued (or "stole," if we follow your logic) slaves were criminals. Consumption of alcohol was illegal in this country a short while ago. On the other hand, in some countries marrying a 9 year-old girl is legal.

Get over your laws and think for yourself for a change.

Re:Reasonable damage figures

[Audity]

Look at it this way, if the lock on my house is faulty did someone who demonstrates this fact to me "damage" my property by "causing" me to have to buy a new lock?

No, but, the real question is how did he demonstrate it to you? Did he personally show you while you were watching that the lock could be compromised? Or did he enter your house without your knowledge, take a look around and then call you up afterwards to tell you what he did? The latter is illegal, and IMO is a more accurate representation of what Lamo did.

Re:Reasonable damage figures

[AKnightCowboy]

...but he didn't take down the NYT site, or make it unavailable. He trespassed. Would trespassing in the NYT building cause $25K in damages?.. even if he rifled through file cabinets? I doubt it.

Oh most definitely. The minute the system is compromised you have to assume everything on it is suspect. He could've planted false stories or stolen business information that wasn't for public consumption to sell to rival newspapers. The fact is you don't know so you must assume the worst.

In this day and age the only people that should be cracking into systems are those who have a pre-signed agreement with the company in question authorizing them to do so. Anybody else is a criminal and should get the book thrown at them. There are no "good" hackers.

Re:Reasonable damage figures

[ziriyab]

If I charged you for sex, I could easily get $100/hour. How about I have sex with you, without your consent, for free?

Very good point. Just one problem: If you look and weigh anything like the rest of us slashdotters, you may be setting your price a bit high. I've found that 10 cents (Canadian) is the most any one of us here can expect for our sexual services (we have to pay for the condom and flowers ourselves). The worse part is when they try to haggle and get more for the 10 cents. I once had to throw in a week of tech support for free.

Re:Reasonable damage figures

[Theatetus]

Yes, a total rebuild is required after any intrusion.

BUT they have *NEEDED* to do a rebuild for a long time; Lamo simply proved that fact. If your system could have been compromised, you must assume that it has been.

To be honest, I don't think Lamo added one cent to what NYT has to pay to fix its systems. If they were running an exploitable system, they need to rebuild and secure it. Lamo cracked them and admitted it, they STILL need to rebuild and secure it. How has he added any extra cost to their operation?

Re:Reasonable damage figures

[finkployd]

Oh, I wasn't saying that the fine is not way too high, just that there should be a fine. It seems there are quite a few people on this board who think that this guy should be congratulated by NY Times and hired by them as thanks for pointing out their security flaws.

Finkployd

Re:Reasonable damage figures

[Merk]

Who defines "breaking into"?

If someone misconfigures their web server so it points at "C:\My Finances" and you surf to their site, are you breaking into their system? What if they configure it so it points to "C:\" and you click on the "My Finances" link? What if they have a default "Welcome to XXX" page but you type in the url: "http://www.icantconfigureiis.com/My%20Finances/"? What if you do a portscan on them and try to connect to a nonstandard port? What if you run a rootkit on them?

Obviously the latter examples are reasonably defined as "breaking in", and the former ones are not, but where do you draw the line? Is it a judgement call about what someone reasonably expects you to be able to see?

From what I have read, it is pretty obvious that this guy saw some things that he reasonably couldn't believe he was supposed to see. On the other hand, he did it all through a web browser. It's not like he was running rootkits. He was simply poking around and being nosy. The onus should be on the NY Times to have some reasonable standard of security in place that can't be compromised by Mozilla.

Re:Reasonable damage figures

[BoneFlower]

Exactly. Now if Lamo had been browing the website and randomly came across a security hole, and notified the admins, that would be one thing. That would be analagous to someone seeing your door is open, and politely leaving a note rather than going in and rummaging through your stuff.

But, you are right, actively probing for them wihtout permission is another thing entirely.

If he wanted to audit their systems for free, he should have emailed "hey, I think you might have some security issues. Call me at 555-555-5555 and we can discuss an audit I can do pro bono at a time it will not unnecisarily disrupt your corporate operations"

Re:Reasonable damage figures

[Anonymous Coward]

So if I lock all my doors, and I put "No Trespassing" signs by them, it's okay for you to break into my house by an upstairs window, because nothing specifically told you that you shouldn't?

Re:Reasonable damage figures

[NeoSkandranon]

Does that mean that unless i put a "no trespassing" sign on my door you can come into my house uninvited? Even though the street from which you entered is public property?

I think not.

Re:Reasonable damage figures

[Anonymous Coward]

On the other hand, if I catch you with your hand in my pocket "returning" my wallet, you will be in trouble.

Re:Reasonable damage figures

[GSloop]

How about you secure your network then. Otherwise, expect someone to hack your network all to heck. And BTW, if they actually *tell* you, I'd say "thanks" too!

Adrian was stupid and niave. He did something techincally illegal, but morally it's a much grayer issue.

Bottom line... If you have insecure systems, you're likely to get hacked. If you're lucky you'll find out by the hacker telling you nicely. If you're not, there's always web defacement, "poof" your data's gone etc.

Sure it's a pain in the ass. But what it comes down to, is if you knew your systems were insecure, then it's your own fault for doing nothing. It wouldn't have been fixed in any case. If you didn't know, it wouldn't have likely gotten fixed either.

Either case, it was only a matter of time. The cost and hassle of rebuilding the infrastructure would have been required.

Re:Reasonable damage figures

[Vindicator9000]

I'm not saying that you totally believe everything he/she says, only that it's preferable to know who you're dealing with, and have (hopefully) some steps in the right direction, rather than knowing only that you've been hacked, or not even knowing that. The real response to this should be that the company takes a serious look at who they're hiring to do network security, because there are obviously people out there that know more about the job than the people who are inside and *supposed* to know the intricacies of the system. This guy may not have been doing the NYT a favor, but he obviously found holes that their own internal security could not find or would not fix, he even told them about it nicely, rather than flooding the logfiles with U R 0wn3d messages. I'm not condoning what he did at all, only saying that him finding a hole was much better than the possible (probable?) alternative.

If this guy was smart, he should have taken his reputation and started a consulting business sometime before he pissed someone off sufficiently to get himself arrested.

Re:Reasonable damage figures

[Anonymous Coward]

But what it comes down to, is if you knew your clothes were skimpy, then it's your own fault for wearing them.

Re:Reasonable damage figures

[Christopher Whitt]

Does that mean that unless i put a "no trespassing" sign on my door you can come into my house uninvited? Even though the street from which you entered is public property?

Bad analogy - but this is /. after all.

If you own a private piece of land, but make it into a park and invite people to use it (perhaps charging a small fee for access to some parks of the park, or maybe getting revenue from advertising on park benches), then unless you put a no trespassing sign on that special flower bed over there, I don't think it's unreasonable at all for somebody to walk over and look at those flowers.

Did he actually damage anything besides just gaining access to the system and telling people he could get in?

Re:Reasonable damage figures

[beekr]

How about if one see another person's vehicle parked, say, at a movie theater, with the lights left on?

Turn them off, or let the owner worry about a dead battery later?

Re:Reasonable damage figures

[willtsmith]

Actually, I believe that sneaking into a movie theatre is considered trespassing, not stealing. Likewise, I think this is a case of trespassing as well.

In order to assign damages, one has to actually show damage. It can be argued in this case, that the person helped companies AVOID damages from more malevolent individuals.

I think there definitely needs to be a statute for "good samaritan" hacking. Poking holes in stupid security should not be a crime so long as you notify an organization that you've done it.

Lately, we've had a spree of journalists sneaking into airports through supposedly "tight" security. As it turns out, tight security at airports is just lip service. The ability for whistle blowers to poke wholes in curtains of smoke is a fundamental service to society.

Hopefully, Congress will realize this at some point and pass statutes that will idemnify white hat hackers (electronic or otherwise) as long as they don't cause damage or alert responsible parties as to their findings.

Ultimately, perhaps the white-hats need to form an online newspaper so that they can claim "journalistic" protection the same way airport hackers have.

Re:Reasonable damage figures

[merchant_x]

Your sysadmin sounds incompetent based on what you've said in your post. Perhaps this hacker did you all a favor by making this abundantly clear.

Re:Reasonable damage figures

[alienw]

Actually it may not be a clear cut illegal intrusion.

If a computer does not belong to you, you are not supposed to access it without explicit or implied permission. Federal law is very clear about that. In most states, accessing private data is illegal even if it is not protected at all. Even if I don't have a root password on my machine, you could still be prosecuted for hacking it if you log in and start sniffing around.

If you see an unlocked apartment door, do you walk in and grab shit simply because it doesn't have a "no trespassing" sign on the door? Why is it any different with computers?

Re:Reasonable damage figures

[ChuckleBug]

Look at it this way, if the lock on my house is faulty did someone who demonstrates this fact to me "damage" my property by "causing" me to have to buy a new lock?

What your analogy leaves out is how this demonstration is conducted. A more precise analogy would be someone demonstrating my lock was bad by breaking in, rummaging through my papers and underwear drawer, maybe inadvertently knocking over a couple of lamps, and leaving a note on the table that says, "See? Your lock sucks - Get a new one!" In this case, my first reaction would not be gratitude to the infiltrator for pointing out the flaws in my lock. I'd be pissed that someone violated my home, and wonder what the perpetrator is doing with the information he looked at (maybe he took pictures of important documents?). I'd also never be really sure he didn't just take something and I didn't notice (I think most people have some things of moderate value they don't check on all the time). The monetary damages would be indefinite, but could be great, and a crime was definitely committed, and I had to put up with a lot of unnecessary stress and inconvenience at a minimum.

Now, I think that analogy is more apt, but I think I pretty much pushed it to the limit and wouldn't want to go any further.

Re:Reasonable damage figures

[Anonymous Coward]

He didn't do them damage.
They weren't damaged at all, so what could he have done?
They may have incurred expenses investigating and
repairing security holes that he made them aware of.
He did them a favor, usually one must pay for this service,
either directly or by getting attacked by somone who does mean harm.

Re:Reasonable damage figures

[willtsmith]

Mitnick was what we would call a "habitual offender". Mitnick was a menace. Sure it was a thrill, but he already did time for thieving source code.

There are hackers out there that are misunderstood. Captain Crunch broke a ridiculously stupid security scheme by an arrogant monopoly. RTM made a math mistake in his worm that caused it to go haywire. Mitnick was a menace. He'd been sent to prison once for various crimes. He didn't learn.

Re:Reasonable damage figures

[ThisIsFred]

I can understand the "good faith" approach here in our country, but the nature of Internet-connected networks is that you may be dealing with people who aren't even on your native soil, or people that have absolutely no qualms about seriously messing-up your network, or even people who lack the maturity to exercise some restraint. This can be due to either malicious intent, different social customs, or the fact that the person on the other end is a latchkey kid bereft of character and ethics. It's a different ballgame, and social expectation is no excuse for poor security practice!

It isn't the analog of a bank. People that frequent a bank are mostly locals, and if they are not local, they are at least fellow citizens, and they programmed from birth to follow our puritanical social customs. In addition, there is a pretty good chance that they are mature adults who have managed to budget and save some money.

Imagine if you will this fictional example: A bank from a western culture opens up a bank in the country of Ugrabit. In this culture, it is perfectly legal to run up and grab things of value out of the hands of the unsuspecting, and perfectly legal for the potential victim to bludgeon the perpetrator with a yak's femur. Western visitors are shocked and appalled when local residents run and grab the cash out of their hands as they stand in front of the teller. Westernized bank employees also refuse to beat the perpetrators senseless as it goes against their beliefs. Is it the fault of the locals? No! The bank didn't understand the potential hazards before placing themselves in harm's way.

Re:Reasonable damage figures

[ukyoCE]

You're analogy is a bad one. If someone comes by with roughly the same skills as an "unethical" intruder, and shows you that any of these unethical intruders will be able to get in, then he is doing a kind service to you. Sure you'll be embarassed and have to (omg!) put forth some effort to secure your network. But it's not his fault your network sucked. Your network already sucked, he just pointed it out to you.

Re:Reasonable damage figures

[Evil Adrian]

If he found security holes and used them to gain access, he saw the no trespassing sign. I'm not moved by your argument, and neither should anyone else be.

Re:Reasonable damage figures

[Lightwarrior]

> ...IT'S ILLEGAL TO DO SO.
> END OF STORY!
It's not that simple.

One of the founding principles of the USA is that "right" and "wrong" can change over time - hence the ability to modify our set of laws. As another poster pointed out, slavery was legal for quite some time - that didn't make it right, and people were forced to take action to make it illegal.

Free speech is one of the methods given to US Citizens to let the government know how we think they're doing. However, as has been shown innumerable times over, sometimes doing something "illegal" is necessary in part of the protest. There are times when people won't see how silly a law or rule is until it is broken repeatedly in front of their noses.

We're living in a time when more and more of our information is becoming more and more accessible. There are people out there whose intentions (good or ill) are not being backed by reasonable security. Accessible personal information and light or no security do not mix well.

I'd greatly prefer it if we could live in a world where everyone could be trusted "to behave". If we could trust people not to break into each other's homes, we wouldn't need door locks. Sure, it's illegal to break into another person's home - but does that mean that you don't need to lock your door?

Or that you should never check your door to be sure it's locked?

Most importantly, are you willing to take the risk of leaving personal, private, or otherwise valuable information or things laying around, in plain view, behind an unlocked glass case (alarmed though it may be)?

Every time a case like this gets into the newspapers, it is a bold reminder to corporations that they are at risk. Without a threat of loss, security grows lax. Be greatful this person did not act with a significant malicious intent, and learn from it.

-lw

Re:Reasonable damage figures

[Evil Adrian]

Trespassing, breaking and entering, theft, etc. are all WRONG, regardless of legality, because they harm the person you're doing them to. THAT'S WHY THEY'RE ILLEGAL, BECAUSE THEY'RE WRONG.

Seriously, I hate to ask, but WHERE are you getting the logic to put your argument together?!! You're an idiot!

Re:Reasonable damage figures

[pkunzipper]

Aside from these two apprent cases which he has been charged with, will they sqeeze more "crimes" out of him now that they have their suspect in custody?

As a frequent net-perp, I would be real worried about the other skeletons in my closet (of course having someone like NYT on your ass doesn't come cheap either).

If the feds or the prosecutor digup more violations and criminal acitivity, those luddites will make "an example" out of him.

Re:Reasonable damage figures

[Anonymous Coward]

You're a retard. you know that?

Re:Reasonable damage figures

[Evil Adrian]

It is that simple though -- the whole point is that some moron is upset that this guy is getting prosecuted, and he shouldn't be, because the guy shouldn't have been doing what he did, because it was wrong. It's cut and dried. No reason to be upset that some asshole is getting prosecuted.

Re:Reasonable damage figures

[Evil Adrian]

If I leave the house without my wallet, you don't BREAK INTO MY HOUSE AND TAKE MY WALLET AND CATCH ME ON THE STREET TO GIVE IT TO ME.

There is a HUGE fucking difference, you imbecile.

Re:Reasonable damage figures

[JVert]

I bought a car alarm for my car. If I find someone trying to break into my car, can I charge the burgler for the cost of the alarm?

outragous? yes.

I bought a car alarm for my car. If I find someone trying to break into my car and need to update my car alarm, can I charge the burgler for the cost of the NEW alarm?

outragous? HELL YES.

but.. whatever, its a computer crime, i'll strangle the terrorist myself.

Re:Reasonable damage figures

[Evil Adrian]

If you want to differentiate between "hacking" and "cracking" and whatever else your l337, 2600 stuck-in-the-mid-90's ass wants to do, be my guest, but mainstream media, the law, etc. all see hacking as BREAKING AND ENTERING. It's trespassing, ok? If you want to TINKER with your own computer, fine, but HACKING has entered the mainstream lexicon as an ILLEGAL ACTIVITY, so don't nitpick.

Re:Reasonable damage figures

[198348726583297634]

Because, as has been said before, you don't know that he's just had a look around.

Re:Reasonable damage figures

[Anonymous Coward]

Yes, this does take away from time I'd spend doing other things, but $100 worth, not $25k.

As a sysadmin you should know that you are not at all describing the situation. You're describing dealing with a single host, and it'll cost the company more than $100. Figure meetings to discuss the situation, explain to the higher-ups what happened, then add in your $100 worth of work to fix that one host. Now extend this to a complete network where you know that someone intruded, but don't know the extent. You must examine each device on the network to determine if there was a problem. You have to correct the machines that are identified as having been broken into. You have to coordinate the entire team involved in this. You have to verify that everything is going as planned. Everytime something like this comes up on slashdot, it's amply demonstrated that the regular posters are complete fucktards who don't get it at all. Yes, they may be technically inclined, but they don't understand the enviroment that the real world operates in.

Re:Reasonable damage figures

[Evil Adrian]

Why wouldn't you leave a note on the outside of the house? What POSSIBLE excuse is there for you to invade property that doesn't belong to you?

There isn't any! Stay the fuck out of other people's property! It's not yours, you don't have a right to go in!

Re:Reasonable damage figures

[Jayzz]

This guy left a memo to notify the security holes. That proves he was aware that he was intruding.

Re:Reasonable damage figures

[Courageous]

Now paying someone $25k to audit security is a perfectly legitimate business undertaking. So, how is providing that service for free necessarily "damage." (???)

When you provide a service for "free," at a time you select, under terms you prefer, you are catering to yourself and not the third party. Such "free" services are hardly "free". They are enacted for self-serving purposes, for one's own personal gratification. The convenenience of the third party isn't even considered.

How would you feel if you left your door unlocked one night, a neighbor came buy and tested it, then entered your house, and begin screaming at the top of his lungs: "HEY! YOU LEFT YOUR DOOR UNLOCKED!!!"

I know how *I* would feel. I would meet him with my GUN loaded, drawn, and leveled at his belly button. Arrest would follow shortly thereafter.

C//

Re:Reasonable damage figures

[Lodragandraoidh]

In the case of the $25,000 - that is about 4 months of my salary; they are going to try to convince me that it will take 4 man months to fix the security issue with their proxy settings? Give me a break!

If they are spending that much money to fix a proxy issue, then I am in the wrong line of work...

Re:Reasonable damage figures

[Anonymous Coward]

The comparision between hacking and home invasion always bugs me. How would you address an issue of a company running anonymous ftp services by accident? Is it ok to attempt to hit someone's web page, but not ok to try and ftp to there server? Downloading credit card information stored on a publicly accessable ftp server can and is construed by many to be hacking to some level or another. This is one of the many examples why "hacking" is such a grey area. People who try to impose the laws of the real (as in physical) world to hacking propagate this aura that hacking in any sense is a major crime. Just because it might piss off the people being "hacked" doesn't mean it was truely wrong. It's part of the risk you take in connecting your server to the public network, and yes you should have some protection governed under law, but those protections should never be applied in such a generalized way.

Re:Reasonable damage figures

[SonOfThor]

I never quite got this... would you really trust a hacker to tell you everything he did? Some anonymous person on the internet breaks into your system and you will just take his word for it? A security incident is a security incident you have to do the same work either way:

offline the system
investigate the system to find intrusion
do a complete reload from scratch
identify other systems on the network with same vulnerability accessable by compromised system
make decision to roll dice and guess others were not compromised or rebuild those systems also

number of steps left out but you get the drift, the entire network is compromised and I don't trust my job let alone hundreds of fellow employees jobs, on a completely unknown person telling me they really didn't leave any back doors and didn't do anything at all after they intentionally broke into a system

I agree with this.

Incident response teams cost big money. Forensic examination of multiple systems and/or networks adds days of work for the IR team. Combined with the downtime costs associated with the examination and re-building of the compromised systems and suspect systems, and you're looking at a massive price tag. No sane Incident Response specialist says "well, this system was compromised, but it's probably fine if we just change the password and put it back into production". The fact of the matter is, you shouldn't be hacking into other peoples systems if you're not Explicitly given permission in writing to do so!!! Without permission it's all considered illegal hacking, and can and will be treated as such. You have no right to bypass the security measures of any computer that you do not own. NO RIGHT, unless explicitly granted to you by the system owner. It doesn't matter if you're a saint or Santa Clause or the Fairy God mother of web security. It doesn't matter if you CLAIM to have the best intentions.

Further to this, I find it humorous whenever someone chimes in on these discussions to paint Adrian Lamo as some kind of public service angel.

PUH-LEEZE.

The only difference between what this guy does and what those Russian blackmail hackers do is that at least the Russians give the target company a chance to avoid the publicity!!! (albeit by paying them off.). But hey, the Russians even offer to help secure the systems, just like Lamo. Dude is just a media whore. That's his pay-off: His name in lights as some kind of "hacker genius whiz-kid". Instead of blackmailing the companies he targets, he just runs straight to the presses with his latest trophy.

He probably sucks at hacking too, just has big balls and a "rebel without a cause" attitude.

Re:Reasonable damage figures

[johnnyb]

"Why wouldn't you leave a note on the outside of the house?"

In the case of physical security, it's obvious what the problem is and the reason for it. With technical things, with many admins, they just don't know what you mean.

Re:Reasonable damage figures

[commodoresloat]

If a computer does not belong to you, you are not supposed to access it without explicit or implied permission.

Arguably, leaving port 80 open constitutes implied permission. Nobody expects me to get a signed note from CmdrTaco every time I visit slashdot.org. On what basis can a prosecutor make the claim that leaving port 23 open does not constitute the same kind of implicit permission?

Re:Reasonable damage figures

[Anonymous Coward]

Actually, it's $10,000 if you're an individual, and $5,000 of you're a major corporation like M$

Re:Reasonable damage figures

[MrLizardo]

You have a good point, but I have to play devil's advocate. If I'm the New York Times and I decide to have the locks changed I don't get Bob's one-man-operation LockSmith Co. to change the locks I get Ginormous LockSmith Inc. to change the locks. Bob may do a cheaper/better job but Ginormous companies can't really disappear overnight with an assload of money without someone noticing. Bob can.

I completely agree that people are much more fearful of the arcane magic of network security but beyond that is the issue of hiring a lone gun who has a history of going to ground and being unreachable for significant amounts of time. Its the same reason that for the most part you can trust K-Mart employees not to rob you at knife point. There's responsibility/accountability and a paper trail to go with it.

Other than that I agree with you :^)

-AX

Re:Reasonable damage figures

[InsaneGeek]

Not for the cost of the alarm (unless he damaged that), but you can sure charge him for the cost of repair to your vehicle i.e. in this case your OS is your vehicle.

Anyway, analogies are a stupid way to put forth an argument.

Re:Reasonable damage figures

[Anonymous Coward]

Fine, but THAT'S NOT AN EXCUSE FOR LAX SECURITY! I don't know if you've ever actually been the victim of a crime, but here's a clue for you:

IT'S NOT BREAKING AND ENTERING IF THE DOOR IS UNLOCKED -- IT'S MERELY TRESPASSING UNTIL SOMETHING IS REMOVED.

This isn't nitpicking! It's true! If you consistenly have your car stolen because you leave it unlocked with the keys in the ignition, you're going to find it hard to get it insured in the future! Companies with poor network security policies are bad investments.

-Frd

Re:Reasonable damage figures

[roystgnr]

The problem is, how do you trust someone who's just broken into your systems to tell the truth about how they did it? Or to tell you everything they did? You can't, so you must look over everything, and probably reinstall your systems.

Suppose they didn't break into your system, but just told you how they could have done so. Wouldn't you want to perform the exact same expensive actions in that case, even though the white hat never broke the law?

Re:Reasonable damage figures

[vijaya_chandra]

he went in through the 'unlocked' back door, roamed around in the house for sometime, came out and then told you abt the credit card info
hmm.. that doesn't sound wrong at all
does it!?!!

Re:Reasonable damage figures

[Anonymous Coward]

The faulty lock isn't a good analogy. A better analogy is that you have a normal working lock, and the person is an extremely adept locksmith who also knows how to circumvent security systems. Don't think "This Old House", think "Mission Impossible".


Psst.. it's not a real lock, it's a bug that shouldn't have existed. I made a login screen lookie it's a lock. I forgot to check for SQL injection in my POST'd password data. Was it a working lock that was broken, or a broken lock in the first place?

Re:Reasonable damage figures

[hesiod]

> you knew your clothes were skimpy, then it's your own fault for wearing them.

Touche', although I don't think a lot of people will understand what you are implying.

Re:Reasonable damage figures

[Anonymous Coward]

Just as a point of order... Lamo has stated that he is not a hero or a white hacker. He's what you's expect him to be. Some guy who found a vulnerability and his curiousity drove him to see how prevalent it was and what was at stake.

So let's stop painting him as an angel.

On the otherside, he wasn't a malicious hacker either. He informed and even attempted to assist companies of their security flaws. And with a couple exceptions he didn't (as he claims) make any effort to alter or compromise the systems. So stop setting up pyres for a witch hunt.

Re:Reasonable damage figures

[Anonymous Coward]

Well, I agree with you about having to wipe the entire machine, but I really don't see how starting from scratch is that big of a deal either. The first thing one should do after configuring a system, offline, is make a known good tape - no compromises to worry about so you don't have to worry about whether your tapes are safe. If the machine has to be wiped, you use that tape, patch-patch-patch, and restore the data.

$25K?

Re:Reasonable damage figures

[ryanvm]

Here's a harsh example: If I charged you for sex, I could easily get $100/hour.

Hmmmm - is there something you two aren't telling us?

Re:Reasonable damage figures

[Lightwarrior]

And if he's getting prosecuted for an unjust law? Or if he's getting prosecuted for something he didn't do? Or if he's found guilty, he will face cruel and unusual punishment? Or punishment not commensurate with his crime? I'm not saying this is how it is, just giving examples why someone could be upset over a prosecution.

There are many, many reasons to be upset over "this guy [] getting prosecuted". You say it's "wrong", that "it's cut and dried". I say it's not as simple as you make it out to be - "law" isn't inherently "right". Further, there's a very real possibility that the plantiffs are looking to make a profit off this rather than reimbursement for damages. That seems pretty wrong to me - does it seem right to you?

-lw

Re:Reasonable damage figures

[Anonymous Coward]

Exactly. It's like seeing that someone has a door ajar on say a house they own but don't live in, and you walking up their garden path to close/lock it for them. Or at least telling them it's open.

Re:Reasonable damage figures

[Anonymous Coward]

This is the reason why you use a cd- (or dvd-)writer to store your logs (Hint: packet writing).
Once a line has been written to a cdr it
becomes pretty hard even for the most
skilled cracker to alter it.

ps: avoid using rewritable media. ;)

Re:Reasonable damage figures

[Natty P]

I really like to hear arguments about morality from someone named 'Evil Adrian'... Based on your arguments I'd guess you're actually Lawful Evil Adrian. :)

If you see smoke pouring out of someone's window and you kick down the door to put out a fire would you be expected to be charged with 'trespassing' and 'breaking and entering'? Obviously, because it's always wrong...

Take a look at your own 'logic'...

Re:Reasonable damage figures

[martyros]

This is one of the reasons white hat hackers like Lamo do what they do. The companies aren't doing what they should, out of fear, thus leaving all the doors wide open. It's a deriliction of duty that the white hats expose to the public.

Perhaps we need a government agency to do this instead? We have health inspectors, after all, and all kinds of other inspectors for other industries. Imagine if every company that dealt with sensitive customer information were "inspected" once a year by a tiger-team of white-hat hackers, and fined for every security problem they found.

I'd work for the government then. =)

Re:Reasonable damage figures

[Anonymous Coward]

"Lamo cracked them and admitted it, they STILL need to rebuild and secure it. How has he added any extra cost to their operation?"

Because they were never planning to fix it anyway?

Do you still want to trust them with your personal info?

Re:Reasonable damage figures

[Anonymous Coward]

Sorry; I am here to learn from famous crackers, in part. Mostly I'm here to polish my ego by spewing big rants and flames about shit, but when you're not learning, you're dead, or you might as well be. It's called stagnation, and it's bad, mmkay?

Slashdot is entertaining drivel, and reading 15 articles a day isn't learning, it's data collection. Go "learn" what learn means, mmkay?

Re:Reasonable damage figures

[clambake]

The NY Times is 2 products; an offline and an online newspaper. You knock the online version out and you've killed half the products the company offers.

So, I'm confused... The guy actually helped prevent this kind of thing from happening in the future, so it sounds like you are agruing that the kids did right... right?

Re:Reasonable damage figures

[Richard_at_work]

He walked around the private flowerbed and then climbed over the fucking wall to get a clear view. I think thats enough analogies for today.

Re:Reasonable damage figures

[ryanvm]

I wonder if $300k really is a realistic fine to apply to someone who essentially is just spraying graffiti, breaking and entering and having a look around.

First off - the $300k is not damages, it's theft of services. LexisNexis isn't cheap and, supposedly, were this guy a paying customer, his bill would have been $300,000.

Secondly - the $25k in damages is quite possibly a legitimate claim. In the great tradition of Slashdot I'll proffer an analogy:

Some doofus carrying vials of ebola and spray paint breaks into a blood bank, sprays some graffiti and leaves only to be caught by the authorities later. How much damage did he cause?

Obviously the blood bank cannot assume that all he did was spray graffiti. They now have to either test EVERY possibly contaminated unit or destroy them. Either way the damages will far exceed what the fellow actually damaged.

So no, he probably didn't cause $25k worth of "damage", but it could very well have cost NYT that much to figure out what he did.

Re:Reasonable damage figures

[Anonymous Coward]

You're missing the damn point.

Your metaphore is wrong. It's not a question of the "lock on your house". It's more a question of looking through the window from the street after nightfall when the lights are on and you've left your blinds up. Yeah, you could call the person on the street a pervert, or a peeping Tom. But maybe it's the other way around, and the homeowner is an exhibitionist?

Look, Home-Depot invites the public into their stores to shop. When they don't want folks going into the back, they put up do-not-enter signs, lock doors, etc. And if they didn't, some kid would wander back there.

Many of these stores have phones throughout the store. If they don't want people using these phones, they put a "for-employees-only" sign on it, or otherwise secure it. If not, folks assume it's just like the phones in Target, put there for their use, and try to use them.

NYT, from all accounts, failed to do this. Their data was plainly accessible, from any web browser, without any sort of locks or do-not-enter signs.

So was the hacker a peeping Tom? Or was the NYT the exhibitionist?

Re:Reasonable damage figures

[AllynM]

Unless someone gives you PERMISSION to break into something of theirs, IT'S ILLEGAL TO DO SO.

END OF STORY!

Fine, lets all just quit worrying about computer security. I mean, we have nothing to worry about, right? NOBODY in their right mind would do anything ILLEGAL... its against the law! Why i'll go take the lock off of my front door right now.

Face it, NYT had sucky security practices and Lamo prooved it to them. They should be thankful. It could have been someone else with much worse intentions.

I'm still floored that NYT is actually claiming damages. The system had crappy security, and he showed them. NYT were the neglent party. Their business model almost appears to be...

1. Blow off security issues.
2. Wait for someone to show you your system sucks.
3. File huge lawsuit, claiming damages that are actually the cost they should have paid themselves.
4. Profit (its apparent here, since Lamo is now the one who will cover these costs).

Re:Reasonable damage figures

[Slime-dogg]

That's why you employ two or three of them remotely, without telling them about eachother. Any back doors that one of them puts in, the other will find, and vice versa. As long as they don't know about the other(s), you should be in the clear.

Re:Reasonable damage figures

[arkane1234]

OH dear god...
I can see this in my head right now... homeland security extending it's tenticles into data security .

Re:Reasonable damage figures

[Crash Culligan]

Quoth the JVert:

I bought a car alarm for my car. If I find someone trying to break into my car, can I charge the burgler for the cost of the alarm?

outragous? yes.

I bought a car alarm for my car. If I find someone trying to break into my car and need to update my car alarm, can I charge the burgler for the cost of the NEW alarm?

outragous? HELL YES.

And to take the analogy to its most excellent extreme:

I bought a car alarm for my car. If I find that someone has taped a note to my steering wheel telling me that my car alarm is wired incorrectly, and lists ways to fix it, can I charge the cost of the burglar for the costs of the new alarm AND a the time and effort it takes to inventory my car to see if he took anything while he was in there?

(And you know something? It just occurred to me: he demonstrated that the system's security was flawed. If they find signs of intrusion, why are they so sure the guy that told them about the problem is the only one to get in there? Shooting the messenger is a sure-fire way to make sure you get fewer messages in the future.)

As someone else pointed out, analogy isn't the best form of argument. However, it does very well to illustrate how poorly the "logic" of a given solution applies to other real-life problems.

(From Dilbert, on reorganization to solve problems:)
PHB: If your car has a flat tire, what do you do?
Wally: If I'm you, I rotate the tires and drive home.
(Sadly, the Dilbert archives don't go back to October 31, 1995, the original publication date.)

Re:Reasonable damage figures

[$uperjay]

He didn't 'grab shit'. If you're using the apartment door analogy, it would be more accurate to say he saw the door was ajar, gave it a push to confirm it was open, and left a 'your door was open' note for the owner.

Re:Reasonable damage figures

[jkauzlar]

What happened to "innocent until proven guilty?" That's another right that needs to be preserved in this case. You don't know he was just having a look around just like you don't know he wasn't sucking lines of coke at the same time either.

They need to fine the guy for what they proved that he actually did and if information turns up missing or posted on the internet later on, then they'll have a pretty good idea of who was responsible.

Re:Reasonable damage figures

[GryMor]

Likely it won't be because one of the other hundred people who walks by will pick it up and keep it.

Now, consider that you are storeing something of mine in your wallet and you drop it on the sidewalk and don't notice. Isn't it my right, and to some extent my responsibility to attempt to return it to you if I notice that you droped it, possibly with a note telling you when you droped it and how to secure your pocket such that it doesn't fall out again?

Thats all he's doing, it's just the wallets he's returning happen to have things important to a lot of people. If you gave someone something to keep safe and they weren't doing it, wouldn't you want to be told?

Re:Reasonable damage figures

[Hatta]

Exactly what I was trying to say, thanks. If anyone is at fault it's the incompetant sysadmins.

Re:Reasonable damage figures

[GryMor]

They had to do that anyway. Even if he hadn't hacked their site, they still havethe responsibility to do everything they are doign now as soon as they found the problem. He has potentially cost them at most the interest on the money they are spending now as opposed to in the future. He has potentially saved them their very existance.

Re:Reasonable damage figures

[martyros]

I certainly see where you're coming from, it's the first thought I had in response to this one.

But remember, there are already tons of government agencies that do inspections of all sorts of things. Aren't you happy there are health inspectors? And the SEC, the FDA, the EPA, and so on? Aren't you glad that governments test the water regularly and investigate corporate polutants and such?

And remember the focus: not private individuals in their homes, but large corporations who should be protecting your private data, but may not be. The only ones holding them accountable are illegal hackers like the ones in this story; this makes all the wrong incentives for large companies. Why secure your data, when you can just press charges against anyone who exposes your weakness?

I was at a conference recently, and one of the talks was given by someone from the NSA. After introducing himself, he sad as an aside, "By the way, I just want to assure you that all the people I know at the NSA, FBI, etc take their vow to uphold and defend the Constitution of the United States very seriously -- and that includes the first and fourth amendments. We're not part of some government conspiracy to take away your liberties, but to protect them." And that's why the vow is not allegiance to the government -- which may be good or bad, honest or corrupt -- but to the constitution.

It's always a good idea to keep a suspicious eye on the government, especially in cases like this. But when people suggest that Bush is working up to institute a military coup, it shows that they're completely ignorant of what the US military is like. The military is made up of Americans, who hold the same values of freedom and liberty that you do. You can bet that if their superiors told them to be oppressive to other Americans, they'd tell their superiors to go to hell.

Re:Reasonable damage figures

[curious.corn]

Hey cool off Mr. Law & Order. As far as I've been able to understand (something for the media to learn... next time they'll make shure I "understand" the "one true version" of the story) the chap is just a semi-homeless chap (we call them punkkabbestia) that knows computers like your average PFY nerd. Just by tinkering with browsers & sniffers (no really cool costom trojan...) he managed to shame lavish executives for their gross tech spending mistakes; previously they used to eat humble pie and admit tech isn't their business but the hippysh white robed Gandalfs in the server room. Some months ago I read some IDG report calling for some sort of C*O Pride Day and threatening nerdy techies to get their suits pressed because misconduct wouldn't be tolerated in today's economy. Some idiot must have read that report and here we are...

Re:Reasonable damage figures

[nervous_twitch]

And to take the analogy to its most excellent extreme:

I bought a car alarm for my car. If I find that someone has taped a note to my steering wheel telling me that my car alarm is wired incorrectly, and lists ways to fix it, can I charge the cost of the burglar for the costs of the new alarm AND a the time and effort it takes to inventory my car to see if he took anything while he was in there?

Hmm... sounds like an interesting idea. Stage a car break-in like this, and when the judge says your requests are unreasonable, point out that major corporations do exactly that with white-hat hackers. Somehow manage to get plenty of news coverage, and put pressure on those companies and the judges on these trials to throw out unreasonable reimbursements for things like this.

Re:Reasonable damage figures

[Elwood P Dowd]

Sure it does. It sounds like he broke the law. But it doesn't sound like he did $25k in damage, does it?

Re:Reasonable damage figures

[DCheesi]

Yes, but technically the data on the system could not be trusted from the moment it went online, since a hacker of similar skill could have used the same exploit at any time and (presumably) avoid detection. In a sense, Lamo didn't compromise the system --NYT's sysadmins did. Lamo merely pointed it out to them. Even if he hadn't actually hacked in, the mere existence of the flaw would be enough to render their data untrustworthy.

Re:Reasonable damage figures

[Anonymous Coward]

Only sheep follow any law unquestioningly and blindly.

Re:Reasonable damage figures

[InsaneGeek]

Where are you getting the charge for a new car alarm? Everybody keeps saying it like that's what could be charged. It's not. It's like saying "I can prove you wrong because 2+2 != 5", but I never said 2+2=5 why are you saying that other than to hide the fact that you have no real meat behind your argument.

Re:Reasonable damage figures

[jBabel]

LexisNexis is a little different. Since he would not have otherwise paid $300,000 for the service, he didn't really cost them that money.

I'm not sure you understand what LexisNexis is (it's a very very big database of articles from just about every news organization). It's not a service provided by the NYT, but rather one to which it subscribes . This means it's LexisNexis that charged the $300K to the NYT, rather than an hypothetical $300K charge that the NYT would have billed to Adrian.

Re:Reasonable damage figures

[_bug_]

It proves that he found something he felt was a security problem. It does not imply that he was intruding. It would be the same if I found out that by changing an ID value in the URL I could access others' personal information on /. I would certainly e-mail Taco or whomever and let them know about the vulnerability right away. That does _NOT_ mean I was intruding, does it?

Re:Reasonable damage figures

[TheGreenLantern]

The difference being, you don't have to do anything special to see the flower bed. A better analogy would be if the ower of the private piece of land put in an underground wine celler, and I spent the better part of 2 hours digging a hole to get to said celler.

I'm quite certain that whatever this guy got into, it wasn't exactly linked to from index.htm.

Re:Reasonable damage figures

[bareminimum]

However in that case all these costs bump up because they're made in a high alert situation. Think about overtime, outside assistance, express delivery of equipment, etc. Security by obscurity is a bad thing, but the corrolary of that is that in the case of a break-in you cannot afford to fix problems at a reasonnable pace, mainly because of the publicity.

You might say that the victims are responsible for the publicity, but that's not true. Who knows when and where that goof who just broke into your system bragged about it.

There is a direct consequences between a break-in and the extra costs. The same way if someone breaks into your house. You will immediately replace your locks for better ones even if the nature of your belongings doesn't justify it. Simply because you do not want to live through the same ordeal again.

If I break into your house, you will have to make a full inventory in order to establish what had been stolen... Then you'll have to change all your credit cards, financial info, etc. etc. Simply because you never know. That takes time, don't you agree?

Re:Reasonable damage figures

[Anonymous Coward]

> The minute the system is compromised you have to assume everything on it is suspect.
> ...
> the only people that should be cracking into systems are those who have a pre-signed agreement with the company in question authorizing them to do so.
> ...
> There are no "good" hackers.

With your logic, if Adrian Lamo had been paid to break into their system, they'd sue him for $25,000 anyways. If he breaks into the system, to prove it's possible, the compromised system would have to be rebuilt. You couldn't just trust that paying him would mean he didn't compromise it because by your statement there are no "good" hackers. So, no one should break into systems to make them more secure? The fact of the matter is, their systems were vulnerable. Anyone could have done what Lamo did. People quite possibly did. Lamo found the vulnerabilities and mentioned them to the NYT for no cost.

So, Lamo didn't randsom the information. He didn't cause any unneeded analysis of systems (unless you want to claim the systems really weren't vulnerable). While he did break in, it's not the same thing as breaking a lock. More fundamentally, it's like realizing that certain common keys, like a skeleton key or screwdriver, and open the lock. He told the owner and he had to show the vulnerability to them to prove it. What else was he supposed to do? I guess the best thing for "white hat" hackers to do is to so totally hack vulnerable websites especially with instructions on fixing the problem that they can't ignore the problem nor can they figure out the perpetrator (by changing logs). Or do you really want a world where any reasonable competent computer user can read anyone's personal information because companies would rather sue people who point out vulnerabilities instead of making their systems secure enough so that anything short of deliberate DoS (which don't involve hacking the system, but are illegal) will have no effect?

Re:Reasonable damage figures

[bareminimum]

You forgot to say that in both cases, if caught, your burglar ends up in jail.

And yes you could probably sue him for the car alarm thing. After all you don't know how he got in, maybe he captured your code when you opened it with a keychain.

Re:Reasonable damage figures

[_bug_]

Does that mean that unless i put a "no trespassing" sign on my door you can come into my house uninvited? Even though the street from which you entered is public property?

Poor analogy.

A better (and more timely) analogy would be if you are handing out candy from your front door during Halloween, can someone try going to the side door and look for more candy?

Why is it when I access a web site I don't need to get explicit permission to access it first? IANAL but it's certainly a fuzzy area in terms of legality.

You could argue that because a computer is set up on a public network and listening on a port specifically used for the common task of transmitting information via HTTP that the server operator would have a reasonable expectation that anyone connected to the internet could/will try to access said server.

That to control access to data the server operator needs to either implement some kind of access control mechanism or remove the server from the public network.

NYT did neither. There was an open proxy that Llamo used to get through to NYT's intranet. If he didn't need to get explicit permission to access the NYT website, why does he need to get explicit permission to access this proxy server or the NYT intranet? Especially if he never encounters an "authorized use only" type of message.

Unless you regularly allow public access to your house there is no pre-defined "access allowed" type of environment/paradigm/whatever. That's probably where the case can be made that a person entering your house without permission is committing a crime. The attacker has no reason to believe he has permission to access your house.

But with NYT, they let people access their data all the time. There's a reasonable belief that the NYT has granted permission to access their computers, or so it could be argued anyways.

But as I said, this is a really fuzzy area.

That's why the law governing whether or not a person can walk into your house uninvited, and the law governing computer access are two completely separate laws and any analogy made between computers and personal property (when not in a physical sense) cannot be made.

Re:Reasonable damage figures

[aricusmaximus]

You're one of those people who's into the "three strikes" laws, aren't you?

Black and white your favorite (only?) colors?

Re:Reasonable damage figures

[WNight]

The problem is that people seem to think that anything you do which costs a company money is illegal. Companies certainly seem to like it when people think this.

For instance, tell people that there's a flaw in a company's product, or in the security they use, making them implement costly repairs, and they want to bill you for their expense. This is a common theme these days.

In this case, this is coupled with illegal access, but you still can't claim that the hacker cost you $100k if that was $99k in updating infrastructure to avoid future attacks and $1k of cleanup after the intrusion. To be secure you'd have had to pay the $99k anyays. There's no way that this hack cost the company $325k, not unless the hacker figured out how to remotely destruct hardware. Claiming that much for damages makes their claim seem ridiculous.

Re:Reasonable damage figures

[Anonymous Coward]

minus the damage to the NYT image for being publicly embarrased by the security compromise.

Well, if they had kept their system secure, that wouldn't have happened, now, would it?

Re:Reasonable damage figures

[JVert]

My analogy of the car alarm originates from a reply to a post, not the article.

In that post the scenario was assumed that the damages were including security. to quote:

offline the system
investigate the system to find intrusion
do a complete reload from scratch
identify other systems on the network with same vulnerability accessable by compromised system
make decision to roll dice and guess others were not compromised or rebuild those systems also


All these actions listed are related to securing your system. If you can prove no damages were done to the core systems your simply taking inventory and (post)preventative steps for security in the future. Back to analogy from hell: If I have a collection of CD's in my car and I belive that the burgler stole one of them may I bill my own hours to take inventory of my CD's and count those hours as damages?

Re:Reasonable damage figures

[WNight]

You can't claim the meetings to discuss the problem as damages from the hack. If you were on the ball you'd be having those meetings anyways. You can *ONLY* claim the actual time spent fixing the damages (or yes, suspected damages).

What I see as the usual stupidity in these threads is some clueless admin saying "They broke in, I now have to assume that everything is trojaned and reinstall everything from the ground up!".

Bullshit. You analyze the attack and you see what they could have done. If they penetrated a web server in your DMZ it's not inside the firewall and you have no reason to assume they got farther in because an attack from your webserver should be blocked by the firewall the same as an attack from an unknown host on the internet, it's the whole purpose of putting some machines outside the firewall.

Also, if you can't tell if anything has been tampered with, and if you have no additional reason to expect that it was, you can't justify reinstalling it just to be sure. If you secured that machine to the best of your ability, reinstalling and resecuring to the same level, is useless. It's superstitious. You might as well wipe and reinstall the whole thing right now(!) because someone might have hacked you while you were reading this!!!!

In short, if you have a clue of what you're doing, you've already spent time in meetings. You've already got intrusion detection systems in place, and you've got procedures around for recreating all of your machines. Not just for hack attempts, but for fires or tornadoes. This hack just means you need to implement these plans, not that you run around like a chicken with its head cut off, implementing a bunch of paniced and useless policies that don't help.

Re:Reasonable damage figures

[WNight]

They don't have to audit anything. They could stick their heads in the sand and reimplement exactly the same security they had before the hack. The only thing they must do, to carry on business as usual before the attack, is fix the hacked server.

They won't. They'll implement new procedures, and try to avoid future attacks, but they should have been doing this before.

For instance, if my company is hacked because I simply missed a new exploit on Bugtraq and they managed to find a way through our firewall with a 0-day exploit we wouldn't change anything except patch and repair. We've already got a good system and we've simply allowed for the fact that unless we read bugtraq 24/7, a hacker who reads it will have a head start. For everything else we've got a policy that I think is sound and we are working to minimize risk. We'll evaluate the attack and see if we were as protected as we could be, but we'd do that if it was the company down the street that was hacked. This planning is simply the cost of doing business.

The NYT will of course choose to implement better security, as you would if you were burgled, but this is merely what they should have done earlier if they really wanted to be secure, not just to feel secure through ignorance of the risk.

As such, they should claim the time spent fixing and reinstalling the compromised machines, at emergency overtime rate, but they shouldn't claim all the planning sessions and paniced changes. To use your analogy, you could pay claim the costs of having the locksmith come at 3am and fix the lock, you could claim the expenses for cleaners, etc. You couldn't claim the expense of an alarm system or a stronger lock.

Re:Reasonable damage figures

[WNight]

If I port-scanned the NYT, a legal activity, and found that they were using insecure programs I could embarass them just as much by simply revealing that they were insecure, as if I broke in. Should I be liable for their loss of credibility because I simply used my technical skills to examine their product and proclaimed it wanting? I think not.

If so it'd be illegal to publish a negative review of a product. Or at least, if it involved opening the hood or unscrewing the case. That's a pretty fucked up kind of world.

It's not reasonable for the NYT to blame him for their loss of face caused by their technical incompotence.

Re:Reasonable damage figures

[Anonymous Coward]

Hmm, how could we seriously listen to you ?? After all, of the two Adrians, you're the Evil one...

Okay, I'll go back in my cave.

Re:Reasonable damage figures

[Bingo Foo]

One of the founding principles of the USA is that "right" and "wrong" can change over time - hence the ability to modify our set of laws.

Wrong. The principles of the founding "in order to form a more perfect union," are clearly geared toward converging on what is right. Moreover, there should be a distinction between right and legal. One is immutable, one isn't.

Re:Reasonable damage figures

[Anonymous Coward]

The problem is a) he's already admitted he did go in, and b) they are free to include the cost of proving he didn't do anything else in with the damages.
These are things they wouldn't have done had he not broke in (and yes, it's possible someone else did and they should do them anyways, but that's not the point), so therefore the money spent is a direct result of his actions.

It's not what damage he did, but also how much to prove he only did what he said he did. It's perfectly justified as it has nothing to do with him being guilty or innocent of doing anything other than he said he did.

Re:Reasonable damage figures

[Lightwarrior]

Right and wrong are no more immutable than legal and illegal. Both can - and do - change over time. Just because we feel guilt or remorse over something today doesn't mean that people felt that way 50, 100, or N years ago.

Also, the distinction between "right" and "wrong" was exactly what I was trying to imply by using quotes, and following it with "modify our set of laws".

Judging actions in the past are incredibly easy to do - "hindsight is 20/20" - and because of this, we have an incredible chance to learn from our mistakes. And change what we punish people for accordingly.

Not to mention that "right" and "wrong" can often fall into a morally gray area. Was it "right" to drop the bomb on Hiroshima and Nagisaki? I imagine you'll get two different answers if you ask a Pacific Allied WWII vet compared with a Japanese citizen - or even compare that with some of the peoples conquered by Japan in their surrounding area (not being known for their humanitarian treatment of such conquered people).

Heck, even compare the changes that take place during a change in the Presidency - when a Republican takes power, he repeals Democratic legislation and furthers Right-wing agenda; just the opposite that a Democrat would do if the situations were reversed.

I'm of the opinion that abortion is "wrong" - and the vast majority of the population disagrees with me. Despite my belief, I don't believe it should be made illegal - chiefly because the majority of the population disagrees with me.

Right and wrong are personal beliefs, which can vary drastically from person to person. Hence, law - in theory, common beliefs or rules necessary for the operation of soceity. "Common", because (try as we might) you can't legislate morality.

-lw

Re:Reasonable damage figures

[Rakarra]

If your system could have been compromised, you must assume that it has been.

This exact statement is where many security-minded folk and the rest of the world differ. Non-security folk (and a lot of security folk as well) are of the mindset that there should be some proof of a compromise before you can assume that it took place. How much of an extreme should you take it to? After all, no system has perfect security. It's certainly possible that someone COULD have hacked into your home system (unless it was completely unconnected to the net), so do you run a full rebuild every night under the assumption that someone might have gotten in?

Re:Reasonable damage figures

[d3faultus3r]

considering how miserable k-mart is doing maybe they should be robbing people at knife point. Just like SCO is doing.

Re:Reasonable damage figures

[Anonymous Coward]

Right. No Black Hat ever used Social Engineering to compromise a system, did they?

How does drawing attention to his break-in HELP the BlackHat?

Re:Reasonable damage figures

[InsaneGeek]

I'm saying yes you can bill the time cost as damages, and I fail to see a reason why I shouldn't be able to.

Re:Reasonable damage figures

[Anonymous Coward]

So you'd just trust the guy then? You are far too trusting to be in a posistion overseeing any sort of security.

First off, this wouldn't happen to me. I run a secure system.

Secondly, I would welcome someone informing me that I missed a security hole. It's certainly better than someone taking advantage of they hole.

3rdly, I would check my system for trojans, etc. But I wouldn't expect the 'Good Samaritan' to pay for it.

Re:Reasonable damage figures

[PCM2]

This is one of the reasons why network security is so poor. Companies are loath to allow outside security experts anywhere near the place. This is one of the reasons white hat hackers like Lamo do what they do.

Errr...yeah. And apparently, the other reason is to see their own names in print on Lexis-Nexis. Real noble.

Re:Reasonable damage figures

[dcocos]

It's always a good idea to keep a suspicious eye on the government, especially in cases like this. But when people suggest that Bush is working up to institute a military coup, it shows that they're completely ignorant of what the US military is like. The military is made up of Americans, who hold the same values of freedom and liberty that you do. You can bet that if their superiors told them to be oppressive to other Americans, they'd tell their superiors to go to hell.


Apparently you haven't heard of some things in US history that contradict this. Hoover's use of the FBI for his own personal gain. Are you familiar with McCarthyism? Similar parallels could probably be drawn to the military members of Germany in WWII. None of these people told their superiors to go to hell. And while I'm sure there are people who do take this seriously I actually know a couple. When it comes down to it people acting for what's right versus what may not be people will do a lot to keep thier jobs.

Re:Reasonable damage figures

[Anonymous Coward]

I'm not trying to troll, but I wonder if $300k really is a realistic fine to apply to someone who essentially is just spraying graffiti...

Well, if you spray graffiti on a 17th century statue in the Louvre, or the wall of a Quickie-Mart, don't you think there should be a difference in punishment for the same crime?

The statue would require a team of experts to delicately try to clean up the graffiti...it would likely take months and cost hundreds of thousands of dollars (assuming it could be fixed).

The Quickie-Mart wall would require a trip to home depot, a gallon of paint, and some brushes...total: under $50.

To complete the analogy, sure, if this guy broke into CleatusHouseOfBait.com, and the government claimed he caused thousands in damage (for a fictitious company that wouldn't make that much in a year), you could complain. But, to think that the NYT didn't incur at least $25k in damages from this "graffiti artist" is asinine.

Re:Reasonable damage figures

[larsoncc]

Stop thinking like a geek, and start thinking like an accountant. Defrayed costs are good. The longer you can avoid dumping money into a project that has no immediate impact on the bottom line, the better.

As time goes on, hardware gets cheaper, labor rates get to be more and more like commodities, and automation of key processes starts to step in.

Heck, they probably had to bring in additional people on a temp basis to solve this issue! Not economical!!

While I can't say I support this rational, it is certainly understandable, and yeah - by forcing a rebuild NOW rather than an unspecified LATER... They incurred higher costs.

Re:Reasonable damage figures

[dipipanone]

How does drawing attention to his break-in HELP the BlackHat?

By covering his presence in the logs. "Oh and by the way, I did break into your system, but not to worry, I was just there to check on your holes. Now just you upgrade your sendmail and everything will be fine..."

And of course, you're making the rather dubious assumption that people who go around breaking into other people's systems are rational. I don't see any evidence for such a proposition.

Re:Reasonable damage figures

[Anonymous Coward]

Who did he threaten? Who did he menance?

"Oh no, he's downloading our source code! call the swat team!"

moron

Re:Reasonable damage figures

[arkane1234]

Also, the squelching of the farmer insurrection in pennsylvania that was over taxation of something or other. It's been a while back when I studied that stuff.

The military really has alot of brainwashed people... for the most part, they've lost their pride in being american and gained their pride in being in a group that has guns.

Re:Reasonable damage figures

[Dun Malg]

Trespassing, breaking and entering, theft, etc. are all WRONG, regardless of legality

This isn't the issue. While what you say above is certainly a reasonable conclusion, it completely misses the point. The real question is "does typing URLs into a web browser rise to the level of trespassing". It most CERTAINLY doesn't meet the standards of "theft", as the NY Times was not deprived of property by Mr. Lamo's actions (though they may have incurred costs as a result, but that not a property crime). It's a very murky area of the law here, with no firm precedent.
To use the park analogy (see above), this is like the NY Times opening a nice grassy park with playgrounds and benches-- with a fenced off area where the maintenance crew works. Is what Mr.Lamo did equivalent to standing on a park bench next to the fence, looking over and saying "hey! I could jump in there and steal those rakes!"? Or is it more like he actually jumped the fence and trespassed, but stole nothing? The only difference there is in one case he jumped over, in the other he just looked. Is poking around via port 80 more like looking, or more like entering? There's no definitive case law on this kind of stuff yet. It's just not all as simple as you seem to think it is. Until the court weighs in on it, anyone declaring unequivocably that what he did was legal or illegal is just blowing smoke.

Re:Reasonable damage figures

[WNight]

What can be done? Tons. Intrusion detection, robust firewalling, compartmentalization, easy backup and restore procedures. Try your best to limit everything incoming to just what you use. If you've got an internal and external NIC in the webserver, don't have anything but httpd listen to the external one, and don't have anything else but sshd running at all. Use keys and passwords. Run scripts which dump real-time logs onto a hardened machine (potentially even straight to a line printer). Run other scripts (logging to these logs) which check for any outgoing connections or open ports. Run another hidden script that watches for the death of the first one. Leave honeypot files around, like a fake SUID binary, and watch for them to be accessed. Don't just run in a chroot jail, lock the whole machine down... never need to ssh out from there? Remove ssh. Better yet, trojan it to alert you and fail with a cryptic error message. Remove everything that your webserver doesn't require to run, then run it in a chroot'ed jail. The list is endless.

The general idea is, be prepared to respond to a break-in, and setup the system so that if they get access to one thing they can't get access to anything else. Set it up so that they don't get anything of value if they do break in.

I don't remember the specifics of Code Red, but a friend's company runs IIS servers and they didn't get hit by Code Red. They had a Linux box in front of the servers blocking everything they didn't want to receive and it kept them safe, even before the details of Code Red were released. It even blocked it for multiple reasons, like having ".exe" in the request, the request being too long to anything other than the one upload URL, etc. That's how they remained safe when faced with a virus exploiting a hole they didn't know about.

And, no, you can't sue the burglar for the cost of replacing the lock if he didn't damage it. It's still just as (in)effective as it was before he came through, it's your fault it's a crappy lock. If anything, sue the company that made it.

Re:Reasonable damage figures

[WNight]

The thing is that reinstalling doesn't cost $25k, reinstalling costs a few hundred maybe. Assuming you've got procedures to deal with non-hacker downtime, like spilled coffee, or a dead motherboard, you've got procedures to rebuild a server from data (not program) backups in a short time. Ideally, you've also got a few old machines in the closet ready to be drop-in replacements for your critical machines after getting a copy of the latest data. So you pull out a spare and rebuild your server.

The rest of that $25k, the other 24, is the sign that the NYT didn't have these procedures. They paniced and called emergency meetings, they had downtime, etc. They then tried to charge this to the hacker, even though this was all stuff they should have done before.

What would they have done if someone had merely said "The NYT's http headers say they're using Version X, and it's got this nasty bug?" Why does the same work (ignoring the remaking of that server) get billed to the hacker, but not to the guy who announces the flaw? (Not that I'm advocating limits on announcing flaws, even ones discovered by legal snooping.)

Useful links.

[sekzscripting]

Here's a few extra (useful) links: free lamo - adrian support site [run by kevin mitnick's girlfriend], the screen savers - shot video of adrian moments before his surrender, trigger street - running a documentary on hackers, currently they're following adrian's story..

Re:Useful links.

[Anonymous Coward]

ummm...just to correct this, the freelamo site is not run by Darci (aka Kevin Mitnick's GF), but a group of Lamo supporters. DO a bit of research next time man. :P

Re:Useful links.

[keepr]

uhg, I am the owner of freelamo.com Current Administration Includes, Myself, Darci, Nulllink, and JMB. The Forums have a few more administrators.

Re:Useful links.

[belloc]

Here's a few extra (useful) links: free lamo - adrian support site

And of course...the rallying cry of these websites is...

Remember A.Lamo!!

Belloc

Re:Useful links.

[GoofyBoy]

>run by kevin mitnick's girlfriend

He has a girlfriend?!?!?!

Truely, this man is a legend.

Re:Useful links.

[sekzscripting]

Sorry, on The Screen Savers they made it sound like Darci was the only one 'associated' with the domain, my bad.

Re:Useful links.

[keepr]

It's ok, Yes they did... I have thought about this and if that's what it takes to get people to the site to learn about adrian that's fine by me! It's about Adrian, not my ego

Negotiated?

[bobthemuse]

"Adrian negotiated the terms of his surrender, which included the charges in the warrant issued against him being disclosed."

You have to negotiate for this now? So if they never tell him what he's charged with, can he get a reduced punishment? :-)

Re:Negotiated?

[BiteMeFanboy]

That struck me as odd too. You have the right to know what you're charged with. That's a relatively basic right.

Re:Negotiated?

[jdunn14]

I believe the issue is whether the charges are publicly disclosed. He would have to know that the charges are in order to defend himself, but the nature of the charges might not see the public light of day without the negotiation.

Re:Negotiated?

[Hatta]

I believe charges only have to be disclosed at the time of indictment. But IANAL.

Re:Negotiated?

[Concerned Onlooker]

Yes, this is how I interpreted it also. But does anyone else find that just creepy? When a person is arrested, privately charged and punished without the public ever knowing why that person was arrested our justice system starts to look more like the Spanish Inquisition. Their main weapon is fear and surprise. No! Their two main weapons are fear, surprise and a....

Re:Negotiated?

[Anonymous Coward]

Judging by affairs in the US occupied region of Cuba, people who aren't told what they're charged with can expect an indefinite jail sentence without access to lawyers, courts, or their countries' embassies... so it's a good thing he managed to negotiate that!

I bet the RIAA wants file-sharers sent to Camp Delta...

Re:Negotiated?

[Anonymous Coward]

How do you figure that? If the defendant and his lawyer didn't know the charges then that would be a problem but I don't see how charges for every case should need to be public notice. In some cases the charges have to be private to protect the victim (like rape) or even to protect the accused (innocent until proven guilty).

Re:Negotiated?

[More Trouble]

I believe the issue is whether the charges are publicly disclosed.

Only if by "public," you mean to the accused. The FBI initially declined to inform him of what he was charged with. He in turn declined to make himself available until the FBI disclosed to him what the charges were. The real question is "Why were the charges sealed?"

:w

Re:Negotiated?

[Rich0]

Unless you're dealing with minors I believe all charges are always publicly disclosed at the time of arrest. I'm not sure about when the warrent is issued. The only exception I'm aware of is the latest round of terorr arrests - which are done in secret with some judicial oversight (a whole matter I won't get into here).

In the USA there is no expectation of privacy when the justice system is involved - this is why some people do not report rapes. I don't see any other way to do it and keep the system open.

Re:Negotiated?

[dipipanone]

I believe all charges are always publicly disclosed at the time of arrest.

You believe wrong. Arrests can be made for a host of reasons, ie, because the police believe a suspect poses a flight risk and they need to interrogate them in respect of a crime. The decision what to charge somebody with very often doesn't come until the after the suspect has been interrogated and the range of charges possible has been discussed with the District Attorney.

Re:Negotiated?

[bobthemuse]

Can they legally prevent Lamo from telling the world what he was charged with? Can you file charges against someone on the condition that nobody else find out about it?

Oh, wait, maybe this is a right reserved for major corporations?

Re:Negotiated?

[Anonymous Coward]

There is a big difference between "detained" and "arrested". You can be detained for no specific reason (but usually only for a limited time). However, when you are arrested, it is for a scecific crime(or set of crimes).

Re:Negotiated?

[GooberToo]

It's rather obvious. He didn't want to be another Kevin. Part of the problem with Kevin's ordeal is that they claimed he was such a public risk he couldn't be freed and that in the mean time, they needed to determine what the charges would be. It didn't matter that he was illegally and unconstitutionally held. It was stated by the FBI that they needed time to determine what his charges would be. Clearly Adrian is smart enough to not want to become the FBI's next illegal victim.

Re:Negotiated?

[dipipanone]

However, when you are arrested, it is for a scecific crime

There's also a difference between being arrested and being charged. Many people are arrested and charged with nothing at all because there's insufficient evidence to warrant a formal criminal charge being brought.

Re:Negotiated?

[Rich0]

I'd question that. Typically police can only hold somebody for about 24 hours without arresting them, and to arrest somebody you need probable cause to believe that a crime has taken place.

I was on a jury which had to decide on whether somebody's civil rights were violated because they were detained and moved a block before being presented to a witness for identification. The general consensus in the law enforcement arena is that this is a no-no - you can't just grab somebody off the street unless you have probable cause to think they did something wrong.

Usually when somebody is even detained it is on a technicality - you might hold a murder suspect for a day or two because fortunately their car had a light out or something like that. However, if you aren't charged with a serious crime you demand an arraignment and request extremely low bail - after all you aren't charged with any serious crimes. If the cops want you in jail, they have to "show the body" (which is what I believe habeus corpus means).

Re:Negotiated?

[Loki_1929]

""Adrian negotiated the terms of his surrender, which included the charges in the warrant issued against him being disclosed."
"So if they never tell him what he's charged with, can he get a reduced punishment?"

I should think a better tactic would be to make one of the terms of his surrender that he's never read his miranda rights. At which point, he can then confess to the police, laugh about it on TV, then walk into court and say, "Holy shit, my statements can be used against me in a court of law?! But nobody told me that!"

Re:Negotiated?

[Anonymous Coward]

Except by doing so you acknowledge you know of Miranda rights, and what they are. Meaning you can't claim ignorance of them (which is what the defense is, the "reading your rights" is just a guarantee you've heard them, not a requirement)

Damage is damage

[Doesn't_Comment_Code]

If someone hacks a site, and it goes down for a day. That business loses thousands or hundreds of thousands of dollars, plus a hit to their reputation. That IS damage, and should be punished.

But I think they're being a little loose with the word damage here. Lost revenue cannot be revenue that you didn't get, that you never would have gotten.

Re:Damage is damage

[exhilaration]

If someone hacks a site, and it goes down for a day

He never caused a site to go down, troll. RTFA.

Re:Damage is damage

[Trigun]

And depending on the site, not only would it not cost them money, it would only help their reputation.

My site loses money every day. It'd be pretty funny to charge someone with saving me money by hacking my website.

Re:Damage is damage

[sixdotoh]

plus a hit to their reputation

parent is somehwat a troll, but anyway...

a hit to their reputation? unless the business is some kind of computer security company, or ISP, i would wager that it does very little to their reputation. come on, any other company (especially outside of any IT related company), which of their customers is even going to *know* the site was hacked. how many of those people are going ever hear that the site was hacked... if they couldn't access they site, they would probably just think their own internet connection was screwy at that time, or just accept the fact that they couldn't access the certain site (happens all the time) and think little of it.

i'm not trying to defend hackers, i'm just trying to set that misconception straight.

Re:Damage is damage

[Xerithane]

Grandparent: But I think they're being a little loose with the word damage here. Lost revenue cannot be revenue that you didn't get, that you never would have gotten.
(Emphasis mine)

RTFC, troll.

Re:Damage is damage

[stratjakt]

Who cares if a site goes down at all.

If I collect a garbage bag full of dogshit, and dump it into someones open car window, there's no real monetary damage done, right? After all they just have to clean up.

So therefore no harm-no foul.

It's idiotic. I agree with the judge in this case, I'm fed up with script kiddies and the douchebags who champion them.

Re:Damage is damage

[Anonymous Coward]

Oh I see. No wait, I don't. They were hacked. Fact. Was the damage that someone pointed out something that was true (that they could be hacked, just like everyone else)?

In other news, Nascar driver sues other drivers for affecting his his reputation by beating him in a race.

Re:Damage is damage

[Anonymous Coward]

This is ridiculous. I bet your one of those people who say you can download a MP3 because you would have never bought it anyway so the artist would not have gotten your money. This is the most naive argument I have heard in a long time.

Idiot.

Re:Damage is damage

[proub]

I agree with the judge in this case, I'm fed up with script kiddies and the douchebags who champion them.

Me too. Which has what to do with Adrian Lamo, exactly? I'm not arguing that his actions were noble and wonderful, or even lawful. Don't know all the details yet.

This argument, though, smacks of "Whaddaya mean we shouldn't invade Iraq? Don't you remember 9/11?!?" Wrong target. Different perpetrators. Different crimes.

And yes, I know that's a horribly inappropriate analogy, but so is the "breaking in to a corporate server is like coming in to my house and sitting in my living room and scaring the shit out of me" argument that's being tossed around constantly in this topic.

If Lamo is to be punished / fined / whatever for what he actually did, OK. Fine. He knew the laws (whatever you or I may think of them) going in. But let's not tar-and-feather him for the similar-but-worse activities of others.

Re:Damage is damage

[Doesn't_Comment_Code]

You're misrepresenting what I said in order to disagree with it. There's a big IF at the beginning of the sentence. The post is contrasting actual and trumped up damage. I never said he caused a site to go down.

So before you go spouting off to RTFA, check to make sure you UTFP.

Re:Damage is damage

[Richthofen80]

Actually, he's right. I work for a company that sells medical equipment. We got hit pretty hard by the blaster and welchia variants. The whole time that our network resources were taking huge hits and our critical applications were faltering, everyone kept asking 'Why didn't someone prevent this...'

would YOU trust your business to someone who's IT department was weak, and demonstratably weak? ANY aspect of poor management, or perceived poor management, will lose you confidence in a shaky market.

Quick..

[grub]

Start printing stickers that say "Adrian" which you can apply over the word "Kevin"..

Re:Quick..

[calethix]

I'd rather have a sticker that says 'Lamo'.

Re:Quick..

[nytes]

The guy at the t-shirt shop misunderstood what I said.

Now I'm stuck wearing a shirt that says "Free Lame-o".

Lexis/Nexis and NYT

[Speare]

What would you want to bet that Lexis/Nexis just winks and nods at their huge customer, The New York Times, Inc., and waives much of the actual charges that resulted from automated searches on Adrian Lamo. At their prices, there is probably still over $25K worth of manual labor involved... Lexis/Nexis is a premier service with some amazingly in-depth methods.

Plus, the scouring job that's required by NYT's IT department to ensure there aren't any new "easter eggs" in their system will go into significant coin too. I don't agree with the preposterous insurance-claim oriented figures that go into these 'cracking' news stories, but you can't just trust a superficial system cleanup after being cracked.

Re:Lexis/Nexis and NYT

[exhilaration]

You forgot the costs of retraining new network admins after firing the incompetent fools that left the NY Times network wide open.

Oh wait, those fools are probably still employed, and they're probably the ones doing the "scouring".

Perhaps if the FBI started going after network admins for doing such a crappy job we might start seeing less of these incidents.

Re:Lexis/Nexis and NYT

[Seth Finklestein]

Lexis/Nexis is a search engine. The only difference between them and Google is that Lexis/Nexis charges money to unsuspecting companies.

As a lawyer, I've often found more relevant results on Google than on Lexis/Nexis, for 0% of the price.

Re:Lexis/Nexis and NYT

[rifter]

Perhaps if the FBI started going after network admins for doing such a crappy job we might start seeing less of these incidents.

In most cases, that would not solve the problem. Now if they were to go after the management who ordered holes in the security or refused to allow the admins to apply patches and implement good security practices, then you would be talking.

Re:Lexis/Nexis and NYT

[silas_moeckel]

I think your looking at the worng person to go after them it's the insurance companies that should be pushing for this aka you want insurance for your network your premiums go up as you have less and less patches applied more open ports etc. Just make it cheaper to secure the system than not. This makes the MBA's and CPA's show security having value.

Re:Lexis/Nexis and NYT

[asbestos_lead]

Plus, the scouring job that's required by NYT's IT department to ensure there aren't any new "easter eggs" in their system will go into significant coin too.

Or make sure that there aren't any old "easter eggs". Adrian Lamo allegedly only used a "properly configured" web browser to exploit holes in NYT's system. How do they know what damage he caused, vs. damage caused by a less vocal individual?

This work should be done whether a homeless kid with a laptop adds his name to the contributer list or not.

Re:Lexis/Nexis and NYT

[Anonymous Coward]

Why would they have to wink? If somebody steals my credit card I usally can get most of the charges reversed. I would be surprised if they didn't refund the money even to a smaller company. I also am pretty sure that NY Times pays an annual license fee and not a per reqeust fee but I may be wrong.

Re:Lexis/Nexis and NYT

[Hatta]

Pardon my ignorance, but wtf is Lexis/Nexis?

Re:Lexis/Nexis and NYT

[Seth Finklestein]

It's a web search engine that you have to pay money to use.

Think of it as "Google for suckers."

Re:Lexis/Nexis and NYT

[The Mayor]

Lexis/Nexis is a legal data warehouse/data mining service that includes a great deal of personal information on people. It primarily is used by lawyers when investigating lawsuits. Given a social security number, a great deal can be found out about an individual. As I understand it, there is a great deal of very personal information that can be gleamed, including detailed credit reports. Sounds like he was doing some digging to see what everyone has on him.

Adrian Lamo may be a black hat, but he is a black hat of the best kind. Although he operates on the shady side of the law, he his very strong morals and ethics about how he operates, and has done the security world a great deal of benefit through his actions (unlike, say, Kevin Mitnick). I wish him the best of luck.

Re:Lexis/Nexis and NYT

[Anonymous Coward]

That's rather frightening.

Re:Lexis/Nexis and NYT

[odin53]

You don't quite have it right about Lexis/Nexis. Lexis is a mind-bogglingly huge research database of many things -- mostly articles from thousands of periodicals of every kind and case opinions from practically every federal and state court that writes opinions -- that's used primarily by scholars, journalists and lawyers for research.

Its people finder function is useful and somewhat scary in its comprehensiveness, but that's certainly not where Lexis derives most of its value, and I'm positive it's not anywhere near the function that's most often used. Lexis' value is in the depth and breadth of the size of its database and its rich search capability. For example, the number of documents (NOT the number of pages!) it has certainly exceeds the number of pages Google indexes -- Lexis has 4.1 billion DOCUMENTS in its database, whereas Google indexes over 3 billion PAGES. And Lexis's searches are robust and very fast.

Lexis is extremely expensive, though. A $300,000 charge isn't that surprising to me, if Lamo used it fairly often and not just to search his name. Repeated searches across the entire news database, I'm sure, is ridiculously expensive, if you don't have a negotiated rate.

Re:Lexis/Nexis and NYT

[Anonymous Coward]

Not really, that might be someone close to the case for about 50 of the 10,000 databases available via LexisNexis, but the other 9,950 are things you wouldn't find on the web.

Re:Lexis/Nexis and NYT

[Anonymous Coward]

And their datacenter and operations center is damned impressive too.

Operations looks a lot like a NASA control center, and they always know how fast searches are responding at (much like google tracks theirs).

Re:Lexis/Nexis and NYT

[Politburo]

Perhaps if the FBI started going after network admins for doing such a crappy job we might start seeing less of these incidents.

Yeah, and when are they going to lock up those pesky women for getting raped? Tired analogy, I know, but your point is ridiculous. Blaming the victim is not going to fix anything. There will always be holes, and there will always be poor admins, penalties or not. Though if the FBI did start to charge admins, we might see network admin salary and job requirements rise significantly, as they would be taking a personal responsibility like that of a professional engineer or accountant. This would also require some sort of certification program, which in the computing field is impossible to maintain.

Hacke contribute to the security of the community

[chompyZ]

Such Hackers sould be acknoledged for finding security holes, posting them publicly, and in effect making the community more secure. In reality, they are prosecuted by government agencies and the institutional world... what a treuturus world.

Disclosure

[SunPin]

Why was this a negotiating point and not automatic? Last time I checked, there were rights to know your accuser and the right to a speedy and public trial.

The New York Times is a fucking plagiarist rag. Just another example of those who need to litigate to shine the light away from their business going to the crapper.

Re:Disclosure

[Senior Frac]

Last time I checked, there were rights to know your accuser and the right to a speedy and public trial.

True. I think the authors point is that, under normal circumstances, that takes place after the arrest.

Re:Disclosure

[Monk[Deviant Form]]

maybe hes a terrorist now?

Re:Disclosure

[SunPin]

Then why do federal investigators send target letters informing subjects about the charges they are about to experience?

It's unfortunate that my post was marked troll. The New York Times IS a discredited, dishonored, ethically bankrupt, plagiarist organization. That's not a troll, that's a fact.

Re:Disclosure

[SunPin]

Indeed. But don't get too ticked off on /. or some jackass is liable to moderate you as a troll.

The "damage" was irrelevant. He typed his name into Lexis-Nexis. Big stinking deal. The New York Times should be shot for leaving their data unsecured. There were significant people in those lists that were put at risk NOT because of Mr. Lamo. They were unbelievably lucky that some happy-go-lucky dork was nice enough to point out the flaws before a Black Hat got to it.

What article?

[stratjakt]

read the article about the nature of the 'damage'

What article? How about a link?

Gawd.

Who cares about some Lamo. I'm sick of asshole kids and this uber-l337 hax0r crap. Stay out of other peoples computers, just like you stay off their property and out of their homes.

Who cares if he caused $X amount of actual damage? There's such a thing as punitive damages. If you smash up my car, I can get the value of the damage plus some, just to punish you for being a stupid dickhead.

AT LEAST WATCH AN EPISODE OF FUCKING JUDGE JUDY BEFORE YOU OPEN YOUR YAMMERING IANAL MOUTHS.

Here's hoping Lamo goes to a federal pound-me-in-the-ass prison, and a message is sent to the rest of you uber-hax0rz out there (read script kiddies).

Re:What article?

[smitty45]

"Stay out of other peoples computers"

yeah, you tell 'em! while you're at it: stop doing terrorism! yeah! stop running red lights, too!

p.s. you have no idea what you're talking about.

Re:What article?

[Anonymous Coward]

hello? punitive damages in a criminal case based on civil-suit type claims?

Leave the poor guy alone...

[Anonymous Coward]

The man's name is Lamo. Hasn't he suffered enough?

Re:Leave the poor guy alone...

[mrtroy]

LMAO

errr......LAME-O

errr......

Free LMAO stickers would go well. Same theme as kevin's of course

Re:Leave the poor guy alone...

[Anonymous Coward]

I'll always remember the A. Lamo...

you know what to do

[SirSlud]

Jail that obviously highly intelligent individual!

Yes, I'm joking. This kid sounds like a bright fish .. why jail him? Surely he can contribute in a positive way to society? It sure sounds like he doesn't have any malicious intentions other than prove what every engineer knows - you often need to experience failure before you address a weakness in your design. Better to have failure 'encouraged' by a guy who's willing to help you lock down your network after the fact than some dude who gets in the door and heads straight for client lists, credit info, etc ..

Re:you know what to do

[Anonymous Coward]

This kid sounds like a bright fish .. why jail him?

It's not a jail...it's a tank. He's an iridescent guppy.

Re:you know what to do

[dipipanone]

This kid sounds like a bright fish

He's gonna be a fresh fish soon though. He's cute as well. I wouldn't wanna be going to jail, looking as good as he does.

Re:you know what to do

[glgraca]

Specially if you consider all the nice
fellas in prison who can make him teach
them some nice tricks or else...

Re:you know what to do

[poot_rootbeer]

This kid sounds like a bright fish .. why jail him?

Um... because he committed a crime?

This seems rather straightforward to me.

Re:you know what to do

[SirSlud]

Man, can you imagine if court works this way?

Judge: Should this man go to jail?
Prosecutor: He committed a crime!
Judge: Well, nobody has explained what the law is, nor the specifics of what the defendent did, nor reflected on any previous precendents .. but if you say he committed a crime, well thats good enough for me!

Are you pickin up what I'm putting down? The real question is, for those authority-lovers out there, explain to me what he did that was criminal, and then explain to me whether or not you feel that it *should* or *shouldnt* be criminal.

Secondly, you clearly havn't even thought for a moment about whether all crimes deserve jail times (you seem to imply they should.) Thats a pretty at-the-teet-of-insitutional-thinking party line, but I happen to believe that the punishment should fit the crime. There are plenty of crimes for which jail time is not a suitable or socially benificial punishment.

Sorry to make you think. You're right. The magic 8 ball says that he committed a crime. It also says that criminals should all go to jail. You're right not to engage in any sort of debate beyond the itellectual trappings of a Parker Brothers' issued "Go To Jail" card.

Uh - shouldn't they sue themselves?

[teamhasnoi]

They left the site open. Do I get to sue Microsoft for servers that I don't patch? (Please?...)

Besides, I'm thinking that there was more than 300,000 dollars worth of damage to their reputaion after this.

They need look no further than their own offices to find fault.

Re:Uh - shouldn't they sue themselves?

[peterpi]

Analogy:

I come home from work to find my front door open and some teenager in my living room. He proceeds to tell me how poor the lock was in my front door, how to install a better lock, and by the way, he racked up $100 of calls while I was away.

You who's at fault, and you know I'd kick his ass.

Re:Uh - shouldn't they sue themselves?

[greenhide]

Hmmm... I have a feeling they didn't leave the site open. They just didn't make it unhackable.

It seems like this Adrian fellow is a pretty adept hacker. It's probably not easy to break into Yahoo and similar sites.

Here's a good analogy: Say someone is a great locksmith, and he breaks into your house, snoops around, reads private information that you have locked up in your cabinets, and then uses your phone to make a bunch of long distance phone calls. Should this person be held liable, even if they are willing to give you, for free, a "Brand New Burglar Detection System"?

Hell, yeah, they should. I personally have a hard time believing that Lexis Nexus really would have charged NY Times $300,000 for the searches that Adrian did -- surely they can't be that expensive -- but otherwise I believe that yes, he should pay for his actions.

If someone breaks into my car and crashes it into someone's house, I shouldn't be held liable, he should. Just because I left it unlocked (or locked it, but didn't use the Club) does not make me culpable.

And yeah, the New York Times had a real image problem when one of their reporters turned out to be a real idiot. It's possible that a few of their advertisers jumped ship. But it seems like they're doing fine now, especially since they were so open about their mistake and showed a willingness and intent to improve.

If Adrian is such a great damn hacker, why doesn't he just go straight to the corporations and say, "Look, I know that I can hack into your system. How about you pay me to make it more secure." Rather than hacking in, and then saying, "Hey, let me make it up to you by showing how to secure it for free." See, that way, he gets money instead of going to jail.

Now that the NY TImes has pressed charges, I don't see anything that will get him out of this situation. He probably won't get a lot of time in jail, and hopefully he will be able to work out some kind of agreement where he offers his technical expertise and knowledge to offset some of the costs he incurred.

Re:Uh - shouldn't they sue themselves?

[Xentax]

This is a flawed analogy, playing on the psychological aspects of a home invasion.

A more proper analogy would be to arrive at work one day, and find a note on the floor saying that the lock was picked and how, and that it needs fixing.

Xentax

Re:Uh - shouldn't they sue themselves?

[goldspider]

"They left the site open. Do I get to sue Microsoft for servers that I don't patch?"

Only if you think we should punish rape victims for wearing the wrong clothes and walking down the wrong street at the wrong time of day. She should know better, right?

Re:Uh - shouldn't they sue themselves?

[spektr]

This is a flawed analogy, playing on the psychological aspects of a home invasion.

A more proper analogy would be to arrive at work one day, and find a note on the floor saying that the lock was picked and how, and that it needs fixing.

Or a message wrapped around a stone that says that your window wasn't bulletproof and needs fixing.

Re:Uh - shouldn't they sue themselves?

[delcielo]

So it's THIER fault the cracker broke in.

I'm not going to become an apologist for people who don't patch their servers; but at the same time, it's not the NY Times' job to keep crackers from being worthless amoral turds.

He didn't break in because he wanted to help the NY Times. At best he broke in for recognition, or a job, or to feel bigger about himself. So in short, he broke in for his own personal gain.

That doesn't exactly endear him to me as the network messiah, come to save me.

Re:Uh - shouldn't they sue themselves?

[Hatta]

The NYT left proxy servers into their network unsecured. There was nothing stopping anyone from getting in. They might as well have left their office unlocked and hoped no one jiggled the handle.

Re:Uh - shouldn't they sue themselves?

[SpaceLifeForm]

Hmmm... I have a feeling they didn't leave the site open. They just didn't make it unhackable.

IIRC, he went in via a proxy server that they left open to access from the Internet.
They left the site open. They just didn't put out a sign saying 'Hack us'.

Re:Uh - shouldn't they sue themselves?

[xrayspx]

You can't sue microsoft for servers you DO patch either. Damned if you do, Damned if you don't.

Re:Uh - shouldn't they sue themselves?

[511pf]

If Adrian is such a great damn hacker, why doesn't he just go straight to the corporations and say, "Look, I know that I can hack into your system. How about you pay me to make it more secure." Rather than hacking in, and then saying, "Hey, let me make it up to you by showing how to secure it for free." See, that way, he gets money instead of going to jail.

Because that's called extortion.

Re:Uh - shouldn't they sue themselves?

[teamhasnoi]

Did he actually wreck anything when was in there? He just added his name AFAIK...

Re:Uh - shouldn't they sue themselves?

[spektr]

Did he actually wreck anything when was in there? He just added his name AFAIK...

The problem is that nobody knows for sure whether he broke something, so they have to check everything, wasting the money they should have spend for security before they where cracked. OTOH, when they get to know that they were wide open, they have to check it anyway. But it is a good thing to have a scapegoat.

Conclusion: if you see a gaping security hole, either look the other way or try to exploit the hole to make money. If you go to jail at least you know why.

Re:Uh - shouldn't they sue themselves?

[Anonymous Coward]

You wrote: "If Adrian is such a great damn hacker, why doesn't he just go straight to the corporations and say, "Look, I know that I can hack into your system...."

He did just that. But look what it got him.

I talked with him last week. A few days before they filed charges.

I also just got off the phone with John Markoff (NYT reporter). Found out more details on the charges. He allegedly had used a NYT employees account to gain entry, and they are charging him for "illegally using NYT's computer time".

Lamo never uses any sophisticated tools. He just uses a browser... So the saying "Use a browser - go to jail" seems to have meaning here.

it's no WONDER the state of internet security is going down the toilet.... Find an exploit - go go jail.

There ARE ways of finding exploits without causing damage to the target networks. It all comes down to a matter of trust... kinda like the fox guarding the hen house.

Re:Uh - shouldn't they sue themselves?

[wcdw]

> If someone breaks into my car and crashes it into
> someone's house, I shouldn't be held liable, he
> should. Just because I left it unlocked (or locked
> it, but didn't use the Club) does not make me
> culpable.

On the other hand, if you leave the keys in it, you _ARE_ liable under those circumstances. This is known as criminal negligence, and surely has parallels in the computer world.

Re:Uh - shouldn't they sue themselves?

[AllynM]

This is freaking crazy. Quit blowing every little thing out of proportion. Allow me to elaborate:

Say someone is a great locksmith, and he breaks into your house, snoops around, reads private information that you have locked up in your cabinets, and then uses your phone to make a bunch of long distance phone calls. Should this person be held liable, even if they are willing to give you, for free, a "Brand New Burglar Detection System"?

Lamo did the equivalent of opening the front door (which can almost be said 'unlocked' in this case), and left a note on the floor saying "lock your door. if you're having trouble locking your door, i'll help you fix it".

If someone breaks into my car and crashes it into someone's house, I shouldn't be held liable, he should. Just because I left it unlocked (or locked it, but didn't use the Club) does not make me culpable.

Lamo did not direct the NYT servers to cause damage to any other servers. Actually, Lamo didnt even do damage to the server he had access to.

But it seems like they're doing fine now, especially since they were so open about their mistake and showed a willingness and intent to improve.

Yeah, this is called PR, every company does it, and does it well, or they go under.

If Adrian is such a great damn hacker, why doesn't he just go straight to the corporations and say, "Look, I know that I can hack into your system. How about you pay me to make it more secure."

Because they (and many corporations like them) would most likely laugh in his guys face. If it was really as easy as you say, all hackers would be employed right now, and news stories like this would never happen.

Re:Uh - shouldn't they sue themselves?

[Anonymous Coward]

The rapist is responsible for the rape.

The woman is responsible for taking the risk she did by being dressed provocatively.

IF you can't see the difference....

Re:Uh - shouldn't they sue themselves?

[theanorak]

There are different ways of working with Lexis, but for a company like NYT they will likely have an account which allows them a certain value of searches per month/week/year/given period. This is negociated & re-evaluated each year.

If they go over their allocated monthly usage, the premiums are very large - searches on Lexis can be stunningly expensive if the complete list of sources are used. Most researchers using Lexis tend to restrict the sources they use, and the time period covered. Its still not unusual for members of a research dept to have a personal Lexis spend of $90,000/month - and that's a professional researcher (admittedly making many searches) trained to minimise the cost and use the system most efficiently. Whatever the relative merits of Lamo and his actions, and however NYT react, its entirely possible that the claimed $300,000 for Lexis searches is correct.

Re:Uh - shouldn't they sue themselves?

[Xentax]

Windows aren't *reasonably* expected to be bulletproof.

Large, public, commercial websites SHOULD be expected to be reasonably secure against unauthorized intrusion.

The argument I've seen of "now they have to go fix this and do that" and so on is INVALID. They *should* have had to do that kind of security checking and good housekeeping ALL ALONG, an intrusion like this is like shining a spotlight on an existing problem to a much greater extent than it is creating one from scratch.

It's a gray area to be sure -- if companies were more liable for such oversights, and if they responded positively to simply being told of vulnerabilities without having to have them exploited to take action -- then this kind of action would seem more over the top.

Xentax

Adrian Lamo Surrenders

[Morosoph]

This story makes me sad. The judge had a "last minute" idea, "Oh yeah, let's ban him from using computers", probably the only thing that really gave purpose to the life of a tramp. Getting a "real" job cannot be a substitute, and as The Register points out, Adrian wasn't exactly writing viruses. Quote:

Following the recommendation of a federal pretrial services officer who interviewed the hacker in custody, Hollows ordered Lamo to obtain full-time employment or enroll in college pending trial. The ban on computer use was the judge's idea.
"This whole business of computer hacking, viruses and so forth is getting very wearisome," said Hollows, explaining his thinking from the bench.

There is something depressing about the whole "join society" ethos, that is, conform to everyday mediocrity.

Re:Adrian Lamo Surrenders

[Anonymous Coward]

> There is something depressing about the whole "join society" ethos, that is, conform to everyday mediocrity.

Get back to work.

Re:Adrian Lamo Surrenders

[cindik]

I wonder how many "real jobs" are left that involve no contact whatsoever with computers.

Re:Adrian Lamo Surrenders

[Contact]

What I'd like to know is how he can get a job (or do anything useful in college) when he's not allowed to use a computer. That even rules out working at McDonalds. Hopefully the actual restriction is slightly less harsh...

Re:Adrian Lamo Surrenders

[Andy Dodd]

Yeah. Tell him to get a full-time skill or enroll in college.

Then tell him he's not allowed to use his one marketable skillset.

Re:Adrian Lamo Surrenders

[Ephemeriis]

What I'm wondering...is how exactly he is supposed to "obtain full-time employment or enroll in college" with a ban on computer use? I teach at the local Community College, and its awfully hard to make it through a single class up there without using a computer for something. I keep in contact with my students via email, and many of their projects are submitted that way as well.

As for full-time employment...well, it looks like he's probably quite well qualified for some kind of IT type position...too bad he isn't allowed to use computers. I suppose he could work retail...oh, wait, no...they use computers too... How about food service? Nope, computers there too. Ummm... I guess he could mow lawns?

yrs,
Ephemeriis

Re:Adrian Lamo Surrenders

[corporate zombie]

I'm trying to think of a good job or university education that doesn't involve using a computer. Anyone? Anyone?

-CZ

Re:Adrian Lamo Surrenders

[BrynM]

Enrolling in college is out too. Nice of the judge to be so considerate.

Funny enough, I heard he was in town (I'm in Sacramento) by spotting him being interviewed by a local newscaster last week. I was wondering if he was still around because I recognized the place he was interviewed at. Does anyone know if his parents live in this area?

Re:Adrian Lamo Surrenders

[clarinetforhire]

How in the world could he go to college if he's banned from computers??? Besides, I'd like to see their deffinition of a computer, because most would include my car airbag-delpolyment device, my watch, the solar calculator that's attached to my check book cover, the security system everyone has to pass through to get into the computer lab, and one of my school's dorms now has keycard entry...

Re:Adrian Lamo Surrenders

[Anonymous Coward]

There is something depressing about the whole "join society" ethos, that is, conform to everyday mediocrity.

As an actual productive non-criminal member of society, I have to say that there is something depressing about the commonplace equating of being a member of society with mediocrity. There's something depressing about how criminals like Kevin Mitnick and now this guy are portrayed as heroes when in fact, they cause enormous amounts of disruption to us ordinary citizens.

"Join society" is a problem for you? What is your alternative? Live like a lawless criminal, I suppose. But if you do that, and treat the rest of us with contempt, I don't see how you can complain when we treat you similarly.

Re:Adrian Lamo Surrenders

[mrtroy]

I would just sit in a wheelchair and pretend not to be able to move my arms

And get everyone to do everything for me

Otherwise id touch like 500 computers a day. And that would suck to lose the 250,000 bail.

Re:Adrian Lamo Surrenders

[NixterAg]

Ditches don't dig themselves!

Re:Adrian Lamo Surrenders

[Anonymous Coward]

I don't think you could even make it through Bob Jones without touching one... (Scary thought!)

Re:Adrian Lamo Surrenders

[Morosoph]

"Join society" is a problem for you? What is your alternative? Live like a lawless criminal, I suppose. But if you do that, and treat the rest of us with contempt, I don't see how you can complain when we treat you similarly.

It's not a problem for me; I just thought that the attitude lacks an appreciation of the human spirit. To have one's day disrupted is annoying, but somehow, our general drive to uniformity causes there to be less life in the first place. I see in this the dead hand of a judge reacting to something larger which this act is not part of (notably writing viruses). In saying "This whole business of computer hacking, viruses and so forth is getting very wearisome," Judge Hollows was making explicit that the penalty (of not being able to use computers) was for others' acts. The spirit of the judgement is of someone trying to tame an outsider by limiting them, not someone who was thinking of how his skills should instead be used to the good.

Re:Adrian Lamo Surrenders

[Anonymous Coward]

The spirit of the judgement is of someone trying to tame an outsider by limiting them, not someone who was thinking of how his skills should instead be used to the good.

That's what a judge's job is, and I'm glad they do it. I'm not interested in figuring out how criminal skills can be "used to the good" so much as I am in seeing them limited, if not absolutely stopped.

Re:Adrian Lamo Surrenders

[corbettw]

Well, apparently being a judge not only requires no contact with computers, you don't even have to understand the difference between a virus and a security intrusion.

Re:Adrian Lamo Surrenders

[tetsuji]

Well, being a judge must be one, obviously.

Re:Adrian Lamo Surrenders

[Natty P]

OK... let's apply the same argument to Slashdot...

Get rid of Anonymous Cowards!

Re:Adrian Lamo Surrenders

[cindik]

No, kid, you don't have to use computers on this job. You just use a shovel. Here's your card. Swipe it at the terminal there to clock in. It will print up the address and directions of where you'll work for the day. Then go to tools and swipe the card to open the gate. Grab a shovel, swipe your card at the terminal, and scan the barcode on the handle of the shovel to check it out of tools. Got it?

Re:Adrian Lamo Surrenders

[Morosoph]

That's what a judge's job is, and I'm glad they do it. I'm not interested in figuring out how criminal skills can be "used to the good" so much as I am in seeing them limited, if not absolutely stopped.

Programming's a criminal skill? I suppose that it can be.

Re:Adrian Lamo Surrenders

[Anonymous Coward]

Plenty of normal, everyday people have to interact with computers all the time.

fucktard

"damage"

[TheSHAD0W]

Just because you catch me strolling across your yard doesn't mean I should pay for having it fenced.

Re:"damage"

[Anonymous Coward]

Could this be the beginning of a long thread of poor analogies? Or is this the perfect, and final analogy?

Re:"damage"

[Anonymous Coward]

I don't own a fence. Does that mean it's ok for any passer-by to paint graffiti on my walls?

Re:"damage"

[stratjakt]

Your trespassing fine will wind up paying for increased police patrols of my neighbourhood.

Now enough with the stupid analogies.

Re:"damage"

[Anonymous Coward]

My yard? This is more akin to you being in my house. And while you shouldnt be expected to pay for new locks, you will pay for any damages you might have caused and for the time and effort that goes into searching for anything malicious you might have left behind.

Re:"damage"

[TheSHAD0W]

It's by no means a perfect analogy, but it's better than the one alluded to by the "hacking" label. If I took a fire axe to your front door, then by all means, I should owe restitution to replace the door, on top of whatever actual damage I did. But if you took that opportunity to demand I pay for an expensive solid-steel door when the one I smashed was cheap, hollow wood, then you would, in my opinion, be taking unfair advantage of the situation.

In this case, not even a hollow door was "hacked apart". Security was bypassed, not destroyed. No vulnerabilities were induced that weren't already present, and which would have persisted if the attack hadn't taken place. So how is it right to demand he pay for upgrading that security?

Re:"damage"

[TheSHAD0W]

Reasonable enough; yet that's usually not what prosecutors value the intrusion at. They'll roll in the expense of putting on those super-duper-high-security locks on top of those costs, just so they could sensationalize the crime.

Re:"damage"

[TheSHAD0W]

No, and the transgressor should pay for removing the graffiti; that's damage he caused.

Re:"damage"

[fenix down]

Fuck. I forgot to extend my rule to hackers. Sorry.

Re:"damage"

[LifesABeach]

i think you used the wrong example here.

the award for damages will be based on any damage done by the defendant's actions, not the defendant's cost.

the prosecution will have to go on to prove the following:

1. the defendant was negligent; he intended to cause damage, or harm.

2. that a 'reasonable and prudent person' would not have done this damage; by action, or inaction.

now the logic of the prosecution also has to state:

3. that emergency handling for acts of system intrusions are not expensed for, the plaintiff, or any 'reasonable and prudent person' would not normally have to expense for system intrusions.AND that this 'intrusion expense' is not a typical expense that the plaintiff, or 'reasonable and prudent person' buys.

4. that tasking a system administrator for handling system security is not a normal course of action by the plaintiff, or 'reasonable and prudent would person' on any system.

5. that there is NO system security used by the plaintiff because a 'reasonable and prudent would person' has no need for it.

if i was the plaintiff, i'd be negotiating price, not damages. ;o)

Re:"damage"

[Ath]

No, but you're gonna pay for the damn flowers you trampled on.

Just because I don't lock the door of my house does not mean you are allowed to come in.

Re:"damage"

[TheSHAD0W]

Like the others who've replied to my original analogy, I think what you propose is certainly reasonable. Unfortunately, reality tends to take a different turn. Prosecutors pile on damages they CAN'T justify by the method you just stated; they'll get as high a number as they can manage and base the charges on it. Look at what happened to Kevin Mitnick, for instance; tens and hundreds of millions of dollars in "virtual damage" that never actually happened.

Re:"damage"

[The Mayor]

The New York Times had the social security numbers of its members available in a poorly secured area. Adrian found this out and notified them. He also added his name to the list of contributors to the newspaper. As I understand it, he told the New York Times of his deads, including adding his name to the list of contributors.

From my perspective, the New York Times was being extremely negligent in their actions. It's not so much as simple as not fencing in their yard. It's more like leaving the bank vault open and then prosecuting the person that discovers it, informs the bank security folk about it, and leaving a note behind saying "I was here". I don't take very kindly to identity theft, and my social security number in the hands of the wrong person can lead to serious financial damage to me.

Adrian is the very best sort of black hat, and I applaud him for his actions. He is still a black hat, and for that he may be punished. But if all black hats were of the same type as Adrian, the world would be a better place.

Outcome?

[deadmongrel]

Well in one of the comments I read the judge said that "This whole business of computer hacking, viruses and so forth is getting very wearisome,". First of all I hate how the word "hacking" is used. second tying the recent M$worms outbreak with Adrians exploits is rediculous. I wonder would if he would get a fair trial if the judge(s) are technically incompetent. I think its time cyber laws get more attention probably a separate division or something. Adrian may or may not have done something wrong. But treating him like a criminal is wrong. His methods may be vigilante type but I don't think he is criminal.

Re:Outcome?

[ideatrack]

I don't see how he isn't a criminal. I know it's very black and white, but if someone had a look around your house while you were out, and then told you what you'd done wrong with you DIY, you'd probably not shake his hand and thank him. It's hyperbole yeah, but this is Slashdot after all.

Re:Outcome?

[Lumpy]

first off you need to remember that Judges are first and foremost lawyers. that's what they were before they were judges.

and anyone that would expect that an Ex-lawyer is fair or honest in any way is a complete fool.

This judge knows nothing about what he is passing his "judgement" on and therefore is incapable of hearing such a case.

The entire judicial process in the United states is based on "who has the most influencial or resourceful lawyer" not who is innocent or guilty.

it hasn't been about innocence or guilt for 50 years.

Re:Outcome?

[deadmongrel]

well if the door is open and if you come into my house it isn't a crime. is it? Second if you just look around and not take anything or disturb anything then i am not going to kick you butt but would indeed buy you a drink for being honest. Then again we don't know what Adrian has done but from his past we can see that he was just finding security holes of course in an unplesent way.

Re:Outcome?

[stratjakt]

Who cares if you like how people use the word 'hacking'. It's irrelevant. I don't like that people who trade xbox games online call them "isos".

I agree with the judge. I'm sick of asshat 14 year olds thinking it's open season to screw around with other people's property. It doesnt matter if I have the latest kernel patches or a club and locking boot for my car.

The point is, it's mine, not yours. Mess with it, and pay the piper.

Re:Outcome?

[gfxguy]

well if the door is open and if you come into my house it isn't a crime. is it?

Yes, it is.

And if I saw an uninvited "guest" in my house, I'm afraid there wouldn't be a chance to ask any questions.

Re:Outcome?

[gfxguy]

I should clarify - it's not called "breaking and entering", it's called "criminal trespass" and it applies to entering someone's home uninvited.

Re:Outcome?

[TomV]

well if the door is open and if you come into my house it isn't a crime. is it?

Of course it's a crime. What on earth gives you the idea that there's any possibility that it might not be?

I can see how there might be exceptions if, say, the house was on fire and you came in to see if anyone needed rescuing, or if there were blood-curdling screams coming from within and you came in to defend someone apparently in trouble.

Second if you just look around and not take anything or disturb anything then i am not going to kick you butt but would indeed buy you a drink for being honest.

Fair, but not remotely relevant to the criminal nature of the event. If you were to batter the chairman of the British National Party (racist fvcks) to death, slowly and painfuly, sure I'd buy you a drink, but it would still be murder.

TomV

Re:Outcome?

[Anonymous Coward]

and anyone that would expect that an Ex-lawyer is fair or honest in any way is a complete fool.

and anyone who think that jsut becuase you are a lawyer mean you cannot be fair or honest is a fool. Another foolish thing would be to say you are a useful member of society, when the truth is you are a load your fat-ass ugly mother should have swallowed.

Re:Outcome?

[Anonymous Coward]

Spoken like a true lawyer about to be beaten to bits after he opened his damned mouth in a bar... I always grin when i see an asshat get his just reward.. kind of like the jerk tailgaiting the old lady for 3 miles speeds around her on the right and flips her off only to slam into the rear end of a semi.. Golden and makes EVERYONE happy.

More lawyers need to have the sheeite beat out of them... or better yet! piled in a burning busto be pushed off a cliff!

Macki's take...

[Anonymous Coward]

While guest editing BoingBoing's mini-blog, Macki posted his opinion.

"Marlowe" offers up some Timothy Leary on the message boards.

What are we really feeding into here?

Re:Macki's take...

[Anonymous Coward]

The Associated Press story can be read here:

AP Story

The url in the original post didn't contain a site id (which you need to actually read the story)

How old are you? 5?

[NDPTAL85]

Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks? Even if he does no damage to your house and steals nothing is that something you'd like to come home to?

Now imagine word spreads about this type of behaviour with no consequences (jail time). Now you'll come home every week or 2 or 3 times a week to some unauthorized person sitting in your living room? Is this what you want? Its just fine and dandy because the intent is good right? What? Road to hell? What? Paved with good intentions?

Re:How old are you? 5?

[91degrees]

Why are you comparing it to your home? He hacked corporate servers! It's more like finding an intruder has manged to get past your security and knocked on your office door.

Re:How old are you? 5?

[pdbogen]

If this annoymous invader then offers to help replace the locks with ones that are harder to pick, sure. I mean, what's the big f-cking deal? He didn't cause damage, plain and simple. All he did was embarass their security people. I wish I could get $300K every time I got embarassed.

Re:How old are you? 5?

[Anonymous Coward]

Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks? Even if he does no damage to your house and steals nothing is that something you'd like to come home to?


First, you can't compare having your (business) computer accessed with having a stranger in your HOME. The latter involves a great deal of physical risk which the former lacks.

Secondly, YES, I'd would like some friendly neighbor to poke their head in through my unlocked kitchen door and warn me to keep it locked... especially if I lived in a dangerous area where break-ins were common.

Re:How old are you? 5?

[Anonymous Coward]

It's more like finding an intruder has manged to get past your security and knocked on your office door.

Well, since their servers also held their files, it's actually more like gaining entry to the office and rifling through filing cabinets. And in order to ensure that nothing was awry, someone had to get paid to check things out.

Re:How old are you? 5?

[Anonymous Coward]

I'd much rather have that happen than to come home and find someone sitting on the sofa with a shotgun...

Re:How old are you? 5?

[rifter]

Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks? Even if he does no damage to your house and steals nothing is that something you'd like to come home to?

Actually, yes, if the guy offers to fix the problem. It would be wildly better than not fixing the security problems and coming home to find my TV, computers, stereo, etc gone and "J00 Sux0r!" spraypainted on my walls.

Re:How old are you? 5?

[stratjakt]

No, the guy could be sitting outside on the curb and say to me as I come home "Hey, I notice you have X brand locks on your doors and windows. You know you can open those things in 3 seconds with a credit card, I can show you if you like".

Then I wouldnt have a problem, and would appreciate his advice - the difference is he RESPECTED my property.

The same guy waiting in my living room is going to be beaten within an inch of his life (self defense ya know - my word against his), then dragged off to jail by the cops. Then sued.

Re:How old are you? 5?

[Anonymous Coward]

"It's more like finding an intruder has manged to get past your security and knocked on your office door."

Which is also trespassing. Which is also not wanted, and illegal. You do understand thay there are places in this world that you are not allowed to go without express permission right?

Re:How old are you? 5?

[91degrees]

Which is also trespassing.

Ineed it is. It's also a much less emotive comparison than someone breaking into your home.

Re:How old are you? 5?

[Srin Tuar]

Its just fine and dandy because the intent is good right? What? Road to hell? What? Paved with good intentions?

Explain to me how this is the road to hell if the end result is a house that cannot be broken into? (Aside from the fact that the whole house analogy was already broken)

If "hackers" werent punished for their non crimes, neglectful companies could instead FIX THE PROBLEM instead of merely FIXING THE BLAME.

Re:How old are you? 5?

[Anonymous Coward]

If I walked into my office and found somebody I didn't know sitting in my chair rifling through my desk I think I would still be pretty "emotive" and he would still be going straight to jail. I don't care if he was demonstrating the lack of security or trying to convert me to Buddhism.

Re:How old are you? 5?

[511pf]

Let's change the scenario, shall we? I drop my keys next to my car in a parking lot. Someone picks them up and tries my lock to see if they have the right car. They do, and they go through the car looking for an address and phone number. They find my business card and call me at work to give my keys back. Do I charge them with breaking and entering? Hell no. I give them a $20 for not allowing anyone else to steal my car.

Re:How old are you? 5?

[91degrees]

That's fine. Personally, so would I, but I wouldn't consider the same level of invasion of privacy as if he'd invaded my home. I was just pointing out that the analogy was flawed, because he used an overly personal example of real world trespass as an analogy for computer trespass to an impersonal corporate server.

My point was that tresspassing in a corporate office would be a much closer situation.

Re:How old are you? 5?

[Anonymous Coward]

Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks? Even if he does no damage to your house and steals nothing is that something you'd like to come home to?

No. But this isnt a private citizen's website, this is a company site. It's more akin to coming to work in the morning and seeing some random dude sitting in the server closet.

Secondly, while I may not want to see someone there, it's a lot better for someone to be there, sipping tea or something and waiting for me to show up so that he can explain the problems than to come in and find things missing with no one to tell me where the problems are.

Re:How old are you? 5?

[Anonymous Coward]

Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks? Even if he does no damage to your house and steals nothing is that something you'd like to come home to?

I've never thought there was a good chance a hacker might kill me. Perhaps a better example might be that someone left a note on my door explaining that I forgot to close it. In many cases vulnrabilities can be detected simply by connecting to a given port and realizing "oh they're running software X version Y".. it's not like even checking the door's handle to see if it was locked.

Re:How old are you? 5?

[Lightwarrior]

/---
Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks?
\---
I lock my doors with a deadbolt.
I have an alarm that I activate anytime I'm not home or asleep.
I have a dog that barks at strangers.
I have a number of swords scattered about the house for just such an occasion.

I have made reasonable attempts to prevent and discourage burglars. Your typical burglar looks for quick, easy marks, and wishes to spend no more than 2-5min in a location. If this atypical burglar is so intent on robbing me that none of this discourages him, and is not intent on violence, then he's welcome to what he can get away with before the police arrive.

The swords are there in case one is intent on doing violence.

Had I left the doors/windows not only unlocked but open, not activated the alarm and made it clear it was not able to be activated, had no dog, and left valuables in plain sight - then yes, I would *expect* to either find my valuables missing, or come home to an unwanted visitor / angry neighbors perturbed by my lack of responsibility.

See, being irresponsible affects more than just yourself. This is why we can take children away from their parents when they display gross negligence. Unfortunately, there is no similar law for cybercrimes at this time - we have no law stating that you must take reasonable steps to ensure the security of all your sensitive information.

Because of this, we get corporations with intentionally lax security, an operation system full of security flaws, and children facing significant fines and potentially jail time instead of a slap on the wrist for what amounts to trespassing.

-lw

Re:How old are you? 5?

[NineNine]

I know of a certain industry online, that if they find you fucked with their computers, won't bother with the authorities. The owners will fly out to where the kid lives, and beat the living shit out of him. It's happened before, and it'll happen again. This kid should consider himself *lucky* that he didn't step on the wrong people's toes. He should consider himself *lucky* that he's just gonna get sued and not lose any body parts. Very fucking lucky.

Re:How old are you? 5?

[clambake]

Do you want to come home to your house, turn on the lights only to find someone sitting on your sofa waiting to explain to you how insecure your house is because he was easily able to pick the locks? Even if he does no damage to your house and steals nothing is that something you'd like to come home to?

And lime Lamo, would he be willing to help me install pick-proof locks? In that case, sure! It'd be great!

Here's one for you: Would you mind a doctor coming over to you on the train and telling you that he can see you have an operable cancer, and that he'd be willing to treat you for free? Or would you rathar find that out when you collapse on the floor as the tumor begins to press on a major artery?

Re:How old are you? 5?

[Anonymous Coward]

How do you KNOW those locks are harder to pick? Why should we trust him? It's a bit more than embarassing. It's potentially disasterous.

I hate how people struggle to justify this.

Re:How old are you? 5?

[Richthofen80]

Have you all gone mad? This guy is totally right!

Even more importantly is this point: when it comes to private property, you don't need to lock your house. If you leave your house unlocked, car unlocked, wallet in the open, and someone takes advantage of your stupidity, its still theft/criminal. It doesn't matter whether *YOU* would be bothered by a man sitting in a couch... what matters is that the home is private, much like the servers. (although the servers are on the net, which makes it a little sticky, but not much. You can let your buddies use your basketball net in your driveway as a rule, but that doesn't mean they can hang out in your pool. )

Private property means that individuals have the right to dictate how that property is used. don't like it, don't live in a country that allows private property.

Re:How old are you? 5?

[chazzf]

(although the servers are on the net, which makes it a little sticky, but not much. You can let your buddies use your basketball net in your driveway as a rule, but that doesn't mean they can hang out in your pool. )

Not sticky at all. My house is located on a public street. Still makes it illegal to break in. Think of a private network at a gated community...

Re:How old are you? 5?

[SirSlud]

Yeah, he's really lucky that newyorktimes.com and all those other domains he hacked didn't turn out to be mob operations. One wrong fortune 500 .com client, and he could have lost appendages.

LOL

Re:How old are you? 5?

[theLOUDroom]

What's wrong with you?

No jail time = no consequences?

WTF!?

Maybe we should throw everyone who speeds in prison too. Anything else would mean "no consequences", so everyone would be barreling down the highway at 120mph all day.

Get real. There are very good reasons why things like probation and communtiy service sentences exist. Maybe we should cut off his hands too. After all, we can have hackers all over the place, doing whatever they want, can we?

Are you telling me that if someone gives you 100 hours community service and a $1000 fine for doing something it's not going to have any effect?

Re:How old are you? 5?

[SirSlud]

So basically, when I log onto newyorktimes.com, I'm on private property? (It being a connection, and all.) I imagine you'd say that I have permission to make this connection.

And when I'm behind the scenes (say, somewhere the admin doesn't want me to be), I'm still on private property, but I dont have permission to be there, right?

So, strip the 'common sense' argument away, because common sense doth not make an enforcable legal code, and how do I know I've made connections that I'm *physically* able to make, but yet, shouldnt be making, according to network admin? The "You shouldn't be here!" signs posted up by the command prompt?

Furthur more, my lawn is private property, but I hardly think that I could prosecute you for having spent ten minutes on it half an hour ago, even if I had gotten it on video tape. Is setting up a camera on the private property and then suing anybody that takes a shortcut through it an undiscovered way to make easy money?

Protecting private property is not like giving you an exclusive license for how that property is ever interacted with by anyone other than the owner .. ("Stop breathing! Thats my private property, and your breath molecules are settling on my driveway!") .. private property laws are designed to protect other people from taking or damaging your private property. Its a shitload harder to sue somebody for touching your car, even for sitting in it if its unlocked, if it isn't damaged or stolen. Go ahead, try it .. maybe you can get rich on this, and buy even more stuff to worry about whether or not anybody is close enough to touch your (I will grant you hard earned) toys without your permission.

Listen to yourself.

Re:How old are you? 5?

[NDPTAL85]

You are talking about the gambling industry aren't you? I remember the gambling Slashdot article from a few weeks ago.

Re:How old are you? 5?

[NDPTAL85]

This is more than a mere prank. This immature person is homeless and has been evading capture by traveling all around the US just so he can keep up his supposed "white hat" activities. Its fucking LAME.

The "white hats are good so don't punish them when they break the law in the name of good" argument died 3 years ago with the dot.com bust. Let it rest in peace.

Re:How old are you? 5?

[Anonymous Coward]

It only takes you a few minutes to look over your car and make sure he didn't steal the CD's and change in your cup holder. How long does it take to go over entire systems in your enterprise that you know have been compromised to make sure nothing else was done.

Maybe the guy should have just turned in the keys to somebody at your work place.

Maybe upon discovering the vulnerability the the "hacker" should inform the companys security instead of going in and looking around and casting suspicion on himself.

Maybe I spend to much time at work reading slashdot :)

Re:How old are you? 5?

[Anonymous Coward]

No, the guy could be sitting outside on the curb and say to me as I come home "Hey, I notice you have X brand locks on your doors and windows. You know you can open those things in 3 seconds with a credit card, I can show you if you like".

Then I wouldnt have a problem, and would appreciate his advice - the difference is he RESPECTED my property.


Yeah, right.

You'd take one look at the dirty bum (who is _obviously_ just looking for a hand out (or to rob you!)), and run into your house lock your doors and thank good you're safe....

Re:How old are you? 5?

[Anonymous Coward]

If he were sitting in your office he would be posing a physical danger to you. He wasn't so he's not, so fuck off you fucking shithead.

Re:How old are you? 5?

[Anonymous Coward]

How long does it take to go over entire systems in your enterprise that you know have been compromised to make sure nothing else was done.

If you aren't a half assed administrator, you should already be doing that. All the time.

Re:How old are you? 5?

[Anonymous Coward]

If some homeless guy showed left a note explaining my server's security holes to me along with an offer to show me how to fix them, I'd fucking buy the guy a month of steak dinners.

Meanwhile, Captain Shitheel (you) sits with his thumb up his ass and an insecure server open the the world. And when a REAL criminal comes along, not a 2-mile-over-the-speed-limit-criminal, you still have to spend thousands of dollars fixing your system and have some real damage. In short, you are as fucked as this guy.

fucking morons.

Re:How old are you? 5?

[rifter]

No, the guy could be sitting outside on the curb and say to me as I come home "Hey, I notice you have X brand locks on your doors and windows. You know you can open those things in 3 seconds with a credit card, I can show you if you like".

Then I wouldnt have a problem, and would appreciate his advice - the difference is he RESPECTED my property.

The same guy waiting in my living room is going to be beaten within an inch of his life (self defense ya know - my word against his), then dragged off to jail by the cops. Then sued.

I suppose you have a point. In my state I coudl get away with shooting the guy, actually. Actually your example reminds me of the time the local police, in the course of a traffic stop, asked me

"Er, you don't have anything valuable in that truck box, do you?"

"No, officer, why?"

"Well, you probably don't want to unless you get better locks. The standard locks on that box are way too easy to pick."

"Thank you, officer I will keep that in mind."

Granted, if they had wanted in the truck box they could have gotten in there. Being police officers and all, they took it upon themselves to let me know of a deficit in my security. Come to think of it, there are IIRC community programs through local police departments to help you increase home security and/or awareness thereof. Too bad the same does not exist w/r/t computer security.

Re:How old are you? 5?

[theLOUDroom]

I never said we shouldn't punish him, just that no jaim time=no punishment is an idiotic statement.

taking bets ...

[akb]

... on when nytimes.com gets defaced. How many times did it have "Free Kevin" plastered on it again?

Re:taking bets ...

[JoeBuck]

That appears to be Adrian Lamo's plan. He wants to be the next Kevin, and has been trying to get people to arrest him (in a way that will make him look like a misunderstood white hat and great hacker martyr) for a year.

Re:Crimes of curiosity

[Anonymous Coward]

Shut up, Michael Sims.

An open door is an invitation

[Chaotician]

The fact of the matter is, Adrian did not crack these networks. Most, if not all of them, left gaping holes that amounted to revolving doors at the front end of their networks. His "access device" was a web browser... you know, most likely the same one you are using to read this right now. I think what the real issue comes down to (hold one moment while I find my tinfoil hat) is that in the course of scouring the NY Times intranet, Adrian was able to come across the personal details of some VERY influential people in this country. And that, I'm sure, had to make the Times looks like a bunch of asses. As if the Jason Blair fiasco wasnt enough.

Re:An open door is an invitation

[Rolken]

"Most, if not all of them, left gaping holes that amounted to revolving doors at the front end of their networks." If I left the door to my apartment open and someone randomly walked in, I wouldn't be asking him if he wanted something to drink. No one said it had to be hard to be illegal.

Re:An open door is an invitation

[magullo]

Is this why nobody locks their front door when they leave their house / office / other type of venue?

Re:An open door is an invitation

[Anonymous Coward]

This isn't even an "open door". It's a server that they put on a PUBLIC network without bothering to secure it and just hoping that everybody would stay out of places that they weren't supposed to go.

A better analogy would be if the highway dept made a bunch of roads that they didn't want the public to use but didn't bother to put gates on them or even a sign that says "no trespassing".

Re:An open door is an invitation

[Rolken]

"A better analogy would be if the highway dept made a bunch of roads that they didn't want the public to use but didn't bother to put gates on them or even a sign that says 'no trespassing'."

Just because it is connected to a public network doesn't mean it is public property - quite to the contrary. It's more akin to a house. There's a sidewalk leading straight to my front door, and if you knock you'll probably get some interaction, but crawl through my window and I'll call the cops and come after you with a knife. Even if it was unlocked! I guess I'm just harsh that way...

Re:An open door is an invitation

[Anonymous Coward]

so lets get this straight, just because there is an exploit or any kind means that the law saying "no unauthorized access" is thrown out the windows. Brilliant fucking logic. I guess if I go into a bank, and the vault door is open, it is an invitation for me to take the money with no reprecussions? let me make this easy for you, you are dumb.

Guess he understands time-space warping too

[mactari]

From The Reg:
Under the terms of his release, Lamo's future wanderings will be confined to the northeastern half of California, and southern New York state, unless he gets prior approval of the court to travel elsewhere.

Hrm. Wandering from NE Cali to south NY w/out going anywhere inbetween would seem about as easy a commute as getting from the West Bank to the Gaza Strip.

Then they tell the fellow he can't use a computer but has to get full-time employment! I imagine anyone savvy enough to Slashdot can see the irony there. ;^)

To completely switch gears, did anyone else find it weird that a paper would have SS#'s for people who have written op-ed pieces [for Lamo to find]? I suppose that implies they were *paid* for the pieces, but it still seems a bit strange.

Re:Guess he understands time-space warping too

[stratjakt]

Then they tell the fellow he can't use a computer but has to get full-time employment! I imagine anyone savvy enough to Slashdot can see the irony there. ;^)

Yeah, he can get a job waiting tables. Or shovelling shit. Or flipping hamburgers. Tough shit for him.

Pedophiles are ordered to stay away from children, 'r337 hax0rz' ordered to stay away from computers. Makes perfect sense. You commit a crime, you give up some rights.

Re:Guess he understands time-space warping too

[confused one]

Hey's flying between his parent's home in CA and the court in NY where he's required to appear. The flight is at the government's expense, btw.

Re:Guess he understands time-space warping too

[Anonymous Coward]

Am I wrong or are you typing Dvorak? The r/l typo in 'l337' looks familiar.

Re:Guess he understands time-space warping too

[Cirvam]

Waiting tables usually involves putting the order into a computer at most chain type places, even flipping burgers can require use of a computer. So I guess he can shovel shit, know of any good job leads? Just saying "no computer for you" is rather broad. Perhaps it needs to be something like "no internet access" and that would allow things like use of ATMs and fast food jobs.

Re:Guess he understands time-space warping too

[Natty P]

Dvorak?!?! You insensitive clod!

He's Japanese!

big mouth

[mantera]

had he only not bragged so much he would've been okay.

Quit coddling criminals

[Anonymous Coward]

Just for once, I'd like to see slashdot not report on some "hacker" who got arrested. It's just not news, and it certainly doesn't matter that another two-bit criminal got picked up.

Don't Reward Burglars, or This Guy

[reallocate]

Sounds like a kid with an inflated ego and a bit of a Robin Hood complex.

I wouldn't feel like thanking someone who broke into my house while I was on vacation, nosed around in my papers, and then told me about my "security problem" when I returned home. Why would I, or any business, reward the same kind of behavior inside someone else's network? Both examples are, at minimum, illegal invasions of another's property.

Businesses that didn't press charges against this guy were negligent and only encourage the phony notion that crime on a network isn't serious.

Re:Don't Reward Burglars, or This Guy

[magullo]

Option A: You leave the keys in the door and a friendly neighbor picks them up, snoops around and tells you about it when you come back.

Option B: You leave the keys in the door and the house gets robbed, vandalized and/or burned.

Option C: You do not leave the keys in the front door.

If you're not smart enough to go for C in the first place, you better be thankful to get A and not B. And if you're not, B might be just waiting to happen.

Re:Don't Reward Burglars, or This Guy

[lactose99]

At the same time, if you left your doors unlocked when you went on vacation (which is the equivalent of what these companies have been doing with their web servers), I certainly wouldn't be sympathetic to your blight either.

I think both sides should share some of the blame here. Adrian wasn't right in going into these systems, but neither was the NYTimes for leaving their systems easily available to this sort of activity (I'm sorry, but I do not consider someone using a malformed URL in a web browser as a cracker or script-kiddie). If a company is not providing due dilligence in keeping their own systems secure, then they should also be punished.

Re:Don't Reward Burglars, or This Guy

[pclminion]

I wouldn't feel like thanking someone who broke into my house while I was on vacation, nosed around in my papers, and then told me about my "security problem" when I returned home.

I'm inclined to agree, but only partially. If the guy just strongarmed his way in (broke the lock, shattered the door hinges, or whatever), then I'd think it was stupid, and I'd probably get a guard dog, keypad entry with multiple steel bolts, computerized surveillance, etc.

Now, at that point, if some wily individual managed to get past all that crazy security, I actually don't think I'd be pissed. First I would be curious as to how he did it. I'd even feel some admiration for a person intelligent and clever enough to do it.

I agree that it is a crime. I wouldn't just invite the guy in for a cup of coffee and donuts. But realistically, we all have some romantic notions attached to the idea of a guy who goes up against insurmountable obstacles and manages to accomplish his goal despite them -- a person who shows no regard for the petty concept of "legality/illegality" but instead bases his actions on the higher concept of "morality/immorality."

Robin Hood was a criminal and yet we all found ourselves rooting for him. Adrian Lamo is similarly a criminal, he doesn't need to be rewarded, but I don't think there is anything wrong with having a little admiration for a person who expresses his principles, even if the mode of expression is questionable.

And seriously, since when should I get so pissed off that a corporation has to spend a few grand? It's just more money flowing through the economy, in the end. Nobody got hurt.

Re:Don't Reward Burglars, or This Guy

[Viking Coder]

If I'm a stockholder in a company that has such lax security that "a kid with an inflated ego" was able to break into their system, you're damn right I'd reward his behavior. Especially since he told them how to fix their problem.

The real harm that corporations should worry about is stockholders selling like crazy, because it becomes public information that their security was so horrible.

When the "kid with an inflated ego" tells you in a private forum that you've got a problem, and how to fix it, do you

A) thank him, fix the problem, and then fire your incompetent security team - thus protecting yourself from further intrusions, and maintaining your stock price, and protecting the investment of your stockholders...

or B) yell at him, take a few days to fix the problem, and file criminal charges, thus inviting investigation and reporting about your incompetence - thus inviting further intrusions from kids with even more inflated egos (who think they won't be caught), potentially dipping your stock price, and screwing up the investment of your stockholders...

You're damn right I'd thank him. And I wouldn't press charges, unless he had done real damage.

Crime on networks is serious. That's why you thank people for pointing out your problems without doing real damage. Because they help you to stop network crime.

Moron.

Re:Don't Reward Burglars, or This Guy

[Arakonfap]

This whole "breaking-into-a-house" analogy is getting out of hand. New York Times is a public webside, a corporation. If you're going to make up an analogy, do not use a personal HOUSE as an example.

This is more akin to a big Mall having a few doors that are supposed to be for mall employees only, yet they forget to lock a door, or have a security guard around.

Lamo's method was obviously illegal, though the damages were not nearly as high as stated. Removing his name from that database cannot take that long. If they plan on charging him for a new lock for a door that was never locked, that's wrong. He seems like a pretty ethical guy, and is reported to have worked with other large companies to fix there problems - I think attacking him shows a failure on the Times' side as well. They're not interested in security.

Re:Don't Reward Burglars, or This Guy

[ratboy666]

The phony notion here is that there is CRIME on a network! [The only "network crime" I could even BEGIN to justify prosecuting is kiddy-porn and trading in other restricted information -- which is a crime if done on other than a computer network as well).

He didn't assualt you with... a computer, now did he?

Llamo *did't* break into your house. Nor did he break into the NYT building(s). He didn't hit someone with a computer, or threaten to destroy it (or destroy it). He didn't STEAL a computer.

He made use of a public network that NYT participated in to use the services provided by NYT.

Ratboy.

Re:Don't Reward Burglars, or This Guy

[reallocate]

This guy apparently deliberately got through the NYT's public servers, via some proxy servers, into internal servers. Once there, he opened and view company files.

I'd accept public website notion if Lamo had only accessed files intentionally made accessible via a public website. He deliberately trespassed on private property belonging to others. THe fact that he uncovered configurtation errors in NYT servers is irrelevant. Rather like arguing that a burglar who picks a lock deserves leniency because he found errors in someone's lock configuration.

Re:Don't Reward Burglars, or This Guy

[reallocate]

Nonsense. Would you argue that theft of data stored on a network is no crime simply it is a netowrk? That theft of credit card info from a network is not theft? That unauthorized electronic transfer of funds from my bank account to your ban account is not a crime simply because it is on a network?

You're assertion that crime cannot occur on a network is ludicrous. And typical of the specious logic that infests this place.

By the way, this character broke through proxy servers in order to trespass on private files of the NYT. Asserting that no crime took place simply because he started at a public website is comparable to asserting that a burglar is innnocent of his crime because he drove to the house on a public street.

Re:Don't Reward Burglars, or This Guy

[clambake]

I wouldn't feel like thanking someone who broke into my house while I was on vacation, nosed around in my papers, and then told me about my "security problem" when I returned home. Why would I, or any business, reward the same kind of behavior inside someone else's network? Both examples are, at minimum, illegal invasions of another's property.

Wrong analogy. Being "in" a machine is not the same thing as being "in" a house. Instead the analogy is more like a doctor looking at you via X-ray or physical examination. If you met a doctor on the train, and he could see by looking at you that you have the first stages of SARS, would you think to toss him in the slammer for letting you know it (and offering to help you cure it)? Or, like the NY Times, would you prefer to find out about it AFTER your lungs were filled with fluid and you were choking and wheezing on your death-bed?

Re:Don't Reward Burglars, or This Guy

[ratboy666]

Actually, I *would* argue that. If it is a crime, it has been facilitated by the organization making available the service on the internet. If the data that is "stolen" is sensitive, it should NOT be available on the 'net.

We are talking about someone at a keyboard here, and the ONLY thing she is doing is typing.

Ok, now let *me* commit a cybercrime:

"I hate Aryan Nazis (and all other Nazis, but especially Aryan Nazis) and I actively encourage you to go and KILL them."

In my jursidiction, that statement is a crime, and I could be sent up for years. Justify THAT.

"Cybercrime" -- what a f'in hoot.

Ratboy

Re:Don't Reward Burglars, or This Guy

[reallocate]

Broken analogy.

How about that doctor doing unrequested invasive surgery to find out I had SARS?

This guy entered a private network and viewed private files. A side effect is obviously to warn the NYT that their security is not as good as it needs to be, but that in no way excuses or justifies this little dweebs illegal behavior.

Re:Don't Reward Burglars, or This Guy

[reallocate]

>> ...that statement is a crime, and I could be sent up for years. Justify THAT.

Works for me. Bye.

Re:Don't Reward Burglars, or This Guy

[clambake]

That would depend very much on the kind of invasion. Since you don't actually "go inside" of a computer when you "break in", it's not like invasive surgery. It's more like a phsycologist asking your questions on a personality test.

Imagine this one: You walk up to somoen ask ask for thier credit card number and pin. And lo and behold, they tell you! You say, "You shouldn't be giving this information out to people" and in response they try and get you arrested.

That is exactly what happened here. The boy asked the NYT computers for information, and the computers responded by giving it to him. Maybe he asked it in a tricky way, just like someone could call you up and pretend to be from AOL and are trying to "fix" the billing for your account to get you to give up the info, but that doesn't mean it was wrong as long as he was doing it to educate you.

Re:Don't Reward Burglars, or This Guy

[reallocate]

He engaged in illegal activity to break into NYT's private network. By itself, the breaking in, regardless of how he did it or the failings of the NYT's security system, it's illegal.

You can define it away, or rationalize it by saying he was just trying to be helpful, but that's all soporific nonsense. If someone stole your car, would you excuse with the claom that the thief was only trying to help you learn how to protect your car?

If this criminal wanted to help the NYT, he should have written a business proposal and sent it to them.

Re:Don't Reward Burglars, or This Guy

[reallocate]

I don't harbor any romantic notions about criminals goiong up against "insurmountable obstacles". They're just criminals.

I don't believe the notions of legality and illegality are "petty" or that notions of morality and immorality are higher. We live in a society governed by law, not indivudal conceptions of morality, because the latter produces chaos and anarchy.

Robin Hood is fiction. This guy, unfortunately, is real.

Finally, the money the NYT spent dealing with this criminal act is unproductive money. It's no less wrong to burglarize a corporation as it is a private individual. Widespread unreasoning antipathy to business doesn't excuse criminal behavior.

As for people not getting hurt, well, if your private data, e.g., Social Securoty, medical records, were viewed by this criminal, would you feel all that comfortable?

Re:Don't Reward Burglars, or This Guy

[reallocate]

Sure, network crime is serious, but rewarding criminals only makes it worse. That's moronic logic, to mimic your subtle word use. That kind of behavior only encourages other criminals to try the same thing, and how many of them will turn around and report their actions to the victim?

You don't make crime go away by saying "Thank You" to criminals.

People in the IT business who hold your opinions are simply encouraging more crime and justifiying many people's unfortunate opinion that computer geeks are just a bunch of "hackers" waiting to strike.

Re:Don't Reward Burglars, or This Guy

[Viking Coder]

Look, there's basically two ways of looking at this...

It's good to find bugs, because you can fix them.

It's bad to find bugs, because it's embarassing.

When someone logs a bug report, you're supposed to take it seriously. You're supposed to thank the person for reporting the bug. You're supposed to tell them that people will investigate the cause of the bug. You're supposed to try to reproduce the bug. You're supposed to hand the reproducable bug over to people whose responsibility it should be to fix the problem. They should track down the root cause, and attempt to fix it. They should also try to figure out what caused the bug to occur in the first place. They're supposed to report exactly what the bug was, exactly what caused it, and exactly how they fixed it. They might also log suggestions about how to resolve further bugs like this in the future. Some of this information is supposed to filter all of the way back to the person who logged the bug in the first place, to demonstrate that you took the bug seriously, and that the issue is resolved.

Any of that sound familiar?

Now, people like you, who apparently don't understand the value in removing bugs, get all upset as soon as the location the bug occured was a "security" problem.

I'm not suggesting that every company should put a $1000 bounty on its own security. Or that the company always ignore any damages that occured. But I am saying that, in many cases, the most responsible thing a company can do is to thank someone for pointing out their mistakes, especially if no real harm is done. I understand that this exact case might be slightly different (the LexusNexus searches added up real quick, apparently), but you seem to be completely inflexible on your stance that any "security breach" is a violation of law, and should therefore be punished to the maximum extent that the law provides.

In other words, cover up the mistake by prosecuting. It's this inattention to security that causes the security breaches in the first place.

You don't make crime go away by prosecuting the criminals. You make crime go away by trying to figure out how to stop it in the first place. Anyone that's willing to show you how to stop it in the first place is helping you.

You play with fire...

[Rolken]

You get burned. Anyone who breaks the law and flaunts it is going to get caught, regardless of how honorable his intentions. Laws do not only exist to punish "bad guys;" they exist to make society an orderly place, and people who run around hacking others' servers willy-nilly are going to be causing chaos (ie the costs of the IT department figuring out wtf's going on with their network, as someone else mentioned). Awhile back the DoD conducted an authorized hacking of their system (with unpleasant conclusions). That is what needs to happen, because when dealing with gray areas there're shades of black. Remember the "good" anti-Blaster patching worm, and how it shut down systems in Canada because of its overly eager replication? It's foolish to presume that we should trust in the skills of a lone ranger. Get off yer high horse, cowboy.

Too...obvious

[Anonymous Coward]

Ya went for too much man. And no "security expert" has the word cyber in his vocabulary.

You failed to snag anyone with this troll. Tsk, tsk.

Re:Too...obvious

[Seth Finklestein]

Maybe I should just copy material verbatim from Seth Finkelstein's web site into comments and claim that I own it.

Letting others protect you

[tarnin]

This is again along the lines of "We dont really want to make sure were secure so we'll just sue/have arrested anyone who finds anything." These are also the same people who loby the gov to pass laws to do this. It's amazing how little people acutally care about how secure their network or computers are and instead care more about huge fines and sentences so they can keep their networks insecure.

None of this has ever made any sense to me. Why is it that leaving a network insecure is fine and dandy but someone comming along and finding out its insecure then entering it a bitter no no then breaking and entering into a house? Didn't we learn long ago to close and lock our doors at night and when we where away? Some of these security holes are equvilant to a wide open window with no screen in it while were on vacation for a month. Yes, its still illegal for someone to enter the house and steal someting but doenst common sense tell us "Hey dummy, close and lock the doors and windows!".

I'm also wondering if they have any case on this. Didn't the NY Times take his help originaly to secure the network? I know the statue of limitations hasnt paned out on this but at some point someone kinda has to say "Ahh well why are you taking him to court now after he helped out originally?". Just another "See what we do to these bad bad men!" cases.

Re:Letting others protect you

[Anonymous Coward]

So what?

Your saying if someone steals my car, he should garner a lighter sentence than if he stole one with a fancy security system?

It ain't your shit, keep out. He didn't "help out". If I dump a bag of dogshit onto the drivers seat of your car, and then argue that I was just showing you how easy it was to bypass your security, is that OK?

Shut your piehole you sycophant.

Re:Letting others protect you

[lostguy]

This is again along the lines of "We dont really want to make sure were secure so we'll just sue/have arrested anyone who finds anything." These are also the same people who loby the gov to pass laws to do this. It's amazing how little people acutally care about how secure their network or computers are and instead care more about huge fines and sentences so they can keep their networks insecure.

Sounds good to me. Going back to the overused house analogy: Should I have to have bars on all my windows because some asshole isn't going to be dissuaded by a locked window? This guy isn't the equivalent of someone walking across the corner of your un-fenced lawn. This guy is doing the equivalent of trying all your doors and windows to see if they're unlocked; then, he's jimmying the doors and windows to see if they have deadbolts; then, he's drilling the door or window to remove the screws that hold the hinges.

How _do_ you protect against some amoral or immoral person trying all exploits until they gain entry to your property? You have laws to deter them from doing things that violate other people's natural rights, and you invoke those laws as necessary.

Your frame of mind is the same idiocy that declares,"She was asking for it," when some girl is raped if she's wearing a short skirt or a low-cut blouse. In this case, the NYT is macing the rapist.

Re:Letting others protect you

[tarnin]

Did you miss this?

"Yes, its still illegal for someone to enter the house and steal someting but doenst common sense tell us "Hey dummy, close and lock the doors and windows!"."

I know its illegal but it still doenst take away from the fact that these companies would rather sue people then actually make sure that their networks were secure. How sorry would you feel for someone who left their house wide open and kept getting broken into? Yup, its totally illegal for the burglers to enter the house but im sure even you would be saying "WTF why dont they lock the damn door!"

Next story : AP Under Attack

[Zork the Almighty]

TOP STORY : The Associated Press website is under attack. A flood of connection attempts beginning at 02:52PM Eastern time have rendered the website unavailable. Initial reports suggest that this attack originates from an organization known as "Slashdot", however it is unclear whether this is a terrorist organization or whether terrorism is involved.

Re:Next story : AP Under Attack

[FireNIce]

This was a bad link

Here is the correct one:
http://customwire.ap.org/dynamic/stories/H/H ACKER_ ARREST?SITE=RANDOM&SECTION=HOME&TEMPLATE=DEFAU LT

For the record there is nothing wrong with AP's site.

Re:How old are you?

[cheeseSource]

Yes, I'd much rather have someone break in and tell me about it rather than rob me. I've been robbed. It sucks and I would much rather know what to fix before than after.

Interesting...

[gfxguy]

I've always been annoyed at how criminals cost law-abiding citizens indirectly. My question to your statement is "why not?"

If you can't somehow manage to not trespass on my private property, then maybe you *should* pay for the fence. After all, why should I be financially responsible because you can't keep yourself from trespassing?

Why should ordinary people have to pay for all the locks on their doors, security systems in their homes and cars? And, WRT computer systems, why whould we have to pay for antivirus and firewalls, the constant security updates because the criminals just keep on hacking? It'd be interesting to somehow place the burden on the people who commit the crimes, and in this case they can.

I'm not saying I realistically believe that it can be accomplished in any meaningful way, in general, but it is at least an interesting idea, IMO.

Re:Interesting...

[TheSHAD0W]

An interesting idea, certainly. Your system, as proposed, would mean your yard wouldn't be fenced unless and until someone did trespass on it, and was caught. Perhaps he was up to no good, or perhaps he was just taking a short cut, but until that time you didn't have a fence. What if that trespasser wasn't caught? What if he made off with your expensive antique pink flamingo lawn ornament?

What I'm saying is that retroactive security is practically useless, and if you don't guard your goodies you're a fool; and waiting for someone to foot the bill is even more foolish.

Further, what sort of fence does this transgressor owe you for? Barbed wire? Chain link? A brick wall? Who decides? Whatever happened to the idea that "the punishment should fit the crime"?

Re:Interesting...

[gfxguy]

ME (in my previous post):I'm not saying I realistically believe that it can be accomplished in any meaningful way, in general, but it is at least an interesting idea, IMO.

In a general sense, you'd catch criminals - a drug dealer, for example, that had thousands in cash on him, and the police would use that for security in that area. It could be buying locks for residents, or paying for their security monitering, for example. Or perhaps each resident in the area would get an additional amount added to their "security fund", then they could get whatever fence they wanted subsidized by the criminals who make it necessary.

In this case, however, the person found security flaws that the Times didn't know about. Well, perhaps they should have known about them, but the fact remains - it's not as if the Times had NO security. So where do you stop? When is there enough security? So sure, if someone finds a flaw - something they didn't stumble on, but they actually seeked, and instead of reporting it immediately they exploit it for their own gain (even if reporting it later), then there's the difference... In this case, if he respected the property of the Times, he would have simply reported it, but he didn't, he abused it.

So maybe he shouldn't pay for the whole thing, but maybe there ought to be some sponsored group writing security patches and antivirus protection that is paid for by the fines imposed by the criminal prosecution of people writing viruses and commiting acts of computer trespassing.

What I'm saying, ultimately, is to stop blaming the victems. In general, people lock their doors, they lock their cars, they stay away from seedy areas at night. And the Times had security on their site - just not enough. So how much is enough? How much do the innocent victems have to spend before you stop blaiming them and blaim the people who commit the crimes? Should I have bullet proof glass in my car? A bullet proof vest? Should I be packing? Should attractive women wear chastity belts? Should there be security cameras on every street corner?

TheSHADOW:Further, what sort of fence does this transgressor owe you for? Barbed wire? Chain link? A brick wall? Who decides? Whatever happened to the idea that "the punishment should fit the crime"?

What's more fitting then having the criminal ensure that he can't commit that crime again? The punishment should be dissausive, after all.

Re:Interesting...

[TheSHAD0W]

I'm not saying a transgressor shouldn't have to pay a fine for trespass, or damage to property he caused while there. I'm saying it's not fair making someone pay for security that wasn't there. As for "having the criminal ensure that he can't commit that crime again", I think again you're imposing an unfair burden on that transgressor.

Under the system you propose, you'd better keep your kids on a leash, in case they cut across the neighbor's property and therefore oblige you to build him a wall.

Re:Interesting...

[gfxguy]

I'm not saying a transgressor shouldn't have to pay a fine for trespass, or damage to property he caused while there. I'm saying it's not fair making someone pay for security that wasn't there.

I'm not saying I don't understand your point, but I simply disagree - he's paying for something that he's making necessary.

I think again you're imposing an unfair burden on that transgressor.

Well, your example of kids doing something that is more or less harmless not withstanding, I don't believe such a burden on any transgressors ought to be considered "unfair", especially if the "transgressor" (nice way of saying "the criminal trespasser") knew the punishment. Most people who are committing crimes are quite concious of it.

And again, for a third time, I was merely mentioning the idea, and that in certain cases it might be practical (and certain cases, it certainly isn't - some drug addict looking for diet pills in my medicine cabinet is hardly going to be able to pay for my security system).

You can bring up extreme cases, like your kids-taking-a-shortcut example - in those cases, almost without fail, the kids get a warning. Maybe, MAYBE, the parents get called. Certainly that's how it should be. But if everyone who got caught committing a crime had to put $1000 into a neighborhood security fund, that got divided up between all the residents to use for security purposes, then my son's trespassing wouldn't cost me the price of a 1000 yard brick fence, but I would end up subsidizing that fence because my child was part of the cause making it necessary. That sounds fair to me, and it would make parents more dilligent in instructing their children right from wrong (or at least legal from illegal). And yes, I do have kids, and yes, I do worry about them doing bad things.

But Adrian did more than trespass.

he should've seen this coming

[geeveees]

He accesses somebody his network, tells them about it "oh but hey i didn't do anything bad".

If YOU were the sysadmin in question, would YOU believe him? No you'd have to check all your systems... And that costs money (=damages).

Re:he should've seen this coming

[Anonymous Coward]

You should already be checking your systems. Constantly. Its one of the reasons you have a job.

Re:he should've seen this coming

[sixdotoh]

but if he really didn't "do anything bad" and you spent some time fixing your "systems", wouldn't your overall security be enhanced ultimatley protecting you from future attacks therefore saving money?

Re:he should've seen this coming

[AArmadillo]

Thank you. If more sysadmins actually monitored their servers for malicious activity, we wouldn't have the thousands upon thousands of DDoS trojans out there on the Internet today. Too many sysadmins think you can just install all of the software, get it working right, and then never look at their server(s) again.

Re:he should've seen this coming

[Hatta]

yes they might have to rebuild their machine (or network) from scratch. But they'd have to do that anyway if they got cracked by a malicious hacker which is really just a matter of time. You have two options. If adrian hacks your site, you have an insecure site and you know about it. If adrien doesn't hack your site you have an insecure network and you don't know about it. Which would you choose?

Re:he should've seen this coming

[Anonymous Coward]

It doesn't matter. The holes are there.

Whether he did something or not, you've been running around for who knows how frickin long with an unsecured server.

At that point, even if you did believe that HE didn't do anything bad, you have to assume that somebody else likely has.

Re:he should've seen this coming

[Kwil]

Three options, actually.

1. The site isn't hacked so remains insecure and I don't know about it. My concern: none. By definition. I don't know about it. I probably think my system is secure. It's not a good situation, but that's the truth.

2. The site is hacked and the hacker lets only me know about it. My concern: medium. I'll get my IT guys on it, they might have to put in some overtime making sure that not only are all the holes we were told about closed, but that no new ones were inserted. A possible loss of data may occur as we restore to backups from before the hacker's entry date.

3. The site is hacked by a malicious hacker and we don't find out til later. My concern: high. My IT guys need to drop what they're doing and find the holes and close them. There may be a loss of data as we try to go back to a prehack version and close the holes there. Some damage control may be needed depending on what was done.

4. The site is hacked and the hacker lets the world know about it. My concern: extreme. My IT guys need to get EVERYTHING fixed RIGHT FRIGGING NOW, because now any malicious hacker is aware that holes exist, so will be banging on the doors to try and find it. This means shitloads of OT for the ITs, possible loss of data because of the need to return to pre-hacked backups before fixing the provided holes, and on top of this means we lose business credibility which costs us untold amounts in future business. Damage control is a necessity. Thanks so much Mr. Supposed White-Hat.. more like asshat, so far as I'm concerned.

Personal case

[Anonymous Coward]

(Anonymous for obvous reasons)

I don't live in the US. In my early days on the university I was involved on a serious case of hacking. Being a nerd for network security I once told a university network administrator, that happened to be a good friend of mine and a student of one of the classes I gave at the time (on network security) on a institution unrelated to the university, that the university network was 'easy hackable', he challenged me for a proof and I responded. About four months later I found myself in deep trouble: my network account was surrendered and all my e-mail was analyzed by the network administrators. For some reason (only known to a 18 years old) I had sent an email to a friend telling him that I had cracked about 2000 passwords on the university network.

It turned out that since my 'friend' spoke with me he went with his superior and 'bought' a promotion for turning me in. The only proof they had was the email and a private conversation recorded without my permission (by a university student, not a government office) where I admitted to have cracked the university super-computer and a cluster to write, compile and run a distributed program that kept running for a little over two months (without anyone noticing it, it stopped running because I decided to stop it).

To get on-topic: They claimed that my actions had caused over US$ 100K. After 6 months of trial (where I has assisted by some great voluntary people) I walked out with a restraint to use any university computer for 4 years, and being unable to create accounts for any ISP in the state for 2 years.

The morale of the story is this: You fight. And fight hard. If you do so the people will support you, because you are fighting from the right side. Take it to the end, at some point justice will be served.

Re:Personal case

[InsaneGeek]

So you intentionally did it, bragged about it and didn't expect any problems to come out of it? I don't know what kind fantasy world you were living in but it sure isn't reality. Step up to the plate take the responsibility, you intentionally did it, you affected other's work.

What "right side" are you fighting from, the right to randomly crack into other's systems just because you want to prove a point?

Re:Personal case

[Anonymous Coward]

I demonstrated the flaw on the system. I did so upon request. I said he challenged me for a proof and I responded, I sent them a anonymous encrypted copy of the 2000 passwords cracked and a set of steps to correct the flwas (basicaly ditch the DES encryption and use SHA-1 or MD5 hashes).

I (wrongly) talked about having used their own super-computers to write the software to crack the passwords after the whole issue went public. In the end I got away with it, I didn't get expelled, but my action caused some incompetent sys-admins to get fired (including the one who managed to tape me) and the security meassures to be increased. I had acces to all the students grades, but didn't do anything, and in the trial that was used on my favor.

I did some things wrong (brag about it twice), and certainly illegal, but morally everything I did was correct, and I'm proud of it (and my family is, my friends are and I have gained some new unexpected new friends among the people that prosecuted me, one of them even offered me to become one of his students).

In the end, the real porpuose that was aimed by my actions was served, but I had to fight hard. I lost one semester in the whole trial, I almost lost my job (it was widely covered by the press), and four semesters later I dropped out of the university to work on network security.

Re:Personal case

[Anonymous Coward]

I did this too once. I cracked 17000 passwords using a 486 (no supercomputer for me!) over a weekend. The default passwords--which as you may well know are rarely changed by most people--used 8 chars of the user's SSN. That narrows the search space down quite a lot at university where most of the students were from in-state. I did get caught, and had my accounts disabled for a while, but after admitting what I had done I was actually offered a job. I guess I was lucky.

Re:Personal case

[Anonymous Coward]

Oh yeah? Well I cracked a gajillion passwords in 5 minutes with my Casio calculator watch. And then they made me president of the company.

So there.

Re:Personal case

[Anonymous Coward]

A few years ago, well ok sometime in the early 90's, someone I knew claimed to have cracked a bunch of dial-up access passwords at the university. His method was to target accounts in the science department and then start entering terms from Star Wars & Star Trek. Supposedly he was able to gain access to quite a few. His use for the accounts... he accessed an open telnet and used it to play around in MUDDs.

Re:Personal case

[CharlesEGrant]

I did so upon request. I said he challenged me for a proof and I responded, I sent them a anonymous encrypted copy of the 2000 passwords cracked and a set of steps to correct the flwas (basicaly ditch the DES encryption and use SHA-1 or MD5 hashes).

Obviously I wasn't present during this conversation, but unless there is more to it then you include here, I think you have some serious problems in communicating with your fellow humans. I know if I asked somebody for proof that my systems were insecure I would be thinking more along the lines of "please describe in detail the vulnerability" not "please try to crack my system". If you really believed that you had a legitimate invitation to try to crack the system why did you submit the evidence anonymously?

....certainly illegal, but morally everything I did was correct

I think you have a very narrow view of morality then. Greater harm justifications only work if the questionable action was the only way to prevent the greater harm. Why didn't you just document the vulnerability and work your way up the chain of responsibility? (I mean immoral here as reading somebody's diary without permission, not as in assault or extortion.)

The legal penalties attached to cracking are just as much a part of the security infrastructure as encryption. Heck, if unauthorized network intrusion was a simple infraction punishable by a $10 fine I'd probably be wandering around my neighbor's unsecured wireless network right now.

Re:Personal case

[arkane1234]

Heck, if unauthorized network intrusion was a simple infraction punishable by a $10 fine I'd probably be wandering around my neighbor's unsecured wireless network right now.

You do realize most laugh at any laws attempting to protect wireless LAN access, right?
It's not the laws people are afraid of... quite honestly, morals are the only thing keeping most people out of wireless networks. But, if those morals aren't there (or bypassed by curiousity), then that net is as good as open. Unless your neighbor has some hitech equipment, or is good at catching something resembling a signature that it's you, there's no problem.

I normally wouldn't have responded, but you sounded so holier-than-thou when talking about these omnipotent laws.

Re:Personal case

[Anonymous Coward]

he challenged me for a proof and I responded

Also known as a "dare". College/adolescant dares often get one into trouble...

Re:Personal case

[Empty_One]

You fight. And fight hard. If you do so the people will support you, because you are fighting from the right side. Take it to the end, at some point justice will be served.

I think you're forgetting one thing. This case is in the United States. We don't have justice here any more. Justice is only for those wierd European countries.

Re:Personal case

[CharlesEGrant]

quite honestly, morals are the only thing keeping most people out of wireless networks.

True, and I will confess to a rhetorical exaggeration, but I still think there is something to my point. I was just setting up my own wireless LAN last week, and I was blown away by the number of networks I was picking up that were broadcasting their default SSID and were apparently unencrypted. Since I was getting a better signal from some of these networks then my own it was very tempting to connect to them and just nose around a bit. My internal conversation went something like:

1. "Hmm. I wonder what I'd see if I connected to "linksys".
2. "That would be rude. You haven't been invited."
3. "It might also be illegal."
4. "How in hell would they know?"
5. "It might be a honeypot and Fry's probably gave your Visa card number and MAC address to Interpol and John Ashcroft."
6. "Give me a break."
7. "Never mind all that, it would still be impolite to connect without an explicit invitation."

As you correctly point out my primary motivation was my personal sence of morality (or at least propriety). However the legal aspect did cross my mind. I didn't want to get in trouble over a matter of idle curiousity.

... talking about these omnipotent laws

I didn't say that laws were omnipotent, I said that enforcement of the laws was one component of the security infrastructure. Legal sanctions don't discourage all, but they discourage some. Encryption doesn't solve all security problems, but it helps solve some. It is my experience that "fear of getting in trouble" is an important regulator of people's behavior. If nothing else it reinforces their own sense of morality when it is undercut by conflicing impulses like curiosity.

Re:Personal case

[Anonymous Coward]

The morale of the story is this: You fight. And fight hard. If you do so the people will support you, because you are fighting from the right side. Take it to the end, at some point justice will be served.

I assume you've heard of but have forgotten about the cases of Mitnick, Bernie S and so on. To say that justice is eventually served in the case of hackers is demonstrably absurd.

Re:Personal case

[Anonymous Coward]

How much is a gajillion, anyway?

Re:Personal case

[arkane1234]

True true.. I agree with everything you said...
I only wish they'd come out with a viable form of wireless encryption that isn't a variant of the old WEP standard. And keep it open, instead of proprietary.

Re:Personal case

[FxChiP]

"I know if I asked somebody for proof that my systems were insecure I would be thinking more along the lines of "please describe in detail the vulnerability" not "please try to crack my system"."

I know that the sysadmins at my school don't fucking listen when you give them a well-documented list of vulnerabilities. The only way to get them to listen is do totally break something and then get in trouble for it.

I think you have a very narrow view of morality then. Greater harm justifications only work if the questionable action was the only way to prevent the greater harm. Why didn't you just document the vulnerability and work your way up the chain?

See above reason: they might not have LISTENED.

The biggest problem with telling a sysadmin about a vulnerability is that they don't listen too often. Indeed, the sysadmins at my high school have a certain disdain for the students, which is slightly understandable, but there are just certain times when they should listen to a vulnerability (i.e. I know a couple of ways to break Fortres) rather than just telling the student to keep it quiet and don't use it.

As we all know, keeping it quiet doesn't fix it. If another student finds out on his own, he could do the damage, and the egg would be on the face of the sysadmin who refused to listen. It's really in their best interests to listen and fix things...

Okay... that's the end of my rant.

Why did he turn himself in?

[Alioth]

Wonder why he turned himself in? If I was in his shoes, I'd go on the run because:
* it seems like anything to do with hacking == terrorism. Justice won't be served, long prison sentence
* being obviously young, not particularly bad looking and probably not physically strong means almost certain prison rape.
* already leading a nomadic lifestyle so why not continue.

However, in his position, I'd probably no longer publicise what I was up to. I think he has made some grave tactical errors in letting his identity being so publically known (and this is why he probably decided not to stay on the run, because his photograph has already been so widely published).

I hope his punishment is in proportion to the crime though - not some arbitrary "war on terror" sentence.

Re:Why did he turn himself in?

[dlosey]

Wonder why he turned himself in?

He talked to one of his friends who has been down the same road, and got caught. Basically, his friend stated that eventually he will be caught too. Its not worth running. This friend also gave him advice on what not to do and to "not trust ANYONE"

I think this is why he is being so public. The FBI can't tell him one set of charges to get him to surrender, then change the charges once they have him in custody. I think he is cautiously wearing his tin-foil hat.

Get a full time job, or enroll in college

[royalblue_tom]

What I don't get is which planet the judge lives on. I hope he'll provide Adrian a reference.

Get a job - "I'm very interested in joining your company, as long as my court case goes well" - don't call us.

Go to college - parents house is up as bail, and I doubt he'll get state/federal assistance while the court case is pending.

Re:Get a full time job, or enroll in college

[stratjakt]

Get a job - McDonalds. He can pick vegetables out in those SoCal fields - they don't care who they hire. The world doesn't owe this kid a corner office and a secretary.

Go to college - Parent cant afford it because your tuition money went towards bail? Boo fucking hoo. The world doesn't owe him a college education either.

Re:Get a full time job, or enroll in college

[Cederic]

Sentencing someone intelligent to mind-numbingly boring manual labour is pretty close to cruel and unusual punishment.

I'm currently unemployed. I could go out and get a job at close on a hundred different places within a week, if I decided to do labouring, shelf-stacking, bar-work or similar levels of work. In practice I'd rather watch my savings deplete, because then I can engage in intellectually stimulating activities instead while looking for a job that I can enjoy and commit to.

Being banned from using computers is harsh too - he can't work at McDonalds, they have computerised cash registers. He can't go to college, it's effectively impossible to get through college without a degree so far.

And as the original poster indicated - he has to apply for work/college with the possibility of an indeterminate period of absence happening.

On another issue, just what on earth is it to do with this judge if this guy isn't working? Is being unemployed and not in education a crime these days? If so I better not go to the US, because that's me..

~Cederic

Re:Get a full time job, or enroll in college

[alecto]

. . . I doubt he'll get state/federal assistance while the court case is pending.

I can't speak about his state, but the only convictions (which haven't even happened, in Lamo's case) that will make a person ineligible for federal grants and loans are drug related. And a family's primary home doesn't count as an asset in the federal formula used to determine how much a student's parents can pay towards college, so the bail arrangement would make no difference at all.

The correct AP web site

[Anonymous Coward]

This is the actual link to the AP story:

http://customwire.ap.org/dynamic/stories/H/HACKER_ ARREST?SITE=NJASB&SECTION=HOME&TEMPLATE=DEFAUL T

The link in the story didn't have a site id, which directs you to a specific AP member newspaper

This.. is my boomstick!

[Channard]

Just because you catch me strolling across your yard doesn't mean I should pay for having it fenced. No, but in certain parts of America you might end up paying in other ways when you found some shotgun toting guy taking offence to you trampling his lawn.

Thank you...

[gfxguy]

great response.

If I leave the keys in my car, that still doesn't give someone the "right" to steal it.

I hate this nonsense that person X didn't do enough to prevent person Y from doing something illegal - so the blame goes to person X.

Now, in some cases, (X being a parent or close friend of Y, and knowing what was going on), the guilt may apply. But in most cases it's quite absurd.

Re:Thank you...

[magullo]

Funny how insurers don't think this way.

Re:Thank you...

[gfxguy]

That may be part of your insurance contract, but it's not a matter of legality, either. If I agreed to have a security system on my car in order to get a lower insurance price, than that's a different story.

Not following my insurance contract doesn't make the criminal any less of a criminal for stealing my car.

Re:Thank you...

[swv3752]

Actually, YOU are responsible if you leave your keys in a car and it gets stolen. Ever hear of the concept Attractive Nuisance?

Re:Thank you...

[gfxguy]

No, you're not reponsible (at least not totally) - I'd like to hear of one specific place or one specific instance that the person who stole the car was let off because the keys were in the car.

Re:Thank you...

[CoyoteGuy]

If I leave the keys in my car, that still doesn't give someone the "right" to steal it.


No, it just makes you quite a freaking idiot for leaving the keys in your car, and if I were an insurance company, I would raise your premiums 500% for being an idiot.

Re:Thank you...

[CoyoteGuy]

No, you're not reponsible (at least not totally) - I'd like to hear of one specific place or one specific instance that the person who stole the car was let off because the keys were in the car.

Well, I can cite quite a few cases where the numbnuts who left the keys in his car was not able to afford insurance again after making such a claim.

Re:Thank you...

[gfxguy]

Granted... and certainly leaving your keys in your car is a pretty stupid thing to do.

My brother in law used to leave the windows in his car open. We lived in Las Vegas at the time, and your car would get extraordinarily hot inside if you closed the windows.

His argument was that if someone wanted to steal the car, they'd just break the window anyway. Idiot.

However, that still doesn't make taking someone elses car legal, and the criminal, frankly, shouldn't get any less punishment because of it.

Insurance has nothing to do with legality. When you get insurance you are obligated to take certain minimum precautions. My homeowners insurance won't pay if I burn down my house with an illegal drug laboratory, either.

Re:Thank you...

[gfxguy]

And I agree with you, although that doesn't change the point - the criminal is still a criminal, even if I stupidly made it easy for him.

Good Luck Adrian

[SunCrushr]

Good luck at your FBI job interview... er I mean hearing on Thursday.

his own name on lesixnexis?

[uunh haun]

Why the hell would he do that when he could just go the closest university library and use it there?

Re:his own name on lesixnexis?

[alecto]

University libraries don't have access to the "good" (e.g. motor vehicle, arrest) databases.

Correct AP Link

[jh6p]

If you see the map of the US on the AP website you need to specify a newspaper.

Try this link that says you read the headline on New Jersey Online:

http://customwire.ap.org/dynamic/stories/H/HACKER_ ARREST

Racking Up Expenses

[yintercept]

he probably used $300,000 worth of the service without paying for it.

This is one of the big problems when trying to create programs that charge for information related products on the Internet. It is very easy to make things that increment counters and add rows to databases. When these activities involve an exchange of cash, there is often an incentive to create false impressions and transactions.

The dot coms discovered quickly that they were paying millions to programs that simply created false ad impressions and false ad clicks.

The telecom industry has similar situations where shady business people do things to create 1-900 calls, or phone calls to Albania just to rack up expenses.

The popup industry is fed largely by people who want to increment counters for various reasons.

By racking up an absurd charge, this case shows what a large number of "business people" are doing every day in smaller ways...ie trying to find clever ways to get the counters to increment.

Looks like he pissed someone off

[TyrranzzX]

The Times called the FBI after Lamo browsed sensitive data on its computers, including Social Security numbers for celebrities and government officials who are among the 3,000 contributors to its op-ed page.

Sensative data, sounds like he got more than cc numbers. Also sounds like he has a political ageda, which is ok by my book. You can get lotsa info off of the Nyt's internal system; memo's, drafts, omitted papers, letters from people with political agenda's....

In any case, this is akin to breaking into a musieum to steal stuff, and instead of stealing he took pictures (very exact ones) and left a how-to note. He didn't damage anything, he showed them security holes in exchange for internal data. They don't like the internal data getting out...

BTW, any good company will resecure their systems after any consultancy and scour it for software; some firms can't be trusted.

Re:Looks like he pissed someone off

[starfarer42]

BTW, any good company will resecure their systems after any consultancy and scour it for software; some firms can't be trusted.

If you feel you need to bring in an outside consultant to secure the network for you then what good is checking up on them afterwards? If you aren't competent enough to secure your own network in the first place, how do you expect to find anything suspicious in the consultant's work?

Re:Looks like he pissed someone off

[dr_dank]

You can get lotsa info off of the Nyt's internal system; memo's, drafts, omitted papers

You can find all kinds of rejected articles on there such as:

- My dinner with Osama bin Laden by Jayson Blair

- Vacation Pictures from Jupiter by Jayson Blair

- On Winning my Third Pulitzer by Jayson Blair

Downfall of Joe Hacker.

[Channard]

It seems that the downfall of a fair few hackers is boasting about their antics. Many seem to have an inborne need to actually make someone aware of their 'l33t sk1llz'. I'd surprised if your average hacker didn't let at least one person in on what they were doing.

Use your NYT accounts...hurry!

[Teahouse]

Yep, all the mindless NYT wonks on this site that repeatedly post stories that link to "Join our Site" NYT will glefully run to the site this morning to read all about it. Worldcom has a sense of humor. Yahoo has a sense of humor. Apparently the NYT can only hire plagerizing writers and prosecute a minor break-in of their DB.

In his Parent's Custody???

[SomeoneGotMyNick]

He's in his parents custody on $250K bail

Man, his codename must be "Zero Cool"

You got it

[DesScorp]

We'll never know who the best are. Because they're SMART ENOUGH NOT TO BRAG ABOUT IT IN PUBLIC.

All sarcasm aside, I once heard Prof. Gene Spafford of CERIUS say that some of his best students had simply dissapeared from the face of the Earth. He suspected that they were either recruited by Government organizations, or major corporations; and he was afraid that some even went to work for organized crime.

THESE people are the real pros. They get the job done, get paid, and quietly move on. They could live next door to you, and you'd have no clue that they crack heavily guarded systems for a living. For every Adrian Lamo or Kevin Mitnick, or even Peter Shipley for that matter, there are a half dozen guys way better that you'll never hear about.

Re:You got it

[dasmegabyte]

Not necessarily. It is just as likely that there are no really great hackers. For one thing, there's no proof that there are anythin other than the self important run-of-the-mill kind of hacker other than creepy speculative statements made by self important members of the "security" community. I know a lot of smart people who disappeared off the face of the earth too. Once in a while I rediscover them, working in coffee shops or as security guards at the zoo. They dropped contact when they gave up on intellectualism for a life of hedonistic pleasures like having friends and making a little money.

You know, it's funny...as much as people here hate on Microsoft for using FUD tactics, they seem to okay the computer security industry using the same tactics to scare people into buying expensive security audits. Better buy a new firewall...Bigfoot broke the cisco backdoor and the Loch Ness Monster could be SSH'd into your daughter's underwear drawer right now and we'd never know because they're using special Voodoo IP addresses that cannot be logged!

See, hackers work by writing code to exploit bugs. It is impossible to write code that is bug free. It is just as impossible to write exploits that are bug free (see: that blaster "fix" that did as much "damage" as the worm did). As such, it is impossible to write code that is completely indetectable. There are bound to be bugs in the indetectability. So this whole idea that stealthy ninja superhackers are sliding in and out of our nation's mainframes without anybody knowing is something I tend to place in the same realm of fiction as bible code.

And if you were "good enough" to write invincible code, it seems to me you could lead a much better life without this stupid Swordfish subterfuge, teaching your methods to senior programmers across the country for big bank. Shit, I'm sure MS has an opening somewhere. The New York Times definitely does.

Re:You got it

[SonOfThor]

No, there really are some very skilled hackers out there. They may as well not exist as far as you are concerned, however. They likely work for sombody, and they are smart enough not to get caught. The famous hacker and the professional hacker are never the same person. Pro's dont get caught. Much like famous spies really. Famous spies are the ones that get caught. The good ones are the ones no body ever hears about. If a spy is really good, I mean exceptional, then he gets to retire, or is retired by (one of) the government(s) that he works for.

Yes, no-one is "untracable" or "undetectable" and yes there is no such thing as a "secure system". Everything has bugs, there is always an exception to the rule, etc. etc. etc... The fact of the matter is, though, that nothing TRULY important is supposed to be stored on systems that can be accessed by the public. There is such a thing as an "air gap", and it is still quite effective in keeping secret information secret. Any pro hackers in operation today are certainly NOT gaining access to ULTRA TOP SECRET information, except by lucky circumstance, no matter how successful they are. Corporate espoinage is often much more successful, as military/Intelligence agency level security measures are pretty rare still in these areas (although they are getting better). My .02 anyhow. Feel free to disagree.

Re:You got it

[dasmegabyte]

Oh no, of course you're right. Amazing hackers exist, and nobody will see them because they're kept in basements filled with doughnuts and computer monitors.

You do know that they don't shoot you when you retire from the CIA, NSA or Secret Service, right? That these are fake things invented to make interesting stories? That in the real world, intelligence is never just one charismatice/intelligent/talented guy taking on the enemy?

Re:You got it

[Seannon]

lysdexic hackers of the world untie!!!

Re:You got it

[SonOfThor]

Ugh, you work in the comic book store, doncha?

Different approach needed

[jazman]

"Lamo frequently trespassed on the networks of prominent companies, uncovering security holes and accessing sensitive information. He then informed the companies of his exploits and often worked with them, as a consultant, to close the holes."

On an enormous salary, no doubt. I expect he could pretty much name his price. It doesn't surprise me then that they can make out they are victims, because, essentially, they are victims, of extortion.

The approach needed now is to approach them first, before hacking them, and if they don't want your skills then leave them alone. If they do want your skills, then they can recruit you at a fair price, on mutually agreeable terms, and nobody has anyone over a barrel.

The other benefit of this approach is that they'll be able to tell the difference between malicious hackers and hackers who are only doing it for the good of the community, which I have absolutely no doubt is going to be Lamo's defence ("I'm breaking into your house for your own good, can't you see that?"). The former will hack without a contract; the latter will hack with one.

Re:Different approach needed

[Alioth]

Hardly extortion - apparently he helped the companies he hacked for free.

Re:Different approach needed

[jazman]

Maybe, but there's always going to be a niggling "but what hasn't he told us".

That's also true for paid work, but less likely as you're in serious doo-doos if found out then.

Not that he isn't in serious doo-doos now, of course.

Real damage.

[Jaywalk]

As anyone who has read Sterling's The Hacker Crackdown knows, the "damages" in computer hacking cases can be absurdly inflated. The funny money corporations use internally to charge services back to departments don't translate into real damages and corporations can inflate the "damages" in order to make an example of the offender.

But this guy was using a Times account to order outside services from LexisNexis and those guys ain't cheap. I suspect the victims will also be able to quantify how much it took to repair their system. However, I hope they're not counting the cost of closing the security holes since Lamo only exploited the holes -- he didn't make them.

Re:Real damage.

[stratjakt]

They can ask for real damages plus punitive damages.

Say you go to your car, you left the windows down because it was a hot summer day. You find that I've dumped a bag of dog feces all over the drivers seat.

Real damages? 5 bucks for cleaning supplies. Punitive damages? Probably up to 5 grand in small claims court.

Re:Real damage.

[rimmon]

Well Lexis ist not for free, but to add a tab of 300000 US$ you need to by 1200 week of full access (that is slightly more then 23 years...). That seems a bit much :-) Hendrik

Re:Real damage.

[Anonymous Coward]

thats the "standard" databases... lexis also allows access to other databases at a much higher cost... My company once ran a search that was billed at $3800 for that one search....

[yes... it was worth it... the info that we got saved us from a $200K mistake...]

Protest!!!

[Anonymous Coward]

How about no more stories on Slashdot with NYT (FRR) links

Re: Funny how insurers don't think this way.

[Rolken]

Insurers aren't concerned with the cause of the damage if it was external, because from their standpoint it doesn't really matter - they're not there to punish, just to repay you. On the other hand, if you share blame for it due to passivity, then you should be compensated less. That doesn't make the perpetrator any less culpable.

pratice what you preach

[Anonymous Coward]

it's all denial of service, and it does cost companies money. I have absolutely no sympathy for this guy and hope he gets the book thrown at him.

I'm assuming you're at work as well? Costing your company money?

1099

[linuxislandsucks]

1099s require ss numbers ...

What a lame-o.

[Anonymous Coward]

At least he's not anymore on the lam-o.

Wrong

[Anonymous Coward]

Ok, so you just have to clean it up. That takes time. In business, time costs money, salaries, resources used, etc. So it does cost money. Just because you are so pathetic that your time is worthless, doesn't mine, or anyone else's is.

Mod this up

[royalblue_tom]

Obviously its a case of no bad intent, but went about it the wrong way. Obviously, if he'd formed a company, hired a few salesmen, and went about contacting large companies as a security specialist, then no one would bat an eye.

The real question is, if he did this, and then hacked people as market research to determine who the salesmen should contact ...

"You should tighten your security" ... "No, we'll just sue anyone who gets in". Good security policy!

Re:Mod this up

[Anonymous Coward]

then no one would bat an eye.

And no one would do anything, either. Look at how many bugs Microsoft has sat on until somebody releases an exploit. Only then do they get off their fat asses and release a patch.

LexisNexis services for $300,000? Yeah, right.

[azaris]

Private individuals using LexisNexis for viewing court doduments will be charged $9 per document (not by search). I'm sure the NYT gets some kind of volume discount. This means Lamo would have had to fetch over 30,000 documents to rack up such a sum. Now assuming your average legal document is ten pages long (many are shorter, some are way longer) that makes 300,000 pages worth of legal documents. A full bookshelf of legal reference material. Why am I not buying this?

How much are you willing to bet the NYT took their monthly (yearly?) bill from LN and claimed that since Lamo had illegally benefitted from access to that material, he should pick up the whole tab?

Re:LexisNexis services for $300,000? Yeah, right.

[Anonymous Coward]

You are pretty close to correct, but suffice it to say that the searches were directly linked to Lamo.

Trust me, the NYT does a LOT more than $300,000 of searches in a month.

Also, the backend of the LN Search engine handles millions of searches a day, 30,000 is easy to do in a short time, if you have the bandwidth to eat the results.

Posted Anonymously because I work for them...

How smart is he really?

[Anonymous Coward]

An FBI affidavit says Lamo added his name, cell phone number and e-mail address to The Times' op-ed contributor list and its administrative database, listing his area of expertise as "computer hacking, national security, communications intelligence. "

Hmmm, he posted his cell # and email on their site??

Easy just imagine if he didn't do anything

[ninthwave]

Ok take the other scenario they don't break in.
No one tells you about the holes in your computer system. You machine sits there as it has always done. Are you secure???? Are those holes still there waiting for someone to exploit??? Or is it only this one person that can do it. Chances are they don't do it and tell you, when you do get hit you are going to be looking at data recovery not a security analysis of your system. And which costs a lot more than that. The thing is this person is doing you a favour take their word or not you have just found holes in your system and you still have your data. It is only a matter of time if you have a high profile site like NY Times before those holes are exploited at the cost of your data. And having SS numbers and employee records involved the risk is in more than money.

Anyway you look at it this guy isn't to blame for telling the people he hacked their security problems. Just look from the situations he told people about as if he didn't and think of those sites as targets as servers to launch attacks from, as political hits in other attacks or in the case of the NY Times case as a trolling place for ID theft. If I were an employee of NY Times I would be thanking this guy for making my bosses look into the integrity of how the stored my personal data.

Re:Easy just imagine if he didn't do anything

[bareminimum]

Oh, you mean like I should put an electric fence around my house because all the windows are easily breakable?

Some defects in security are well known but assumed. When they get broken though they still involve costs, and I'm not just talking about window replacement.

Re:Easy just imagine if he didn't do anything

[ninthwave]

Yes windows breaks easily.
Or is windows less secure????
And with the current license scheme windows replacement is not cheap.

Sorry the joke was laying there and your metaphor is weak but I understand your point. I prefer I world where people can say to others hey you have a problem here fix it and be respected for their knowledge and skill not hunted down. Though by changing a web page on Yahoo he did cross the line. I would like to see the NY Time complaint to see what damage was done but if he did not expose data to anyone else or destroy, deface data I believe he did no wrong.

Mod this up!

[spookymonster]

Excellent rebuttal!

Oh I get it

[Anonymous Coward]

.. I'm supposed to know who that is. Because you guys are such crack "in the know" nerd journalists that you don't need to add the word "Hacker" to the headline

Aacch!

[gfxguy]

You know, there is NO excuse for this criminal activity. There is a great expense to keep computers/networks/homes/cars/people secure. The reason for this expense is the criminal, the criminal should be made to pay.

I know it's a non-existent utopia to think that criminals should pay for security systems, but think of all the waste that goes into security because of people doing illegal things. Stop blaming the victems, they were NOT "asking for it" anymore than anyone "asks" to get raped or robbed.

Are you going to blame rape victems for not wearing chasity belts? Where does it end? If you absolutely want to prevent yourself from being raped, you'd have to wear one, wouldn't you? But that's a pretty rediculous extreme, isn't it? And you'd probably get beaten anyway.

Do not tell me they didn't have ANY protection on their website - someone went looking for specific exploits, they didn't stumble upon them randomly, it was a conscious choice to do something illegal. Where does it end? The fact of the matter is people should just respect other people and their property.

Do not stand up for this guy just because he's a hacker like us against a big stupid company. What he did was wrong! The blame goes to the criminal, not the victem.

Re: Funny how insurers don't think this way.

[magullo]

"On the other hand, if you share blame for it due to passivity, then you should be compensated less"

That is the point that I was trying to make. Thank you 8?)

yes, what he did was wrong... BUT

[sbma44]

let's be honest here: there are shades of cracking. given how easy it is to be anonymous on the internet, attacks like this one are *almost* constructive. I agree that punishment is appropriate, but would hope it would be tempered in light of the non-destructive nature of the intrusion. Paying a large fine to cover damages, probation and doing community service seem appropriate. Jail time and being forbidden to use a computer (in this day and age) do not.

Unfortunately a measured response doesn't seem likely given the technical ignorance of most judges and legislators. Penalties for cracking are formulated with the end result of the worst attacks in mind, but those who are caught are generally not the ones behind such attacks. Yet because the type of crime is new, frightening to business, and the limits of damages are often hard to delineate, the book is thrown at these kids.

Just look at that dope who got caught for writing a Blaster variant. Just one guy -- but do you really think the judge and/or jury will be able to understand that he was not the original author, and that his work only caused a subset of total Blaster damages? My money's on No.

Do you know who was the most successful hacker ?

[ChaoticLimbs]

And neither does the F.B.I..

hello slashdot

[Anonymous Coward]

happy i have SLASHDOT. here i get news from MY perspective! articles from nerds/hacker/crackers for nerds/hackers/crackers.

really, some articles on other web-sites sound like this "hacker" made a oil-ship sink *wink*wink*.

"desperately trying to sell news"-mentality ...

where is the "which is obviously rediculous"

[egarland]

I keep wondering how "news" ended up simply being a mouthpiece for whomever wants to create a press release or make a legal claim in court. The old unbiased reporting where balance was applied to issues has turned into todays lazy equivilant where hevily spun news items are repeated verbatum by thousands of news channels. When the RIAA sues someone for billions of dollars the number is never followed by "which is obviously a rediculously inflated value" which in the end gives the appearance that this person stole billions of dollars from music companies. The news has more or less stopped reporting and insead just acts as a mouthpiece for all kinds of powerful organizations.

The $300,000 figure is rediculous. If this guy could break in then someone else could also so any review process that needed to happen based on his intrusion should have been made anyway. The use of the LexusNexus service is a greyer area but in reality he didn't steal anything, he didn't hurt anyone, he didn't make a single person lift a finger. He made some machines work a little bit more instead of doing nothing. The Times won't have to pay the bill sine they didn't actually use the services they are being asked to pay for. $300,000 is a *huge* ammount of money and unless someone died, it is obviously rediculous.

It's sad that we live in a time where practically the only critical analysis of the crud that passes as news is on a fake comedy news program simply because in order to make fun of the news you need to criticise it.

Re:where is the "which is obviously rediculous"

[kelleher]

The use of the LexusNexus service is a greyer area but in reality he didn't steal anything, he didn't hurt anyone, he didn't make a single person lift a finger. He made some machines work a little bit more instead of doing nothing. The Times won't have to pay the bill sine they didn't actually use the services they are being asked to pay for. $300,000 is a *huge* ammount of money and unless someone died, it is obviously rediculous.

WTF? Grey...? You can't be serious. Adam accessed a paid service with someone else's credentials. It seems pretty clear to me. If you still have doubts, how about sending me your Exxon/Mobil card. I guarantee I won't "make a single person lift a finger" and I'll only "make some machines [gas pumps] work a little bit more instead of doing nothing".

Seriously, are you honestly saying that what he stole (yes, taking other people's stuff without asking is still stealing in my world) was over-priced so it's ok...?

Re:where is the "which is obviously rediculous"

[Anonymous Coward]

It's a 100% Theft of Services case because LexisNexis is a Pay-for-Search service. It costs X for a search, he did Y searches.

X * Y = Z, Z = $300,000. How hard is that to figure out?

And it's LexisNexis, we aren't the car.

Also, LexisNexis didn't have a security issue, he got the NYT userid/password and abused it.

Once you give someone a userid/password, there is some responsibility of the end-user to protect that information.

Re:where is the "which is obviously rediculous"

[Anonymous Coward]

If your stuff's so damn valuable, maybe you should protect it with a little more than a username and password, huh?

Re:where is the "which is obviously rediculous"

[egarland]

The difference is if you steal gas, the gas station doesn't have it anymore. If you steal my money, I don't have the money anymore. If you "steal" LexusNexus service everyone still has LexusNexus service. It's not stealing. In my book, in order for something to qualify as stealing somone must not have something that they had before and that thing must have value. Copying music isn't stealing, hooking up cable isn't stealing. It's illegal and arguably immoral but it's not stealing, it's something else.

From one of RMS's better rants:

When it comes to copying, this analogy disregards the crucial difference between material objects and information: information can be copied and shared almost effortlessly, while material objects can't be. Basing your thinking on this analogy is tantamount to ignoring that difference. (Even the US legal system does not entirely accept the analogy, since it does not treat copyrights or patents like physical object property rights.)

What this guy did was most definitely illegal and wrong. It's wrong in the way that peeping in people's windows while they are undressing is wrong though, not in the way that robbing a bank or stealing a car is wrong. It's mildly annoying and should be stopped but it's not a major offense, nobody got hurt, nobody died, nobody is scarred for life, and he definitely did not steal $300,000. He should be arrested, given community service, and released and we should take this as a healthy reminder to close the security holes that we know are in our networks.

Also, don't fool yourself into thinking that if you just through the book at everyone who get's cautht hacking, your security problems will go away. That's not the way it works and it's foolish to think that.

Re:where is the "which is obviously rediculous"

[egarland]

Yes. He abused someone's username and password to help get more information. Nobody died, nobody lost $300,000. There is no damage here. Is there a crime, almost definitely, but the claim of damages is rediculous.

Re:where is the "which is obviously rediculous"

[Anonymous Coward]

We were going to require a blood sample with each search... but the lawyers complained...

Re:where is the "which is obviously rediculous"

[Anonymous Coward]

NYT is claiming damages because they had to pay LexisNexis $300,000 they didn't spend. LexisNexis is the one with the evidence.

also, there's no E in ridiculous.

Re:where is the "which is obviously rediculous"

[Anonymous Coward]

Would they complain about using an RSA fob?

Re:where is the "which is obviously rediculous"

[Anonymous Coward]

Site licenses... There are so many licensing methods (including basic CC pay-as-you-go) that makes it difficult.

Re:where is the "which is obviously rediculous"

[Hank Reardon]

...and he definitely did not steal $300,000...

If , and it's a big if with the way that lawyers boost damage claims, there was a monetary charge to the NYT's LexisNexis account made by Lamo, I don't see how it could be anything but theft or fraud.

The account was used by an unauthorized individual and the charge was made. The money is taken from somewhere, be it the NYT accounts to pay for the unauthorized use, or the LexisNexis accounts via a bill adjustment. Just because saleable item is "bits" doesn't mean it doesn't exist.

Re:where is the "which is obviously rediculous"

[kelleher]

The RMS rant, while interesting, has little to do with what occurred here. Adam isn't being accused of logging in, copying a CD, then logging out. He allegedly made use of one companies services while billing it to another. This is more along the lines of me going into your unlocked house while you're not home and ordering/watching Pay-Per View movies. Did I steal anything from anyone? If not, who is liable for the cost of the movies? You? The Cable company? Not me, of course, I didn't take a physical object and everyone else still had access to Pay-Per View - right?

When someone, be it LexusNexus, a cable company, or a barber, provides a service they do so for a given price. Taking their service without paying them is theft.

Slash Mods SUCK!

[Anonymous Coward]

While Slashdetters hyperventilate about the hacker arrests, in other news, unreported at Slashdot, Edward Teller died.

Re:Slash Mods SUCK!

[Anonymous Coward]

It's true, the mass murderer is dead. Truly an American icon, like Stephen King, and *BSD.

Re:Slash Mods SUCK!

[Anonymous Coward]

ignorant asshole

"How old are you? 5?" Nope 30.

[lost_n_mad]

I'm tired of the house metaphor. Maybe if this was someone's PERSONAL computer then that would hold some water. But take it to the scale of what these places really are. He made it into a secured building with security guards, and went into a locked room and broke into the safe while avoiding a camera watching the safe. THAT is not someone's house with a dead-bolt, that is a business and how they would physically secure these things. So would everybody please drop the house metaphor unless we are referring to someone's personal computer. Everyone he has hacked thus far have been business, and if they go to the above extremes to secure things physically then why not on the internet?

But was the victim causing the damage?

[Spamalamadingdong]

Ok, what if they do this when you are not home and leave you a note? Then you are gonna call the police, go thru your house to see if anything is missing, tampered with, etc. This costs money and your time, which in business transalets to even more money.

If you discovered that you left the door open, you would need to check everything even if nobody left you a note. Due dilligence requires that every discovery of a security hole, by whatever means, be followed up; the person who found the door open and left a note might not have been the only one to make the discovery, just the only one to share the information with the person whose things are at risk.

Also, was the lock broken, or is it a design flaw. there is a difference. Reparing a design flaw costs money.

The design flaw is not the responsibility of the person who discovers that the door doesn't lock as it is supposed to.

In the end he caused the companties time and money to recover from his unauthorized access, which BTW is illegal.

The company was risking its integrity for every day the holes remained open, and they would have had to conduct a full intrusion check when they discovered them regardless of whether or not anyone told them that the holes had been used. The NYT could have merely assumed that everything was okay if they didn't know of any intrusions, but that would have been a failure of due dilligence; a proper response would have been to conduct a full audit to make sure that no black-hats had come in. They would have to do this whether or not Lano had ever come into their systems, so the proper evaluation of the cost of Lamo's activities is probably zero.

Wrong analogy.

[Anonymous Coward]

I was writing a long explanation about how this is morally wrong, but I'm getting tired of stupid people.

So, go on, put half the geniuses in jail and let the other half "voluntarily" go to another country. You've got a bright future, for sure, my neighbour citizens of the U.S. Very brilliant!

(Since you're stupid, let me hint you that this note is sarcastic.)

how odd that worldcom is good & NYT bad

[asscroft]

In their respective reactions to Lamo (L4M30) worldcome is the nice guy, saying thanks - we're glad you pointed it out and the NYT is the bad guy, getting the FBI involved and having him arrested. I didn't expect such a scenario.

If someone pointed out to me that my windows were really easy to open and I should get some window locks (which they are and I did) I would be glad that he told me. If he opened one and went in and left a note in my wife's panties drawer telling me this I'd be a little pissed off and scared.

I guess he crossed the line.

Martyr Complex?

[decapentaplegic]

Here's a Blog link to a conflicted perspective from Macki (former 2600 web-master) on Adrian's potential martyr complex.

Permalink from BoingBoing Guest Blog

He's been doing things that would be very easy for him to get away with and that no one would really care about all that much. Instead of getting away with it, Adrian made a decision a long time ago to become a hacker martyr.

Among other things, Macki also points out that that the lead link you gave, FreeAdrian.com, was registered over a year ago.

LexisNexis Pricing (for pay as you go)

[wherley]

is here

300 grand?? how??

Re:LexisNexis Pricing (for pay as you go)

[Anonymous Coward]

With the ID he had, he was able to do repeated searches very quickly on himself over the entire set of databases... That racks up some pretty hefty costs pretty darn fast.

Lexis is really a combination of over 10,000 databases... costs are associated with how many you try to access at once.

Not the same as going to your house

[cylcyl]

I see all those analogies of breaking into your house and walk around to what Lamo did, I think it's a bad analogy.

My home is not a trusted public institution / company to which many people trust their private info. Remember all those investigative reports into airport security? How reporters demonstrate how poor they are ? This is the proper analogy.

Only difference is that his "motivation" is less trusted (c'mon, people don't believe in altruism), and hence, feared. Whereas we know that reporters are doing it for the job and $$, tho I'm sure airport security never asked for this kind of investigation.

Explaining the LexisNexis figure

[psxndc]

A lawyer friend of mine told me once that services like LexisNexis and Westlaw charge their clients something like $500 per search. Not per session. Per search. Think about that the next time you search on google, don't like what you get, and search again. Pretty easy to see how he got up to $300k that way.

psxndc

Re:Explaining the LexisNexis figure

[Anonymous Coward]

Not only that... the "scope" of the search can have a value as well... a single "mega search" that goes into the same records that the NSA, FBI, Homeland Security, TSA use [lexisnexis is one of the companies that houses some of the data that those orgs use] costs the law enforcement only $~50 a search as part of a reciprical contract, but is sold to lawyers/general public at $7000-$12000 a SINGLE SEARCH.....

Re:Explaining the LexisNexis figure

[merchant_x]

According to the lexis website [http://web.lexis.com/xchange/ccsubs/cc_prods.asp] searches are free and docs are $9 per. Maybe your lawyer friend meant that he himself charges his clients $500 per search.

Re:Explaining the LexisNexis figure

[psxndc]

No, definitely not. He said Lexis, etc are dangerous because they are free to law students, who get used to using them like google, but expensive for law firms, since the firms then hire the students who are used to doing three or four searches. I see your link, and it does look like you can buy individual docs for about $9 each, but maybe it's different for him because he goes through his firm. Maybe he was referring to Westlaw. I just remember suggesting to him that there be a goole for lawyers and he explained how there already were ones, and they definitely were not cheap for firms to use. *shrug*

psxndc

Re:Explaining the LexisNexis figure

[jsupreston]

They must have changed their policy since I left my job at an accounting firm. Lexis would charge us a fee just to connect to their system via a 1-800 line, and then charge an outrageous amount for each search. Needless to say, out of 140 employees, about 3 had access to Lexis. If I remember correctly, they dropped the connection fee once we were able to go IP to their system, but it was still very expensive to use them.

Re:Explaining the LexisNexis figure

[Anonymous Coward]

Depends which databases you are searching.

The really interesting stuff (Driver records, federal records, etc) costs more because there are royalties that LexisNexis have to pay to the data providers.

The basic public data is cheap, because it's, well.. public. You are just paying for the convenience of it all being in one spot.

Re:Hacke contribute to the security of the communi

[krwren]

I get tired of this stupid argument. I know security holes in most businesses (i.e. cut the phone line and throw a bring throw the windows). I can then steal any credit card information they have on site. But somehow some people think its different when you do basically the same thing to a computer. No, breaking and entry is breaking and entry, no matter how you justify it.

This guy has a major martyr complex

[JoeBuck]

It appears that this guy has been trying to get arrested for the last year, so that he can be the next world-famous hacker martyr, like Kevin Mitnick was. A close friend of his registered FreeAdrian.com over a year ago, though it now forwards to freelamo.com.

Read all about it and beware of giving publicity to publicity hounds. This guy's ambition in life appears to be that hackers everywhere will deface web sites and put his name on them, like people did for Kevin. If he hadn't been busted by the New York Times, he would have kept on going until he did get busted.

My take on things.

[elel]

I was an Excite@home customer. I'm glad someone closed the holes.

I was a NYTimes customer. I'm glad someone closed the holes.

I was a Yahoo member. I'm glad someone closed the holes.

The fact that these holes existed and the companies weren't doing anything about them (because their admins misconfigured proxies and who knows what else) says to me that they didn't know the holes existed. Look at his targets. Were these 50-employee small businesses that got their IIS web-server hacked? No. They weren't. They were all very large corporations with substantial customer bases that had gaping holes in their security.

The targets were carefully selected and the publicity was purposeful. I doubt he made it public on purpose and I'd hardly call it bragging. This isn't someone getting on EFnet and joining #warez and saying (while holding down the shift-key instead of using caps lock)

# Appears as ADRIAN
ADRIAN: OMG I HAXORED NYTIMES AND PWN3D THEIR PROXZ!

This was someone being professional about what he was doing, or so it would appear, calling up the system administrators and offering to help fix the problem. Not to mention making it publicly known that large American corporations don't care about safe-guarding data like your SSID or credit card numbers. But everyone already knew that, right? I guess nobody cares.

Damage? They owe him their thanks. If you didn't bother reading some of the other articles about his past experience you would have learned that most of the companies were grateful (WorldCom and @Home just to name a couple). The fact that the people at NYTimes are whiny asshats was simply something that was bound to happen sooner or later. Read some more articles and you'll see that some of the SSIDs he got were of some pretty important figures in world politics. I'm sure plenty of powerful people were pissed and expected, if not demanded, that NYTimes go after Adrian.

Re:My take on things.

[zaphodbblx]

Damn straight... He COULD HAVE stolen identities, money and ruined lives He didn't. BUT he did embarass some 100+k a year security hack for the times, andfor that he will go down! I dont believe he did 300+k worth of damage to the Times...I believe its standard practice to claim large monetary losses to get the feds involved. Kill a kid go free, hack the times go to jail. Isn't "justice" wonderful

Re:My take on things.

[zaphodbblx]

Hey thanks...I have an above average case of keyboarditis

Hmmm, sounds personal.

[Anonymous Coward]

My company's web sites have been the victim of numerous DoS attacks (no, I do not work for SCO - I work for a company you guys like, though I don't really want to say which), which while using different methods amount to the same thing this guy did

I dunno, that is like asking the surviving member of a murdered family if the death penalty is wrong....

So, IANAL, but...

[Esion Modnar]

I thought having your charges read to you was one of the things they are supposed to do, much like your getting your one phone call.

I didn't think you'd have to negotiate just for them to say what you're arrested for.

"You're under arrest."
"For what?"
"Um, we're not saying, it's, um. Classified. Yeah."
"Oh, really..."
"Yeah, telling you why we're arresting you would, um, threaten national security, um. Yeah."
"And do I get a lawyer?"
"Sure, if you can find one in Gitmo."

Re:So, IANAL, but...

[AlphaOne]

I thought having your charges read to you was one of the things they are supposed to do, much like your getting your one phone call.

Well, in a word, no.

The only thing required is that you be read your Miranda rights. Everything else is optional.

You can be detained for any reason at any time by anyone (yes, even private citizens can detain via citizen's arrest rights).

Police officers are held to a legal standard called "probable cause." This is not because they need it to perform an arrest, but because the arrest would not pass basic legal requirements to be a basis for a criminal charge.

There is absolutely no requirement that you be told why you are being arrested, but you do have to be told what the charges against you are when you are formally charged.

Don't confuse an arrest warrant and a a formal charged levied against you by a court. An arrest warrant simply means that, in a judge's opinion, a sufficient amount of evidence has been presented in an appropriate way to support the strong possibility, aka, "probable cause," that you have committed a crime.

Once you are arraigned, then you are charged and you will hear the charges levied against you by the court.

I just heard the sad news on CNN...

[Anonymous Coward]

Noted homicidal psycopath Edward Teller has been found dead in his San Diego apartment. There were few details available. Teller was the model for Stanely Kubrick's Dr. Strangelove. Reportedly, Kubrick toned down the character a bit, since nobody would believe that anyone could be that evil. Teller reportedly recommended noted astrophysist Bob Lazar for his first job with the shadow government because he "though his name sounded Hungarian". You may not have appreciated the prospect of being incinerated by a hydrogen fusion hellfire, but still, he was a batshit crazy evil motherfucker.

Are you SURE he's dead? Put another bullet in him.

Not quite

[iii_rjm]

you stated: Why not? Because physical locks aren't black magic beyond their understanding. No, the reason is that locksmiths are bonded. You want to be a white hat hacker that people trust and that people will hire to do security work? Get bonded.

Re:Not quite

[hesiod]

> Get bonded

Hey, I don't talk about my private life, so don't tell me to go do some sick, twisted shit like you do!

Damage is damage, and you are a troll

[Anonymous Coward]

Script kiddie, eh? I'm sure that Mr. Lamo's technical skills would make your own look truly childish. At least he had the wherewithall to announce his hacks:

What the hell have you accomplished with your life, besides moaning on /.?

Jayson Blair

[b1t r0t]

So how much damage did Jayson Blair do to the NYT? Maybe Adrian and Jayson could get together to write a book or something.

I say again

[BortQ]

Get a slashdot interview with this guy.

"Harsh Example" = Poor Example

[Idou]

"If I charged you for sex, I could easily get $100/hour. How about I have sex with you, without your consent, for free?"

No, let's say you have cancer, but you don't know it, and you are not getting proper check-ups so you aren't going to find out. Some self-proclaimed doctor rigs the urinal you are about to use so that he can get a sample of your urine. He then takes the sample to his lab in the basement (without your knowledge) and performs a urinalysis. When he discovers you have cancer, he fully discloses to the world (without your permission 'cause he knows doctor-phobes, like yourself, would never give him permission) that you have cancer saying, "See how screwed up it is not to get regular check-ups at the doctor's office. This guy had CANCER, and he was going to DIE just because he refused to get check-ups." In other words, the social issue takes priority to the individual's rights.

Now, regardless of whether you agree with this or not, you have to admit that this is more accurate than the "sex" analogy. If you can come up with a more accurate analogy to what actually happened, by all means post it, but arguments supported by poor ananologies are poor arguments, regardless of the core ideas behind them.

the charges being disclosed?

[Torp]

I don't understand, please explain. If there is a warrant against him, isn't he entitled to know what he's accused of?

Re:the charges being disclosed?

[prestidigital]

He wants the charges made public. He knows what the charges are, but the warrant is currently sealed, and therefore not public.

Re:the charges being disclosed?

[Torp]

Ah, thanks.

Don't use fear..

[msimm]

This is not a rapist where talking about. He wasn't trying to kidnap your daughter.

Just happens the kid had an idea about how to do things you don't like (probably not his best idea). I agree with the parent poster that this type of crime doesn't justify jail time and I also agree with you that his 'crime' shouldn't be without consequences, but jail just isn't the answer (and probably not for most non-voilent crimes).

Re:Hacke contribute to the security of the communi

[BoneFlower]

Hear hear! Lets bring that spirit offline!

Burglars, murderers, rapists all make the offline community more secure by pointing out weaknesses in our physical security. We should honor them for their service rather than imprison and execute them. The pain and difficulty they cause their small number of victims is a small price to pay for the greater security the rest of us enjoy.

Anyone even see interview with Lamo?

[barks]

I remember a classic episode of The Screen Savers in which Mitnick and Woz were hosting the show. One part Mitnick interviews Lamo...and he asked rather simple questions like "Now I use to hacker b/c I was curious why do you do it?"

All of Lamo's responses were rather "crackhead" like...I'm not trying to knock the guy, but it didn't really seem he had an answer for why he hacks...not because he's curious or because he's trying to help companies...he just kept saying that he considered himself "at the right place at the right time".

It's possible he was just camera shy.

Ah, the old boogeyman argument.

[Anonymous Coward]

Many, many students "disappear". It's called graduation. They don't keep in touch with their old school, and folks at the school (outside alumni associations) don't exactly spend much time tracking the students. Spaf tends to embelish his descriptions; that's a useful skill when you head a large group.

Re:Ah, the old boogeyman argument.

[DesScorp]

He wasn't refering to graduates at the time. He was refering to very gifted students, ones that were establishing reputations for themselves, suddenly dropping out of school, or just dissapearing altogether. He wasn't talking about the normal cycle of graduates moving on somewhere else.

Re:Ah, the old boogeyman argument.

[Macrat]

No. Purdue spends a LOT of money keeping track of students after graduation.

For the past ten years no matter how many times I move and DON'T forward my mail, those bastards keep finding me and keep asking for donations.

what a moron

[iamhassi]

"The New York Times contacted the authorities after we learned of the breach and addressed the [security] holes internally,"

Moron! You're just suppose to break in and steal stuff, not unlock the door, announce yourself to the occupants, then offer to buy them much better locks!

Yeah, Right, Crime Is The Victim's Fault

[reallocate]

>> If you're not smart enough to go for C in the first place, you better be thankful to get A and not B. And if you're not, B might be just waiting to happen.

Well, sure, if you want to argue that any network that this guy broke into has left the keys in the door. I don't agree with that analogy.

How about this: You put a lock for your door, lock it, and go away. While you're gone, some smart kid picks the lock, sits down in your living room, looks through the family album, checks out your bank accounts, helps himself to pizza and a beer, and then leaves you a note reminding you not to brings charges but, instead, to buy an ad in the local paper praising him.

Yeah, I'm sure going to do that.

Following your logic, we'd absolve all criminal behavior due to the presumed failure of the victims to protect themselves.

Video of Lamo

[acedtect]

TechTV has video of Lamo before his arrest

http://www.techtv.com/chkpt/240hp091003/http://www .techtv.com/screensavers/story/0,24330,3520394,00. html

He did an interview in the hotel room beforehand and talks about his attitude towards the charges and what he did. Then there's some video of him with the fed at Starbuck's that doesn't have any inofrmational value but is interesting from a documentary standpoint.

Seems like Lamo's willig to pay for his crime as long as he agrees that he's being accused of something he consciously did.

Privacy Hypocrites

[DaveV1.0]

Why is it so many here on Slashdot complain about their privacy being invaded, yet turn around and applaud someone who invades the privacy of a corporation or individual by hacking into a computer system or network?

If the roles were reversed you can bet there would be an outcry for the maximum penalty for the perpetrator.

Re:Privacy Hypocrites

[Anonymous Coward]

Let's get one thing clear: individuals and corporations do not deserve the same rights.

Where the hell did his folks get $250K???!

[Trolling4Dollars]

WTF!?? How can anyone afford that amount of money?! That's ludicrous!

Re:Where the hell did his folks get $250K???!

[SithLordOfLanc]

Typically, you need only need to post a bond in the amount of 10%. Thus, they wouldnot have to actually put up 250K but pay 25K and prove they can pay the rest if he flees. Also, since he turned himsef in, he would be considered a low flight risk. IANAL.

broken house window

[Anonymous Coward]

If a locksmith walked up to your house and saw the window was broken, looked inside and told you your window was broken what would you do??

Sue him for breaking and entering? all he did was tell you your window was broken, he didnt go inside he just verifies the window is broken by sticking an arm inside.

If this happens in the computer world what happens you scan a network and see that they didnt patch up xyz... verified they didnt patch xyz... then told them... what would you do now?

Re:broken house window

[e.coli]

... but Lame-o didn't do that. He looked in the house and then entered. Then watched cable tv. Then sent off some magazine subscriptions. Then left and told all of your neighbors about it before telling you.

Twitch Boy

[VonGuard]

Well, Twitch Boy has landed. But of course, he's back on the outside world and he'll probably come after my balls now.

My bet is he'll enjoy the federal pen since he swings that way anyway.

It's interesting to see that there's actually someone out there less socially functional than kevin Mitnick.

What a Lamo!

[Anonymous Coward]

You'd pretty much have to be a lamo to brag about your 1337ness and get caught by the feds. That would make the Baby Jesus cry!

Re:where is the "which is obviously ridiculous"

[egarland]

Wow. Yea. Now that I look at it that wasn't ridiculous.
Where's the edit previous post button when I need it.

Not quite the end of story

[podperson]

Unless someone gives you PERMISSION to break into something of theirs, IT'S ILLEGAL TO DO SO.

What if a Fireman breaks into your house to rescue your cat?

What if a neighbor breaks in to turn off the water that's overflowing?

What's reasonable and legal in a given situation is determined, in our legal system, by what a "reasonable man" might be expected to do in a given situation. I don't think Mr. Lamo can claim to have acted as a "reasonable man" would act -- but that's the acid test. Ideas that laws are absolute end of story blah blah blah are just windbagging.

awwww maaan

[nocomment]

now we're going to see "Free Adrian" stickers on every phone booth in the universe.

Re:awwww maaan

[arkane1234]

I guess that's better than having a "Free Lamo" sticker on every phone booth in the universe.

Or on the bumper of your car......

thousands don't depend on me

[BlueboyX]

The difference between my house and a company is that the company is responsible for the saftey (information-wise) of thousands of customers and employees. If their security is bad then there are problems. On the other hand, if the security of my home is bad and I don't care then there is no problem; nobody is depending on me and I haven't sold my home to anyone as being a secure haven of any sort.

Fuck 'em.

[Anonymous Coward]

He got caught doing something illegal. No matter how much you rationalize it, the point remains he's doing something that 99% of the US public disapproves of.

Furthermore, he wasn't hacking in the name of freedom of speech, civil liberties violations, sweatshop workers, or anything remotely noble. He's doing this for his own gratification. I hope he gets locked up.

End of story.

how ironic

[Anonymous Coward]

I went to news.google.com as per the link in the story, clicked blindly on a link, and ended up right back at /.

nice.

damages

[Darth]

so, if they find during their audit that there is another black hat (or more than one) in their network that they didnt know about, does the total cost of damages they avoided by finding that guy mitigate the damages claimed against Lamo?

somehow, i'm betting they only count damages in one direction.

Fix your analogies, people!

[clambake]

Breaking into a computer and breakign into a house are not the same thing whatsoever, dispite the similar wording. When you "hack in", the target machine and you are having a conversation. If you just had to find a house analogy, it's more like having your house and the target house merged together through spacial dimension warp...

So, if you want to find a good analogy like this, think of this:

You are on a train, heading to work. There is a man sitting next to you, bumping up against you everytime the train lurches on the track, nothing abnormal, nothing that you really notice. The before you get off, he tells you, "Hi, I'm a doctor. While I was bumping up against you, I was secretly feeling your chest for lumps. I have found a massive tumor in your left breast. You are free to leave it there, but one of these days, it's going to kill you. I am an excellent cancer surgeon, and I will perform the operation (or show your regular doctors how to) for free."

Now, what is your response? Assuming the cancer really *is* there, is your first thought to have him arresed for sexual molestation? Do you curse him for trying to save your life? Would you rathar have found out this way, or would you have preferred to find out after the cancer has spread and it's too late?

If the NYT didn't have this good samartian helping them, then they would eventually have been in serious jeapordy. Considering how fickle the economy is these days, he may have saved thier lives (how much would it have cost them if they ran a ficticious, slanderous story, of if someone subtly re-wrote all the ads to make them look bad, or if their servers were used to host mountians of RIAA goodies, or if al-queda decided to use them as thier cyber commad post)?

Re:Fix your analogies, people!

[e.coli]

It appears that you forgot about the parts where the doctor picked your pocket and, before telling you about the tumor, told everyone else on the train.

Yeah, good analogy.

Re:Fix your analogies, people!

[clambake]

It appears that you forgot about the parts where the doctor picked your pocket and, before telling you about the tumor, told everyone else on the train.

Yeah, good analogy.

That's fine, the question still stands: Do you want to learn about the tumor this way, or learn after it's too late and you're going to die?

Re:Fix your analogies, people!

[e.coli]

The NYTimes wasn't going to die though. They were being robbed.

Besides, what are the credentials of this "doctor"? Was he studying to be a dentist? a vet? was he a drop out who only did abortions?

Is his "medical opinion" valid? diagnosis correct? Or was he just feeling people up and scaring the hell out of them with his diagnosis?

Here is an analogy - probably more fitting.
He walks into YOUR store. He looks around. Other customers are there looking around. He notices that there are no cameras in the store and he doesn't see a burgler alarm. He returns that night after your store is closed, jimmies open the back door and enters your store. He watches the pay-per-view channel on your tv (yeah, you have cable). He goes through your customer list. He orders a pizza on your credit card number to be delivered. Eats the pizza. Leaves before dawn. Tells the news media about the break in. Tells you about the break in. Wants to give you a security system of dubious quality. You have his stoopid ass arrested.

Yeah, I like that analogy better.
You pay for the pay-per-view he watched.
You pay for the pizza he ate.
You have no idea if he retained any of your customer information.
And every punk in the neighborhood now knows how easy it was to knock over your store.

Martyr

[ffallen]

It appears to me that he is seeking some sort of computing martyrdom status. The action taken to register a website FreeAdrian.com etc. appears to me to be the work of someone who is seeking to make a point using the judicial system. With regards to the lexisNexis (whatever) search. It might not make sense to some, however, shouldn't one have a right to view any material where they are a part of the subject matter (articles, etc). If the searches were simply on his own name (which I'm not sure if they were or not) etc?

Re:Martyr

[e.coli]

Lexus/Nexus is a subscription system. If you want things printed out, it costs extra. They gather news from may different sources, electronic and printed, put it in a database for easy searching and then charge people. The idea is to make money off of the information that they had to pay people to gather and input.

If he wanted free, let him use Google/Yahoo.

Screw you, you smug asshole.

[poot_rootbeer]

Don't put words in my mouth.

Imagine if court worked the way you think it should?

Judge: Should this man go to jail?

Prosecutor: He committed a crime. Here's the statutes under which he was charged, here's his own testimony affirming what he did, here's a stack of earlier cases that establish precedent.

Defense attorney: But... but he's INTELLIGENT! It would be wasteful to put him in jail!

Judge: Well, we certainly don't people to face the consequences of their actions unless they're stupid! Case dismissed!

Re:Screw you, you smug asshole.

[SirSlud]

Smug asshole, lol. This from the guy who responded to "why should he go to jail" with the nicely glib "cause he committed a crime."

Thats just as smug. We can both be smug. Together. Its fun!

But back to the point, I think you forgot to prove that he, in fact, broke some laws. Thats what I was asking .. most hackers are charged for stealing information or causing damage. Clearly he'd done this a few times before and the people he committed *those* crimes against actually paid him for it! Sounds like evidence that his actions might not actually constitute the sort of action we should neccessarily criminalize 100% of the time.

How old are YOU?

[RdsArts]

What he did here wasn't breaking into a house.

It was going on a tour of a house, that's arranged by the owner, noticing where it's not roped off, and taking a look.

Later, the owner notices, goes "Jesus Christ, your not supposed to be there," after the fact, and then makes it their point to make your life a living hell.

He's didn't go break into a building and get onto the network. He used a publicly available connection, and looked around. He saw somehwere people wouldn't normally go, and went.

Your use of "breaking into someone's house" analogy is flawed.

The Dark Arts [Was: Re:Reasonable damage figures]

[Kussic]

The truth is that we are concidered something close to what Wizzards and Witches where during the Dark Ages. They where close to the King, he had to trust them, he actually needed them but then again they where hunting them down and burning them.

My wife once said that in her eyes I'm something like a Sorcerer, I do things that no-one can understand, and in most people's eyes look unbelievable; "But you are there and I'm here how on earth did you manage to change my IE homepage?"

Magnetism was considered "magic" 100 years ago, then a guy came along studied it and explained it to the rest of the human kind. The weird thing is that we are not using black boxes, or unsolved riddles, the answers are there for anyone who is willing to ask, but how many people can understand them? Computer Security is something like advanced mathematics; you can't just start solving a problem if you don't have the proper foundations to do so! We do! Our only difference is that Mathematics where here since the Start of Time, the Universe and Everything, but we are a new breed and as history has proven numerous times, Humans as a kind just don't like anything new and they always fail to accept it without first condemning it as Evil and Bad.


High Leader of the Dark Legion of ZeroOne,
Lord Kussic

When I was in high school . . .

[CustomDesigned]

in 1975, a fellow student wrote a program that retrieved the entire password list for the system, including admins. The system was an HP2000, and the flaw was that BASIC common memory was not initialized to zero by the system - it contained whatever was left over from another program. So if you ran a program with lots of common variables just after logging in and interpret them properly . . .

He presented the program and the password list to the school administrator. Instead of persecuting him, they contacted HP, who fixed the problem, and HP hired him with a college scholarship as soon as he graduated.

How times change.

Erm...

[Tokerat]

I bought a car alarm for my car. If I find that someone has taped a note to my steering wheel telling me that my car alarm is wired incorrectly, and lists ways to fix it, can I charge the cost of the burglar for the costs of the new alarm AND a the time and effort it takes to inventory my car to see if he took anything while he was in there?

How much was that burglar, anyways? ;-)

My opinion of this:

[Funksaw]

Lamo did a dumb thing.

His intentions were good. But could he have done this with the permission of the NYT instead?

Say what you want about "they'd shore up the system before he went in" -- isn't the entire point of white-hattery to get people to shore up their system?

Now, *considering* Lamo's intentions and reputation, the NYT would be, well, assholes for not trying to allow some sort of light sentence. But this isn't, like, say the RIAA, where they go after 12 year olds that don't know what they're doing is wrong. Lamo's been in this business long enough to know that what he was doing was illegal.

There needs to be a significant revision of the code of ethics of White Hat Hackers - specifically, it needs to be written down.

One of the rules that should be in there is:

1) I will notify and seek permission from any public or private individual, corporation or institution that will explain what I am about to do and seek permission to do so. I will make it clear that whatever I find, I will be publishing my findings.

Number two should be something along the lines of "not working within the U.S. whenever possible" or something like that.

-- Funksaw

Re:My opinion of this:

[Funksaw]

In the post above, replace "don't know what they're doing is wrong" with "don't know what they're doing is illegal."

Even *I* sometimes make that mistake. Damn media saturation bombs.

-- Funksaw

Re:My opinion of this:

[e.coli]

So you are saying that Lame-o has been asleep all of these years and missed the media frenzy on this type of action?? He somehow didn't know that if you enter someone's computer system without their permission it's illegal??

If that is the case, he shouldn't go to jail. He should go to a mental institution for being too stupid to breathe!

why_not

[Anonymous Coward]

reprint of
http://web.archive.org/web/20020603035051/adri an.a drian.org/whynot.htm

Letter to Deb Cote 1/28/02

---

Hello Deb,

I noticed your post on comp.security.unix :) Thank you for giving your readers an opportunity to voice their views. I always appreciate any forum that stimulates people to think and arrive at their own conclusions. I generally don't participate in discussions about me, something I feel would be inappropriate, but I would like to clarify an issue that searchWebManagement.com mentioned.

It's difficult for me to communicate this effectively to media, as story structure frequently requires the protagonist to have a clearly identifiable motive and goal, but I do try to straighten the record a bit here and there as applicable.

The editor's summary at http://searchwebmanagement.techtarget.com/newsItem /0,289139,sid27_gci785232, 00.html indicates that I consider myself benign. Other sites have gone considerably further in tacking views and motives onto me. I do what I do as an extension of how I live my life. Curiosity, trying to look at issues and entities from all angles while being beholden to none, not letting myself be prejudiced by views or methods more commonly applied, but not rejecting them offhandedly either -- these and other .. I hesitate to say principles, but can't think of a better word .. these and other principles get applied equally through my life in the physical world and my time as a network citizen.

The important distinctions are -- I don't see myself as having a right to do this. I don't think that just because it happens to help people, I'm above the law in doing it. Nobody has granted me a right to be on anyone elses network without their approval, and I don't think that the rules somehow will not apply to me if someone wants to send the feds looking for me. Life is gradiations of risk. However -- this behavior will occur for as long as there are networks and electronic resources. Rights having been granted or not, the history of law enforcement in America [and elsewhere] shows that you cannot ever exterminate a pattern of human behavior altogether. People are people, and though we can make them react to us, we cannot change them fundamentally -- and if we ever find that we can, we may be taking on a role that is not ours to take on in this world.

If this behavior is an irrevocable part of human nature, legislation and electronic countermeasures can only mitigate it so much. Law-enforcement and industry can, if they deem appropriate, engage this behavior in a no-surrender no-retreat many-prisoners struggle indefinitely. I don't know who this would help. As long as unauthorized exploration is going to happen on some level, what makes the most sense to me is to have it harm the fewest people as possible.

If I'm trying to push any idea for people to evaluate here, that's it -- if you can't eliminate it, and possibly aren't sure you want to, is harm reduction so unreasonable? A computer isn't a house or a car or whatever analogy people want to draw for intrusion scenarios. I've never seen an analogy that works without a hitch. A computer is a computer, the situation is unique, there are no perfect parallels in 'real life', and not wanting people to be hurt if it can be avoided doesn't seem like such a bad thing. Just because it's a central feature of human nature doesn't make it unquestionably 'right', doesn't give me any right, but it does, to me, mean that we should deal with it realistically as a part of the human condition rather than a new problematic situation to be legislated into the ground. In my humble opinion.

On a more personal and less [more?] central tangent, I have to think that laws and legal conditions which generate harm where none previously existed should be questioned by all those party to them, on either side of the thin technicolor line. Complex systems such as the internet

Awww... Poor NYTimes Got a Black Eye...

[Mnemennth]

... so they're taking it out on the guy who's trying to show them how to fix their own abysmal lack of security.

I realize this is a matter of laws and such; but really... if it hadn't been him it would have been someone else, and they'd STILL have the same expenses once anyone who knew what they were doing got into the system, even if it was only a new head of IT Security. All Adrian did was to save them from hiring a headhunter.

Those fraudulent charges to LexisNexis will be refunded as a courtesy to such a large customer as the Times, and probably along with them will be refunded a reasonable number of legitimate searches for Adrian Lamo. This will net them a profit in the long run.

So the ultimate end here is that The Times looks like a bunch of jerkoffs, and even if Adrian goes to jail all it will do is boost his street crit thereby improving his saleability as a consultant, perhaps even leading to a job with our own government.
It's really a win/win situation for Adrian, and if the Times weren't such a bunch of weenies, they'd realize it was for them too.

Mnem

What's right and what's wrong....

[e.coli]

The problem here is that people who like to break into computer networks don't see the harm in their actions. They view it like a little kid, it's theirs and no one has a right to take it away - it's their game/toy/fantasy.

In the case of Adrian Lame-o, the neeping lemmings put him up on an altar and bow down before his mighty web browser. They cannot see anything else but his brilliance.

They do not see the network as property. They can't comprehend the concept of breaking and entering because the net is free!

But here is the truth of it. The NYTimes paid for the servers, routers, firewalls, wiring, fiber, storage devices. This is property. They collect subscription fees from people who want to use this property. That is their right.

They paid people to collect information, stories, lists and data. This is property. They sell this property. That is their right.

They built a store front to allow people to enter their property and conduct business with them. That is their right.

They have security in this building to prevent people from going beyond the ground floor where normal business is conducted. That is their right.

They have paid for all of this.

Now, along comes Lame-o. He sneaks/walks into the storefront, looks around and notices that one of the security devices is not turned on.
Does he notify anyone? No. When no one is looking he makes his way past security and away from the first floor.

(The security people have their hands full with people trying to get past the first floor and their budget is cut, not enough people to patrol, not enough in the budget to repair, new devices for circumventing security coming out everyday. Can't keep up with training.)

Lame-o is now on the second floor. Does he notify security? NO. Is he supposed to be there? NO. Does he know that he is not supposed to be there? YES
He rifles some desks, file cabinets, scans lists, checks out credit card numbers. Does he stop and notify security? NO

At this point we know that he alters some data, effectively using resources that the NYTimes has paid for (Property!!) without authorization or permission.

Now he sneaks back out of the building. Does he notify security? NO

What does he do? He notifies the press!

Does he pay the NYTimes for the resources that he pilfered? NO
But that is okay, the public opinion of a bunch of sheep/lemmings will bouy you out of troubled water. Lame-o will be a god unto them!

You haven't done anything wrong!?!?! YOU WEAR THE MANTLE OF THE WHITE HAT!!! Your press clippings say so! Your adoring admirers don't care about property! They want a free and open system where they can gambol and despoil the landscape making it impossible for the average user to get anything done.

Bullsh*t

Oh yeah, and about those sys admins that are always getting bashed, the ones who missed that one hole out of a gazillion. The lemmings/sheep will heap steaming trash on their heads too. After all, new exploits happen all of the time. There are so many fingers in the web pie that it's difficult to find all of the openings that vermin can come in through. A few sys admin. A few thousand lemming/sheep.

Let's see these white/black hat lemmings/sheep set up web servers that cannot be broken into while conducting a business similar to the NYTimes. Oh yeah, and with very little money. And let's see them keep it running for a year without anyone breaking into it. And if someone does break in then these same lemmings can get their asses canned.

White hat. Black hat. It's all bullsh*t.

Criminals. (Yeah, this stuff pisses me off!)

Do any of them set up a security business and try this stuff legitimately? The ones who stop being neeping sheep do. But white/black hat dittos don't. They can't. They don't have the strength. They just want to be dittos who aren't responsible for their actions. They just want to have fun. Or see their faces in the press clippings like Lame-o.

There was a hacker who got busted

[callipygian-showsyst]

There was a hacker who got busted
and Lamo was his Name-o
(CLAP!) L A M O
(CLAP!) L A M O
(CLAP!) L A M O
and Lamo was his Name-o

He's out on $250 Thousand Bail
and Lamo was his Name-o
(CLAP! CLAP!) A M O
(CLAP! CLAP!) A M O
(CLAP! CLAP!) A M O
and Lamo was his Name-o

He's not as cool as Kevin was
and Lamo was his Name-o
(CLAP! CLAP! CLAP!) M O
(CLAP! CLAP! CLAP!) M O
(CLAP! CLAP! CLAP!) M O
and Lamo was his Name-o

He found his name in Nexus
and Lamo was his Name-o
(CLAP! CLAP! CLAP! CLAP!) O
(CLAP! CLAP! CLAP! CLAP!) O
(CLAP! CLAP! CLAP! CLAP!) O
and Lamo was his Name-o

So if you are a computer guy
and Lamo is your Name-o
Don't get busted, or you'll fry!
Hacking is no Game-o
(CLAP! CLAP! CLAP! CLAP! CLAP!)
(CLAP! CLAP! CLAP! CLAP! CLAP!)
(CLAP! CLAP! CLAP! CLAP! CLAP!)
and Lamo was his Name-o

Re:There was a hacker who got busted

[Anonymous Coward]

This is, by far, the best thing I've seen on /. in a long time. I'm tempted to record it and distribute it on KaZaa as an mp3

Bonded

[Bruha]

"His parents have also put up their house to guarantee his appearance in New York."

Jeez what next, strap a parent into a letheal injection machine to guarrentee appearance in court?

Re:Do you know who was the most successful hacker

[Anonymous Coward]

I'll own up.. It's me.

Why surrender

[Unregistered]

He wasn't arrested. I would have just left the country. It's not that hard to get out. Beats the hell out of jail.

Re:Why surrender

[forkboy]

Maybe he didn't have a passport? That pretty much makes it impossible to go anywhere off the continent. Living on the lamb in Mexico as a skinny white American boy would just be moronic. Canada? Well, Canada might not be a bad place to hide out, but he'd need to establish some sort of identity which is not that easy to do in a civilized technological country other than the one of your birth, so he'd be washing dishes for $5 an hour under the table in some seedy restaurant.

Living on the run isn't fun unless you're filthy stinking rich and can live somewhere that you can buy your way out of trouble.

Re:Why surrender

[forkboy]

Well, considering he's probably going to prison, I hope he wasn't too attached to that vow of any vows of chastity he may have had.

How about debating the actual situation?

[jvonk]

Is anyone else sick of hearing both sides of the debate analogizing the incident? mm? How about when one side "corrects" an analogy used by the other?

"It's like this, you communist!"
"No, it isn't, you fascist. It's like this!"

I have heard n analogies from each side, and everyone knows n^2 time is inefficient.

Re:How about debating the actual situation?

[e.coli]

IMHO.

That would be nice but the lemmings following Lame-o just want to ignore facts in order to free their hero in tarnished halo.

The other side want to impress upon the Lemmings that it is wrong to steal other peoples property and the Lemmings don't want to hear it. They want a free system, free of laws and penalties it would seem.

So ... people try to put the situation into a point of reference that the ditto heads can relate to.

The ditto heads just come back ignoring the property issue saying "but i did it for their own good!" like some kind of good samaritan, ignoring the fact that laws were broken and property was abused/stolen.

nuff said?
but you're right. This does get old after a while.

One problem with your argument.

[mindstrm]

The fact that he did it in order to tell them they had security problems in the first place, very vocally, indicates he DID know he was not supposed to be there.. that was the whole point of what he did.

Harsh Example = Incomplete, but valid, example

[zabieru]

You're missing the point of the sex analogy. It doesn't apply to the situation as a whole, it merely establishes that there are cases (this may or may not be one of them) where the normal price for something (sex or an audit) may not be adequate when that is forced upon you without consent.

Think of security as insurance

[HiggsBison]

I think your looking at the worng person to go after them it's the insurance companies that should be pushing for this aka you want insurance for your network your premiums go up as you have less and less patches applied more open ports etc.

Mod this guy up! He hit the nail on the head!

This is the way security is supposed to work. You buy system insurance. They inspect your systems before they agree to take the risc. If they find weaknesses you can't sue them and say that they caused huge damages. Just like the guy who pointed out that you can't blame the building inspector for causing the problems that he finds.

I still think Lamo went about it wrong. If you know you are dealing with bastards who prosecute white-hats, don't be so damned surprised! And if you didn't know...

OK, I'LL SPELL IT OUT: Most corporate MIS hacks are litigous bastards who will prosecute white-hats. Save yourself the trouble. They're not worth it. Let the black-hats take 'em down. They WON'T learn this lesson any other way!

Re:Think of security as insurance

[silas_moeckel]

Breaking into systems to show people that they are broken sounds like a nice thing. If you realy want to do that go get a gig with a security outfit and get PAID to do it along with enough legal paperwork to keep you posterier covered. I've seen the disclosures NDA etc etc pile it will take you an afternoon to initial each page and sign at the end.

So here is the todo list to be a whitehat:

A Leave your parents place they love you but you can do your own laundry.

B Get hooked up with or form your own security sonsulting business.

C Sick the legal people on enough agreements etc that the only place they can take you to court is is in a nice comfertable tropic island thats happens to have great fiber connections.

D Do what you want to do and general make a good living doing it.

Now the donts would be:

Stay with your parents.

Break into systems just because they should be more secure and you can help them.

Dont get paid ofr any of it.

Got o jail when the FBI shows up with a list of charges after you admited to commiting a crime by telling your victims whats wrong with there network.

Re:Think of security as insurance

[rifter]

This is the way security is supposed to work. You buy system insurance. They inspect your systems before they agree to take the risc. If they find weaknesses you can't sue them and say that they caused huge damages. Just like the guy who pointed out that you can't blame the building inspector for causing the problems that he finds.

The problem here is that it shifts the blame. The CEO, etc do not get hurt by having to pay more for insurance. It is much like the debacle we have now with malpractice insurance, where doctors just raise the rates of health care to high heaven as the insurance companies raise theirs with no fix to the actual fucking problem since nothing happens to the doctors. Worse, good doctors pay for high insurance as well even if they do good work.

Hammurabi had the right idea when it came to malpractice. Thousands of years ago, in the oldest known code of laws, we had a solution for malpractice. It was a criminal offense. This makes the doctor pay attention and does not raise rates when you go to good doctors.

Here as well, the case could be made for criminal negligence when the management refuses to allow fixes to the system. Especially when the holes in one system cause problems through dos attacks and worms filling up the network, or spam.

wow!

[Anonymous Coward]

Apparently nobody else noticed the fact that his parents can afford $250,000 bail. Wow!

Re:Do you know who was the most successful hacker

[Anonymous Coward]

I think it was Thomas Anderson. I heard he was pretty good.

Lamo?

[betat]

Let me get this straight. He illegally made a search using his own name? His real name?? And with a last name like 'Lamo'?

Now that's a good way to avoid getting caught...

how much of your brain is shit? all of it?

[Anonymous Coward]

Hey asshole, a guy who breaks into your house poses a real, physical threat to you. He can kill you, rape your wife or murder your kids. A guy who leaves an "ownz joo!" message on your website doesn't do any of that.

fucking cockgobbler

Re:Explaining the LexisNexis figure -- Uh, *not*

[zooblethorpe]

Nice idea, but let's Do the Math(TM) --

1. $300,000 @ $500 per search = 600 searches
2. 600 searches @ 10 seconds each (to give some time to look at the results) = 100 hours

Possible, I suppose, as we don't know how long he had access before alerting the NYTimes. But 100 hours is a long time.

And for that matter, you'd have to be one hell of a fruitcake to run 600 searches on your own name. Which makes me think the $300,000 figure itself is crap, as the rest of the account suggests Lamo isn't entirely out of his gourd, just misguided or naive depending on your point of view.

--------
If I can own an idea, does that mean I can legally claim some portion of your soul once I tell you that idea? Or even if you just come up with it on your own? Heck, who needs contracts written in blood...

A Thief by any other name

[Anonymous Coward]

White hat my ass. Lamo posing as a security expert is ludicrous. He simply rationalizes his break-ins with a lame "I did it for your own good" claim after the fact. He DID run up $300,000 in Lexus/Nexus costs. Those were real supplied services involving real money that generated a real invoice that has to be paid by the Times.

The NYT made an excellent analogy: "It is like someone breaking into your house, writing his name on your walls, racking up $300,000 in long-distance charges and then claiming he did it to show you that your deadbolts weren't adequate." Lamo is no different than any other thief on the planet, he just uses a pathetic "security" rationalization to try to get away with it.

Re:Explaining the LexisNexis figure -- Uh, *not*

[psxndc]

A couple things. The article said he was altering the Yahoo databases between February and April of 2002. That gives him three months of access. Secondly, and my brain may not be working right (it's 6:30 AM), but using your numbers, doesn't 600 searches @ 10 seconds come out to 6 searches per minute, which means 100 minutes, which means about an hour and 40 minutes, not 100 hours? Thirdly, another guy posted that some of the searches, the ones that cover FBI and NSA type info go for $7,000 a pop. I just said $500 because that was what I had been told the seaches cost.

Two hours over three months is entirely conceivable, especially if he was looking for updates and to see if the Feds were on his trail.

Just my two $.02

psxndc

RAPE ME PLEASE!

[Anonymous Coward]

Another 'victim as criminal' argument I see.

Victim: "But officer, I was RAPED by this guy!"

Officer: Well that's YOUR FAULT ma'am.
You should have put better locks on your doors. You see, this guy is a WHITE HAT rapist.

Rapist: Hey! I'm a security expert! i was just doing the bi*ch a favor by showing her deadbolts weren't any good.

Not a valid defense?

[KnightWolfJK]

From ComputerWorld: "It's like a guy who sees the keys in the car in a parking lot, opens the door, takes the keys out and hides them under a mat and leaves a note," he [Mark Rasch, former head of the computer crime unit at the U.S. Department of Justice] said. "It's not a valid defense." What a horrible comparison- personally, I'd thank any such Good Samaritan

Re:Explaining the LexisNexis figure -- Uh, *not*

[zooblethorpe]

<loudforeheadslap/> Doh!

Can I beg off that I was stuck using the New Math? Sheesh. Just call me Chuckles the Clown. :P

One thing I may just be confused about though, but how is his access to Yahoo's info directly related to the NYTimes' claims of damages?

--------
If I can own an idea, does that mean I can legally claim some portion of your soul once I tell you that idea? Or even if you just come up with it on your own? Heck, who needs contracts written in blood...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Explaining the LexisNexis figure -- Uh, *not*

[psxndc]

Sorry, I didn't mean Yahoo, I meant NYTimes. And he was using the NYTimes account to search Lexis.

psxndc

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Do you know who was the most successful hacker

[ChaoticLimbs]

No way. If you were, you would have pointed out that I started a sentence with the word 'and'. Nice try though, but you fail it.

Your Justifying Network Vigilantism

[reallocate]

Don't be silly. It's obvious that bugs and security lapses should be repaired, however they are discovered.

But, then, I didn't say anything at all like that.

Here's what I've said: This Llamo character seems to have admitted to engaging in illegal actions, i.e., breaking into a corporation's private and internal network. Of course, that corporation should learn from that and fix those shortcomings. But, that fact does not erase Llamo's behavior. Whatever the motivation, whatever actions are taken afterwards, breaking the law remains breaking the law, and anyone who does that is a criminal.

To believe otherwise is to believe that anyone has the right to act as a network security vigilante, and that any criminal action vis-a-vis a network is excusable if the criminal simply tells someone abou the security gaps he found. OF course, that's utter nonsense.

Re:Your Justifying Network Vigilantism

[Viking Coder]

Well, if you watch the video, Lamo explains that when he tried to tell them how to fix the problem, they wouldn't even write down what he was telling them. So, to them, apparently, it's not "obvious that bugs and security lapses should be repaired, however they are discovered."

I'm going to phrase a hypothetical, and walk you down the path, to show you the gray that you apparently can't see in this issue.

Stealing company confidential documents. "Whatever the motion, whatever actions are taken afterwards, breaking the law remains breaking the law, and anyone who does that is a criminal. To believe otherwise is to believe that anyone has the right to [steal company confidential documents], and that any criminal action vis-a-vis [stealing company confidential documents] is excusable if the criminal simply tells someone about the..." ...toxic dumping that a corporation was doing.

If someone "steals" corporate documents that prove that the law was being broken, they are pretty well sheltered by whistle-blower laws. That's because society recognizes that more good is done by rewarding those who took a risk for the benefit of everyone. I mean, you can look into the legal arguments for whistle-blower laws, but I'm just paraphrasing those arguments down to "we protect them, because otherwise, we'd never know about the toxic dumping."

Now, yes, I am stretching the case to talk about a company with security holes, and someone outside the company who's blowing the whistle.

But I'm not going to passively sit here and let you call my example "utter nonsense."

Re:Your Justifying Network Vigilantism

[reallocate]

I see no room for gray here. Someone broke the law. Arguably, the victim became aware of security gaps as a result of that crime. What's gray, though? Someone broke the law and merits prosecution. End of story. Don't like that law? Different story.

Analogies are pointless, but...if a burglar enters my home through a hole in the roof I didn't know was there, should that burglar escape prosecution simply because I learned about the hole? Should I, the victim, express my joy about being burglarized by buying an advertisement confessing my sins of omission and praising the criminal who burglarized me?

I see no difference, no gray area, between that house burglar's crime and burglarizing a private network. Both are criminal acts.

Re:Your Justifying Network Vigilantism

[Viking Coder]

So, you just absolutely compltely refuse to even comment on my whistle-blower analogy?

Fine. I guess the conversation is over.

Re:Your Justifying Network Vigilantism

[reallocate]

I'll comment:

You're right that laws exist re: whistle-blowers. But, to my knowledge, no laws exist outlining similar treatment for network violators who uncover hitherto unknown weaknesses in that network.

Now, it's possible to make an argument that such a law ought to exist, but it doesn't, and I'm not going to make that argument because I wouldn't support such a law.

So my position remains the same: He broke the law and merits prosecution.

Re:Your Justifying Network Vigilantism

[Viking Coder]

Thank you. I appreciate it.

I don't really advocate what this guy's done. But it's not too far a walk from "hacked this specific company, pointing out their security problem" to "hacked this specific software, pointing out its security problem." The first case is covered by things like laws on theft and trespassing, etc. Unfortunately, the second case is also covered - by DMCA. I think the DMCA is absolutely rediculous in this manner.

You could make the case that if I hack Outlook, and send an email to Microsoft telling them how to fix it - that I've done almost exactly the same thing as Lamo. I've damaged the property of Microsoft - their Outlook software, and their reputation. That, in fact, I've broken the law (DMCA), and am a criminal. That's nuts.

If I don't do any direct harm (by exploiting the bug), then I should be thanked. And if I'm not thanked, then the laws (DMCA) should be changed to protect me from them. Give me whistle-blower protection.

This case isn't a perfect one-to-one case to what I just described, but in my mind, there's some gray in there. They're 100% within their rights to prosecute him. But I don't think they should have. I think they're acting in an immoral manner. Pretty similar to the kind of immoral behavior that whistle-blower laws exist to protect us againt.

Thank you for the interesting conversation. Sorry about calling you a moron, earlier.

Re:Your Justifying Network Vigilantism

[Viking Coder]

By the way, I just came across this (highly topical) article:

U.S., ABC Go To War

Upset federal officials are threatening criminal action against ABC News and its reporters for smuggling depleted uranium into the country to test customs inspections. "It is a question of whether or not journalists should be breaking the law in the pursuit of a news story," Homeland Security Department spokesman Dennis Murphy told the Associated Press. "It's not right for a reporter to rob a bank to prove the bank has lax security." Homeland Security Assistant Secretary Asa Hutchinson accused the reporter, Brian Ross, of "trying to carry out a hoax on our inspectors." Pointing out that the depleted uranium was harmless and that it was not the intent of the ABC news crew "to defraud the U.S. government, to smuggle in contraband or to avoid duties," ABC News spokesman Jeffrey Schneider maintained that the sole purpose of the report was to call attention to lax screening procedures at the border. The report is due to air on ABC's Primetime Thursday tonight, on the second anniversary of the terrorist attacks on the U.S.

How do you feel about that?

Re:Your Justifying Network Vigilantism

[reallocate]

I think it's a stupid stunt on the part of ABC and Brian Ross. I'm sure it will make for a good story. He isn't the first reporter to resort to this.

However, they knew what they were doing was illegal. (After all, there's no news if you smuggle something legal through customs.) I don't see any reason why they shouldn't be prosecuted.

Now, there is potential benefit that may come from this, if it develops that systemic security issues are involved, rather than sloppy work by one customs agent. Balance that against potentially encouraging real terrorists to smuggle real uranium.

In any case, Ross doesn't deserve a get out of jail card.

clearly you've never used Lexis

[Anonymous Coward]

It is very easy to run up very large charges on the services. there are many different classes of search and database access levels, and you can have a $3,000 bill in under an hour.

What do I want to bet the NYTimes is asking for their entire monthly charges for Lexis/Nexis? How much do you have?

Slime and oranges

[Anonymous Coward]

Pedophiles == sick bastards
1337 hax0rz == marketable skillz

To take away his [assumedly] one most marketable skill and then tell him to get a job is a bit ironic.

Comment removed

[account_deleted]

Comment removed based on user account deletion