6-Month Sentence for NASA Cracker

lunartik noted an AP story running on a 6-month sentence given to Gregory Aaron Herns for cracking into the computer system at NASA's Goddard Space Flight Center. 'Herns told federal agents he was looking for computer space to store movies he'd downloaded. It took hours for technicians to find the problem, fix it and patch the system's security holes.'"

Comments

With the direction Slashdot has been going lately,

[Chess_the_cat]

I'm surprised this wasn't posted under YRO.

I'd love to see a breakdown of the damages

[Nine Tenths of The W]

NASA are claiming it was $200k. It'd be nice to see how much of that was spent on fixing the security holes he uncovered.

Re:I'd love to see a breakdown of the damages

[mordors9]

So would I, it didn't really sound like he did any actual damage, just used some storage space. And no I am not condoning what he did. I still am amused by this blowing up of damages every time one of these cases come about. I just wonder what the sentence would have been if he broke into a local warehouse and stored some stuff there. He gets 6 months here and then the additional sentence of limited computer use for 3 years. Pretty tough sentence on a CS major.

Re:I'd love to see a breakdown of the damages

[sporty]

Agreed. I'd like to see how much money was lost or required to fix damages versus the cost of fixing the security holes that should be fixed anyway.

Re:I'd love to see a breakdown of the damages

[Richard_at_work]

He said he broke in to use storage space. Are you going to take him at face value and continue using the system as is, after patching the security hole that let him in? Or are you going to forever view that system as 'dirty', with the costs associated with replacing that system and the data on it? This isnt a simple case of 'change the locks, add more CCTV', as you would with a physical wharehouse, you cant 'distrust' a physical building, there is a lot more he could do with a compromised computer system, including hiding unwanted code.

Re:I'd love to see a breakdown of the damages

[NoOneInParticular]

The more apt analogy would be a world where warehouses are used by burglers both for storing stuff and for putting poison in the stored food. When you find someone storing warez in such a house, are you still going to sell the crackers?

Re:I'd love to see a breakdown of the damages

[More Trouble]

Are you going to take him at face value and continue using the system as is, after patching the security hole that let him in?

Am I a competent sysadmin in this scenario? If "yes," then I guess I'm probably running a tripwire of some sort. So I boot from CD, take a look at what's been changed, and fix it. If I'm really on the ball, I'm using something like radmind, in which case I still boot from CD, but I let radmind reverse any damage that had been done.

:w

Re:I'd love to see a breakdown of the damages

[dhilvert]

More to the point, fixing security problems cannot reasonably be considered damages unless the problems were caused in some way by the unauthorized access (compromised utilities, etc.).

Re:I'd love to see a breakdown of the damages

[Anonymous Coward]

Detection and patching of problem: $2000

Lawyers fees: $3000

Paperwork: $500

Lost productivity due to downtime: $75

Bullshit: $196,225

Claiming 5100% damages in court and winning: Priceless.

Re:I'd love to see a breakdown of the damages

[Jozer99]

Wow! If it took them several hours to fix, I would love to be the IT guy there!

Well now, you had a port open on your firewall, and "pswrd" as as the password for root, so, it took me 1/2 hour to fix, plus 3 1/2 to get through security, so at $50,000 an hour, that will be 200k! I take personal checks...

Re:I'd love to see a breakdown of the damages

[Peden]

"Pretty tough sentence on a CS major" Why does his education have anything to do with the sentence?

Re:I'd love to see a breakdown of the damages

[Oligonicella]

And that will guarantee that you got everything right? To the point of trusting billion dollar vehicles and people? Sure.

Re:I'd love to see a breakdown of the damages

[Oligonicella]

Bullshit. It cost to investigate and fix. Simple as that. Those are damages from an economic view.

Re:I'd love to see a breakdown of the damages

[Oligonicella]

Well now AC jackass. You didn't include the time that the computer was unavailable for processing its data. Not to mention the delay in the task, which delayed the overarching tasks, which delayed the final reports. All of which accrue costs.

But, what to expect from juniors who simply think that systems are a couple of "big" programs hooked together.

Re:I'd love to see a breakdown of the damages

[Timmmm]

And that will guarantee that you got everything right? To the point of trusting billion dollar vehicles and people? Sure.

Unless he had some way of faking md5sums, sure.

Re:I'd love to see a breakdown of the damages

[Detritus]

It costs a substantial amount of time and money to take the system off-line, preserve the evidence, attempt to determine what was exploited, format the disk, reinstall the operating system, applications, patches, and restore user data. Then you have to write reports and try to determine if other systems were compromised. All the while, you are not doing your regular job.

Re:I'd love to see a breakdown of the damages

[Twanfox]

The safest and most reliable way to 100% be assured that you have wiped all trace of actions done is to roll back to a prior backup. While yes, Tripwire is a great program and yes, while using it myself I conceed that it does in fact trap file alterations well, I seem to recall there was a story not too long ago about generating two files of the same MD5 hash. If that is even remotely possible, then you cannot trust life and death situations and billions of dollars to a system that can still be compromised just because you didn't want to take the time to roll back the system to a known 'sane' version.

It's just a matter of principle in high value systems. What happens if he replaced the policy and key files for tripwire, masking his trail? What happens if he knew the passphrase to use the local and site keys? Even if you know he could not, it just isn't worth the risk. Either take your time to drill down and dig out the pieces, or take the same time to wipe and reinstall. For my money, I feel more secure about wiping and reinstalling.

Re:I'd love to see a breakdown of the damages

[IO ERROR]

I get the security holes emailed to me every day and fix them on an ongoing basis. This is a normal course-of-business expense, and charging the expense to someone else is...well...just a little bit gray ethically. NASA should have been fixing their security holes rather than waiting for someone to come along and try to pass the expense off on.

I'm not at all saying the cracker was right to break into NASA's systems. What I am saying is NASA has a responsibility to keep its systems secure, and spend the required $$$ to do so, and they failed. That they failed does not give them the right to charge that expense to the next person to walk through the door.

Re:I'd love to see a breakdown of the damages

[Twanfox]

So would I, it didn't really sound like he did any actual damage, just used some storage space.

This is what he says he was seeking. What he intended to do, or what access he sold off to others may be different. I could tell you all day that I was breaking into your machine in order to fix things. However, I've already committed one illegal act. If I really wanted to make the shuttle go boom, why would I honestly tell you that and get myself into more trouble? I'd make up some story that sounded good at the time to keep myself from going to prison for 15 years, instead of 6 months. See how that works?

As for your 'actual damage' and 'blowing up of damages' statements, consider that it's not necessarily financial cost in the system that he broke into that they count. It's the Technician's time to investigate and repair the system, the cost to NASA of the system being unusable (if it was a core system, and their next launch must be delayed because of the intrusion, that is a valid consideration), and the cost of redeploying a sane image on the system to bring it back online. It's recovery cost and time in a case like this that determines the financial charges.

Re:I'd love to see a breakdown of the damages

[fatboy]

I'm not at all saying the cracker was right to break into NASA's systems. What I am saying is NASA has a responsibility to keep its systems secure, and spend the required $$$ to do so, and they failed.

I/O, This is true, but you must remember at many educational and scientific institutions there are a lot of undocumented machines that sit back in the corners and closets that are not properly patched. This is because the institution does not want to seem fashist about their "computer policies" that could hamper research.

That they failed does not give them the right to charge that expense to the next person to walk through the door.

Pass the expense of patching on to whom? I'm afraid I am not following your logic. (As you know, I am a little dense at times ;) )Can you elaborate?

Re:I'd love to see a breakdown of the damages

[codegen]

While tripwire and radmind may have some utility in protecting system files, it does little to protect data. In a research lab you may be generating large data sets and if the intruder installs a root kit, the modified libc (and other libs that are installed) may have bugs or be incompatible with large simulations that are running (many of which are multi step). Thus the intrusion may in fact compromise serious work that is being done on the machine.

Re:I'd love to see a breakdown of the damages

[Fortun L'Escrot]

i would agree with this. but imagine if this we're a malicious kid. or some foreign government.

we've all watched CSI: they always make up theories that explain the evidence. if your prints or DNA show up at a crime scene your are implicated. they will take you in, ask you questions until their are satisfied that you were just passing by earlier and had nothing to do with the crime.

what it seems NASA did is ask the kid what he did, he told them what he did and probably how he did it. they didnt need to locate the problem because they know where it is. they just fix and patch it. and the patching is something they should have done as part of their securing-the-system policy regardless of what this kid did. im sorry but the if-it-aint-broke-dont-fix policy is for poor poor poor as in 3rd world poor IT depts.

but nasa didnt stop there: they had to ensure the system was not contaminated. this is where i can understand all those damages. but honestly: this should again have been part of the normal policy. what really scares me is that just normal maintenance seems to cost so much. this looks like an outrageous fixed cost if you ask me.

ok, while verifying your entire system might not be a foolproof method, it works well enough that you could tell if a system was contaminated or not. unless some other cracker piggy backed on this kids work, and then caused some damages nasa could not directly pin on the kid so they fatten the cost. if they had not reason to believe the system was further compromised why does it still cost so much?

i guess if you are a crime scene and even after your investigation has found the murder weapon and the murderer and you have explained all the relevant details every suspect is a suspect and they should be detained right? when your methodology makes you constantly paranoid of your own systems i think there is a problem here. i dont know how but im sure your paranoia will be your downfall.

Re:I'd love to see a breakdown of the damages

[_Sprocket_]

A few years ago, I was sitting in on a meeting for Infosec activities at a NASA Center. One of the first presentations was a rather nicely done outline of recent vulnerabilities and exploits admins should be taking action on. A look around the room saw a vast majority of glazed-over gazes. The next presentation was from our local FBI agent who discussed a recent compromise and the actions being taken to apprehend the perpetrator. The room was alive.

There was much appreciation for the progress being made on the case. Apparently, the FBI had their suspect and were busy building an air-tight case for prosecution. There was a general air of victory. But what many failed to realize was the whole exercise was a signal of defeat. The incident represented potential compromise of data. It involved considerable man hours spent on investigation and recovery of the system. It also represented loss of equipment removed from the budget-strapped lab to support forensics activities.

This represents a couple different problems with the common view of information security at NASA.

It shows a lack of understanding of infosec issues. Instead of approaching infosec as a technical problem, the issue often gets far more attention as a legal / law enforcement issue. This is attitude calls for action after the damage has been done.

It shows a inappropriate focus on funding. All IT budgets are stressed. NASA is no different, and perhapses even more thinly spread than others. That means infosec activities tend to get cut in favor of other IT activities. Yet there is no perceived issue in later spending considerable resources to prosecute each infosec incident.

It may be worth stressing that this meeting happened several years ago. And there have been changes in how NASA, and the US Government in general, now perceive information security. So my observations do not represent an all-inclusive view of infosec at NASA (and those observations are my opinion and not policy of my employers). None the less, these observations are still applicable today.

One side observation to anyone considering taking a stab at *.nasa.gov space. Historical statistics show that you'll find suitable targets and manage to compromise a system. But keep in mind, for the US Government that is just the beginning. The FBI views a case as making progress over several years of investigation and finally prosecution. So the compromise of a system that takes minutes, and the abuse of that system over a period of weeks or months may mean that years later you'll find yourself in court.

Re:I'd love to see a breakdown of the damages

[m50d]

But the fixing was necessary anyway. It's like getting burgled and then trying to claim extra damages from the burglar to buy more secure locks.

Re:I'd love to see a breakdown of the damages

[Firethorn]

If you make a sentence for say, a welder, that includes "no welding", you've just taken away his most salable job skill. This increases the odds that he'll be unemployed, and the chance that the job he will be able to get is a McJob. This should be and probably was taken into account by the judge when he did the sentencing.

I'm not saying that it's an unjust sentence, but then again, I tend to think that sentences should be harsh.

Re:I'd love to see a breakdown of the damages

[helioquake]

200K? Probably all of it. This figure of the punitive damage is drastically underestimated. While this cracking incident was on-going, there were several disruption on front-end routers and switches that goes in and out of Goddard Space Flight Center. In turn this led to disruption of work by researchers and administrators while the problem was being looked at and fixed.

That said, NASA is seeking a punitive damage that is actually payable by the defendant.

-b
ps. I was there while that hacking took place. Not involved in fixing the problem, though.

Re:I'd love to see a breakdown of the damages

[nboscia]

$200 seems a little low. Any intrusion requires weeks, if not months, of investigation and forensic work. If the intruder connected to any other system, those need identified, users contacted, and systems "cleaned up" as well. The cost also should reflect if any system or service had to be pulled offline and if projects got delayed due to the incident. There's also the post-intrustion work which includes lessons learned -- implementing new password policies, stricter firewall rules, perhaps new hardware. I'd be more interested to see how much time was spent on this, including the work of security, system administrators, public relations, and all those fun meetings with management. I bet if they included that, it'd be more than $200k.

If these people realized how much effort went into fixing the damage they caused, maybe their conscience would stop them from doing so beforehand.. yeah, who am I fooling.

Re:I'd love to see a breakdown of the damages

[owlstead]

The MD5 hack only works for pre-calculated values. There is no way yet (and unlikely to be found in the near future) that calculates a collistion for a particular hash. So while using SHA-1 or newer is better, it would not make a difference in this case. So tripwire is still safe, unless you compromise it deliberately in advance.

Re:I'd love to see a breakdown of the damages

[bckrispi]

To say nothing of the fact that he was sentenced to federal pound-me-in-the-ass prison for a property crime he committed as a juvenile.

Re:I'd love to see a breakdown of the damages

[jschottm]

That, and there's a chance he installed a keylogger and/or fed the password file into a cracker, so now you have to determine which other systems might be tainted as well and do an analysis of each one as well. Not what most IT staff want to spend their weekends doing.

Re:I'd love to see a breakdown of the damages

[Wavicle]

He said he broke in to use storage space. Are you going to take him at face value

Well said. You've got to admit, that is a ridiculous excuse. I suspect the reason his punishment was "harsh" (I personally find it light) was because the judge believed the guy was lying through his teeth.

When we compare the time, cost and risk required to store a movie (typically what? 700-1400MB for divx or 2000-3000MB for dvdr?) on another computer with the time, cost and risk required to store a movie on a $0.10 CD-R - I don't see how anybody would reasonably believe "storage" was anything approaching the truth.

CS majors breaking into government computers are giving the rest of us a really bad public image. We should lobby for harsher sentences for these *ssholes.

Re:I'd love to see a breakdown of the damages

[KUHurdler]

I suspect he wasn't storing them for himself. He was probably trying to make them publicly available on a high bandwidth server.

Wow...

[Flaming_cows]

6 months in prison because he was too cheap to buy a hard drive...

Re:Wow...

[mirko]

It should at least have been 6 months of collectivity-related work.
If the guy was technically decent, it's a shame he'd be sent to a federal fuckodrome... :(

Re:Wow...

[Trailwalker]

This isn't funny, its the truth.

"He's going to get to learn," Brown said. "There are other ways to live."

And he will find them.

Re:Wow...

[Anonymous Coward]

But it's like an anti-virus company hiring a virus writer. How can you be sure he won't crack stuff anymore? This guy's a moron, I wouldn't trust him and I don't think the gov does either.

Re:Wow...

[mirko]

You invented the ISO9xxx certification so that whatever this guys do could be traced if he's an insider... so use it or dump it if you don't trust it.

Re:Wow...

[asdfghjklqwertyuiop]

6 months in prison because he was too cheap to buy a hard drive...

It was the bandwidth he was probably after. He was probably setting up a place to exchange with others.

Re:Wow...

[the grace of R'hllor]

Warez boards make use of 'public FTPs', or directories with write access. Sometimes this write access is acquired through use of bugs or exploits. Then you upload your crap to the public FTP, post the address for people to use, and people will snag it for as long as it lasts.

There's a self-deterioration effect, though, since if *you* can write stuff there, other people can write stuff there too, and they can delete stuff, which is a lot quicker than uploading it.

Re:Wow...

[Detritus]

I had something similar happen to one of my systems at work. They filled it up with porn movies and used the site's large amount of bandwidth to distribute them to lusers all over the world. For months afterward, I could see unsuccessful attempts to download the files in the logs.

Re:Wow...

[matt-fu]

I had that happen on a system of mine. Someone had uploaded site mirrors of ideepthroat.com and suicidegirls.com and posted the URL to a message group. My log size tripled within a week. After taking it down I put up some midget porn in it's place for a week.

Bad movies

[Red Warrior]

Now if he'd just uploaded LOTR:ROTK instead of Legally Blonde....

Re:Bad movies

[bersl2]

Oh, so he has bad taste in addition to being a frickin' idiot?

Re:Bad movies

[JustinXB]

Chick in skirts vs hobbit: What would you pick?

Re:Bad movies

[bersl2]

If I want to see chicks on my computer, I'll get some pr0n thankyouverymuch.

Great idea

[Anonymous Coward]

Let's just download some movies. Oh wait, I've run out of space.

LETS HACK NASA!

Step 1: Download movies.
Step 2: ???
Step 3: HACK NASA!

Re:Great idea

[djsmiley]

If you dont mod this up you have gotta be as brain dead as the guy who tried it.

I mean seriously, parent is right. If you really really needed some space that bad, record some damn CDs?

Anyway how fast he manage to upload them? Surely it would of taken a few hours and STILL nasa took how long?

If your gonna hack someone for some space, why not try on a few of these v.cheap web hosting companys, i've heard enough people who tried this and ended up helping out the company, maybe even with jobs. (yes i know its an urban ledgend, but it really happened to my mate and the fucker put MY name on the site he "owned").

Peace out and watch out the whitehouse, some kids need space for their games...

Re:Great idea

[TFGeditor]

But where's the Profit? There's gotta be Profit. You can't have a 3-step program without Profit. Profit makes the world go 'round. We like Profit...oh, wait...

Re:Great idea

[knipknap]

Who has more expierience solving space problems than the NASA?

Re:Great idea

[wik]

Puns aside, don't forget that the Mars Rover had serious space issues on their 32MB flash volume that caused repeated reboots.

Re:Great idea

[myke113]

Isn't this the same organization who has lost 40% of their shuttle fleet, 50% on launch, 50% on landing?

Mmm. No.

[Ligur]

"It would be like clearing a sidewalk full of spectators with a fire hose so you can walk through it," said Assistant U.S. Attorney Greg Nyhus.
More like breaking into a bank vault to store the bicycle you just stole.

Re:Mmm. No.

[djdavetrouble]

yeah, yours is better and funnier. He should step down immediately !

****FOR IMMEDIATE RELEASE****

Longtime Slashdot.org member Ligur (453963) has been selected to replace Assistant U.S. Attorneey Greg Nyhus. Nyhus, although promising, proved unable to form relevent analogies in meetings with the press. Ligur, although not formally trained in law (a condition known as IANAL) is highly knowledgeable in general subjects, has excellent karma, and is frequently moderated to +5 funny.

Re:Mmm. No.

[autocracy]

I work for a fire department. I'd kill for a day when spectators were in my way and refused to move. After all, if you park in front of a fire hydrant, policy's to run the hose THROUGH your car. In a fire lane? We'll use your car as support for the ladder truck's rigging. Don't think it hasn't happened before.

Re:Mmm. No.

[dhilvert]

'More like breaking into a bank vault to store the bicycle you just stole.'

... or the set of encyclopedias you just copied.

Re:Mmm. No.

[neoform]

on a side note:

"It's not like firing up your Macintosh or your Apple where you push a button and wait six minutes for the thing to boot."

who has a 6 minute load time?! takes about 30 seconds. not even my G3 takes that long to load up OSX..

crackers

[Anonymous Coward]

"It took hours for technicians to find the problem, fix it and patch the system's security holes'"

That's so obviously the cracker's fault...

Re:crackers

[CK2004PA]

Yes it is his fault. Just like the guy who finds a way to disable home or car alarms, break in and steal stuff. Are you kidding me? You side with a criminal because the lock on some window wasn't good enough to stop a crowbar forced entry ? 6 monthes isn't enough, this caused far more damage than armed robbery and cost taxpayers more money than grand theft auto. I'd like to see what you think after someone commits a crime against you or a family member...we'll see you throw your "protect poor criminals because their cool" argument out the window. Hackers are losers who can't get chicks. Guys that protect us against hackers and clean up their mess, have chicks, thats why they need steady jobs. Moral of the story ? Get a girlfriend, loser.

Re:crackers

[Firethorn]

You side with a criminal because the lock on some window wasn't good enough to stop a crowbar forced entry?

What we're objecting to is the idea that part of the "damages" this thief is being charged with would be the installation of bars in the windows afterwords.

Sure, charge him for actual damages, such as cleanup & verification. But charging him for patching the holes?

Re:crackers

[CK2004PA]

No their charging him for re-formatting the drive and restoring from backup. This task is a must after a break-in on a government computer with possible national security data on it. So yes it is "clean up".

This is a good thing

[lorcha]

He was a cracker. He cracked and abused a system. He was convicted, and was given a reasonable and appropriate punishment.

This is how the system is supposed to work.

Re:This is a good thing

[bagel2ooo]

Can we find something more appropriate? The whole thing of having to come up with new labels for things just because they are online is silly and pointless. Is there not something like a vandal or other thing that is a stronger definitive that we can use for people who do this?

Re:This is a good thing

[downbad]

How is hacking a "secure" system any worse (or better)? This guy knew what he was getting himself into as soon as began to nmap NASA's IP range.

Re:This is a good thing

[jfonseca]

Yeah, you're right. Maybe he should have sold the secret to Bin Laden for 1 million bucks instead of showing NASA the secret.

Shame on NASA, they're the only ones to blame here. You know the US gov has a big problem admitting its own mistakes in the past 4.x years.....

Re:This is a good thing

[Frogbert]

A prison sentence? Why? He didn't pose any physical risk to society. Its not like people would likely be hurt should he remain on the streets with a hefty fine.

Hacking Vs Cracking

[Archon-X]

The age old terminology debate.
Cracking == bypassing software protection
Hacking == Bypassing server protection

Re:Hacking Vs Cracking

[MikeyVB]

Oh boy, this one again!

I disagree.

Cracking == Breaking or "cracking" any type of computer security, weather it be software or a server.

Hacking == Programing.

Re:Hacking Vs Cracking

[Flaming_cows]

Actually, that's not it at all. According to 'purists', hacking is a term used to denote someone who programs (e.g. hacking code is programming) whereas cracking is breaking into a system with malicious intent, although the term hacker has been demonized by the media and government (e.g. Kevin Mitnick's story).

Re:Hacking Vs Cracking

[Archon-X]

Sure, but that's kinda archaeic.
If you're looking at the current 'scene', cracking is software, and hacking is online.

Some people love to use these terms in their original definition, and I'd say that they're quite welcome to - have a gay time!

Re:Hacking Vs Cracking

[nkh]

But I don't care about the rest of the world. Even my teachers say "let's hack something to show you how this algorithm works". I don't need the rest of the world to spoon-feed me (remember this same rest of the world uses words like lol or a/s/l or even weather instead of whether, do you want to be like them?)

Re:Hacking Vs Cracking

[Archon-X]

Sure, I agree.
If you read those definitions, there are as many supporting ones as there are opposing ones. I guess it's more a case of the context, then.

Re:Hacking Vs Cracking

[WhatAmIDoingHere]

One guy around here, I don't remember his name, calls himself a "White Hat Code Wizard" to get around the Hack/Crack thing.

Re:Hacking Vs Cracking

[the_2nd_coming]

languages like VB are bastards and people who think they are programmers because they can use VB are idiots.

Re:Hacking Vs Cracking

[RobinH]

languages like VB are bastards and people who think they are programmers because they can use VB are idiots.

...and companies who write quick user interfaces in C because it's 1337 usually don't stay in business past year 1. Use the right tool for the job.

If the customer wants a program that collects a couple choices from the user on his desktop machine, writes it to a file and FTPs it off to some central server, I use VB. If they want a server program that processes 3000 100k files every hour, and might process more in the future, I use C.

If I want to do some offline batch processing of files to sort out some useable information, I use Perl.

If I'm programming a machine, I use ladder logic for manual mode operations and alarming, or flowcharts for sequence, or function block diagrams for data flow. Then I drop into structured text to parse the data at the string level.

Don't be the guy who only has a hammer and thinks all problems are a nail.

Re:Hacking Vs Cracking

[dustinc20]

I'm going to agree, hacking does not mean anything close to just a programmer. Programmer = programmer. Hacking and cracking are two different things, but hacking is NOT programming.

"I'm not a nerd! I'm a HACKER!"
"No, you're a programmer. Nerd."

Re:Hacking Vs Cracking

[the_2nd_coming]

just because I do not soil my self by using VB does not mean I only have one tool in my belt.

there are other RAD tools that you can use for UIs. why not use them?

Re:Hacking Vs Cracking

[ScrewMaster]

"Wrenches made out of anything but vanadium alloy are bastards, and people that think they're mechanics because they use wrenches made out of steel are idiots."

Do you use C#? Welcome to the world of VB, you pompous ass. Languages are tools, no more and no less, and part of being a good tool-using ex-primate is to know how to select the right tool for the job. I've seen C++ jocks spend a couple of weeks writing a GUI that could have been done in an hour in Visual BASIC, loudly proclaiming that VB "isn't really a programming language" and in complete denial all the way ... and yet you call all VB programmers "idiots". Amazing.

True programmers grow up and get past language bigotry early on. Something you'll learn eventually, after you get canned for inefficiency trying to pound that round peg into that square hole a few too many times.

Re:Hacking Vs Cracking

[nondeterminism]

I was always told cracking was "criminal hacking"... kinda rolls off the tongue even if it isn't true.

Re:Hacking Vs Cracking

[RobinH]

Because the customer's standard is .Net, and C# is an abomination.

Put these morons to use

[Timesprout]

NASA should be allowed use these idiots in their experiments. I'm thinking 'Effects on subject A when parachutes fail to deploy on capsule dropped from 50,000 feet' or 'Impact determination of Subject A foolishly slashing open his space suit in LEO" sort of stuff.

NASA could get valuable data, some small furry woonland creatures would be saved this fate and the world would have a few idiots less. Win all round scenario.

Re:Makes perfect sense!?!

[Anita Coney]

Could you please post your address, I'd like to show you how clever I could be at breaking into your house.

Policing our own

[TFGeditor]

Tacit approval of this sort of thing (cracking) paints us all with the same unsavory brush. If we do not start policing our own, the "geek/nerd" stigma will deepen. We are professionals, let's act like it.

Re:Policing our own

[Grey_14]

Stigma? I dont know about you, but I'm proud to be labelled a geek or nerd, and to take all that comes with that title.

Re:Policing our own

[back_pages]

Tacit approval of this sort of thing (cracking) paints us all with the same unsavory brush. If we do not start policing our own, the "geek/nerd" stigma will deepen. We are professionals, let's act like it.

Right, but I see you have a UID in the seven hundred thousands. You're new here! You see, you are absolutely correct - if we are professionals, then we should act like professionals. Unfortunately, the parent post is more correct - with the direction Slashdot has been going lately, I'm surprised that this wasn't posted under YRO.

Re:Policing our own

[Simonetta]

This young naïve fool should have just stood up and told the judge that he was working on a special secret project for national security and that he couldn't say any more about it.

Since the prosecuter wouldn't be able to prove him wrong, he would have gotten off and had the case dismissed.

Should this happen to you, I suggest that you try it. You have nothing to lose and every reason to believe that you can get away with it.

Re:Policing our own

[westlake]

You have nothing to lose and every reason to believe that you can get away with it.

Not a chance. The burden on the prosecution is proof beyond a reasonable doubt, you do not escape conviction by going into court with a defense that is laughably implausible.

Re:Policing our own

[SurgeonGeneral]

Actually, the judge directs the jury as to the posible defences that one might have with regard to the charge. A defence might be consent - NASA consented to the intrusion. There is the defense of lawful authority, however unfortunately for the original poster, the legal system DOES require proof. If you presented this as the only reason for your actions without proof, the jury would be instructed to ignore it and you would be left with no defense at all. An automatic finding of "guilty" would ensue.

Re:Policing our own

[Ahman_Ra]

isn't this purgery? And something funny to me, only 16 months for breaking into NASA? We have someone here in st. louis area that just got 9 years for getting into Lowes. Lowes the new home for undercover government issues now?

Maybe he hadnt checked pricewatch recently

[aardwolf204]

With hard disk space nearing $0.50 / gigabyte why on earth would you crack into NASA computers to store you movies?

Re:Maybe he hadnt checked pricewatch recently

[saider]

Because this happened 4 years ago when a typical hard drive could only store a dozen movies or so. And a 17 year old is unlikely to be able to afford a large drive (I don't know if he was working or not).

Re:Maybe he hadnt checked pricewatch recently

[the_2nd_coming]

awww.pooor 17 year old kid......

please. the kid was not looking for hard drive space.

Re:Maybe he hadnt checked pricewatch recently

[BlainTheTrain]

Not that I condone his actions, but he did this 4 years ago when he was 17 years old. I bet he could not afford an extra drive - I know when I was 17, I couldn't afford a drive big enough to play all the games I wanted to. Just my .02.

Re:Makes perfect sense!?!

[Flaming_cows]

At the risk of stating the obvious; hacking into NASA is not technological advancement. Furthermore, it's 6 months in prison, and some computer restrictions, they're not exactly branding him with a giant forehead stamp that says "DANGEROUS HACKER - DO NOT ASSOCIATE WITH OR HIRE, OSTRACIZE WHEN POSSIBLE".

Re:With the direction Slashdot has been going late

[kngthdn]

That's not offtopic, that's just funny...

Tip to future crackers...

[Anita Coney]

...who need hard drive space. Hard drives are VERY cheap nowadays! My god. How many movies did this guy have?!

Huh?

[Pheonix5000]

"It's not like firing up your Macintosh or your Apple where you push a button and wait six minutes for the thing to boot."

He must be talking about Windows ;)

Re:Huh?

[ejohnsty]

Yeah, I really loved that one...

Re:6 Month Sentence for NASA Cracker

[Nicholas Evans]

I do. With real world breaking and entering, you don't need to bring down a mission-critical server to reimage the driver for to ensure security. You just change the locks.

I don't know

[ElMiguel]

A prison sentence seems a bit excessive for what he did.

Re:I don't know

[nkh]

We want this "friendly geek" out of prison while we demand that spammers are put behind bars? This doesn't make sense...

Re:I don't know

[m50d]

Spammers cause me a lot more unhappiness than losing a bit, or even all of, my hard drive space would.

Re:Makes perfect sense!?!

[La Gris]

Lets switch the word "computer" to "lockpicking".

Lets see...

"Here we have a person that is very much talented towards lockpicking..."

Does a lockpicker know much how to build efficient locks actualy?

Does a computer security breaker know much how to actualy build secured systems?

Is that much different?

Well it's not exactly new....

[Anonymous Coward]

I well remember the days of downloading pr0n off of illegitimate ftp servers setup, on you guessed it, NASA computers. This was back in the day when 3 GB was a fantastic amount of data. And why yes it was busty asian pr0n.

Re:Well it's not exactly new....

[Lord Kano]

And why yes it was busty asian pr0n.

Like pennies from heaven.

LK

Re:6 Month Sentence for NASA Cracker

[Vellmont]

Yah, that's probbably pretty accurate. His sentence seems to be within the federal sentencing guidelines for criminal trespass. Check it out here
The sentence seems a bit much considering the intent of the crime (stupid attempt at finding DL/UL site), but not really unduly harsh.

Yes, your honor ...

[dhilvert]

... after the accused stole my $3.59 flowerpot, I had to spend hundreds of dollars putting locks on all of my doors.

Nice

[jmcharry]

Break into one government computer, go to jail. Break into tens of thousands of personal computers, ....

Re:Nice

[theTerribleRobbo]

... run successful spyware company.

Restricted access to computers -- has to change

[ckedge]

.
Herns was ordered to pay restitution for the damage he caused and will have limited access to computers for the next three years. After the judge outlined the terms of Herns' restricted computer use, Levine pointed out how hard those conditions will be for a man who does everything online, including paying his bills.

"He's going to get to learn," Brown said. "There are other ways to live."

The Canadian government has declared internet connectivity to be (I forget the exact term) a "necessity" or something.

If you rob a bank, do they forbid you from walking into any type of business establishment for the entire duration of your parole? No! It would be idiotic - everyone needs a bank account or groceries in today's society, and there are already tons of other perfectly good laws to deal with the individual should they commit a crime in a bank or other "place of business" again.

If you commit a traffic violation, do they forbid you from getting into any vehicle on any road? No! They might prevent you from driving, but they still let you get in as a passenger in other people's vehicles or take the bus.

Judges are going to eventually have to stop throwing out blanket "computer bans" as minor parole conditions - and realize that they have to handle it differently. PCs may/can be the basis of entire home entertainment centers, your library, your photo album, your telephone, etc etc.

What they should do (and what would be more effective) is to ban the user from say spending more than 30 minutes at a time on a PC, or making an IP connection to a class of third parties, or posessing any tools or software that could be used for illicit purposes - and then have the parole officers make unannounced audits and/or taps.

This goes along the lines of what kind of an effect would it have on you and your life if the police seized your computer in the midst of an investigation (not even an investigation into you, say your webcam caught some images of a crime). My PC is all of the things I listed above and more. And remember, saying "make backups" doesn't cut it, they always take your backups too and withholding those could get you in even worse trouble.

To put it another way - the police need to develop methods that don't "deny you use of your entire house just to check the window for fingerprints".

If they want to ghost the drive and look at the inside of the system before they leave, that's fine. But taking the entire thing for an indefinite period - unacceptable. (I'm talking about when I'm not the suspected murder or something :| )

Re:Restricted access to computers -- has to change

[codegen]

If you commit a traffic violation, do they forbid you from getting into any vehicle on any road? No! They might prevent you from driving, but they still let you get in as a passenger in other people's vehicles or take the bus.

Your analogy about cars is not even close. The ban does not stop someone else from using a computer on his behalf. He can go to the bank to pay his bills, and the bank teller will use a computer to pay the bills. Or he can use phone banking. You don't need a computer to live a full and active life. My mother and father do just fine thank you.

Judges are going to eventually have to stop throwing out blanket "computer bans" as minor parole conditions - and realize that they have to handle it differently. PCs may/can be the basis of entire home entertainment centers, your library, your photo album, your telephone, etc etc.

I think it is entirely appropriate. When you break the systems for others, the system should be broken for you. The punishment is much better than jail time and makes the point much better. Having been on the other side a breakin, it is not a lot of fun. Instead you often have no idea what is compromised. How much has to be reinstalled? Are any of the data files compromised? Compare them against backups? Have any of the files that have changed since the last backup been compromised? What happens if the system was compromised just before the last backup? Did that backup overwrite a previous backup and as a result you have no backup of the compromised data files? Has the system been used to break into another system? Is this the only one broken into, or are other system compromised?

Personally, I would be tempted to lock him up and throw away the key. But 3 years without significant computer access may be more effective and not as expensive as incarceration in a federal pen. Particularly since the lame excuse is that he was looking for storage for movies he had downloaded. Which means he would have to download them again from Goddard. Wouldn't it be more effective to download them again from the same place he got them in the first place? Or burn them to a DVD-R?

Re:Restricted access to computers -- has to change

[Lawrence_Bird]

IANAL, but if you do an armed robbery, you are unlikely to
be allowed to get a gun permit;

As you said, you might lose driving privledges under certain
circumstances. analogus to losing computer use. Unlike
your example of riding a bus, there is no practical way to
have somebody else do your driving on the PC for you.

A lot of damage can be done in 10 minutes, let alone 30.

What judges must determine is the intent. Was the hacker
intending to be malicious or intending to use a system not
his own for the commission of a crime? The case of
accidental 'breakage' should be treated differently, but
not given a get out of jail free card.

Personally I think the best 'sentence' for these type of
offenders is to be assigned to a domestic, non-combat job
for one of the military agencies. Restricted to base with
room and board provided but at least the tax payer gets
something of benefit out of it and maybe the offender will
learn some responsibility.

Re:Restricted access to computers -- has to change

[JustinXB]

The Canadian government has declared internet connectivity to be (I forget the exact term) a "necessity" or something.

The thing about that is no one cares about Canada, you damn hippie.

Re:Restricted access to computers -- has to change

[ChrisMaple]

or posessing any tools or software that could be used for illicit purposes

Such as a compiler?

Re:Makes perfect sense!?!

[Anonymous Coward]

That is precisely what the "Have you been convicted of one or more felonies" portion of the job application is about. The big thing he's got going for him is that he was 17 at the time and might be able to explain things away somewhat, but he won't even have the opportunity to find a job that matches his livelihood for three years -- and then his skills will be stale when he can.

"There are other ways to live", indeed. He's already had three or four years for the enormity of his crime to sink in, and now a few more of his career-making years will be pissed away flipping burgers for a lesson he probably already learned at 17. This is not to the greater good, in my opinion.

This just doesn't make sense

[WidescreenFreak]

I don't buy for a second that he was doing it to find space for movies. It just makes no sense at all.

Let's assume for a moment that all of his movies were DivX-encoded at 650 MB each, just for the sake of argument.

* Hard drives four years ago were still relatively inexpensive. By working at McDonald's part-time for three weeks or so he could have had a new hard drive.

* Even if he had so many movies that he required an additional hard drive, why could these movies not have been burned to CD-R instead? CD writers were available for less than $100 and CD-Rs could have been found for less than 50 cents a piece. He could have had virtually unlimited space as long as he purchased a new spindle now and then. (See afformentioned McDonald's reference.)

* Most importantly, what did he expect to do with those movies? Unless he had a T3 or something equivalent to his house, he would have had to wait hours to both upload for storage and download to view. I've had 1.5 Mb/sec DSL for four years, so I know that it would have been feasible back then, but it still would have been far less effort to burn them to CD-R. And at least then they would have been portable, far more so than a hard drive.

* Assuming 1.5 Mb/sec broadband, it would have taken almost an hour just to download one movie. So, he would have taken an hour to download, an hour to upload (at the VERY least since most broadband companies don't use the same upload/download speed), and another hour to download when he wants to watch it? Was he planning on installing a streaming media server as well?

* Why NASA? Why not find some schlep on his ISP who wasn't running a firewall, had lots of space, and store the data there? A Joe-Clueless-User would have been far less able to determine who was storing data on his system than NASA.

I'm sorry, but I just dont buy the "he was looking for computer space to store movies he'd downloaded" line. It makes absolutely no sense whatsoever. Sounds more to me like he was doing something nefarious and was hiding it or he was just looking for ego points and got nabbed in the process.

Re:This just doesn't make sense

[Grey_14]

Ok, Lesse here....

*Hard Drives Are Cheap* - Sure, but so are most University Students,

*Burning to CD-R* - No, Means the movies are inaccessable from anywhere else, CD-R's rot, and you are assuming they are 650MB DivX's, what if they were not? What if, (God forbid) he wanted a little quality in his movies?

*What to do with them?* You get a little confusing here, and are mixing points, (Connection speed vs portability), Whats more portable than a server online? with basically assured 24/7 uptime?, As well, assuming he's getting these movies still, and they are not JUST things he has, there are warez sites/irc groups with T3's out there.

*Why Nasa? Why not Joe Schmoe?* Because Joe Schmoe is slower, and likely to get taken out by a virus any given day of the week,

And yeah, I admit, He made a stupid choice going with nasa, he would have been better to take on a web hosting company or something, even a university, NASA is a little too high profile, so I'd say he was going for ego points.

Re:This just doesn't make sense

[ZorbaTHut]

No, it makes sense.

What he was doing wasn't just storing movies. It was storing movies in a place where others could download them. Having movies gives you points, but having movies on a really big internet connection and letting lots of other people download them gives you major points. Especially if you set it up as a trade system, so you *get* lots of movies and such at the same time.

NASA (like most companies) has lots of space on a big internet connection. There ya go.

Re:This just doesn't make sense

[Linker3000]

"CD writers were available for less than $100 "

No sh*t - I've just bought an NEC OEM 16x dual layer DVD+/- CD-R/RW burner for £36.00 ($70) from an online store. Hate to think what the profit margin was for all concerned.

Re:This just doesn't make sense

[khallow]

And the fact that it was NASA probably added to the alure.

Re:This just doesn't make sense

[gnovos]

Why NASA? Why not find some schlep on his ISP who wasn't running a firewall, had lots of space, and store the data there? A Joe-Clueless-User would have been far less able to determine who was storing data on his system than NASA.

You just have absolutely NO concept of what kind of wide-open whores the servers are at NASA. It's really quite shocking. It's difficult to even port-scan them without accedentally taking over thier entire network.

He was obviously incompetent.

[poopdeville]

The article mentioned that NASA technicians had to spend several restoring the system from backup. What did this kid do? He's either lying about his intentions -- he really wanted to cause damage -- or was just incompetent. Secretly keeping a few gigabytes on a big machine really isn't so hard. poopdeville

Really?

[lorcha]

Well, what do you feel would have been the appropriate punishment for breaking into a US Government computer system and using it to store illegally-downloaded movies?

It's not like it was 6 years or something.

Re:6 Month Sentence for NASA Cracker

[CK2004PA]

Insightful ? Wow, do you guys know anything about security? How about him leaving behind several trojan horses for his buddies? Yes you take the drive, especially if it has sensitive information, and incinerate it. Dumbass, this is national security we're discussing, not your quicken data.

Re:6 Month Sentence for NASA Cracker

[dosius]

What is cruel and unusual may vary depending on who you ask. For one, I would probably use monitoring to keep him off computers for several years. Some people would think that disappearing him is not cruel and unusual.

Moll.

Yeah - let's give the CS student a computer ban...

[CharonX]

I applaud the judge for his great insight - giving a Computer Science student a computer ban.

And 200k of damages? Er, did he delete research papers or something? (If he did, to make room for his movies, he does deserve it, though).
Sounds more like 200k to finally get their asses moving to fix some security holes, which were there in the first place.
He went into my house, through the big holes in my fence, climed through my dried-up moat, opened the door with the broken lock, and then stole my potted plant. It cost me a fortune to replace the lock, refill the moat and fix the fence.

Oh cry me a river.

[EvilStein]

I guess he should have thought about that before HACKING A BOX AT *NASA* for pete's sake - and to do what, use it for Divx movies?

This guy was an idiot and got what he deserved. Sorry. Perhaps he should have though first before compromising a piece of United States Government property.

Re:Oh cry me a river.

[lachlan76]

He is going to jail remember? FFS, isn't spending 6 months in a cage getting ass-raped on a regular basis enough punishment for uncovering security holes and embarrasing NASA, which is what this is all about?

Re:Oh cry me a river.

[Oligonicella]

"...for uncovering security holes and embarrasing NASA, which is what this is all about?"

Uh, no. Perhaps you aren't aware that breaking into government systems is illegal. Also, loading illegal movies onto them is illegal. It's about his being a criminal.

Re:Oh cry me a river.

[lachlan76]

If he broke into my computer, or some little workstation somewhere, he wouldn't be getting a punishment this stiff.

Re:Oh cry me a river.

[Class Act Dynamo]

You know what's ironic about the whole thing. He was breaking in to NASA computers because he did not have enough room to store illegal movies. Now some inmate is going to break into his prison cell because he needs to use this guy's butt to store a few things. I guess the punishment fits the crime.

Re:Oh cry me a river.

[m50d]

So anyone who commits any kind of crime at all deserves a prison sentence?

Re:Oh cry me a river.

[Jardine]

Well, you're not a government agency, are you? The "damages" he could have caused by breaking into Joe Shmoe's computer are a just a teensy bit little less than those caused by breaking into a large organization/government agency's, don't you think?

That's exactly the problem in computer crime cases. People are always being punished based on what they could have done.

"Your honor, upon searching the house of the accused, we found a substance that could have been C4 plastic explosive. Upon later analysis, it turned out not to be, but the fact that it could have been shows that the defendant is a danger to society."

Re:Oh cry me a river.

[zallus]

"Mr. President, upon searching the country of the accused, we found a substance that could have been WMDs. Upon later analysis, it turned out not to be, but the fact that it could have shows that the defendant is a danger to national security."

Re:Oh cry me a river.

[m50d]

What sort of idiot are you? The twit broke into a computer owned by the US Government. That's illegal. They don't care why you did it, or how you did it, or if it embarrassed anybody. You break in, you get caught, you go to jail.

Well, in this case it does look like they care if you embarrassed anyway. Because I'm pretty sure they wouldn't be giving a jail term if he hadn't. Yes, what he did was illegal. But should you go to jail if you're breaking the speed limit? Just because it's illegal doesn't mean he deserves jail time for it.

Remember - if you don't like the laws, it's your choice to live there. You can live anywhere that'll have you.

That's so ridiculous it's not even worth arguing with.

Harsh

[My Iron Lung]

This seems a little harsh to me, this computer science student not only has to spend 6 months in prison, but has limited use of computers for the next three years. This really stunts his growth professionally, but also puts a very black mark on his record when being considered by future employers. NASA should be ashamed of themselves for not discovering these holes themselves, as it is a strong likelihood that this 17 year old high school student didn't -really- know what he was doing (storing movies on NASA's servers? what?). And if he really did know what he was doing, it seems to me NASA probably should have hired the boy to hack them constantly and reveal more security holes that should be mended. Instead of ruining the kid's future. Just my two cents.

Re:Harsh

[the_2nd_coming]

dude... he broke the law!!!!!

what do you think happens when some one does that? he is lucky he was not put away like mitnic.

Re:Harsh

[Renraku]

Less competition for the rest of us computer guys that haven't been caught yet!

Re:Harsh

[JustinXB]

What the hell? He broke the law! And you want to give him an award, some money, a party, and a job? No, no, no. He did the crime, he can do the time! Criminals shall not be rewarded.

Re:Harsh

[xjerky]

"This really stunts his growth professionally, but also puts a very black mark on his record when being considered by future employers."

Um....that's the point.

Re:Harsh

[My Iron Lung]

All I'm saying is that NASA is weak. It pretends not to be, but it is. He was just a kid, and he was probably just playing around. None of us really know the full details here, so only assumptions can be made. I'm not talking about rewarding him, but it is definitely something that has happened before, companies actually going as far as hiring hackers to exploit their weaknesses. The punishment in place is strict. Where I come from, they wouldn't even try a 17 year old for that kind of bologna. True, it is NASA and a government institution.. but shouldn't places like this simply be more secure? In my opinion, it could have been a lot worse for them.

Re:Harsh

[Trapperdan]

All I'm saying is that NASA is weak, then by that rational we should not punish those that exploit the elderly with phone scams, because they are weak. I think they are trying to send a message with this judgement, and that is DO NOT mess with fed. I'm suprised the judgement wasn't harsher considering they could have made it worse under the blanket of national security/terrorism in light of the Patriot Act.

Re:Harsh

[flosofl]

NASA probably should have...(blah blah blah)... Instead of ruining the kid's future.

I hate to shine the harsh light of reality on your post, but NASA didn't ruin this kid's future. He ruined it all by himself.

Responsibility

[MichaelKaiserProScri]

Clearly he's responsible for any damage he did. But why is he responsible for fixing the security holes. He didn't cause them, but rather revealed them. Looks more like NASA owes him a consulting fee...

Re:Responsibility

[cdn-programmer]

I agree with you 100%. This is another case of shooting the messenger.

Re:Responsibility

[qw(name)]

I don't see how you can say that since his purpose was to illegally make use of someone else's assets. As someone else has pointed out, this is no different than having substandard locks on one's house. Just because someone can easily break into your house doesn't make the actions of the robber justified.

Saying that the robber broke in to store his couch in the basement just so he can point out the substandard locks is just stupid.

Re:Responsibility

[Eric604]

But he send the message unintentionly. There is a difference between (1) someone entering your house and telling you that your front door lock is broken and (2) someone that sneaks in and while secretly putting stuff in your basement wakes you up. Still I wouldn't trust the first person, why would anyone test front door locks?

Re:Responsibility

[m50d]

But if the robber breaks in and stores his couch in the basement, you can't charge him for the cost of new locks.

Re:Responsibility

[qw(name)]

That would depend on how good your lawyer is! ;-)

Re:Responsibility

[m50d]

Indeed. But this guy didn't break anything. Let's say they were using an old vulnerable version of (for example) ssh. If he had uninstalled this then they'd be entitled to charge him for replacing it. But is he's just taken advantage of a hole in it (as I suspect is the case) there's no way they should be able to charge him for upgrading it, as he hasn't made them any worse off in regard to the version of ssh installed, just aware that they've got a hole.

Wow, the word 'hacker' wasnt abused, for once

[nurb432]

Nice to see term not used improperly for a change.

Sure its just a pet peeve of mine, the mis-use of the term 'hacker', but it doesn't lessen the annoyance factor for me.

Re:6 Month Sentence for NASA Cracker

[Darkn3ss]

Seems to me like he was a smart guy who just had to come up with an excuse to justify what he was doing. I doubt he was really looking to upload movies to a NASA computer, it doesn't make any sense. If your internet connection is fast enough to get a movie from NASA in a few seconds, then chances are you have enough money to buy a few large harddrives. That kind of bandwidth isn't cheap!

Re:Yeah - let's give the CS student a computer ban

[the_2nd_coming]

umm, why not? the kid fucked up and broke the law using a computer.

it is the kid's fault that he thought NASA was a good place to store his movies.

Re:Makes perfect sense!?!

[jacksonj04]

Generally speaking, yes and yes. You can't pick locks without knowing how they work (it's not a matter of sticking a bent paperclip in and wiggling it around - trust me).

Likewise, you can't hack a computer as easily as you can in films. "login root" doesn't work in real life, but if you know how the security works then you can find a way around it, or patch the holes.

Who is "we"?

[ElMiguel]

I don't demand that spammers are jailed, even though they do a lot more damage than this guy.

Re:In space nobody can ...

[the_2nd_coming]

a 6 month sentence will likely be done in a minimum security prison since it is less than 3 years.

Re:Yeah - let's give the CS student a computer ban

[Jozer99]

They didn't have any chairs to sit on in the server room while they fixed security holes, so they made a big pile of money and sat on that, and it worked almost as well. After the whole fiasco NASA is now researching a new more expensive type of money that is more easily convertable to a sitting appliance.

Re:6 Month Sentence for NASA Cracker

[lachlan76]

If the admin has any idea what he's doing he'll be running tripwire anyway.

Nice of you to ask

[ElMiguel]

Well, what do you feel would have been the appropriate punishment for breaking into a US Government computer system and using it to store illegally-downloaded movies?

A fine. After all he only caused economic damage, and not a lot, either. The criminals in Enron caused incomparably more damage and I don't think many (or any?) of them will be put behind bars anyway.

Re:Nice of you to ask

[lorcha]

A fine? You think a college student is in a position to pay a $240,000 fine to make NASA whole? I don't think so.

And that stuff you said about Enron, I'll do you the favor of ignoring. You don't even know the first thing about Enron, what the damage was, and who (if anyone) went to jail as a result. How is that an argument?

Just to give you an idea, first realize that the executives at Enron are hiding behind a corporate veil and a metric fuckload of high-powred attorneys. Then realize that Enron is not over with yet. Also realize that DOJ is offering bargains right and left in exchange for testimony against Lay. Even with all that advantage, last I checked, there have been 2 convictions for 5 and 10 years apiece and Justice is by no means finished. Lay will probably die in prison.

Your little college student buddy got 6 months, and that's fair. If he broke into your house and used your kitchen to store his smelly rodent collection, what do you think his punishment should be? 6 months?

Re:SELinux

[david duncan scott]

No, SELinux is NSA's baby.

Cracking into NASA is one thing. You're up against propellor-heads and zoomies, nice people who think space is neat. Cracking into the NSA is a whole 'nother ballgame. Those folks are professional paranoids, and while they don't kill people, they certainly know people who do.

Re:My letter to NASA

[JustinXB]

What kind of moron are you? He committed a crime! He broke the law! You just want to let him off the hook? Great idea, then I'll hack NASA just for the hell of it and get off to! Great idea, dumbass.

Re:Makes perfect sense!?!

[Oligonicella]

THIS bullshit is insightful???

Perhaps thinking before committing one of those felonies would have done him some good.

Seventeen is plenty old enough to know good and goddamn well that what he thought of, planned, and executed was fucking illegal. If he didn't, then I sure's hell don't want him further educated in his abilities.

He and only he pissed away his career-making years. Tuff shit.

Re:Makes perfect sense!?!

[Oligonicella]

"yes and yes"

Bzzzt! Wrongo. What he said was...
"Does a lockpicker know much how to build efficient locks actualy?

Does a computer security breaker know much how to actualy build secured systems?

Building that effecient lock and secured system is about designing same, not about assembling components, ala Tinker Toy.

Also, you can buy books on how to pick locks and find bookoo info on exploiting security holes. Your straw just burnt up.

Fire Hose Justice

[handy_vandal]

"It would be like clearing a sidewalk full of spectators with a fire hose so you can walk through it," said Assistant U.S. Attorney Greg Nyhus.

Which is fine, as long as Uncle Sam is holding the fire hose, and rioting citizens are taking the splash -- and not the other way around.

-kgj

Re:Makes perfect sense!?!

[Oligonicella]

"Day after day, year after year, the elite in the government or media get away with crimes known to be crimes, and these same posters never say a word. "

Must be your first time on /.

Re:Makes perfect sense!?!

[PhoenixFlare]

Here we have a person that is very much talented towards computers, a person who knows a lot and a person who could potentially bring big innovations and discoveries to mankind.

No, here we have a first-class idiot that felt breaking into a NASA system to illegally use their storage space (likely to set up a public FTP full of pirated movies) was preferable to something semi-sane like buying another hard drive or server.

I guarantee you there's plenty of law-abiding people out there that vastly outclass this kid in terms of bringing "big innovations and discoveries to mankind."

Lets all beat the hell out of him before he unfolds something that should be kept hidden... Or better yet, so he never gets to be anything the 'general' public is...

What does breaking into a government system to store pirated movies have to do with what you're insinuating?

Is the 'law' still protecting the public or beginning to get in the way of technological advancement?

People manage to find, report, and fix security holes without unlawfully breaking into government computer systems. Imagine that, eh?

Not to mention the fact that, yet again, he wasn't trying to expose security holes, he was trying to save money by storing pirated movies on someone else's space.

Re:Kevin Mitnick

[cdn-programmer]

Yes - I see a lot wrong with this picture.

Kevin Mitnic hacked into Sun's systems and read some of the OS code. Before his sentance was up SUN OPEN SOURCED at least SOME of this code. Furthermore, Sun claimed millions in loses for this intrusion. Yet we can all see the sun is setting on SUN. The value is in millions of people having access to the source code so like a languge (english for instance) it can be used and improved apon and adapted to meet a wider range of needs. English for instance would have no value if it were locked up and used by a small group of preists... and this is what closed source is.

So the whole premise of Sun's claims against Mitnic are flawed right from the get go!

So yes, Kevin Mitnic is even a better example of punishing the messanger.

The judges in these cases should be embarrased with their ignorance. At least in the case of the Salem witch trials there is good evidence that their food was laced with Ergot, which is hallucenogenic... so they have an excuse. I cannot see much in the way of an excuse here.

If the judge ruled that NASA should simply fix its servers then perhaps people would wake up to the fact that when you connect a computer to the net, you need to accept responsibility to secure it. It is a fact that there are evil people in the world who will attack them and get in and perhaps create harm. Even if this kid or Mitnic was malicious, and there is ZERO evidence to support this, they should not face anything more than a small fine. They really did nothing more than what most teenage boys and some teenage girls dream of doing.

In the case of a bank, throwing the thief in jail is a deterant because the thief needs physical access. In the case of cracking a computer the physical access is to all people in the world and it occurs the instant it is connected to the net. There is no deterant in punishing one person because all the would be crackers are mostly invisible and often live in other countries... some of which are our enemies.

Any bank would consider it rather unacceptable to leave the door off the vault and place it in the parking lot with no supervision. As a customer I would not deal with a bank that does this. Yet on a daily basis many of the professionals I use regularly expose confidential data through their incompatence and unwillingness to hire competant IT professionals.

I stand by my original opinion. If NASA got cracked it was their own fault. They should punish themselves for their incompetance. They should not be punishing the messenger.

Furthermore the Judge in the case should recognise this and send the correct message.

'Find the problem'

[dhilvert]

'Herns told federal agents he was looking for computer space to store movies he'd downloaded. It took hours for technicians to find the problem, fix it and patch the system's security holes, officials said.'

What 'problem' is being referred to in this sentence? Does the reporter not have the backbone to take the most tentative steps toward investigating why unauthorized access had been allowed?

If a physical media copyright infringer had been habitually storing his wares in restricted areas of the Library of Congress, would the AP reporter have written, "It took LoC staff hours to find the problem, fix it and patch the library's security holes"?

Re:In space nobody can ...

[downbad]

not to mention that it'll be a federal prison, which is a walk in the park.

This cracker's biggest enemy = the KGB

[jfonseca]

Hey, if this kid got pr0n into these servers then foreign spies must have been using them for ages right under NASA's nose. Right now the KGB's of the world are insanely mad at this kid for showing NASA why they should patch a gaping security canyon.

6 months in jail and you make this kid an ex-con. He won't get a job anywhere decent, no credit, his chances in life even with a CS degree are 50%. The US has created another socially excluded propellerhead.

That's how inverted things are nowadays, and some here say this was fair punishment....NASA should be red-ashamed of allowing this kind of security hole open.

Makes you wonder if all the explanations we got for Challenger and Columbia aren't a pile of PR bullshit in the first place.

North Korea, Iran, anyone could have sabotaged these servers and all we get is the White House CNN pile of crap.

Gimme a break, free this kid, give him community service cleaning up spyware from gov computers and pay him the 200k for protecting americans against Al Qaida.

This judge obviously misunderstands the challenges of the 21st century. Ah, but so does the highest office of the US...

Re:This cracker's biggest enemy = the KGB

[jfonseca]

You do make some good points. But we're not talking about a criminal here. He broke into a gun store and hid some porn from his parents behind the balcony, he didn't grab one of the guns and went out shooting.....

Re:This cracker's biggest enemy = the KGB

[Jim_Callahan]

Uh... actually, we are talking about a criminal here... It's quite illegal to compromise government property in this fashion, I'd think.

It's not like NASA hired this kid to test their security. He enterd illegally. Had he done this with a physical building, and been shot by a resident, it would have been written off as a case of self-defense. There is not a whole lot of legal protection in place for trespassers.

Also, given your analogy, I'd say that expensive checks to ensure that none of the guns had been sabotaged are entirely in order, and making the criminal pay for them is pretty much appropriate.

when you know there is a bug...

[Fortun L'Escrot]

say a vulnerability is posted on the web and it happens to affect your systems. how much does it cost you to get your IT department to locate, fix, and patch the problem?

let's further assume that the party that posted the vulnerability is being purposefully uncooperative. but they agreed to get the vulnerability tested independently by a third party who also happens to be uncooperative. how much does it cost your IT department?

i havent got a clue. but 200k seems like a lot. it would seem that keeping a network secure is very expensive business. and i agree that this is true for physical installations, but digital? i mean seriously. unless of course you are over working your staff who also answer all the phones for tech support in-house making it impossible to manage their time or actually do the work they were hired for in the first place. but 200k for a bug? jesus.

i feel really bad for nasa. no matter what system you use there will be bugs and even when that is not the case a system can be badly configured. if each of these issues costs on average 100k (just a guess) to "locate, fix, and patch" can you imagine how much money is going into IT departments right now? or how much money is going into the IT industry? its like paying the plumber 4 times (just a guess) more than his already expensive rates (apparently there is a shortage of plumbers) and honestly believing that this is the way the world should work.

for crying out loud people. what exactly did this kid do? "shutdown -h now"? and it takes 15minutes to boot up? i mean sorry guys, but maybe you should be protecting your system a little better. i always tell myself. if a teenager can pull a prank like this one there are two things you should do. punish the teenager the way we punish any teenager for a prank like this (which they have sort of done). secondly, get some help securing your systems because a foreign nation will not be looking for space to store movies. they will be out there looking to cripple your systems and not necessarily permanently, 30mins could be critical for a crack squad tectical unit and if it is as easy as just shutting down a server......

ps. to be fair, it could be that restarting the system as part of their "locate, fix, and patch" program takes a lot of time (more than 10 minutes?). there again my friends i would suggest a better system to reduce your costs. this has nothing to do with me believing you shouldnt punish this guy. but quit posting damages that could have been avoided if you spent a little more time designing a better system that met your needs. if google can do it i am sure you can too.
if it takes so long to restart your system even during normal maintenance then build redudancy for your production environment. if this is really just about your personal inconvience then remember you are a plumber and that crap cloggin the pipe is your job.

Re:Makes perfect sense!?!

[jfonseca]

Bits and bites are replaceable. Your front door isn't. In this type of situation it is NASA that should be punished, and this kid given community service for showing NASA that Al Qaida could have been using this for who knows how long unnoticed. You can't use real-world reasoning for digital crimes. Digitally robbing something does not take it away from the owner, it is a copyright and intellectual property issue, not a regular crime. I posted below : if this kid got porno into these NASA servers just imagine what Al Qaida could have been doing....

Wow

[Nimey]

I'm impressed that some rising-star prosecutor didn't get him sentenced to eight years of hard time. Maybe the system still works here and there.

Rational thought from a teenage mail?

[skoda]

You expect a teenage male in high school to use such a rational thought process?

Are you from a different planet?

Re:Makes perfect sense!?!

[Caiwyn]

"Here we have a person that is very much talented towards computers, a person who knows a lot and a person who could potentially bring big innovations and discoveries to mankind."

Yeah. And someone who wasted that talent on downloading movies and breaking into NASA computer systems.

Do you have any sense of proportion, at all?

Re:6 Month Sentence for NASA Cracker

[aurispector]

What's the difference if you destroy my property by coming into my house and wrecking something versus doing so electronically? You argument seems to be that it's nasa's fault for not having perfect security. A lock or a firewall is only as good as the guy who's trying to defeat it. Is it my fault if someone robs my house because I "only" use a deadbolt and not a jimmy proof steel door? If the INTENT is to illegally enter someplace they don't belong, then it's no different from someone using your garage to sell pirated DVD's. Server space and bandwidth isn't free.

I'm a bit surprised my original post got rated flamebait but then again I'm not really in favor of flogging. It's not severe enough of a punishment.

Re:Yeah - let's give the CS student a computer ban

[WoBIX]

So by your reasoning, if someone can get into your house and clean it out, then it's your fault.

What's your address?

Sorry officer...

[eMartin]

...I only broke into this back yard to bury these dead bodies.

He was obviously in an FXP Group..

[J-B0nd]

Some of the comments here refer to why he would hack into a system to store his movies when disk space is so cheap. The answer is speed. NASA most likely has a fast connection to the internet. This guy was part of a FXP group, so what happened was that when a new movie was released, he would FXP the movie from a distro server to this NASA ftp, and then give other people in his group the login to the NASA ftp. Other s would do the same for him, so they all got new movies without all of them leeching off the original distro servers.

Give the "damages' cost to the hacker

[Simonetta]

If the government is serious about fixing problems in supposedly secure and sensitive systems, then they should reward not punish people who find holes.

Instead of going to the courts with a trumped up case about supposed damages in hundreds of thousands of dollars, they should give hundreds of thousands of dollars to the people who document holes in the security of sensitive systems.
And tax-free, too, if you please.
And give this kid the job of special intern for security at a decent salary. Loyal Americans and allies of the American corporate empire should be rewarded for tracking down, finding, and documenting security problems.
Suppose YOU found a hole in some NASA computer that allowed you to endanger a shuttle launch or mission. Suppose that if you took it to NASA there was a good chance that you would get thrown into some secret third-world hellhole prison like Guantanamo with no release or no record of your imprisonment. This might happen if you're Muslim instead of being some 18-year-old, rich, white, suburban, Computer Science community college student harmless geek.
Suppose that you mentioned your discovery to someone at the mosque and they came back a month later with an offer of several hundred thousand dollars for all the details on how to blow up a NASA mission along with a new identity and citizenship to some quiet Muslim community in a country not monitored by the FBI.

What would you do?

There are holes in every major on-line computer system. It is better that we have our geeks get rewarded for finding and reporting them, rather than have our enemies find them and use them to kill our people.

In other words, Homeland 'Security' agents, stop putting harmless hackers in jail for finding weaknesses in your chickenshit computer security systems.

There's a good chance that they didn't tell you everything that they found out about your pathetic security systems, and they won't be 'harmless hackers' when they get out of an American prison.

Dumb schmucks!

Re:Give the "damages' cost to the hacker

[_Sprocket_]

Instead of going to the courts with a trumped up case about supposed damages in hundreds of thousands of dollars, they should give hundreds of thousands of dollars to the people who document holes in the security of sensitive systems.

Perhapse you should go back and re-read my post. Especially pay attention to this part:

It shows a inappropriate focus on funding. All IT budgets are stressed. NASA is no different, and perhapses even more thinly spread than others. That means infosec activities tend to get cut in favor of other IT activities. Yet there is no perceived issue in later spending considerable resources to prosecute each infosec incident.

The money isn't there. It's not like NASA doesn't know what it needs to do, nor has any access to individuals that can provide that information. Its simply an issue of having the funds with which to pay people to do the work.

The only caveat to that is one of policy. Some centers are more infosec aware than others. As such, anyone who tracks this kind of thing will notice a difference in the frequency of compromises from Center to Center. So even if the proper funding existed, it wouldn't be the silver bullet solution in all cases.

There are holes in every major on-line computer system. It is better that we have our geeks get rewarded for finding and reporting them, rather than have our enemies find them and use them to kill our people.

Taking that one step further - it is even better to tighten up those systems in advance that it takes a considerable adversary to take advantage of those holes instead of the random budding geek kid. The current system that prosecutes some kid for what is a technically somphorish act years after the fact does little to remediate the situation, bennefit the future of the kid, nor does it help society in general.

Re:Give the "damages' cost to the hacker

[krbvroc1]

If the government is serious about fixing problems in supposedly secure and sensitive systems, then they should reward not punish people who find holes.

So according to your logic, the 19 hijackers on 9/11/2001 should be rewarded, not punished? If the governemnt and airline industry was serious about fixing problems in in a supposedly secure and sensitive transportation system, then they should reward not punish people who find holes.

Part of the problem with your logic is that you somehow possess a 'crystal ball' that lets you devine a 'harmless hacker' from an intrusion designed to damage. You all you know the 'I'm just trying to get storage for my movies' is a cover story for an espionage assignment. In any case, I don't recall someone approaching NASA and advising them of the hole--he was caught after the fact. In fact there was no altruistic motive here, he was trying to store his warez / pirated movies.

Re:Give the "damages' cost to the hacker

[Infonaut]

Suppose YOU found a hole in some NASA computer that allowed you to endanger a shuttle launch or mission.

This presupposes that rummaging around inside a NASA system is somehow a virtuous activity. You don't accidentally find security holes when you're downloading pictures from the most recent Mars Rover mission. I don't buy the notion that somehow if while you are probing the defenses of a US government computer system for your own reasons (curiosity, sense of achievement, whatever) and you find a vulnerability, that makes you a stand-up citizen.

It's extremely easy to see NASA and other government agencies as being filled with incompetents, but most people who have never worked in government don't understand the competing pressures operating in such an environment. Time is tight, money is tight, politics is involved, and in government you can't just use money as you please. It makes for a torturous decision making process and an environment in which change comes slowly and only after great effort.

Now imagine that you operate in such an environment, and on top of all that you have people constantly trying to crack your systems. If you're an IT person at NASA, you don't care what the motivation of these people is, because it is making your already difficult job just that much more painful. You don't have a crystal ball, you can't read into someone's mind to find out if they have the intention of exposing these holes for the good of NASA, or they are just trying to get free hard drive space or perhaps some information they can sell to someone.

Not all geeks believe that snooping around in government systems is ethical, let alone useful for the government agencies affected by such behavior. If someone came up to your house at night with infrared goggles, snooped in all the windows, tried all the locks, tried wiggling the bricks in your chimney and watched your front door to find out when you'd left, would you be so sanguine?

Prison Rape

[lorcha]

Prison rape is not a laughing matter. It is a serious problem that needs immediate attention.

A 6 month timeout to think about what he did is very appropriate. The Circuit City credit card crackers got like 10 years! That is way out of whack. But 6 months seems fair to me.

As far as the worst thing I ever did? I stole a bunch of shit from a house that was under construction. It was insecure, as you say (no doors or windows yet). I felt bad about it and give the shit back a week or so later. Kids do dumb things. That's the worst thing I can think of at the moment.

"looking for computer space to store movies"

[motherjoe]

The IT staff will probably be enjoying Mr. Herns, "Donations", for quite some time.

Re:In space nobody can ...

[the_2nd_coming]

umm... federal prisons are better maintained, but they are hardly walks in the park. go visit one and tell me that you would love to be locked up in one of those places.

Re:With the direction Slashdot has been going late

[theM_xl]

But it IS posted under YRO. Well, it shows up there at least. That's where I came from.

Re:Makes perfect sense!?!

[westlake]

Digitally robbing something does not take it away from the owner, it is a copyright and intellectual property issue, not a regular crime.

If the laws defines you actions as a felony or misdemeanor, you do the time, just as you would for any other crime.

Dilbert Theory...

[lxt]

...you never know - these idiots might follow the Dilbert theory, and get promoted up to the top of the NASA chain of command...they might move on to government next, and who knows what might happen.

Oh, wait.

Re:Makes perfect sense!?!

[devnull17]

That's retarded. Does it look bad for NASA? Definitely. But does that absolve the kid of what he did? Absolutely not. You can't even make the case that he was just trying to expose a vulnerability, because he didn't try to contact them about it. It was for personal gain, plain and simple.

I consider myself to be pretty skilled with computers, and I don't doubt that I could probably break into systems like this if I tried. Of course, I could also probably successfully conduct a bank robbery if I tried. The point is that I don't do either, because it's illegal and I'm aware that there are serious consequences.

Also, the line that some people tend to draw between the real world and the digital world is not as thick or as clear-cut as you seem to think. The technician that had to clean up the mess was being paid with--guess--that's right, real tax money. My money, and probably yours, too. Not to mention the fact that every time NASA launches a shuttle, peoples' lives are at stake. And if you think that innocuous, seemingly unrelated incidents can't cause serious system-wide problems, then you obviously haven't done much debugging.

What the kid did was wrong. You know it. I know it. And in this case, I think that the punishment is quite adequate. In six months, he can get out and get on with his life. In the meantime, perhaps it will deter someone equally foolish from making the same mistake.

Re:Makes perfect sense!?!

[lowe0]

Or perhaps we could send a message to other bright, talented individuals that the rest of the world's computers are not their own personal scratch disks.

Besides, just because the guy can exploit a few security holes doesn't make him Albert Fucking Einstein. He's not a genius or a hero; he's just a guy who doesn't understand the idea that you don't just help yourself to others' property because you don't want to pay for it yourself. I mean, he stole storage, for God's sake - yeah, not like you can't get that off the shelf at any fucking CompUSA in the country.

Re:how 'bout we drop "cracking" alltogether?

[Archon-X]

Forgive my crack-induced haze, but what about the scores of groups of crackers, who call themselves crackers, and who crack software protection.

Oh, and the websites distributing these cracks.

And the fact that it's commonly accepted, by anyone who isn't
a) a pedantic /. troll
b) anyone who knows a grain about cracking

Delude yourself, fine, but accept that some of us work in the real world.

This is ridiculous

[i41Overlord]

If I really wanted to make the shuttle go boom, why would I honestly tell you that and get myself into more trouble?

How the hell is he going to blow up the Shuttle by hacking one of their systems? Statements like the one you just made are absolutely ridiculous. If NASA somehow set up their launch system so that you could blow up their rockets from the Internet, that would be ultra stupid and border on criminal negligence.

It seems that everyone wants to be the first to make doom and gloom "the sky is falling" type statements.

Also, if you've ever followed lawsuits, and I'm sure you have, you'd know that over-inflating damage estimates is the norm.

Re:This is ridiculous

[Twanfox]

It is called an example of the extremes. Basically, in terms that you would be more comfortable with:

If I went into NASA's systems to commit a crime that would land me in jail for decades, why would I tell you that and not something that would only put me away for 6 months?

Does that sound better to you?

Frankly, I have no clue as to what is possible in NASA's computer systems. Suppose that he had hacked into a ground guidance system while a mission was going on (if that's even possible)? It should be obvious at this point that the shuttle can be destroyed on reentry by something as stupid and simple as ice-encrusted foam that damages just a few tiles. What would happen if the angle was too steep into the atmosphere and the reentry velocity was too fast? How about if they were off on landing by just a few degrees? That thing handles like a falling brick with wings and if it doesn't come down just right, it may not come down in one piece. I would just hope that NASA's critical systems are on an isolated network not connected to the internet in any way. Whether that is the case or not...

In this case, I do not feel that 'damage estimates' that are putting him in jail for 6 months and restricting him from Computers for 3 years necessarily over-inflating. He broke into a someone else's computer system. If he was honestly that stupid to be looking for storage space for movies when DVD burners are cheaply available, than he needs to learn a reason why that is bad. This punishment seems as good as any.

He was 17 people!!!

[syousef]

Did anyone RTFA and realize this guy was 17 at the time? Yes he committed a crime and a crime is a crime but this isn't murder we're talking about people. This is a 17 year old nerd who did something stupid and is going to end up in jail for it 4 years later..

Yes at 21 he'll be going to be going to a federal prison where he can learn to be a real criminal. He's also being restricted in his use of computers for 3 years so he'll have to find employment in something else and cope with his computer addiction no doubt. He's bound to become bitter about it after 6 months of prison life and is going to be very likely to break the terms of his 3 year ban.

This is shear madness IMHO.

Re:He was 17 people!!!

[RzUpAnmsCwrds]

" Yes he committed a crime and a crime is a crime but this isn't murder we're talking about people. "

And he's not going to prison for 40+ years, either.

Re:He was 17 people!!!

[syousef]

And he's not going to prison for 40+ years, either.

You're right. 6 months is just long enough to be buggered blue, and gain enough exposure to the criminal element to become a criminal for life. Then once we've done that let's unleash him on society, just for fun.

Re:He was 17 people!!!

[SI285]

At 17 your old enough to know better...

Re:He was 17 people!!!

[syousef]

At 17 your old enough to know better...

I suppose at 17 you never did anything stupid and your judgement was perfect huh? You're either a very uncharitable person or you're doing this to stir. Either way end of conversation.

Re:He was 17 people!!!

[SI285]

No, I made plenty of mistakes but I was taught to respect other people and their property, consequently I only caused problems for myself because I was held accountable for my actions, and I learned from it.

Suppose his actions caused financial harm to You? Would you be so willing to let him off easy?

Not holding people accountable for their actions sends the wrong message. I hope his sentence deters other from trying the same thing.

Re:He was 17 people!!!

[syousef]

Suppose his actions caused financial harm to You? Would you be so willing to let him off easy?

I'd want him punished but I wouldn't want him raped nor would I want him to associate with criminals and become a hardened criminal. How the hell does this make things better for those who were harmed financially? This is NOT the way to punish him. Society is cutting off its nose despite its face.

Re:He was 17 people!!!

[SI285]

The fact is;
Breaking into something whether it's a house or a computer system is a CRIME!!! He was convicted of that crime. That makes him a CRIMINAL... He committed this crime to store illegally reproduced copyrighted material! Another CRIME!!!

I don't buy your assertion he will be raped, do you think everyone who goes to prison is raped? What do you base this statement on? If he is that much of a babe in the woods he'll get protective custody and spend time with other first time offenders and not the hardened criminals you speak of.

People must be held accountable for their actions as a detterent to the next person contemplating the same behavior. Seeing this they just might say "it's not worth it if I get caught".

Re:He was 17 people!!!

[syousef]

You're very naive if you think the authorities are going to place someone in protective custody with other first offenders when they go to prison. Prison systems world wide are rife with crime and corruption.

Also you'd be surprised how many crimes you commit every day.

Re:He was 17 people!!!

[SI285]

Plese tell me what makes you an expert on the US prison system!!!

We are not talking about prison systems world wide, we are talking about the Portland Oregon prison system. Again I ask you, What makes you an expert on the Oregon Prison system? Did you research the subject? If so post your results so I can understand... You make these statements of rape and abuse and offer nothing to back them up. Is the US prison system perfect? NO, But it's seems to be the safest/cleanest place to be jailed when compared to other countries.

He has a family doesn't he? Don't you think they will make sure he is treated correctly? If I were them I would, and if I saw abuse I would notify the authorities and then go to the media if it was not corrected.

Yes I do break the law, I drive too fast. The reason I drive fast is because the penalty is a small fine and a slap on the wrist. If the penalty was an overnight stay in jail I would not speed anymore...

While I don't agree with your opinion I do respect it, really.

Re:He was 17 people!!!

[syousef]

I am not an expert on any prison system. Nor am I naive enough to think its a fair just system where your family can make sure you're treated well.

Re:He was 17 people!!!

[SI285]

Don't you be so naive... You want a perfect system of justice and punishment. Well I got news for you...it's not going to happen. Not when one group (the guards) can exert so much control over another(the inmates).

The best anyone can ask for is for an "adequate" system of checks and balances which includes the family and media so the police don't end up policing themselves.

It's far from perfect but I'll bet it's a heck of a lot more than what people in other countries may have.

If you're so down on the justice system then why don't you do something to improve it instead of sitting on your butt arguing with me? Are you involved with any advocacy or watchdog groups?

If you feel that strongly do something instead of complaining...

Re:...or NASA is being cautious?

[poopdeville]

Perhaps. Frankly, I don't see why NASA would make such a big deal out of a minor intrusion like this unless it was obviously malicious. NASA rarely handles classified aerospace projects anymore (and wouldn't be networking a machine with access to classified information) and in fact rents out time on their supercomputers. Considering the cost of storage -- even then -- stealing a few gigabytes amounts to petty shoplifting.

I'm with you

[DesScorp]

I think they should peel his flesh, baste it in a nice barbeque sauce, and make him eat it.

Btw, I love your sig

Re:Yeah - let's give the CS student a computer ban

[burns210]

The kids hacked into a federal agency. That alone needs to have a significant bitch-slap associated, it doesn't matter to what end he took it, there needs to be a minimum ass kicking when you hack into the federal government.

If the kid was smart enough to hack into a server(s?), he is smart enough not to do it with federal equipment, as their are thousands of just as vulnerable and lower-profile systems out there.

The kid is an idiot for doing this, he deserves a good punishment. He brought it on himself.

What??

[vwjeff]

If he broke into my computer, or some little workstation somewhere, he wouldn't be getting a punishment this stiff.

How can you even make this comparision? This guy broke his way into a government production system. I don't think your workstation or mine has millions of dollars worth of data that took years to obtain. Since this was a government system we all pay for his dumbass actions. He should go to prison for 6 months and pay $200,000 in damages.

(In prison he should be cell mates with Bubba.)

Re:What??

[lachlan76]

millions of dollars worth of data that took years to obtain

Well, if they have millions of dollars worth of data on a system, and didn't back it up, then they're getting what they deserve.

Re:What??

[lachlan76]

For all you know, he might have turned himself in.

Re:Makes perfect sense!?!

[Gopal.V]

IANALP (*cough*) , but I guess a lock pick expert would know what other lock pickers can easily pick ?.

I am a part-time sysadmin at office and I'm pretty much the best cracker around as well. I therfore know how another cracker would go about breaking in and can take pre-emptive measures. I also know how vulnerable/unsafe these things are , so I take special steps for physical security and access to the box.

It takes a computer security breaker to "ensure" that the system is unbreakable to his talents. He's a unit test case ..

Re:Makes perfect sense!?!

[SurgeonGeneral]

This is not to the greater good, in my opinion.

Contrary to what people might think, lawyers have long ago decided that the purpose of law is not for the greater good. That is properly the realm of politics. The head counters in office create the laws, and lawyers interpret and apply them.

It falls to the legal community to maintain the rights of all and determine when conduct falls outside the sphere of protected liberty and causes harm to someone else. The boy committed an offense, and to give him any less of a punishment than any other person in a similar case recieved would not only be an offence to all those people, but would fly in the face of the fundemental principles of liberal democracy, namely EQUALITY BEFORE THE LAW.

Completely fuzzy terms

[RedLaggedTeut]

It took hours for technicians to find the problem, fix it and patch the system's security holes. - now what does that mean? Did it take them 2 hours? 180 man-hours? 0.05 hours?

MOD PARENT UP

[iammrjvo]

Thanks for putting it so well.

Correct me if im wrong

[g0bshiTe]

But the article said the crimes happened in 2001. It's now 2004. Why did it take this long to either A) find out who did it? or B) prosecute him? Also at the time he was 17 which means he was a minor and subject to punishment as a minor. Seems a slap on the wrist 6 months and resitution, compared to Mitnik.

Some Background (This was not his first "mistake")

[Anonymous Coward]

The reason he was in the alternative school was the the first time the same federal agents arrested him. He was using stolen credit cards to get stuff delivered to vacant houses.

Since the feds do not prosecute minors normally, he was handled by the state/local system.

The second time around they are not so nice (actually I thought he was over 18 at the time of the second arrest).

Getting caught does not make you super-bright! He might or might not have had any real talent for cracking, but he sure has the mindset for committing crimes.

His prior(s) are not reported in the AP article, and the judge might not have been allowed to consider them, but the investigators knew him personally, so the prosecutor would have been more motivated.