Judge Refuses To Convict Hacker

Jake96 writes "A judge in Wellington, New Zealand, declined to convict a man who ran an unrequested security audit on a bank's phone systems and was charged with 'intentionally accessing a computer system knowing he was not authorized to,' according to an article in the New Zealand Herald."

Comments

Can this set a precedent here in the States?

[defile]

I hope so.

Re:Can this set a precedent here in the States?

[Anonymous Coward]

Stupid court results?? I thought that was the norm in the US so why would it set a precedence?

Maybe you should read what this guy actually did. he intruded into a banks phone system (without permission), performed a security audit (again without permission), and then tried to get the bank to pay for his work. If I was the bank I would be taking this bastard to court too. how would you feel if someone turned up at your house did some work then sent you a bill all without you requesting anythign be done. The fact that the bank has a security issue is a side note here, they should be hiring a "reputable" security firm to look at there systems.

Re:Can this set a precedent here in the States?

[joe90]

Actually, it's a bit more serious than that. The bank http://www.rbnz.govt.nz/ who's phone system he compromised is an approximate functional equivilant of the US Federal Reserve http://www.federalreserve.gov/ (but quite a bit smaller).

He's very lucky he did it in NZ where it appears that the courts consider him stupid rather than malicious. In other countries he might get charged with terrorism related offenses or worse.

Re:Can this set a precedent here in the States?

[Fordiman]

He committed no intentional crime. He was identified a security flaw, and provided this info to the bank before asking for money. Sure, it's a little like the guy who washes your windshield at a sopt light asking for money, but it's far from dishonest.

If the bank were a computer company with the present mindset, the bank would get to work on fixing the problem, and he'd have been ignored when he asked for cash, rather than prosecuted.

Re:Can this set a precedent here in the States?

[Typhon100]

Except that instead of washing your windshield, he got into your car, pulled down your pants and gave you a rectal exam.

You don't "unintentionally" hack into a bank's phone system.

Re:Can this set a precedent here in the States?

[Fordiman]

You don't 'unintentionally' wash someone's windshield, either. But guess what: indications of a vulnerable system are about as easy to see as a dirty windscreen, if you're looking. No invasion necessary.

Now, quick question, when did I use the word 'unintentionally' in my post, as you seem to be implying?

Re:Can this set a precedent here in the States?

[networkBoy]

Maybe not a bank, but I got very bored one day when talking to Delta Airlines phone computer.
I started saying random gibberish and various swear phrases backwards "uoy kcuf"* and such. Ended up accessing some maintenance subroutine or such that seemed to have the ability to list all prompts by menu tree. Likely could have gotten farther, but I really was trying to book a flight so I hung up and started over.
-nB

I love WAV recorder. It will let you reverstethe WAV and play it back. Learned everything backwards by wrote. Damn difficult.
-nB

Re:Can this set a precedent here in the States?

[Fordiman]

Never mind, found it.

In TFA, he states that he wasn't aware it was illegal. Hey, funny that; he didn't intentionally commit a crime!

So, yeah. He intentionally probed a vulnerability, and reported his results, then asked for compensation. Stupid, businesswise, but a very reasonable way to go about things. It happens all the time in the software world, and there's a lot less money to protect there. You'd think a bank would welcome the info, and the suggestions on how to repair the issue.

Re:Can this set a precedent here in the States?

[Schraegstrichpunkt]

Except that instead of giving you a rectal exam, he molested your daughter, exploded your favourite hockey team's home town with NUCLEAR WEAPONS, and stole your glasses.

Care to provide any justification for why your analogy isn't just an arbitrary construction designed to suit your position?

These are information systems. Not cars, not windshields, and not the doctor's office. Discuss the actual question, not stupid analogies.

Re:Can this set a precedent here in the States?

[8ball629]

It's just like stopping at a red light in downtown Detroit or Chicago, getting your windshield cleaned by some bum and then him sticking his hand in your window asking for money when all he did was smudge your windshield without your permission.

...Except in a larger, more complex way.

Re:Can this set a precedent here in the States?

[Zooka]

''He committed no intentional crime. He was identified a security flaw, and provided this info to the bank before asking for money. Sure, it's a little like the guy who washes your windshield at a sopt light asking for money, but it's far from dishonest.

If the bank were a computer company with the present mindset, the bank would get to work on fixing the problem, and he'd have been ignored when he asked for cash, rather than prosecuted.''

I don't want someone evaluating my security unless I ask them to, just as I don't want anyone ''washing'' my windshield unless I ask them to. Both are trespasses. That being said, I suppose that if there was a strong case that the hacker's intentions were purely honorable (if he was unlikely to be attempting extortion), then perhaps I wouldn't want to render punishment that could have a devastating impact on their life. But given this man's past criminal record, (even if his record has been clean for the past 10 years), I would not have been so lenient. The severity of the punishment I'd render would depend upon factors such as how aggressively he demanded payment. Anyhow, I don't think it's safe to say his intentions were ''far from dishonest'' after only reading the article (which is clearly light on details).

Re:Can this set a precedent here in the States?

[Dahan]

Now, quick question, when did I use the word 'unintentionally' in my post, as you seem to be implying?

Well, you never explicitly used the word, but the first sentence of your post is, "He committed no intentional crime," which implies you think he did it unintentionally. Lots of implications going around here, huh?

Re:Can this set a precedent here in the States?

[Anonymous Coward]

Can this set a precedent her in the States?

How is the US Constitution bound by NZ laws? Is there some treaty that says that when a NZ judge issues an order, US courts have to follow? No? Then US courts won't care.

It shouldn't be surprising that in every federal judge confirmation before the US Senate they always ask prospective judges whether they think laws made by foreign judges (not international law, just individual foreign court rulings) can be used as a precedent. It is a GO/NO GO question. The common answer is that if US courts accepted individual foreign court rulings as precedent, they could pick and choose one to their liking since there are so many varying laws and courts around the world. In that case, US citizens would be subject to laws that were never debated or approved by Congress. This would be judicial tyranny.

Re:Can this set a precedent here in the States?

[Darby]

It's just like stopping at a red light in downtown Detroit or Chicago, getting your windshield cleaned by some bum and then him sticking his hand in your window asking for money when all he did was smudge your windshield without your permission.

Dealt with that situation at least a dozen times.

If *once* my windshield was ever left cleaner then when he started, I'd probably throw him a Hamilton just for the novelty.

Re:Can this set a precedent here in the States?

[montyzooooma]

"He's very lucky he did it in NZ where it appears that the courts consider him stupid rather than malicious. In other countries he might get charged with terrorism related offenses or worse."

Can anyone point to an example where "other countries" doesn't just mean the US?

Re:Can this set a precedent here in the States?

[Fred_A]

I just remove my windshield. The look on their faces when they try to wipe it is worth it.

Re:Can this set a precedent here in the States?

[8ball629]

Agreed, they could atleast use a cleanser or some kind instead of dirty gutter water, hehe.

From the looks of your sig, you may enjoy this mostly liberal site.

Re:Can this set a precedent here in the States?

[Kijori]

Actually, it almost can. While court rulings in America are not binding on US courts in the same way as a US ruling in the same situation would be, they are advisory and can be used in the deliberations. This is true of all court systems that took their initial mandate from the English system.

Re:Can this set a precedent here in the States?

[Anonymous Coward]

The UK?

Re:Can this set a precedent here in the States?

[Kijori]

For "America" read "Australia"...

Re:Can this set a precedent here in the States?

[badfish99]

How about the UK: see for example here

Also, in the UK someone was fined £1000 and lost his job just for typing in a URL with "../../.." on the end of it. Story here.

Re:Can this set a precedent here in the States?

[PDAllen]

The problem with this is the bank will lose a lot of money if it takes its site offline while it fixes the problem. So when they get mail which could easily be read as 'I have found a security hole in your systems and I could have screwed you royally by messing with it. Give me MONEY!' they, not surprisingly, feel like they're being blackmailed. If the guy had simply sent mail saying, 'you have a security problem, you might want to fix it', then taking him to court would have been stupid. But sometimes someone who thinks they've been helpful and wants money gets unhappy when they're not paid. Squeegee kids at lights have been known to scrape paint off cars that don't pay them occasionally, and the bank no doubt was worried that this guy might go back and exploit the security hole he'd found when he wasn't given money. If you are a major bank, you really can't afford to ignore it, even if only one in a hundred people turned out to be bitter about not being paid, that one in a hundred could seriously mess up the NZ economy for a few days.

Re:Can this set a precedent here in the States?

[Skrynesaver]

Unfortunately the precedent in the states has been set.Randal Schwartz got done for a far less outrageous test of a client companies system.

Re:Can this set a precedent here in the States?

[matress]

For "Australia" read "New Zealand"?

Re:Can this set a precedent here in the States?

[Anonymous Coward]

The word is "precedent", moron.

Re:Can this set a precedent here in the States?

[infofc]

That case is so much BS. I know the UK law can be pretty fascist, but that judgement makes no sense at all. Im so tempted to start doing the same hack on my own sites until I get "caught".

Re:Can this set a precedent here in the States?

[Kijori]

Oh dear. Oh dear oh dear... I need some sleep :(

Re:Can this set a precedent here in the States?

[Anonymous Coward]

Erm Australia and New Zealand are two different countries. And calling a kiwi an Australian is something of an insult (for the kiwi). It's like calling a Canadian an American. Oz and NZ do have some nifty citizenship transfer policies, though.

Re:Can this set a precedent here in the States?

[nacturation]

It's just like stopping at a red light in downtown Detroit or Chicago, getting your windshield cleaned by some bum and then him sticking his hand in your window asking for money when all he did was smudge your windshield without your permission.

No, no... wait, it's like this. It's like stopping in the red light district in Amsterdam and, while looking through a window, you get your bum cleaned by some money *without* your permission.

(Substituting in for BadAnalogyGuy.)

Re:Can this set a precedent here in the States?

[matress]

The crime requires intention, his actions were intentional, therefore he commited an intentional crime. Whether he knew it was a crime or not is beside the point (in the eyes of the law, ignorantia juris non excusat).

Re:Can this set a precedent here in the States?

[russ1337]

What is funny is the court and judge didnt share your point of view.

Re:Can this set a precedent here in the States?

[puteri tasha]

how would you feel if someone turned up at your house did some work then sent you a bill all without you requesting anythign be done. If this happen to me... I won't pay him. Why? because I'm not ask and give permission for the work, then If he still do it. " You do for free man !!!!"

Re:Can this set a precedent here in the States?

[matress]

Yes, silly District Court judge... Honourable intention is still intention; the guy should've been convicted. Sure, maybe given a suspended sentence, but at least convicted.

Re:Can this set a precedent here in the States?

[joebagodonuts]

Stupid court results? Why stupid?

First, you don't know all the evidence. Basing judgement on what you read or hear in the news (hearsay and rumor rather than fact)is stupid.

Is it stupid that the judge didn't overreact? Just becasue folks in the good old USA like to overreact and blow things out of proportion doesn't mean the rest of the world should follow suit.

Like it or not, the right descision was made. If you were so smart, you'd be a judge, instead of posting on /.

Re:Can this set a precedent here in the States?

[Anonymous Coward]

Hi - it's me again. Love the grammar. It's precedent, fuckstick.

Re:Can this set a precedent here in the States?

[Anonymous Coward]

Here's an analogy for you.

If I connect to your PC and do stuff to it, find something wrong, and let you know, it's illegal.

So is what this guy did.

How's that for an analogy?

Re:Can this set a precedent here in the States?

[John Jamieson]

These days the UK and the US seem to be the same country. And to think some in the US used to call Canada the 51st state.

Re:Can this set a precedent here in the States?

[iminplaya]

And for those of you who don't own your own house, but do drive to work everyday(poor souls), it's kinda like the guy washing your windshield while waiting at the light and expecting a "tip". You wanna tip? Get a real job, you bum!

Re:Can this set a precedent here in the States?

[Schraegstrichpunkt]

It's better, but it's still overly simplistic. What if you just port-scanned my machine, and found that I was running a vulnerable version of SSH? What if my machine were a service that was essential to the public (like a bank)?

Analogies are great tools to explain things to people who are just curious, and lawyers like to use them to explain their otherwise arbitrary positions about particular cases, but they're substantially less useful when you need enough depth of understanding to make an important decision. For that, you need to look at the actual facts of the case. That's what the judge did here.

Re:Can this set a precedent here in the States?

[poot_rootbeer]

Now, quick question, when did I use the word 'unintentionally' in my post, as you seem to be implying?

Your words were "He committed no intentional crime." I'm not sure there's a meaningful difference between "no intentional" and "unintentional".

It's against the law to wash someone's windshield without permission and then ask for money. There's no reason it wouldn't be equally unlawful to audit a federal bank's security system without permission and then request payment.

Re:Can this set a precedent here in the States?

[Chacham]

And to think some in the US used to call Canada the 51st state.

You do realize that Article 11 of the Articles of Confederation states:

Art. 11. Canada acceding to this confederation, and joining in the measures of the United States, shall be admitted into, and entitled to all the advantages of this Union: but no other colony shall be admitted into the same, unless such admission be agreed to by nine States.

So, Canada and the US have a long history of *very* friendly relations. And, it is very helpful for a country we share a long border with, including tax breaks for people who live in one country and work in another.

Re:Can this set a precedent here in the States?

[baggins2001]

No it can't set a precedent in the US.
Everything this guy did was bad.
But if I were the judgs and if this were the US Federal Reserver, Homeland Sercurity, or a major company in the US that handles personal data and someone showed they were negligent in security. I wouldn't allow a reward and I wouldn't convict the guy. But if he did not show proof of security negligence I'd throw the book at him. If he did find something wrong I would push someone to find a reason to prosecute the supposed victim in this case.
Some of these organizations are running around like the 3 stooges when it comes to security. They go through all of the bureaucractical steps and drop common sense. Like allowing people's sensitive data to walk out of the secure environment on a laptop, ( so people can work on it at home ). During such cases as this someone needs to go to jail. That's my data, which can cause me or someone a significant amount of pain or sufferage if it gets exposed.
I'm sorry but I know of 2 instances of theft where the culprit was some institution that was negligent with the information. In one of those cases it was mine and it caused me lost time roughly 4 hours and lost money roughly $200. And they never explained to me how the hell it happened they just said we're sorry 3 weeks later and returned 90% of the money. I then had to remind them that, that wasn't all of the money, they owed me for overdraft charges. Oh yeah here we're sorry return it in a few days. A few days later, yeah but you didn't return the money that the other banks charged for overdraft. Oh yeah we're sorry we'll get right on it. Four days later most of that was returned.
In the mean time I had all these people tell me I was lucky. The hell with luck, how about someone find out how the hell somebody got the information. How about the local police or the Federal Bureau of Investigation or Homeland Security putting a stop to this or at least telling us how they cleaned up the hole and spanked the people that allowed it. To busy arresting a bunch of mental retards in Florida, who still haven't figured out whether they were working for the US government or were actually duped into working for a terrorist organization. Poor bastards all they want to do now is get out of jail and go back to their werehouse, sit on the couch, drink malt liguor and bitch about the government.
I do my bitching sitting in an office chair drinking Red Bull.
Good Day and Good Luck

Re:Can this set a precedent here in the States?

[mooingyak]

You make it sound like you think a free rectal exam is a bad thing.

Re:Can this set a precedent here in the States?

[sethstorm]

Here in the States, that cost some people a university admission. The irony of it was that MIT was one of the colleges that went against their normally permissive nature. I guess they seem to think it's permissive only when they know you're an exclusionist.

Re:Can this set a precedent here in the States?

[uufnord]

The purpose of analogies to find similar things from which we can draw conclusions. You're just bad at finding analogies. So, here, let me help you.

Except that instead of giving you a rectal exam, he told you how someone could molest your daughter and explained how you could take action to prevent it, explained bombs to you and showed you what could happen if someone exploded your favourite hockey team's home town with NUCLEAR WEAPONS, and demonstrated how someone could steal your glasses and gave you a comprehensive plan on how you could protect your glasses from theft, before billing you for the explanation.

There. Is that better? Does the cream soothe your aching vagina?

Re:Can this set a precedent here in the States?

[John Jamieson]

Yes, the relations are friendly. They would be much better except for the few times that the US decided to invade them(I bet they won't loose next time though). And when the US takes fits because they don't see eye to eye on Iraq, and the fact that Canada has so much softwood that it is cheaper than in the US and so they tax it to death. Oh ya, and then Washington State kills all their salmon breeding rivers, and then insists on catching all the salmon before they make it back to BC and Alaska (where they actually try to preseve such things).

Hmmm, good thing those Canadians are so nice.

Re:Can this set a precedent here in the States?

[tt075711]

That man has been punished for the offence that he did...which he hacked into the security of the auditing system without permission...regardless of the intentions, still he is considered to be a trespasser What I'm trying to say, it's like somebody's been into your computer and seen all your data...of cause you as the owner will get mad, regardless of the hackers intentions...and then he has the balls to send me the bill just to point out that my computer isn't secure...Heck, I wouldn't like that to happen to me...

Re:Can this set a precedent here in the States?

[Schraegstrichpunkt]

The purpose of analogies to find similar things from which we can draw conclusions.

And that's fundamentally flawed. See my other posts.

Except that instead of giving you a rectal exam, he told you how someone could molest your daughter and explained how you could take action to prevent it, explained bombs to you and showed you what could happen if someone exploded your favourite hockey team's home town with NUCLEAR WEAPONS, and demonstrated how someone could steal your glasses and gave you a comprehensive plan on how you could protect your glasses from theft, before billing you for the explanation.

Heh. Nice.

Re:Can this set a precedent here in the States?

[MadMidnightBomber]

Maybe you should read what this guy actually did. he intruded into a banks phone system (without permission), performed a security audit (again without permission), and then tried to get the bank to pay for his work. If I was the bank I would be taking this bastard to court too. how would you feel if someone turned up at your house did some work then sent you a bill all without you requesting anythign be done. The fact that the bank has a security issue is a side note here, they should be hiring a "reputable" security firm to look at there systems.

And speaking as someone living in NZ, I'm glad the bank has to fix the bloody problem rather than shooting the messenger - as seems usual in these cases.

Re:Can this set a precedent here in the States?

[irc.goatse.cx troll]

If you told me (helpfully and without an attitude), I'd be thankful.
If you billed me, I'd take you to court.

Miracles!

[soft_guy]

A judge who uses common sense. Wow!

Re:Miracles!

[Who235]

He did not pass the information on to others and did not use it for personal gain. "In my view his intentions were honourable."

I know. Amazing isn't it.

Although there was the slight matter of calling the bank and presenting a bill for services that were never asked for, but I'm willing to chalk that up to creative marketing. . .

On a side note, my uncle (who is a lawyer) has a low opinion of judges and tells the following joke which you may tell your friends under the JPL (joke public license):

Q:What do you call a lawyer with an IQ of 50?
A:Your Honor. (Substitute M'Lud or other region appropriate judge appellation here if necessary.)

Re:Miracles!

[icepick72]

On a side note, my uncle (who is a lawyer) has a low opinion of judges and tells the following joke

Enlightening indeed. After all those lawyer jokes the lawyers finally made a joke about somebody else ... and it wasn't even funny! Nice try by the lawyers, but there's gotta' be another lawyer joke in there somewhere.

Re:Miracles!

[Cyberax]

It's the only joke about lawyers. The rest are true stories.

Re:Miracles!

[Chuck Chunder]

Q:What do you call a lawyer with an IQ of 50? A:Your Honor. (Substitute M'Lud or other region appropriate judge appellation here if necessary.)

Or for even more entertainment, use both. F. E. Smith to witness: "So, you were as drunk as a judge?"
Judge (interjecting): "You mean as drunk as a lord?"
F. E. Smith: "Yes, My Lord."

Re:Miracles!

[DikSeaCup]

Nice try by the lawyers, but there's gotta' be another lawyer joke in there somewhere.

You mean like:

"You've got to admit, 50 is a very high IQ for a lawyer."

Re:Miracles!

[Anonymous Coward]

Q:What do you call a lawyer with an IQ of 50?
A:Your Honor.

All right buddy. You're gonna hafta come with us down to the station.

"Researcher" was stupid

[Gemini_25_RB]

I see absolutely no problem with someone analyzing the security of a network and relaying the results to the owners of the network. According to the article, the "researcher", Macridis, checked the network and then tried to sell the results to the owners, _after_ already accessing the network. Seems a little bass ackward.

Re:"Researcher" was stupid

[ianejames]

Imagine this: A man walks up to your house while you're gone and tests each lock on every door and window. He finds a way to break in -- but claims that he hasn't. Then he sends you a letter saying he knows your security vulnerabilities and requests payment for that knowledge.

Is it better or worse that he actually walked around inside your house?

Re:"Researcher" was stupid

[Rodyland]

This is New Zealand - everything is bass ackward.

Re:"Researcher" was stupid

[Anonymous Coward]

Worse. And he's NOT a "Researcher", he's a hacker who tried to extort a bank.

Re:"Researcher" was stupid

[Fordiman]

Backwards. The above is blackmail. This guy presented the info first, then asked to be paid. The bank went a little far prosecuting. I'd have just ignored his request for payment, and maybe offered a job in security auditing instead.

Re:"Researcher" was stupid

[Fordiman]

Pay attention. The term "Security Researcher" means "Hacker with authorization".

Meanwhile, he gave the info, THEN asked for money. That's not extortion. It's a stupid request, in that he's got no pull after he gives the info to the bank, but it's not extortion.

If I were the bank, I'd have either told him to shove it, or added him to my security auditing team. He in no way deserves to be paid for work he did without request, but he has proven skill, knowledge, experience and maturity in the way he went about it (aside from the asking for money bit - he should have known he wouldn't get a dime AFTER he gave them the info).

Re:"Researcher" was stupid

[StrongAxe]

I spent an hour walking around your house and found that you had some unlocked doors. Please pay me $5000 and I will tell you where they are, rather than your enemies.

is blackmail.

I spent an hour walking around your house and found that you had the following unlocked doors... Please pay me $50 for one hour's work.

is a bill for professional services rendered.

Re:"Researcher" was stupid

[Fordiman]

"I spent an hour walking around your house and found that you had the following unlocked doors... Please pay me $50 for one hour's work.

is a bill for professional services rendered."

A bill that the 'customer', in this case has no obligation to pay; no contract or sales agreement, you see. A respectable human / company would pay it anyway, despite the lack of obligation.

Re:"Researcher" was stupid

[Fred_A]

The problem is that this could set a precedent:
"Thank you for your prompt payment of my security bill. During your vacation, I took the liberty of redesigning your house by adding turrets in the corners, a moat and a drawbridge. I also painted it striped pink and orange. Your garden now sports a beautiful 35m marble fountain representing 'Mammals Overtaking Dinosaurs' (an allegory). I left your mail on the little table by the door. Please find my bill for $7 897 463 attached."

Re:"Researcher" was stupid

[ArsenneLupin]

Meanwhile, he gave the info, THEN asked for money. That's not extortion. It's a stupid request, in that he's got no pull after he gives the info to the bank, but it's not extortion.

It's still extortion. And he still has pull:

• The bank has no way of knowing that the guy communicated all the information he had. Maybe there's more than one security hole that he discovered (very likely if the system is really shoddy...)
• The bank has no way of fixing the issue instantly. Especially since banks have some really heavyweight development procedures in place, which make even the most trivial change a matter of several months of development. Thus, the "security researcher" could still cause damage by revealing the hole to the public before it can be fixed.
• Or maybe the bank feels that the hole is obscure enough that it doesn't warrant spending boatloads of money fixing it (... more money than the "researcher" asked for, if he's smart...). But now, the bank no longer has the choice of ignoring the issue, it's either pay the researcher, or invest money in an otherwise unneeded (in the eyes of the bank) development.

Asking for money after or before telling somebody about a security hole in their system is always iffy, and very easy to become misunderstood (even if you have no intention to actually act on your implied threats).

Re:"Researcher" was stupid

[benplaut]

And there's still another difference --
You either charge for the information, or you give the information and then request to be paid.
FTFA, it appears that he told them what the problems were before asking for money. More honerable, even.

Re:"Researcher" was stupid

[deek]

Oh man, it seems like I'm on a witch hunt for bad analogies. This has got to be the bazillionth one so far in this slashdot topic. What, me exaggerate?!

Anyway, the guy didn't redesign their house. He just discovered something about it. No changes made. He was asking them if they're interested in paying for his knowledge.

If someone uses a house in an analogy again, I swear I'll do something that I'll regret.

Re:"Researcher" was stupid

[ArsenneLupin]

I spent an hour walking around your house and found that you had the following unlocked doors... Please pay me $50 for one hour's work.

is a bill for professional services rendered.

No, that's blackmail too, only better veiled (... and, admittedly, more reasonably priced...).

• You can't be sure whether he told you about all the doors he found.
• Maybe some doors have broken locks, and you can't get a craftsmen within 3 weeks because they're all busy. During that time, you're a sitting duck, wondering what the "professional service" provider might do to your house during that period. Better pay up.
• You lived in a trusting neighborhood (or at least it was trusting, until that helpful provider of "professional service" walked by), and felt quite comfortable deliberately leaving your doors open. Now, you're no longer as confident

Re:"Researcher" was stupid

[hyfe]

Imagine this; you put a booth on a public space, and while you're gone, someone walks around it, takes notes, finds some weaknesses and offer to sell you the list. Doesn't sound that bad, now does it?

Put something on the internet and it's on public space pr definition. It doesn't give anyone the right to destroy it, but it does give us the right to look at it (or rather, it doesn't give you the right to refuse us).

(I haven't read the story, don't know if my analogy is more appliciable, but I find GP's analogy abhorrent either way.. because it's not necessarily correct; it all depends on the details)

Re:"Researcher" was stupid

[SlOrbA]

And how do you think Security Firms open up their sales pitch?

Nobody in this case has indicated that there were "or else" incentives used in request for unprecontracted compencation.

Re:"Researcher" was stupid

[giorgiofr]

Wait a second, by your definitions every security consultant in the world is implicitely extorting money from me by not telling me what my weak points are. I am *sure* I have some, yet they won't speak up unless I pay.
It's a professional service. They provide you with info, you pay them.

Re:"Researcher" was stupid

[Fred_A]

The point was more along the lines of "don't pay people for stuff you didn't ask for".
Not "come up with a realistic analogy". :)

Should we use the time tried car analogies then ? ;)

Re:"Researcher" was stupid

[ArsenneLupin]

Wait a second, by your definitions every security consultant in the world is implicitely extorting money from me by not telling me what my weak points are.

• they don't go rooting around in your system (at least not without your consent). For extortion there should at least be some kind of hint that something bad may happen.
• they don't actually ask for money (unless you employ them...). For extortion there should at least be some kind of hint that payment is expected.

If neither a threat nor a demand of payment exists, it's not extortion.

Mere existence of necessary skills is not enough.

It's a professional service.

Real professionals provide their service only when asked to do so. If some wall-siding company suddenly vinyl'ed your home without consent, and then demanded payment for the "service", you would be rightly pissed to.

Re:"Researcher" was stupid

[giorgiofr]

... which is pretty much what I was trying to say? I was showing how stupid calling this "extortion" would be. The fact that he is not a professional does not matter here.

Re:"Researcher" was stupid

[dwandy]

wow ... with logic like that you are well qualified to work as our security officer...

Sticking your head in the sand doesn't actually make security problems go away.

So the banks system has N security holes, where some other number X have already been identified by the bank and reviewed for severity and decisions were made as to how to deal with them.
This guy identified some set of problems that are in N and possibly in X.
Other people (aka: Bad Guys TM) have identified some other set of vulnerabilities in this system and may be taking advantage of them right now.

So let's review:

The bank has no way of knowing that the guy communicated all the information he had. Maybe there's more than one security hole that he discovered (very likely if the system is really shoddy...)

So what? His disclosures don't affect the number currently in existence. They exist whether he tells the bank or not. And if he found them, someone else can find them. Furthermore, if he had dishonerable intentions he probably wouldn't have disclosed any to begin with. Even if he made a partial disclosure, the disclosure doesn't make him any more or less of a threat.

The bank has no way of fixing the issue instantly. Especially since banks have some really heavyweight development procedures in place, which make even the most trivial change a matter of several months of development. Thus, the "security researcher" could still cause damage by revealing the hole to the public before it can be fixed.

He told the bank about the problems. He's made no threat (that I'm aware of) to go public. If anything the bank is now in a potentially better position to fix the problems then they were before he contacted them. If any of the problems he found were not already identified then he has in fact increased their security position, not decreased it.

Or maybe the bank feels that the hole is obscure enough that it doesn't warrant spending boatloads of money fixing it (... more money than the "researcher" asked for, if he's smart...). But now, the bank no longer has the choice of ignoring the issue, it's either pay the researcher, or invest money in an otherwise unneeded (in the eyes of the bank) development.

Security through obscurity is no security at all.
If they had identified and reviewed any of the problems he outlined and decided that it wasn't a problem worth fixing (and he's added no new data to the problem) then it's either still not worth fixing, or the analyst who decided it wasn't worth fixing needs his/her nuckles rapped.

When are people going to realise that the internet is a hostile environment, and that any exploit that exists will eventually be found by someone with malicious intent. Ignoring problems, suing honest researchers etc does nothing to increase your security posture. Meanwhile those that are dishonest are in no way deterred by some threat of legal action.

This incident was merely a response to someone getting embarrassed. Someone in the organisation got caught with security vulnerabilities and decided to take legal action to get the heat off of themselves. Pitiful really.

Re:"Researcher" was stupid

[Fordiman]

"Or maybe the bank feels that the hole is obscure enough that it doesn't warrant spending boatloads of money fixing it (... more money than the "researcher" asked for, if he's smart...). But now, the bank no longer has the choice of ignoring the issue, it's either pay the researcher, or invest money in an otherwise unneeded (in the eyes of the bank) development."

The bank never had a choice in the first place. If it feels it has a responsibility to its customers, it's JOB is to remain always vigilant about its own security. Any less, and the bank is not to be trusted.

At least, that's how I, a consumer, see it.

Re:"Researcher" was stupid

[tomhudson]

There *was* a demand for money. Backed up with the implied threat that "your system is vulnerable." It WAS an attempt at extorting money. The judge was an idiot.

Re:"Researcher" was stupid

[tomhudson]

No, the real argument is "don't try to bullshit people into paying for something they didn't ask for in the first place."

He isn't a researcher ... If you had read the article, you'd have known he's an ex-con. Obviously his ethical compass is still bent.

Re:"Researcher" was stupid

[deek]

The point was more along the lines of "don't pay people for stuff you didn't ask for".
Not "come up with a realistic analogy". :)

Should we use the time tried car analogies then ? ;)

Oh heaven forbid! Please don't start on the car analogies. That would drive me up the wall. ;)

Sure, the bank didn't ask for it. They also don't have to pay for it. And, as far as I can tell, they didn't pay him. He wasn't threatening them or anything. He appears to be saying: "Hey, you have security issues that I can fix. I'd like you to pay me as a consultant to fix them for you." Surely that's a reasonable request. Well, I think it is anyway.

Re:"Researcher" was stupid

[StrongAxe]

He isn't a researcher ... If you had read the article, you'd have known he's an ex-con. Obviously his ethical compass is still bent.

In TFA it mentions that he USED to be a con - 10 years ago. Since that time he was a security consultant who kept is nose clean. In this case, he made no threats to hack them or divulge their vulnerabilities to third parties if they didn't pay. He only wanted comensation for the time he spent (and it probably would have cost them a lot more if they had actually HIRED a security consultant to give them a "report" about their system security). Granted, they were under no legal obligation to pay, but it's like the "cutting grass" analogy someone posted earlier - They would have to pay SOMEBODY to do this analysis (or SHOULD - since they obviously have security concerns that would bite them in the ass big-time if not addressed), so why not this guy, since he has already done the work?

Re:"Researcher" was stupid

[StrongAxe]

You can't be sure whether he told you about all the doors he found

But you're still better off, since the day before, you had a whole bunch of open doors and you didn't know about any of them.

Maybe some doors have broken locks, and you can't get a craftsmen within 3 weeks because they're all busy. During that time, you're a sitting duck, wondering what the "professional service" provider might do to your house during that period. Better pay up. If he had wanted to rob you, he could have done so before telling you of the vulnerabilities. The doors were open, regardless of his telling you, and regardless of the availabilit of locksmiths.

You lived in a trusting neighborhood (or at least it was trusting, until that helpful provider of "professional service" walked by), and felt quite comfortable deliberately leaving your doors open. Now, you're no longer as confident

You are suggesting that ignorance is bliss.

In this case, I disagree. In this case, it is the other way around.

Re:"Researcher" was stupid

[tapehands]

So...what you're saying is...this man is a professional open-door finder?! Sweet Giant Jesus! I could do that! Just think of all the official-looking doors you can find in say...a mall! ;D

All joking aside, aren't professionals more...eh...professional about offering their services? I know that there are tons of analogies stacking up and getting people all pissed off...so here's one more!

Say, for instance, this man was wielding a gun (yeah, it's an overkill analogy already. bear with me.) - this man runs up to you, sticks the gun to your head, and shouts, "HAH! I BET YOU THOUGHT I WAS GOING TO SHOOT YOU, RIGHT?!!"
After much conversing with a gun to your head, you find out that this man simply wished to point out that he could point a gun to your head. For this jarring revelation, he wants $50 (of course, after retracting the gun from your head - asking for cash with the gun to your head would just be armed robbery!).

Now...we all know there is no such thing as a secure system, unless you've got it disconnected from every network, and locked in a basement somewhere. Granted, some systems could definitely use some help...but pointing out flaws, then asking for cash is not a good solicitation method. It might be easier to submit a resume saying, "I read your e-mails", or something to that effect.

Re:"Researcher" was stupid

[tomhudson]

Since he's tried to get money by conning the bank, he's STILL a con. Nosing around uninvited and then crying "wolf", and hoping to get paid for it? He's not just a con - he's a stupid con.

He wasn't owed anything for the "time he spent." Do you know what he was doing? He was calling their phone number, dialing an extension, then, if the person didn't answer, entering random number sequences to access their voice mail. And he wants to get PAID for this? Fuck off.

This guy's a ucktard who deserves to be banned from ever using either a computer or a phone for the next 5 years. We had one case here where a guy was doing that to the local police, and tried to claim he was "just testing their system."

He got fined for it, did it again, and got jail. This is not "security consulting." This is a public nuisance.

Not a good way to do business

[BadAnalogyGuy]

More than anything, this guy is a business dumbass for doing the work and providing the results before even a contract was drawn up. Because of this strange sequence of events (providing vulnerability information before being requested), all of a sudden his generous offer looks more like extortion than altruism.

His background with fraud (though 10 years prior) sullies his reputation even further.

It's not a crime to be a dumbass. At least not in NZ, apparently.

Re:Not a good way to do business

[Petrushka]

Apparently so (that's comforting, since that's where I live). At first I doubted that the judge actually acquitted him, and thought maybe he just convicted him without imposing a sentence; but another NZ source says the judge "discharged him without conviction, despite police opposition."

dumbass for doing the work and providing the results before even a contract was drawn up.

In fact the other source I cited above has a different story: it says he "identified security vulnerabilities in the bank's telephone system, and then offered to provide them with details if they paid for his services." Sounds like a much less daft approach.

Re:Not a good way to do business

[BadAnalogyGuy]

It still sounds dangerously close to extortion. What happens to the data if the bank decides not to hire him? The bank was right to have him arrested, IMO. The judge was right to acquit him.

Re:Not a good way to do business

[dougmc]

his generous offer

He sent them a bill. That's not so generous. Generous would be finding the issues, letting them know, and not asking for money. (Though people have been arrested and I assume convicted for things like this too.)

I had a guy show up and mow our yard, then knock on the door and asked to be paid. My wife, not really sure what to do, called me (I was at work) and asked if I really did hire this guy to mow our yard. I did not. Should we have paid him?

Did it matter that he seemed to barely know English and seemed genuinely confused when we told him we never asked anybody to come mow our yard? An honest mistake or a good con job? Ultimately, we did not pay him, though in retrospect I suspect he needed the money more than we did and I came to believe that it really was an honest mistake, but I didn't think so at the time. That, and my yard DID really need mowing! If I could go back in time and pay him, I would.

Re:Not a good way to do business

[Korin43]

Your analogy doesn't fit. I wouldn't arrest someone for mowing my lawn for free..

Re:Not a good way to do business

[BadAnalogyGuy]

You'd have them arrested for tresspassing, presumably.

Re:Not a good way to do business

[Anonymous Coward]

You'd have them arrested for tresspassing, presumably.

Hardly, I'm a Texan. I would have shot them for tresspassing.

Re:Not a good way to do business

[Nutria]

He sent them a bill. That's not so generous. Generous would be finding the issues, letting them know, and not asking for money. (Though people have been arrested and I assume convicted for things like this too.)

Sure it's generous, but it's also a one-way ticket to the poor house. From TFA:

it appeared he was trying to obtain money through virtue of his technical knowledge

Wow! Guess what??? So do I!! And I bet so do most of the people who read /.

I had a guy show up and mow our yard, then knock on the door and asked to be paid. My wife, not really sure what to do, called me (I was at work) and asked if I really did hire this guy to mow our yard. I did not. Should we have paid him?

I would not have to pay him, but if my lawn needed it, and he asked a reasonable fee, I'd have paid him.

Re:Not a good way to do business

[Anonymous Coward]

Texan bravado is boring.

Re:Not a good way to do business

[Dun Malg]

You'd have them arrested for tresspassing, presumably.

Maybe, but I'd definitely wait until they'd finished with the lawn first.

Re:Not a good way to do business

[Anonymous Coward]

not if you live in texas.

Re:Not a good way to do business

[Fordiman]

"His background with fraud (though 10 years prior) sullies his reputation even further."

I dunno. Some of the best security experts are post-black-hat hackers.

Re:Not a good way to do business

[Fordiman]

"I would not have to pay him, but if my lawn needed it, and he asked a reasonable fee, I'd have paid him."

See, that's the difference between you and this bank. You, apparently, have respect for other people.

If I were an Australian, I would not use that bank; the proper course of action would be not to pay him, but to hire him. Good security auditors are hard to find (though, awful, by-the-book ones abound).

Re:Not a good way to do business

[fuzzyrabbit]

New Zealand is not part of Australia....

Re:Not a good way to do business

[Fordiman]

Yes, sorry. I thought it might be NZ, but I missed that part of the article. I know how sensitive kiwis are about being grouped in with those nasty aussies.

Re:Not a good way to do business

[Dachannien]

More than anything, this guy is a business dumbass for doing the work and providing the results before even a contract was drawn up.

But street bums do that to my windshield all the time!

Re:Not a good way to do business

[91degrees]

Texans like to take potshots at p[eople to relieve the boredom

Re:Not a good way to do business

[BadAnalogyGuy]

You never know if the bum you aren't going to pay today will be the one that smears feces all over your windshield as you try to walk away. That's why it's a ticketable offense in most cities to wash someone's windshield without their consent. You don't want that sort of activity going on in the first place.

Re:Not a good way to do business

[giorgiofr]

I'd find it hard to respect the first guy who comes around and mows my lawn without being asked to and possibily against my wishes, who then proceeds to act like he deserves anything. I'm not sure you realize my fictional lawn is my property.

Re:Not a good way to do business

[Nutria]

I'd find it hard to respect the first guy who comes around and mows my lawn without being asked to and possibily against my wishes, who then proceeds to act like he deserves anything. I'm not sure you realize my fictional lawn is my property.

It's a odd business tactic, that's for sure. Unless it was an honest mistake of "wrong address".

Re:Not a good way to do business

[lantenon]

So, in going with an analogy that's pretty far-removed from the original story: if I mowed your lawn by mistake (wrong address), would I really have a basis to expect payment? I don't think I would.

Re:Not a good way to do business

[dougmc]

Texans like to take potshots at p[eople to relieve the boredom

No, they don't.

Re:Not a good way to do business

[dougmc]

I'm not sure you realize my fictional lawn is my property.

Well, it's your fictional property anyways.

In any event, I thought I made it clear, but the lawn mowing I was referring to was real -- a real man with a real lawn mower mowed my real lawn, and asked my wife for real money.

Did I owe him money? Perhaps an issue for the courts to decide, but at the time since I didn't ask for my lawn to be mowed, I decided I didn't. But as I mentioned earlier, in retrospect, I should have paid him -- not because I legally owed him money, but just because since I think it was an honest mistake, it would have been the right thing to do.

Re:Not a good way to do business

[Nutria]

So, in going with an analogy that's pretty far-removed from the original story: if I mowed your lawn by mistake (wrong address), would I really have a basis to expect payment? I don't think I would.

Legally? Definitely not.

Morally? It depends on factors like whether

• the lawn needed mowing
  
• you did a good job cleaning up
  
• you did not act like a jackass.

Re:Not a good way to do business

[giorgiofr]

That's perfectly fine, if you *decide* that you feel like doing it, by all means go ahead. *Demanding* money, however, is not perfectly fine in such a situation.
I made a point to call my lawn fictional because *I* don't have one - I live in a flat - I understand you have a real one ^_^

Re:Not a good way to do business

[lantenon]

I still don't think I would be morally justified in expecting payment. Even if I did an absolutely PERFECT job in mowing the lawn, and was polite-as-can-be, the mowing in question was an unrequested service.

Hooray for Judicial Activism!

[Rachel Lucid]

The precedent needs setting!

I'd be pissed too

[Anonymous Coward]

..then billed the bank for his unsolicited services..

He sounds like a bit of a jerk.

Re:I'd be pissed too

[John Jamieson]

I think idiot is a better description.

Stupid.

[Kid Zero]

In other words, I can break into your house and wander around, take notes then leave. When I come to the door later, I can bill you for the "Security Consultation" and not be charged for robbery.

Great! ...and they call Americans silly? This one's off the chart.

Re:Stupid.

[Firehed]

Well, seeing that you didn't take anything, I'd hope that you're not charged with (or convicted of) robbery. Unless by 'take notes', you mean in a literal sense and walk off with my stack of Post-Its. In which case, you should be charged with criminal idiocy.

Re:Stupid.

[Anonymous Coward]

It would still be breaking and entering. Or as is the case when the door is open, criminal trespass or illegal entry.

In the sense of the house the saving grace is that you can walk in an open door (not a window) and be actively calling for someone and possibly get away with it. But it is hard to call for someone in a computer system.

Re:Stupid.

[pembo13]

Hmm. If you break into my house which I assume to be very secure, take notes - only, and are willing to relay that information to me. ..I am not sure that I would be pissed. I would just hope your fees are reasonable.

Re:Stupid.

[deek]

In other words, I can break into your house and wander around, take notes then leave. When I come to the door later, I can bill you for the "Security Consultation" and not be charged for robbery. Great! ...and they call Americans silly?

  If you don't steal anything, you can't be arrested for robbery. If you left your door unlocked and open, you can't charge them for breaking and entering. You could probably get them on trespassing, but your analogy fails here because your house is not a public area, whereas a company phone system is used both by staff and public. You really haven't chosen an applicable analogy here.

  If I was a customer of this bank, I would be grateful to this person for highlighting any security issues they have, and not taking advantage of these issues. Would you rather security problems be exposed, or would you prefer to have your head buried in the sand?

  Yes, there is a reason why they call Americans silly, if your reaction is typical of Americans.

Re:Stupid.

[omeomi]

But it is hard to call for someone in a computer system.

wall [-n] [ message ]

Re:Stupid.

[Kid Zero]

[i]If you don't steal anything, you can't be arrested for robbery. If you left your door unlocked and open, you can't charge them for breaking and entering. You could probably get them on trespassing, but your analogy fails here because your house is not a public area, whereas a company phone system is used both by staff and public. You really haven't chosen an applicable analogy here.[/i]

To be picky, I should have called it "Breaking and Entry" rather than robbery. B&E doesn't have the force requirement that Robbery does. B&E also doesn't have to have an actual theft happen to occur before being called into play. If you'd like to refine the argument, My hypothetical Burglar would be better charged under B&E, the attempt at billing non-withstanding.

Feel Better? :)

Re:Stupid.

[fishbowl]

>If you left your door unlocked and open, you can't charge them for breaking and entering.

Don't bet your life on that one. Speaking for my jurisdiction, if it is trespass, then it is
breaking and entering. If you have a firearm in your possession, or if there are any among a long
list of aggravating factors (e.g., you jumped a fence before walking into the open door), it's
automatically burglary.

Re:Stupid.

[Firehed]

Breaking and entering != robbery. Still illegal, of course, but generally you have to actually steal something to have stolen something (probably not always the case with some of the idiots we have in black robes, but that's another matter). As simple as it would make things, crimes aren't generic and thus you must be charged with the correct one in order to be convicted of it (I would hope). The poster I originally replied to just used the wrong one in his example. Or translated it poorly or something. Dunno, but looking around without permission certainly isn't theft.

Re:Stupid.

[BluesGeek]

Really?? How do you know that I am not the kind of person who likes to pee in Listerine or wipe poop on your spinach!? Worse, maybe I like to replace the lock to your front door with one that is identical, but accepts your key and mine. The point is, you have no idea of what actions I took while in your house ... which is why you locked the front door in the first place I assume. Of course you should be angry at a breach in your security ... regardless of if I told you how I did it. Maybe I left something out of my unsolicited report?

Re:Stupid.

[Anonymous Coward]

And in still other words, I can wander into any discussion and make car/house analogies out of anything. When I come back later, I've got +insightful mod if moderators were silly americans.

Re:Stupid.

[Anonymous Coward]

Why would someone who had done something illicit draw attention to that fact? It's possible someone broke into your house, planted a hidden camera in your bathroom, and left leaving no evidence. Catching someone is one thing, but busting a bragarts balls for telling you they got away with something based on what he might have done is retarded.

Re:Stupid.

[deek]

If you'd like to refine the argument, My hypothetical Burglar would be better charged under B&E, the attempt at billing non-withstanding.

Feel Better? :)

Not just yet. :)

I already coverd B&E in my original argument, as well as trespass if you're thinking of using that. Accord to Wikipedia, Breaking and Entering, or Burglary does indeed not need an actual theft. But it does need an intention to commit a crime. Making notes is not a crime.

Anyway, my original point is that your analogy really doesn't hold up. It's a bit redundant arguing the points in the analogy, if it's useless in the first place.

I'll add a bit more to this post, to actually make it on topic ...

The guy is certainly walking a fine line. I believe that he should have been arrested and convicted, IF he was discovered in the process of purposely cracking the phone system. BUT, if he has purposely cracked the system without being discovered, and only notified the owners about it, then he is completely blameless and should never be convicted. In fact, he should be lauded for exposing a problem.

It's strange to think that there are two such extreme results from one action, only dependent on whether you're discovered in the process or not. But such is the case in this situation, and that is the fine line. If he was discovered, then we have to assume that he was acting maliciously. If he wasn't discovered, and he reports the problem, he has actually helped to benefit the owner of the system. NOBODY should EVER be punished for reporting a problem, when they haven't benefited themselves and the owners aren't threatened. Even if he was asking for a consultancy fee, the owners don't have to pay it. He has still helped the system owners by making them aware that there is a security problem.

I mean honestly, what would you prefer: a world where people are frightened to report problems, or a world where people can freely report problems. The judge was right. This case should definitely be dismissed.

Re:Stupid.

[ArsenneLupin]

Well, seeing that you didn't take anything, I'd hope that you're not charged with (or convicted of) robbery.

Depends. Years ago, their was a robber gang who would break into houses, take notes (or rather, snap pix), and go away without taking anything. The pix would go into their catalog.

Once they had a customer for your antique furniture, they would come back with their van and get it. I guess, this cut down on their storage costs, or sth like that. Just-in-time robbery.

And given this modus operandi, I'm pretty much sure that even the first visit could be considered to be (part of) a robbery.

Re:Stupid.

[mikek3332002]

and in your 'note taking' you fall down the stairs, which give you an excuse to sue the home owner for having an unsafe house. Something similar happened in Aus, a Burgular was either bashed or slipped and was able to succesfully sue the victim(the property owner).

Re:Stupid.

[juhaz]

If you left your door unlocked and open, you can't charge them for breaking and entering.

The door was not left unlocked and open. It just had a bad lock, guy walzed in, and left a bill for "identifying a security flaw in the front door" on the kitchen table.

Company internal data systems accessible only through faults in the public interface are not any more public than my house is public just because it happens to be alongside public road network. They both have public parts (my doorbell), customer-accessible part of the company system, and private parts.

Re:Stupid.

[giorgiofr]

Talk about organized crime o.O

Re:Stupid.

[Kid Zero]

I mean honestly, what would you prefer: a world where people are frightened to report problems, or a world where people can freely report problems.

I think he goofed up when he tried charging for his services, which he hadn't been contracted for. That is very presumptious, and more than a little irritating. I don't believe he'd been asked to look for holes, which amounts to B&E.

Re:Stupid.

[toonworld]

When was a robbery commited? Did he 'steal' or duplicate sensitive information? Did he intercept faxes or documents being sent? Did he try to extort money by threatening to release the information to the public? No, he told the bank straight up what the vulnerability was and asked for payment.

The man could have done a lot of damage but instead chose to do the right thing, which was to reveal what the security risks were and ask for a consultation fee.

Re:Stupid.

[deek]

I think he goofed up when he tried charging for his services, which he hadn't been contracted for. That is very presumptious, and more than a little irritating. I don't believe he'd been asked to look for holes, which amounts to B&E.

Well, I guess we'll have to differ on this. I think he's well within his rights to ask for payment for his time and effort, as long as the amount is reasonable for a security consultant. If I was in charge of that system, I would be grateful that someone has come forward to notify me of any problems with it. Even if they wanted standard consultancy rates for their effort. But that's just me. You obviously feel different about it, and we can leave it at that.

Re:Stupid.

[OceanKiwi]

Can I suggest that your analogy is beyond silly? In fact I'd go so far to call it Stupid. It's not a frickin house for crying out loud, or anyone's personal property - It's a publicly accessible phone-banking system.

From TFA: "He told the bank its phone calls and facsimile transmissions could be intercepted from overseas." The Judge said "Macridis used his talents to identify security risks and he had identified a grave risk to the Reserve Bank and its customers."

Genuine question: How is this any different to a researcher finding security holes in IE? Is it because IE is distributed as binary, and the phone-banking system is hosted? Are we to expect that attempting to find holes in WindowsLive is a criminal offence?

At any rate - it's not like he was searching for evidence of alien life on their system...

Re:Stupid.

[WilliamSChips]

But the notetaking was not the robbery. Planned robbery at most.

Why does this supprise people?

[Anonymous Coward]

He should have been convicted. He was not under contract or authorized to probe that system. He demanded money before he would tell them what was wrong. In my book that is extortion.

Re: Why does this supprise people?

[zoftie]

Extortion would be, is if he'd threaten to make vulnerabilities public. The guy is small time and banks never invest in right caliber buisnesses.
What bank protecting is its image. Realistically, he is incurring unexpected expenses and not via extortion. They can choose to not pay and keep
running leaky telephone system. How often people don't change their oil in the car on time? or at all. Extortion is when consequences of not paying
are immediate and far reaching. System is already insecure. The guy is in position of power and banks don't like to be bullied.
But he did not threaten to hurt the banks.
2c.

Re: Why does this supprise people?

[revolu7ion]

You can't expect to get paid for work you weren't asked to do. Sure he incurred expenses, that he wasn't asked to incur by anyone but himself. If he truly had integrity, he would tell the bank and leave it at that. Not try to get money from it. That doesn't help his case of having a pure motive.

Re: Why does this supprise people?

[mark-t]

It doesn't matter that he didn't threaten to make the vulnerabilities public, he disclosed that he knew of the vulnerabilities to the bank, which instantly creates the knowledge that there _ARE_ vulnerabilities that somebody else might potentially try to uncover and exploit. The bank's only recourse is to fix those vulnerabilities, and the only way they will discover what vulnerabilities were uncovered is if they pay the guy.

Whether or not it was his intention, this soooo looks like extortion.

Re: Why does this supprise people?

[inKubus]

What the parent means is that they COULD pay someone else to look at the network. Obviously they don't want people running around with knowledge of their security, but I wouldn't call it EXTORTION. For instance, say someone has really brown grass and you are a gardener. You go up to the house and say, I know why your grass is brown. When they ask, "Really? Why?" you reply, "I'll tell you how to fix it for $500." They decline then have you arrested for not telling them what the problem is? That's not extortion, that's crazy!

Anyway, of course, when there's a bank and money involved and computers which few people know a lot about (therefore it's SCARY), it becomes a story. The bank probably only made a complaint because they were worried about their customers, and in this case, as it should always be, justice worked and the guy got off. He didn't do anything wrong so why shouldn't he?

Re: Why does this supprise people?

[whogben]

It looks to me like this: He couldn't get them to ask for the work, hes a lone guy, and banks tend to go with larger more established firms for security work. So, his best bet at getting a more extensive job at the bank would be to do the work first - its good practice / learning, its good for the resume regardless of whether they hire him, and its probably the kind of thing he actually likes doing. He calls them, tells them the security problem, and then asks for money. He didn't extort them, or in any way take advantage of them. Just the fact that he asked for money AFTER explaining the security flaws and their potential fixes shows his belief that he was doing them a friendly favor, and hopefully going to impress someone there into giving him a job. I'm sure he didn't expect that 4 months later the police would be in his house. Seems fair to me that the judge wouldn't convict.

Re: Why does this supprise people?

[zoftie]

Integrity compared to who, banks? If thief's treasure chest has holes in it would you tell him? I won't pity banks, they are money extraction mechanisms. Call me relativist. It is less then favorable predicament person themselves into. However the guy has gained some mindshare. If they bank was a non-profit organization, then maybe. However, if guy poked around and found glaring holes, its only enterpreneurship would distinguish this guy from regular stiff.
Take opportunity that you get, clearly the bank won't pay anything to the guy. In fact it will be a double bind. Say they pay him after writing up a contract. It would be harder to incriminate him. But if he'd divulge vulnerabilities for no charge bank will:
1. ignore it
2. threaten the individual

because money was involved bank, being one knowing about the money, a red flag somewhere raised, so this happend. Its sort of like going to a neighborhood and selling surveilance equipment, while mentioning that a serial killer, a rapist and a pedophile movied into the neighborhood. Also referring to the gunshop for a cut in sales. Its a biz. And also it is free publicity.

Re: Why does this supprise people?

[revolu7ion]

If you are having trouble finding work, do what most out of work nerds do and ring up the local McDonalds... or become a trolley boy like i did. And who the hell spells Supprise with a double p???

Re: Why does this supprise people?

[enrevanche]

Actually it's like he told you how to fix it and then asked for money.

Re: Why does this supprise people?

[zoftie]

Lol, no coffee in the morning can do some of the worst things to my spelling and grammar. As for diversifying work fields only will give you strength in future endeavours in the computing field, I agree. You don't have to surcome down to McDonalds though. May do some painting work or something.

Borderline scam?

[Louis A. J.]

While he didn't do anything illegal, I would be very surprised to receive a bill for a service I didn't request. His actions weren't illegal but his method of doing business definitely leaves something to be desired. Although his decision to not broadcast the bank's weaknesses to the public could be viewed as integrity, it could also be calculated business sense. It doesn't sound like someone I would choose to do business with.

Would you honestly pay for a service you weren't told you were receiving and didn't ask for if you were billed for it?

Re:Borderline scam?

[gr8whitesavage]

No, I wouldn't. I'd take him to court. Ha ha.

Re:Borderline scam?

[xs650]

Right, who does he think he is , the government?

Re:Borderline scam?

[Anonymous Coward]

I thought we all paid taxes?

Re:Borderline scam?

[ruben.gutierrez]

No, I'd hack into his personal computer, and then bill him for services to correct the issues.

Re:Borderline scam?

[alakazam]

>> Would you honestly pay for a service you weren't told you were receiving and didn't ask for if you were billed for it?

If it was good advice and helped my business, I might. *Especially* if it was in the realm of pointing out a security risk.

Would I be obligated to pay? Of course not. But depending on the service that was provided, I might very well be inclined to pay something.

  Jay Jennings

PS - If the person does it backwards, says he found info and will tell you details for $X, that's different and deserves a call to the authorities.

Re:Borderline scam?

[sjames]

His actions weren't illegal but his method of doing business definitely leaves something to be desired.

Very true. I'm guessing the court declined to prosecute because all of that should be abundantly clear to him now. After all, the bank haas his report and may do as they will with it and has no obligation to pay him. Further, he spent time in court (and presumably money on a lawyer). All good signs that your business model won't work.

Monkey see monkey do

[gr8whitesavage]

Score! I'm going to try that!

No surprise

[djuuss]

Thats what you get when you ship off all your criminals to a newly discovered island (or is it a continent?) and come back a hundred years later to look at their justice system.

Jokes aside, the reason the bank would have indeed have the man arrested was probably a mix of pride and caution. Quite understandable, but I sure hope they pay the man after all this is out of the papers.

Re:No surprise

[BadAnalogyGuy]

Given the man's approach to business, I don't think it's in the bank's best interest to hire this huckster.

There are many legitimate security firms that don't resort to extortionary tactics. The bank would be wise to hire one of them to do a security audit.

Re:No surprise

[Anonymous Coward]

New Zealand, dumbass... not Australia.

Fuck, do they teach you cunts anything at school?

Re:No surprise

[spagetti_code]

As an inhabitant of NZ, I think you need some lessons in Geography.

Australia is where the convicts were sent.
Colonists chose to go to NZ.
Australia is 2.5 hours away from NZ by airplane - i.e. a *long* way.

And we've got the Bledisloe Cup
and Australia doesn't. :-)

You need to spend some time with Google Maps.

Re:No surprise

[Simon Garlick]

With your ignorance of geography, I can only assume you're American. My sympathies. Nice work on that whole "War on Terror" thing, by the way.

Re:No surprise

[ThePeices]

"Thats what you get when you ship off all your criminals to a newly discovered island (or is it a continent?) and come back a hundred years later to look at their justice system."

What the hell are you on about, read TFA, this happened in NZ, not Australia.

Re:No surprise

[Anonymous Coward]

Fuck off. I'll bet you couldn't point out Ohio or Delaware on an unmarked map, so stfu.

Re:No surprise

[mjwx]

As an Australian, I can tell you that NZ is not a continent, in fact it is not an island its several islands.

Please feel free not to display your knowledge of geography with us nor your opinions of other legal systems. If the US declared idiocy to be a crime we'd have to turn the US into a penal colony.

Re:No surprise

[westyx]

But if he did want to comment on where ohio is, he'd probably use something we like to call here "a map" before he typed in his reply.

Re:No surprise

[ghostcorps]

LOL!!! Gold! mate.. good call.

Re:No surprise

[dltaylor]

Your post is what happens when religious nutcases fundamentally opposed to thinking, and petty criminals not smart enough to avoid capture and deportation to "the colonies", are the majority breeding stock of a country. Given the blatanly obvious stupidity posted, you MUST be an American (as in the United States of). You are an embarassment not only to the country, but the species.

Re:No surprise

[djuuss]

All these replies honestly cracked me up.

I'll admit to having misread the article in a way i previously believed only Americans were capable of. I blame lack of sleep for that.
Still, I love how you guys go all self-righteous and respond like i came to your house and shot your dog, while infact i just made some lame joke about the wrong country, on a website already crawling in lame jokes about all the wrong countries.

Get over it, anti-America fanboys!

Mod self -1, flamebait

Re:No surprise

[Kirth]

Guess what, we've got the Americas Cup and America hasn't, and neither have the New-Zealanders ;))

Re:No surprise

[Anonymous Coward]

Listen Frenchy, keep it up and we'll bomb you and the rest of Greenland!

Re:No surprise

[kaffiene]

Guess what, we've got the Americas Cup and America hasn't, and neither have the New-Zealanders ;))

Well... it was still won by New Zealanders :o)

Re:No surprise

[kaffiene]

Ohio and Delaware aren't countries you fucktard

Re:No surprise

[bartman227]

"With your ignorance of geography, I can only assume you're American. My sympathies. Nice work on that whole "War on Terror" thing, by the way." [Message enclosed]: Kiss my ass! We clean up your shit all the time. If it weren't for us, you'd be speaking German and paying homage to the 3rd Reich right now. Uncle Sam

First Xena, then LoTR, now this

[bunions]

what is it over there, like some kind of geek paradise?

Re:First Xena, then LoTR, now this

[Introspective]

what is it over there, like some kind of geek paradise?

Yep, thats why they created the .geek.nz 2LD. Geeks are taken seriously in NZ, almost as important as the sheep.

Re:First Xena, then LoTR, now this

[Petrushka]

what is it over there, like some kind of geek paradise?

No way, hell you should see what passes for broadband here.

Re:First Xena, then LoTR, now this

[Anonymous Coward]

Does that mean they'll get laid too? The geeks, that is.

Re:First Xena, then LoTR, now this

[Anonymous Coward]

yes, with the sheeps

Re:First Xena, then LoTR, now this

[Plutonite]

Geeks are taken seriously in NZ,

*me gets hopes up

almost as important as the sheep.

Ooooooookay.

Re:First Xena, then LoTR, now this

[Anonymous Coward]

You mean the *Gigabit* fibre internet connections we have in Wellington CBD, or the 10Mbps Residential cable service? Or do you live in some other city? :-)

Re:First Xena, then LoTR, now this

[GyroTech]

Oh sheep are very important to the NZ economy.

More important than geeks even...

Re:First Xena, then LoTR, now this

[poot_rootbeer]

Yep, thats why they created the .geek.nz 2LD. Geeks are taken seriously in NZ, almost as important as the sheep.

The sheep still get a lot more action, though.

Re:First Xena, then LoTR, now this

[Petrushka]

Oh, I live in Wellington ... just not in the CBD.

Re:First Xena, then LoTR, now this

[mgcarley]

Just a pity the broadband offerings are so S@#tty! (For example: http://www.telecom.co.nz/chm/0,8763,203071-202449, 00.html)

Re:Insert dick here

[Who235]

Is that your anus? Are you propositioning me?

And wouldn't that make us "Linux fuck-anuses" and not "Linux fuckheads?"

Your troll is very confusing.

Speedy Justice

[ColaMan]

At least it shows efficient legal process.

Macridis had telephoned the Reserve Bank on May 30, introducing himself as a security consultant.
The Reserve Bank made a complaint to police, who searched Macridis' house on September 21 and seized his computer.

Ok, a bit slow there - four months - but maybe the bank did some research on the flaws first. And the wheels of Big Business turn pretty slow....

Gerasimos Macridis, 39, appeared in the Wellington District Court on Wednesday - the 27th - on one charge of intentionally accessing a computer system without authorisation.

A little over a week from when the police took his computer, to when he appeared in court.
They presumably searched it, did all the legal paperwork, had the weekend off, etc.
Not much crime in Wellington lately? Or are they normally this speedy?

Re:Speedy Justice

[Anonymous Coward]

A little over a week from when the police took his computer, to when he appeared in court. They presumably searched it, did all the legal paperwork, had the weekend off, etc. Not much crime in Wellington lately? Or are they normally this speedy?

Ah, yes, but notice the name of the Bank - the "Reserve Bank" - in the US it would be called the "Federal Reserve Bank", and in the UK it would be the "Bank of England" - little wonder they were acting fast....

Re:Speedy Justice

[Snad]

The Reserve Bank of New Zealand is not a bank, as such. It's not like you waltz down to the Reserve Bank to make a deposit of your weekly wage cheque.

I believe it's more like the Federal Reserve in the States, though the RBNZ is 100% government owned.

So basically this guy decided to do some "security analysis" of a governmental body, not some penny-ante savings & loan branch in the backwoods. So yes, the police are going to be on to it pretty damn quick.

Re:Speedy Justice

[ColaMan]

I know, they've the same function as the Reserve Bank here in Australia. I just didn't feel like typing it all out.

And the cogs of government are often the slowest moving ones, you know.

Re:Speedy Justice

[oh]

I believe it is roughly equivalent to the Federal Reserve in the US.

Re:Speedy Justice

[james_gnz]

Ok, a bit slow there - four months - but maybe the bank did some research on the flaws first. And the wheels of Big Business turn pretty slow....

Or they might have wanted to fix the problem before informing anyone else (and particularly before making the information public in court). I know I would. :-P

Re:Speedy Justice

[fmoliveira]

It is speedy. In my country that would probably be longer than his lifetime. 10, 30 years are pretty normal times for a judgement in Brazil. Unless the judgement is heavily pressed by big media, then it can be solved in something like 2, 3 years.

It was this week, there was a news on the tv talking about some guys that won the lottery, but the bank said his ticket was irregular somehow and refused to pay. 30 years after that they finally won the cause. You know, they would probably enjoy this money when they were younger, not now in the end of their lives. Crappy legal system we have.

Won't be long before...

[__aaclcg7560]

New Zealand becomes the Script Kiddies capital of the world. After all, they're providing a valuable service by exposing faults in network security.

MAYDAY MAYDAY

[copponex]

Lawyer 131236716723: Shit. This is not good.

Lawyer 216421934614: What?

Lawyer 131236716723: They didn't throw this guy in jail who broke some technicality against a major corporation.

Lawyer 216421934614: WHAT?

Lawyer 131236716723: I'm serious! New Zealand! That fucking judge forgot how hard it is to pay off an SL500 and those student loans on a measly $70,000 starting salary!

Lawyer 216421934614: Look, I know you're new here, but this is America. We've got the RIAA, MPAA, not to mention all the lobbying to be done in DC. I mean, those Native Americans don't rip themselves off, eh? Plus, we've got so many laws on the book that someone, somewhere isn't doing something right, and who gets to prosecute?

Lawyer 131236716723: Lawyers?

Lawyer 216421934614: And who gets to defend?

Lawyer 131236716723: Lawyers!

Lawyer 216421934614: And who gets to judge?

Lawyer 131236716723: Former lawyers elected by other lawyers!

Lawyer 216421934614: And who makes the law?

Lawyer 131236716723: Former lawyers who have even less ethical concerns than other lawyers, lobbied by lawyers! Thanks, Bill... I was starting to worry!

You must be American

[Anonymous Coward]

New Zealand was never a penal colony, so has never had criminals shipped to it, other than the state visits by royalty and presidents. You are obviously thinking of Australia, a completely separate country about 1800 km away. You could drop Texas into the gap in between. (and nobody would miss it either)

Re:You must be American

[Anonymous Coward]

Okay, I am sick of the anti-American shit...BUT, that is fracking hilarious! On both counts, even.

Re:You must be American

[MichaelSmith]

You could drop Texas into the gap in between. (and nobody would miss it either)

Don't tempt the yanks. It would make a terrible splash.

moderate parent insightful

[inKubus]

That's a good way to remember. Anytime you have a problem with the government, remember that it's a government of lawyers for lawyers. I thought it was supposed to be for the PEOPLE.

Re:moderate parent insightful

[oyenstikker]

Lawyers are people too!

Re:moderate parent insightful

[Anonymous Coward]

I think that point is debatable.

Shoplifters of the world...

[denmarkw00t]

err um I mean "hackers of New Zeland, unite!"

Re:Shoplifters of the world...

[Anonymous Coward]

Dyslexics of the world, untie!

Not just once

[shack420]

This is actually the second time this has happened in NZ this year...

"Sahil Gupta, the second man charged over the Telecom voicemail hacking incident in April, walked free from an Auckland court last week.

Gupta was charged along with a teenager who cannot be identified for legal reasons. The teen was charged with unauthorised access of a computer system and pleaded guilty. Gupta was charged under the same section of the Crimes Act and faced up to two years in prison.

However two justices of the peace discharged Gupta saying there was no case to answer after a hearing in the Auckland District Court on Wednesday."

more @ http://www.crime-research.org/news/21.01.2006/1770 / and all over ya google.

Re:Not just once

[Petrushka]

This is actually the second time this has happened in NZ this year...

"Sahil Gupta, the second man charged over the Telecom voicemail hacking incident in April, ...

Well yes, but you gotta admit, "hacking the Reserve Bank" sounds a lot cooler than just "hacking voicemail".

Re:Not just once

[Audent]

Isn't that interesting... a website called "crime research" that doesn't know the meaning of the word "copyright" or even "just quote the intro and link to the original story ya munters"...

original story here:

http://computerworld.co.nz/news.nsf/UNID/FD9D3F1F2 E04EC92CC2570FE0025DF44

Re:Not just once

[Anonymous Coward]

No, that case was different. The judge ruled that Sahil actually had nothing to do with it, other than knowing that the teenager had told him it was possible. Presumably they had both talked about it, but there's no evidence that Sahil actually did anything.

Re:Not just once

[ArsenneLupin]

This is actually the second time this has happened in NZ this year...

The second time? Dangerous precedent! Hmm, time to fire up google, and enter inurl:asp inurl:id site:nz and rake in that free cash!

It is not a HOUSE

[LandruBek]

In other words, I can break into your house and wander around...

When will people realize that public networks are totally unlike houses! It's a lot more like a 7-11 than a house. You are allowed to wander into the 7-11 any time of night or day, presumably to do business, but if you notice that there's a hole in the wall, or the security mirror is missing, well, it's not your fault.

Don't bother telling me why this network isn't really like a 7-11 either. (Actually it's a series of tubes... :-) All these analogies are weak. I'm just so tired of the house analogy I had to add a counterpoint.

Re:It is not a HOUSE

[BluesGeek]

Nitpicking ... let's change the analogy slightly to make it a little more appropriate. I am allowed to walk into my local branch of bank X. Of course I am allowed to access the _public_ areas of that branch, namely the lobbey. If notice that every Thursday at 1pm there is only one employee and he is asleep and I tell the bank merely from my observations walking around the lobbey, I have done nothing wrong. I am NOT however allowed to pick the lock into the manager's office, a _restricted_ area, and look around. Maybe take a picture of the vault combo, etc ... unauthorized access to private and/or sensitive data where a clear preventative measure is in place, is and should be illegal. It is of course in the bank's interest to use better security, but this guy has no business breaking it without being asked first.

Re:It is not a HOUSE

[deek]

Heh. Analogies are fun to destroy, aren't they?!

Certainly the House is a bad analogy. I totally agree with the parent poster on this one. Let's run with this Bank analogy though ...

Suppose the man stays within the public areas of the bank. He is walking along, careful not to enter any restricted zone, but he is testing any doors leading to restricted or staff areas. Nobody seems to notice him doing this. Suppose he finds an unlocked door, but he doesn't take advantage of it. He goes to a staff member, and reports that the door is unlocked. Should he be arrested and convicted for this?

Voila! If anything should be arrested, it should be my case. Of course, not knowing what the guy specifically did, it's hard to say whether this scenario works for him. But that won't stop me from casting aspersions on anyone who dares to disagree with it. ;)

(note for the humor impared: yes, that last bit was a joke. please feel free to argue anything. it is a free society after all. well, pretty free. ok, somewhat free. free enough to argue stuff anyway. most stuff.)

I think you're focusing on the wrong crime here

[patio11]

While I think the trespass is morally wrong and the judge should have left it legally criminal, I can't follow your reasoning here. Suppose I constructively prove P=NP tomorrow, instantly threatening essentially all of modern cryptography. If I call up my bank and say "Hiya, you know that SSL encryption? You're going to want to change that, fast. Why? OK, we'll talk that after I have you NDAed up and some money sitting in my account, because I have literally the most important advance in mathematics in the last 50 years sitting on my PC. Thats worth some serious money to me -- if I'm the first to publish I get the Fields Medal for sure, and thats just for starters.", thats clearly not extortion. I haven't hurt or expressed a plan to hurt the bank yet.

Yep, granted, they'll only know the exact nature of the vulnerability if they either pay me or independently prove P=NP, but that has been true for every day of the last 50 years regardless of what I've done.

"Pay me $250 million dollars or I upload the n*log(n) factoring code to the file sharing networks. Imagine what the Russians could do with that. I'd hate to have a billion dollars an hour running over insecure wires, wouldn't you?", now THATS extortion.

I can't find the crime here which is divorced from the trespass.

Hole in the bank's security

[it074813]

Regardless his intent is malicious or not, he is smart in doing business or not, he managed to show the bank has a big hole in its security. A salute to him.

This is boring guys. New Dvorak

[Anonymous Coward]

Guys someone submit his new crock of rumors and fud.

Re:Insert dick here

[pembo13]

Windows? Is that you?

But there's a missing detail...

[KingJackaL]

...did he wind up getting any payment from the RBNZ/Telecom?

The decision by the judge would about make sense if he didn't. Namely - you weren't bad enough to get hammered, but you were stupid enough that shouldn't be rewarded.

sense of justice

[Anonymous Coward]

Just by reading the headline I knew it couldn't possibly be in the US. Most judges here are out of touch with society, or beholden to special interests. They'd never stand out of line. If you've even been involved in the US legal system you learn this all too quickly. The judge and lawyers cut deals behind your back, and you sit there like an idiot to see how much pull your lawyer has, regardless of the law.

Judge Refuses To Convict...

[GotenXiao]

...CRACKER. Turn in your geek license.

Re:Judge Refuses To Convict...

[kaffiene]

Oh piss off newb. When I was a kid, "hackers" hacked into systems and "crackers" cracked programs to defeat copy protection. Just because you facists decided you could tell everyone else that those words have different meanings, doesn't mean everyone else has to follow.

It's all in the details.

[TheLink]

It's a matter of the details and we don't know the details of the case. And the details are important.

After all, from what I see he could have told the bank something like the following:

"Hi, you've got security problems with your email server, the following webservers have serious problems and need to be patched (list of IPs), the following servers have easily guessable ssh username and passwords.

If you want more details my professional rates are XYZ."

While that's not the best way of going about doing things, I don't think that should be considered criminal.

The Bank is free to look for a different person/organisation to do the job, and give that info to them as a starting point.

After all providing a detailed and professional report and recommendation takes a fair bit of time and effort. You can't expect that bit for free.

So not knowing the details I don't think we should be so sure that he's been doing extortion or blackmail. Maybe the Bank has been nasty about the whole thing - after all when was the last time a Bank has behaved well?

Maybe someone had to cover up their ignorance and incompetence and thus treated it as extortion.

AND that's why I think the guy was dumb to do what he did - after all he's not dealing with a friendly organisation - he's dealing with a Bank. Lucky for him, he's in NZ and not some uncivilized country like the USA[1].

Many of the slashdotters seem to be used to the US "justice" system.

[1] If you win cases because you have more money or power, that's not really better than one of those corrupt African countries is it?

Re:It's all in the details.

[TheLink]

Oops it should read: "If you want more details and help my professional rates are XYZ."

Re:It's all in the details.

[Espressoman]

Surely the manner in which he obtained his information was illegal.

Um, Exposing a problem is not CREATING a problem

[Anonymous Coward]

Excuse me,? He compromised NOTHING, he only exposed problems already existing in the system that apparently they would rather keep than fix.

"Hey, he exposed our weaknesses! put him in jail so on one else (like the PUBLIC we are supposed to serve) finds out we aren't smart enough to properly configure our stuff and are too cheap to have it done correctly for us!"

Good job!

At least the judges have some brains in NZ.
I wonder what thier immigration laws are like?

Re: TFA Says Nothing About Threatening Banks

[alakazam]

In fact, TFA says exactly the opposite -- says he told the banks what the problems were, provided details of how to fix it, and asked for payment:

He outlined problems with the bank's telephone system, then requested payment for providing the information. He also contacted Telecom and asked for payment, outlining testing he had conducted, vulnerabilities he had found and ways these could be fixed.

We may not have *all* the details, but there's nothing there that could reasonably be construed as extortion.

Jay Jennings

He was asking for it....

[Bitsy Boffin]

sorry, but this guy was asking for trouble. Firstly, it wasn't just any old bank, it was the Reserve Bank (http://en.wikipedia.org/wiki/Reserve_Bank_of_New_ Zealand), secondly, when he discovered this flaw he didn't just tell them about it, he said basically "I found a flaw, now pay me money".

You don't mess with the systems controlling an entire countries economy, and then demand money for it, if you do, well, Darwin would like a word with you.

Re:He was asking for it....

[cdn-programmer]

You sure got that worng. The judge sided with the guy.

finpost

[Anonymous Coward]

final porst!!!

In New Zealand ...

[Anonymous Coward]

only dumbarses say dumbass.

Bravo AC

[Anonymous Coward]

Only in america could bush ever get in.

Re:Insert dick here

[Anonymous Coward]

Linux is for everybody. Got a problem with "fags"?

who's bad?

[hkBst]

So you've got this bank which holds a large sum of money for you/lots of different entities. But instead of renting a building and doing their business there they figure it is cheaper to just conduct business on the street and save some money on rent, but to protect their security they set up in a deserted part of town, where normally no-one goes. Then some day this guy decides to take a look. So he takes the day off and buys a bus ticket and off he goes. Imagine his horror at the bank's security measures. So this guys thinks to himself: "I should do this for a living. I'm good at it and somebody had better make these banks understand. 't Might as well be me.", and sends the bank a bill for his security check.

Morale: you can't break in through an open door. Banks should keep their doors closed. Keep your money in a sock and let no bank near it.

Judging from the name...

[Anonymous Coward]

...he's a Greek. We Greeks are notorious for covering our utter stupidity with the steadfast belief that we're smarter than anybody else out there.

Re:Insert dick here

[Aeamarth]

Maybe what he is trying to tell us is that he's an arseface or something...

lazy judge~

[tokapi4223]

LOL.. the judge just lazy..

Re:Um, Exposing a problem is not CREATING a proble

[aplusjimages]

Maybe he shouldn't have said he was an auditor, but instead a security systems checker. Then he could have charged more.

Since when...

[toonworld]

..is telephone system considered an information system? I think I missed something.

I actually applaud the NZ courts. The man could have used the information to commit fraud, steal sensitive/valuable information and sell it to the highest bidder and make a whole lot of money but instead he chose to go directly to the bank and ASK for payment.

So he had a sure way to make money, but instead he ASKS for money AFTER revealing the security flaw. If you ask me, the bank suffered from bruised ego syndrome and wanted some sort of revenge. It's nice to see that the bank didn't get what it wanted.

Re:Since when...

[tomhudson]

He didn't have a "sure way of making money."

On any phone system, there are going to be users with easy passwords and default passwords that didn't get changed, or got reset during maintenance.

This doesn't give him the right to go around playing detective unasked, then trying to bill them for it.

How about if someone shows up at your house unasked, and tells you they inspected it, and you need to do the following work, and by the way, their bill for the unwanted "inspection" is $300.00? I'd call the cops and nail the con artist for trespassing.

Re:Since when...

[Schraegstrichpunkt]

This isn't a house. It wasn't trespassing.

I consider banks to be an essential public service, even if they're privately-owned. If this guy was able to get access, regardless of what he did with it, then I think the people at the bank should have to answer for it.

Re:Since when...

[DocSavage64109]

Suppose he was driving down the street with a war-driving app and was informing people of their open wireless routers.
Suppose he offered to correctly configure said routers for the homeowners for $5.00.
That doesn't sound so bad, does it?

I have no idea how much money the hacker/consultant wanted from the bank for his services, but I bet the ammount relative to their income was miniscule indeed.

Re:Since when...

[tomhudson]

Give it up. This wasn't that type of bank - which you would have known if you had read the article.

It was a phone system. How would you like someone else listening to your voice mail because your password was 1-2-3-4-5?

Re:Since when...

[tomhudson]

He was war-dialing their phone lines, trying to get into peoples voice mail boxes by entering easy passwords, like 111 or 12345 or the person's birthday.

Would you like someone doing that to you? Would you consider that the same as an access point with NO password?

Its not the same as an open wap with no password - the voice mailboxes had passwords, and they weren't broadcasting their existence to the whole world.

Re:Since when...

[Schraegstrichpunkt]

Give it up. This wasn't that type of bank -

I wasn't what type of bank? The type of bank that handles large sums of other peoples' money?

which you would have known if you had read the article.

I read the article, and I just looked at it again. I still don't see what you mean.

It was a phone system. How would you like someone else listening to your voice mail because your password was 1-2-3-4-5?

There are only three reasons why my voice mail password might be 1-2-3-4-5: either I didn't know that was the password for some reason (maybe somebody else set the password up for me on speed-dial), or I thought there was something else preventing others from accessing my voice mail, or I just don't use my voicemail. In the first two cases, I'd want to know, and in the last case, I just wouldn't care. In no case would I be taking legal action against the person who told me that I have a problem.

However, that's irrelevant to my point, which is that the rules change when the organization is effectively (if not legally) a public trustee, like a bank, a telco, or a government. In the case of my voice mail, it's perfectly within my rights to have a stupidly easy-to-guess voicemail password. However, public trustees have (or should have) an obligation to maintain a reasonable amount of security. They do not (or should not) have the right to have (in your example) a stupid voicemail password, if that password protects other people's assets in a significant way.

People should be trying to break into these security systems every day, and they should be failing most of the time. I would be much more trusting of a bank that encourages anyone to test their information security than one that tries to hide their security flaws using the legal system.

When it comes to information systems, it's much like cryptography. Do you trust the algorithms that have been attacked countless times and found to be secure, or the algorithms that have never been attacked?

Re:Since when...

[tomhudson]

I wrote:

Give it up. This wasn't that type of bank -

Poster replied:

I wasn't what type of bank? The type of bank that handles large sums of other peoples' money?

I wrote:

which you would have known if you had read the article.

I read the article, and I just looked at it again. I still don't see what you mean.

No, it doesn't handle "other people's" money. You can't open an account there. Its the central bank for New Zealand http://www.rbnz.govt.nz/

The opening phrase of the article: " A man who accessed the Reserve Bank's telephone systems" should have been sufficient. Like the Federal Reserve in the US, it sets monetary policy, etc., but you can't apply there for a car loan or a mortgage.

People should be trying to break into these security systems every day, and they should be failing most of the time. I would be much more trusting of a bank that encourages anyone to test their information security than one that tries to hide their security flaws using the legal system.

When it comes to information systems, it's much like cryptography. Do you trust the algorithms that have been attacked countless times and found to be secure, or the algorithms that have never been attacked?

So by the same logic we should encourage the local mob to send a couple of boys around to break a few of your bones or smashing a few windows, testing your "personal security" and "need for protection". After all, its "okay" to attack unprotected systems, even if its illegal ...

The guy should have been sent to jail, just like anyone else who tries to run any sort of "protection racket" ... which is what this guy was doing, the implied threat being "I could leak this information."

Re:Um, Exposing a problem is not CREATING a proble

[tomhudson]

The judge was an idiot - what this guy did was just a new twist on the old "send them a bill and hope they pay at" scam.

A man who accessed the Reserve Bank's telephone systems to find security weak spots then billed the bank for his unsolicited services told the Wellington District Court he was surprised when police questioned him about his actions.

Gerasimos Macridis, 39, a researcher, represented himself in court before Judge Ian Mill.

Macridis pleaded guilty to one charge of intentionally accessing a computer system knowing he was not authorised to do so.

Police prosecutor Colin McGilivray told the court Macridis had telephoned the Reserve Bank on May 30, introducing himself as a security consultant.

He outlined problems with the bank's telephone system, then requested payment for providing the information. He also contacted Telecom and asked for payment, outlining testing he had conducted, vulnerabilities he had found and ways these could be fixed.

This is the same sort of scam that boiler-room ops do all the time - sending bills for unsolicited ad space in non-existent magazines, etc.

The guy is scum. The judge was out to lunch on this one.

Lets put it in terms slashdotters can understand ... someone does a pen test of your web site, and sends you a description of what they found, plus a bill for their unsolicited :advice" ... even though you didn't ask them to try to do any penetration testing and you never heard of them before ...

Or someone tries to break into your house, then sends you a description of all the "security weaknesses" they found, plus a bill for their time.

Just because its a phone system doesn't make it any less an attempted con job.

dyslexics of the world...

[toonworld]

UNTIE!!

Re:Um, Exposing a problem is not CREATING a proble

[lubricated]

Yeah I get something similar from charities sending me mailing labels every Christmass and then charging me for them. I also get mail in the form of a check only when you look at the small print it's a loan. Yeah it's all bullshit. Usually legal though.

AGHHH. Stupid Analogies ...

[Anonymous Coward]

BANK != HOME
13
Do you live at a bank? Do you sleep there? Is that where you consider yourself safest at night?

Look, comment for what this story is, not what you think its equivalent to.

He did an unauthorized security audit for a bank phone system, and tried to bill them for his actions in the audit. At most he is guilty of gaining unauthorized access, and being stupid.

Should he be locked up? Doubtful. Was what he did illegal and punishable? Yes. Should he be required to sort RJ-11/RJ-45 ends out of a landfill for 1 year as punishment?? Yes.

A terrorrist, cracker, or whatever malcontent term people prefer, would have identified the security lapses, sold it to someone else with 'bad' or 'nefarious' intentions, for either profit, idealogical reasons, or disagreement with the government. As best we can tell, he did none of these things. Merely tried to make himself a quick buck out of unwanted services rendered for the bank.

If I was the bank, I'd give him $50, make him sign a legally binding contract regarding information disclosure. If he refused, then sue him.

Re:Um, Exposing a problem is not CREATING a proble

[sjames]

Lets put it in terms slashdotters can understand ... someone does a pen test of your web site, and sends you a description of what they found, plus a bill for their unsolicited :advice" ... even though you didn't ask them to try to do any penetration testing and you never heard of them before ...

Tell him you aren't going to give him a penny, but thanks for the free security audit!

The judge's decision came from a correctional view of the justice system there rather than the punitive model used in the U.S. (despite the U.S. tendancy to falsely call prisons correctional facillities). That is, the judge believed that the process of justice up to that point had already convinced the defendant not to do it again and the free security audit was adequate restitution.

Almost as rare ...

[Dareth]

... as a Math teacher who teaches the material, brings the students who are behind up to the level they need to be, and doesn't fail 85% of the class.

Alas, I fear this Judge will last about as long as "good" math teachers. To be liked by students is a death sentence for math teachers.

Ouch

[John Jamieson]

How could someone that is so right on Linus etc, be so far off on this one. I have previously enjoyed many of your posts.

The poster was using an analogy to show his perspective, and you went off and started talking about sexual abuse and killing? Molestation causes perminant scars, and nuclear weapons the same... so while you might not like his "stupid" analogies, at least they were in the "same book". The "same book" as in, he was likely trying to find an analogy where there was no harm done by the actions, In your analogies - well...

Thanks in advance for your Christian Charity in trying to understand my perspective, and why I find talk of molestation more serious and offensive than all the bad analogies and benevolent hacking in the world. (ok, so I have a daughter)

Re:Ouch

[Schraegstrichpunkt]

How could someone that is so right on Linus etc, be so far off on this one. I have previously enjoyed many of your posts.

Thank you.

The poster was using an analogy to show his perspective, and you went off and started talking about sexual abuse and killing?

Fordiman started by using an analogy to explain his position, and Typhon100 answered with another analogy to explain a different position, but he did it as though that somehow constituted an argument against Fordiman's position. That is where my criticism lies.

Analogies can be useful in giving a simplified view of some aspect of a system. For example, a "folder" on a computer is analogous to a folder in a filing cabinet, and a file on computer is analogous to a file in a filing cabinet (insomuch as files go inside folders). The value of analogies is that they discard most of the details of a system while keeping certain notions-of-interest intact. However, because using analogies involves discarding arbitrary details, it is silly to use an analogy as the basis for an argument; Different parties can form different arguments based on different analogies that discard different details. In the files/folders example, it would be stupid to use those analogies as the basis for arguments about the merits of implementing directory indexes, hard links, versioning, or whether it's a good idea to nest directories.

My analogies were supposed to be both disgusting and comical in an over-the-top sort of way (think "NUCLEAR WEAPONS" like how Dr. Evil would say it). They illustrate my simultaneous disgust and amusement when I see people trying to advance arguments based on analogies. That they don't do a good job is exactly my point.

Re:Um, Exposing a problem is not CREATING a proble

[squiggleslash]

I kind of agree with you, and at the same time I really don't want a situation where every time someone acts like a jackass, they get jailed.

I'd love it to be easier to be compensated by people acting like jackasses though. Some way of, without having to spend a lot of time and effort, "fine" people $10 every time they do something deliberately against me in bad faith. That would certainly cut down on the jackassery. The problem is finding a workable, no false positives, mechanism for doing it.

This is no different...

[An Ominous Cow Erred]

...than the guys who go walking down the street peering at houses looking for termite damage that the owner might have missed. Not only do they tell you about a problem that you might not know about, they offer their services to fix it. You're under no obligation to pay them for finding it, but a lot of people are grateful to the person and fork over some cash anyway (and maybe hire them to help more).

Re:This is no different...

[owlstead]

A termite-analogy for an IT issue? What are you thinking? You should really try keep to car analogies if possible. The guy walks along rows of cars to see if they are locked, and mentions it to the owners if they are not. See? Fixed that.

I like that

[albsallu]

People are failing to realise that without that guy doing what he had done, the bank wouln't have realized that there is a security problem with their system. We all think hacking is a dangerous thing. In some sense yes it is when it is done without you submitting that you have done something bad that will put someone into a loss, but in the reverse it is good. Would you thank your neighbor if he tell you that your wireless is open or would you care about how he knew that it was open? You will thank him/ or her and find a way to secure it.

Re:I like that

[owlstead]

Exactly. Just performing your yearly security audit is not going to cut it. Sometimes you must take someone that thinks sideways and let him/her have a crack at it. What if someone had used this later on for bad purposes? What is going to happen if these guys feel let down by the system and get creative after breaking in? I mean, it seems that the chances of getting sued are actually smaller if you do something really illegal with the security flaws discovered (because the reserve never may have found out). If every whistle-blower is going to be taken into court, I don't think the world will be a better place.

Re:Um, Exposing a problem is not CREATING a proble

[Anonymous Coward]

> The judge's decision came from a correctional view of the justice system there rather than the punitive model used in the U.S. (despite the U.S. tendancy to falsely call prisons correctional facillities).

Funny, in the U.S. we call that judicial activism. Sounds like this judge from New Zealand is more interested in conducting a social experiment than interpreting law.

> That is, the judge believed that the process of justice up to that point had already convinced the defendant not to do it again and the free security audit was adequate restitution.

First of all it wasn't a "free security audit", it was a crime. The hacker had no authorisation from the bank and violated the privacy of all customers holding accounts there. Second, the judge has no evidence that the hacker won't commit the crime again. The judge even went so far as to call the hacker's actions "honorable." Does anyone else see the irony here?

Re:Um, Exposing a problem is not CREATING a proble

[Anonymous Coward]

> Funny, in the U.S. we call that judicial activism

No we don't. The term "judicial activism" is used in reference to acts of judicial interpretation that critics consider to take on suspected political reasoning, rather than an evaluation of applicable law. It has nothing to do with correctional vs. punitive. You're a moron.

Mod Parent UP!!!

[grolschie]

Parent tells the truth. Australia was a convict colony, NOT New Zealand. New Zealand != Australia.

Re:Um, Exposing a problem is not CREATING a proble

[Anonymous Coward]

Thanks, I'll admit that my framing was moronic, but that doesn't justify name calling. The New Zealand judge is clearly applying his own ideology to the ruling. The judge actually believes that the hackers invasion of the privacy to thousands of the bank's customers was "honorable." Whether you call it correctional, political, or ideological it _is_ judicial activism, plain and simple. Mor... oh wait.

viva New Zealand

[sii074306]

I think in other country, he may faced the opposite judgement. So for those who like to be just like that man, you can come to the New Zealand.

hacker judge

[PK075840]

Maybe they had to come up with the hacker judge.That would be more secure and for sure a lot of people are interested to.

Own government

[PK075840]

I think he'll plan to set up his own government.

Can this set a precedent all over the world

[PK075840]

I hope not so

judge and the lawyer

[PK075840]

since the judge is giving stupid result,what are the laywers doing there.

Re:Um, Exposing a problem is not CREATING a proble

[sjames]

Funny, in the U.S. we call that judicial activism. Sounds like this judge from New Zealand is more interested in conducting a social experiment than interpreting law.

As others have pointed out, that's not judicial activism. Secondly, you assUme that New Zealand takes the same punative approach to criminal behaviour that the U.S. does and that the judge has gone against that. Have you considered the possability that the New Zealand judge in New Zeland presiding over a case of New Zeland criminal law might have acted entirely in accordance with the guiding principles of of New Zeland legal philosophy? Different countrys are different!

First of all it wasn't a "free security audit", it was a crime. The hacker had no authorisation from the bank and violated the privacy of all customers holding accounts there.

The hacker accessed the phone system of a reserve bank. You and I have no evidence that any customer (which would be other banks, not actual people) data was accessed at all. Perhaps he dialed in and then made a long distance call for example. The judge, on the other hand, would have that evidence if there is any.

Second, the judge has no evidence that the hacker won't commit the crime again.

Are you sure? He was there and we were not. He had the opportunity to observe the defendant's demeanor and statements and weigh them for himself. He might have found the defendant's statements as repentant and based on his demeanor, believable. Such JUDGEments DO have a place in criminal law.

The judge even went so far as to call the hacker's actions "honorable." Does anyone else see the irony here?

The judge called the hacker's INTENTIONS honorable, not his actions. That is, he judged that the man intended to improve the bank's security and be paid for doing so. Those are the intentions of any security consultant. This is as opposed to intending to take advantage of the bank's security problems for undeserved gains. That would be a criminaal intent.

Performing the service first without authorization then seeking payment was at least foolish. It may have been criminal in NZ law (I don't know either way). However, the judge determined that given the defendant's intentions, a conviction would be disproportionally punative.

Re:Um, Exposing a problem is not CREATING a proble

[Anonymous Coward]

>> Funny, in the U.S. we call that judicial activism. Sounds like this judge from New Zealand is more interested in conducting a social experiment than interpreting law.

>> As others have pointed out, that's not judicial activism. Secondly, you assUme that New Zealand takes the same punative approach to criminal behaviour that the U.S. does and that the judge has gone against that. Have you considered the possability that the New Zealand judge in New Zeland presiding over a case of New Zeland criminal law might have acted entirely in accordance with the guiding principles of of New Zeland legal philosophy? Different countrys are different!

And as others have done, you are ignoring the fact that I said, "in the U.S.", it's a very important part of what I said. I never claimed that judicial activism applied to New Zealand in the literal sense. I was simply pointing out that the ruling would be more controversial here in the States. Others in the broader discussion have noted enthusiasm that this New Zealand ruling should set a precedent here in the States, but to me it seems that there's a fundamental difference between American standards and New Zealand's standards. I believe a little caution might be in order to those that would have us quickly adopt another country's standards.

Of course we don't know all of the details, that's why it's called speculation. What we do know is that the hacker was awarded for his foolishness and if I was a New Zealander I would hope that would be enough to give me pause.

Re:Um, Exposing a problem is not CREATING a proble

[sjames]

I did see "In the U.S." but mis-interpreted the phrase to apply to the term rather than the action the judge took. Sorry about that :-)

In general though, I do advocate moving to a more corrective approach to criminal justice. I believe it would result in an overall reduction in crime and save money on prisons at the same time.

It's not something that can be done overnight, but we could transition that way gradually. For example we could start by repealing minimum sentencing for non-violent offenses.