EBay Hacker's Conviction Upheld

An anonymous reader writes "The 9th Circuit Court of Appeals has ruled in the case of Jerome Heckenkamp, the former University of Wisconsin student convicted of federal computer crime charges in 2004 after hacking into Qualcomm, Cygnus Solutions and other companies, and defacing eBay. Heckenkamp was caught after a system administrator at the university hacked into his Linux box to gather evidence that Heckenkamp had been attacking the college mail server. The court ruled today that such counter-hacks are allowable under the 'special needs' exception to the Fourth Amendment, and upheld the warrantless search."

Comments

Correct decision

[daveschroeder]

The University was not acting as law enforcement, as an agent of law enforcement, or at the behest of law enforcement, and thus is expressly and explicitly not covered by, or even related to, the Fourth Amendment.

The University acted to mitigate and prevent further intrusions, the scale of which were as yet unknown, into critical University servers and infrastructure upon which tens of thousands of people and many diverse University functions depend.

If you hack University servers from your computer (or even if the computer is being used a zombie), and then take steps to hide your identity or otherwise conceal your activities, your network access will be removed, such removal will be actively enforced and verified, and any immediate actions required to protect the security and integrity of the University network and computing resources will be taken.

Academic, legal, and possible criminal action will then follow, as warranted. These were exigent circumstances, and not done under the guise of law enforcement, but rather the protection of critical university resources from activities clearly and explicitly disallowed by numerous University information technology, housing, academic, and general policies (not to mention various federal and state laws).

Also, while we're on this topic, if the situation were reversed, I can imagine slashdotters would hardly call the equivalent situation a "hack" (i.e., "the university hacked into his Linux box"). Using the typical logic, he apparently didn't protect his machine well enough, so it's okay, right? Oh, but he's on the malicious side, so he's right, and the University trying to protect itself, from someone violating just about every University policy with no expectation of privacy on the network of a public research university, is wrong?

Let me know when you people get your stories straight.

And please, RTFA:

Here, Savoy provided extensive testimony that he was acting to secure the Mail2 server, and that his actions were not motivated by a need to collect evidence for law enforcement purposes or at the request of law enforcement agents. ... The integrity and security of the campus e-mail system was in jeopardy. Although Savoy was aware that the FBI was also investigating the use of a computer on the university network to hack into the Qualcomm system, his actions were not taken for law enforcement purposes. Not only is there no evidence that Savoy was acting at the behest of law enforcement, but also the record indicates that Savoy was acting contrary to law enforcement requests that he delay action.

Under these circumstances, a search warrant was not necessary because Savoy was acting purely within the scope of his role as a system administrator. Under the university's policies, to which Heckenkamp assented when he connected his computer to the university's network, Savoy was authorized to "rectif[y] emergency situations that threaten the integrity of campus computer or communication systems[,] provided that use of accessed files is limited solely to maintaining or safeguarding the system." Savoy discovered through his examination of the network logs, in which Heckenkamp had no reasonable expectation of privacy, that the computer that he had earlier blocked from the network was now operating from a different IP address, which itself was a violation of the university's network policies.

This discovery, together with Savoy's earlier discovery that the computer had gained root access to the university's Mail2 server, created a situation in which Savoy needed to act immediately to protect the system. Although he was aware that the FBI was already seeking a warrant to search Heckenkamp's computer in order to serve the FBI's law enforcement needs, Savoy believed that the university's separate security interests required immediate action. Just as requiring a warrant to investigate potential student drug use would disrupt operation of a high school ... requiring a warran

Re:Correct decision

[The Only Druid]

Fantastic post. Frankly, the thread should end right here.

Re:Correct decision

[Score Whore]

Last Post!

Re:Correct decision

[stecoop]

You forgot to add that Odds are that the 9th Circuit will get overturned...AGAIN!

Can you guarantee that the System Admin didn't plant the evidence or the evidence was otherwise compromised? Well, now here is the problem, since you said you can guarantee it, that anyone that is called a System Admin is now allowed to plant evidence and vigilantism rules the internet.

Re:Correct decision

[daveschroeder]

Well, the 9th Circuit (which issued this ruling) is a very liberal court, which routinely sides with privacy, individual rights, and personal liberties, and does not err on the side of the state. So you can rest assured that any appropriate protections afforded Heckencamp were more than duly considered.

You may be interested in reading the entire ruling.

The applicable bit:

Once a court determines that the special needs doctrine
applies to a search, it must "assess the constitutionality of the
search by balancing the need to search against the intrusiveness
of the search." Henderson, 305 F.3d at 1059 (citing Ferguson,
532 U.S. at 78). The factors considered are the subject
of the search's privacy interest, the government's interests in
performing the search, and the scope of the intrusion. See id.
at 1059-60.

[...]

The district court did not err in denying the motion to
suppress the evidence obtained through the remote search of
the computer.

[...]

Here, even without the evidence gathered through the
allegedly improper search, there is sufficient information in
the affidavit to establish probable cause. The affidavit recited
evidence that the server intrusion had been tracked "to a campus
dormitory room computer belonging to Jerome T. Heckenkamp";
that "[t]he computer is in Room 107, Noyes House,
Adams Hall on the University of Wisconsin-Madison"; and
that "Heckenkamp previously had a disciplinary action in the
past for unauthorized computer access to a University of Wisconsin
system." This was sufficient evidence to obtain the
warrant to search "Room 107, Noyes House, Adams Hall."

So, the search warrant exemption applied, and even without the information in question, there was, regardless, already sufficient information for a search warrant.

Re:Correct decision

[jrockway]

> Using the typical logic, he apparently didn't protect his machine well enough, so it's okay, right? Oh, but he's on the malicious side, so he's right, and the University trying to protect itself, from someone violating just about every University policy with no expectation of privacy on the network of a public research university, is wrong?

Problem with your logic there. If the University thinks being hacked is wrong, then why do they think hacking someone else is right? Two wrongs don't make a right. The hacker is a criminal, and the University (employee that did the hacking) is a criminal. It's that simple.

Re:Correct decision

[daveschroeder]

The reason the 9th Circuit gets overturned is because it's a very liberal court that is often seen as out of step with prevailing views.

It also is very protective of personal and individual rights, liberty, and privacy, and does not err on the side of law enforcement or the state. It is probably statistically the most likely court to rule against the interests of the government and for the interests of the individual.

This one's not going to be overturned.

Also, you should really, really read the ruling.

Re:Correct decision

[Nukenbar2]

How is that different from any evidence collected from anywhere?

Most evidence has to be authenticated by the person that recovered it. Just like if a store security guard see you shop-lifting, stops you and searches you, anything he finds, such as a bag of coke, you can be prosecuted for. How do we know he didn't plan it? He has to take the stand, swear to it, and then be cross-examined. That is how our system works, mostly.

Re:Correct decision

[garcia]

Problem with your logic there. If the University thinks being hacked is wrong, then why do they think hacking someone else is right? Two wrongs don't make a right. The hacker is a criminal, and the University (employee that did the hacking) is a criminal. It's that simple.

And the fact that this user agreed that SysAdmins may take steps to end emergency situations doesn't immediately say to me "oh, they can then hack my machine to hand over my personal files to the government without a warrant."

To me that says, "oh, they can fucking shut off my port and block my current MAC address," but I'm not a University of Wisconsin IT staff member/zealot like Mr. Schroder.

Re:Correct decision

[sumdumass]

The ninth circuit has a large percentage of rulings overturned by a higher court.

I cannot find the quote but I think they hold over 60% of the overturns the supreme court has done in the last 20 or so years. They tend to have what some would call "activist decisions" and have been questioned about which constitution they were looking at when deciding some cases in the past. The tend to have a liberal interpretation of the laws too.

Re:Correct decision

[daveschroeder]

Its track record is clear, exactly as stated, and no matter how "liberal" it is or isn't, the 9th Circuit has a consistent record of always erring on the side of individual rights, liberties, and freedoms, and against the interests of the government, sometimes to ridiculous degrees.

And since there's an entire huge section in Wikipedia and over 1 million hits on google for "9th circuit liberal", regardless of "how much" it's true, there is no denying that, among all appeals circuits, the 9th is the "most" liberal.

But in this case, it's so clear cut that the University acted properly, it wasn't difficult for the court to rule on the side of the University's actions.

The point is, the court most likely to overturn the conviction didn't. And therefore, it's reasonable to believe this is how it will remain.

Re:Correct decision

[bhsx]

If the University thinks being hacked is wrong, then why do they think hacking someone else is right? Two wrongs don't make a right. The hacker is a criminal, and the University (employee that did the hacking) is a criminal. It's that simple. Scenario:
You are at the mall and some psycho starts shooting everyone in sight with an AK-47. You work in the mall as an armed guard. If the mall thinks being shot at and killed is wrong, then why do they think shooting someone else is right? Two wrongs don't make a right. The shooter is a criminal, and the mall security guard is a criminal. It's that simple.

Re:Correct decision

[daveschroeder]

You forgot the whole part about how even without the allegedly improperly obtained information, there was still sufficient evidence for a search warrant.

Also, at the time that this incident occurred, there wasn't an integrated capability to block MACs on the Housing network by the central IT organization, for various reasons. The most immediately available option was blackholing the IP, which was done, at which point the user simply manually assigned himself an unused IP on the DHCP network and continued malicious activity. The central IT organization does not operate the Housing network, and also didn't have immediate capability to physically disable ports in dorm rooms.

Today, we have all of those capabilities. Then, the only option for dealing with a very critical situation was taking all steps to actively ensure and verify that this computer did not come back on the network during the evolving emergency situation occurring over a very short period of time.

Re:Correct decision

[sumdumass]

There are a lot of situations were people are forced to do things that are illegal but is otherwise considered ok in the circumstances. Killing a person is illegal, killing a person to save your own life gets you a pass. Speeding is illegal, speeding away from a shootout where it is likely you could be hit by a stray gets you a pass. Jaywalking is illegal, jaywalking to get away from a crumbling building gets you a pass.

Do you see a pattern here? Sometimes in order to protect yourself, illegal actions don't' make you a criminal. It was supposed that these illegal actions were necessary and therefore don't make the universities criminal.

Re:Correct decision

[daveschroeder]

Yes.

Cutting off his network access wouldn't have been able to happen immediately. The central IT organization does not operate or have physical access to the Housing network. The only option, at the time this occurred, was blackholing the IP and ensuring insofar as was possible that the same computer not reappear on the network and continue malicious activities.

Today, after a 5-year, $50 million network upgrade, there are numerous options for blocking MACs, remotely disabling network ports, and so on. None of these options were available at that time. So in an emergency situation, everything was done to ensure that intrusions into critical systems and infrastructure, possibly broader than were even known at that time, would be stopped as soon as possible, which included actively ensuring that the same computer not reappear on the network. At that time, there wouldn't have even been an easy way to see the MAC on the Housing network, so verifying that it was indeed the same computer and then taking mitigating steps was the best immediate emergency option.

Re:Correct decision

[Kythe]

Whether there was sufficient evidence for a warrant is irrelevant -- as you yourself noted, the University is not a law enforcement entity, nor were they working in that capacity.

Additionally, whether the University had the means to sufficiently control its network is also not relevant to whether they had the right to break the law -- unless the man in question specifically allowed hacking into his computer by agreement. Did he do so?

IANAL, but I wouldn't be terribly surprised to see a lawsuit against the university over their actions. Frankly, I'm rather surprised no one has been charged with hacking the man's computer. Perhaps it's being "overlooked" due to the obviously bad actor involved -- but IMHO it shouldn't be. OKing this sort of vigilantism is a pretty dangerous thing to do, on many levels.

Re:Correct decision

[Waffle Iron]

Since his computer was in a dorm room, the correct thing to do would have been to walk down to the dorm, get the local Resident Adviser or whoever is in charge to open up the room (which is undoubtedly allowed in emergency situations under the lease-like contract that students sign), unplug the network jack, and call the police. This would have had the additional benefit of clearly preserving any evidence of wrongdoing within the attacking system.

Even if access to the room were not possible, they could have simply gone down to the router, pulled the plug on that room, and called the police.

Illegally counter-hacking the attacking computer (which also was likely to taint any evidence in the system) was *not* necessary under the exigent circumstances.

Re:Correct decision

[eli pabst]

I'm not that familiar with the case, but my question is who owned the computer that the administrator "hacked" into. If this was a University-purchased system, then I think they had every right. But if this is his own system that he purchased and simply was connected to a U of W network in his dorm then I think he had a reasonable expectation of privacy. His network traffic would be fair game, but unauthorized access is something different.

I'm not sure how connecting to someones network gives them the right to access my system without my consent. If I'm on a Verizon network, does that mean they can bruteforce my passwords and log onto my system, simply because I 'm connected to their network? What about Starbucks?

If the justification was to "protect the mail server" couldn't they just have physically disconnected his dorm room from the network (they knew where the first IP address was coming from). Again, I don't know the specifics of the case so I'm more curious than trying to throw stones.

Re:Correct decision

[daveschroeder]

He did have an expectation of privacy, and the court held that.

It also held that the emergency search fell under the doctrine of the "special needs" exemption to the Fourth Amendment.

These two principles were balanced, and special needs won out.

I really wish people would read the ruling, as it speaks in great detail about the principles of privacy, expectations thereof, why the search was acceptable in these circumstances, and so on.

Re:Correct decision

[Ardeaem]

AFAIK, you are wrong, and that is simply spin. A quick google search yielded this: http://mediamatters.org/items/200511090012

During its 2004-05 term, the Supreme Court reversed 84 percent of the cases it chose to hear from appeals of 9th Circuit decisions, compared to a 73 percent average reversal rate for all circuit courts of appeals.* But the high court reversed 100 percent of the decisions it heard from the 1st, 2nd, and 10th Circuit Courts of Appeals.* Moreover, as Media Matters for America has documented, the 9th Circuit's reversal rate was slightly lower than the national average for all circuit courts during the 2003-04 Supreme Court term (76 percent for 9th Circuit vs. 77 percent nationally), and only slightly higher than the national average during the 2002-03 term (75 percent for 9th Circuit vs. 73 percent nationally) and the 2001-02 term (76 percent for 9th Circuit vs. 75 percent nationally). and

While it is true that the Supreme Court has reversed more decisions by the 9th Circuit than by any other circuit court in terms of numbers alone, the 9th Circuit has a far bigger caseload than any other circuit (including the U.S. Court of Appeals for the Federal Circuit). People have tried to label them as some kind of crazy pinko judges, always on the wrong side of the Supreme Court, but it isn't true. And even if it WERE, with some of the decisions we've gotten lately you could do much better than always siding with the Supreme Court.

Re:Correct decision

[bugnuts]

Most universities with any sort of net access have rules stating that the sysadmins, in the course of their duties, can take action to stop attacks on the network.

The sysadmin initially blocked the port and called it good, probably with the intent to inform management and let them deal with it. One could argue that "I pay tuition and I was blocked illegally" but nobody here is saying that violated any rights.

Blocking was not sufficient to prevent the attacks, so the sysadm escalated his effort. That is a reasonable discharge of his duties IMHO, but some people are saying that this was illegal. I claim that doing nothing, or blocking the whole dorm would probably have been far worse for the rights of the students.

It's important to consider the rights of the guilty... the last thing we need is a drumhead legal system. But the rights of the innocent must be considered first. The impact of doing nothing or blocking everything was too great.

Re:Correct decision

[Kythe]

the underlying act itself was specifically exempted under special needs.

Again, this was specifically for the purpose of determining the admissibility of the evidence. The 9th Circuit was addressing an appeal, so could only rule on matters of law pertaining to that appeal.

Whether or not the university sysadmin would be convicted under the circumstances is a fairly open question, if he were charged with unauthorized access of a computer system. Now that I've read the ruling and the facts considered, it certainly doesn't look like this was "cyber vigilantism" under the normal definition of the term, nor was it for any of the normal purposes one might think of that make such unauthorized access illegal in the first place. It was directly intended to stop impending harm to the network, once the sysadmin had a reasonable suspicion he had the right guy. So I rather suspect that in this circumstance the sysadmin wouldn't be convicted even if charges were brought against him.

But again, I'm not a lawyer.

Darned good thing he didn't go further, though.

Re:Correct decision

[daveschroeder]

I think we essentially agree on the basic points here.

I understand that this ruling is only speaking to the conviction that is unrelated to the University efforts with regard to ensuring this computer remained off the network.

However, since special needs only applies to the explicit and direct action the University took, while this ruling is speaking specifically to the appeal of the conviction, it is still reasonable to believe that the action itself would be viewed legal upon consideration of that action alone. In other words, if that action is legal and allowable under special needs in this context, it's intrinsically legal and allowable on its own for the purpose it was intended to serve, namely, the protection of the University network and computing resources. At least, that is, in the view of the 9th Circuit - and I understand the 9th Circuit has no standing to comment on that issue alone, but I trust you see that this as a reasonable conclusion.

I do agree with your other observations, but I'm not even sure that any prosecutorial entity could be persuaded to bring changes, especially in the light of the 9th Circuit ruling, even if it is tangential.

Re:Correct decision

[geekoid]

This is the Problem:
What recourse does the person have if the Admin planted evidence?

This may or may not be the case here(probably not) but we know how petty people who illusions of power can behave, espcially in college.

Re:Correct decision

[daveschroeder]

This was 7 years ago, and all network resources (access, authentication, topology), among many other things, were not centrally managed.

There were a limited amount of things that could be done centrally. One of them was blackholing IPs. Physically disabling the port was also not possible in a timely manner.

After a 5-year, $50 million network upgrade, a lot of these things people are suggesting from their armchairs are now possible. But they weren't then. This was an IMMEDIATE situation that required emergency action.

This isn't as easy as it seems on a decentralized campus with 18000 staff, 45000 students, and 850 buildings, with the dorms run by a complete distinct university department (including, at the time and still today to an extent, the network), and so on.

Re:Correct decision

[keraneuology]

How does browsing through tmp block an account? He had verified that the computer was the same one that had been previously blocked but decided to give the hacker an additional 15 minutes of time which could have been used to cause additional damage on the university's network. Since the sysadmin was taking the time to snoop it should be clear that he was going beyond what was necessary in the emergency situation. A cop kicks in a door because he hears a scream and finds a woman bleeding to death on the floor. Instead of calling an ambulance or otherwise rendering aid he takes 15 minutes to wander through the house to search for drugs. Proper action?

Re:Correct decision

[kad77]

It's only that simple to simpletons. GTFO.

Re:Correct decision

[Waffle Iron]

After a 5-year, $50 million network upgrade, a lot of these things people are suggesting from their armchairs are now possible.

No, the only person with an armchair problem was that guy who couldn't be bothered to get out of his and make an appropriate response to the incident. Instead, he went the lazy/fun route, kept his butt firmly planted in his chair, and took matters into his own hands as a vigilante. Now 300 million Americans have just seen their bill of rights eroded by yet another increment because the university had to set new legal precedents to cover their asses from the fallout of this poor decision.

No matter what, they could have blocked access from the entire dorm for the hour or two that it would have taken to sort out the problem legally. If their network management was sooooo crappy that even that couldn't be done, they should have just turned off their own goddamned mail server to protect it from this omnipotent hacker that was apparently impervious in his dorm room a couple of blocks away. Committing new federal felonies as a first option was not the answer.

Re:Correct decision

[daveschroeder]

If you are a system administrator responsible for securing a network that serves 65000 people on a public research campus with a $2.1 billion annual budget, and you take actions to defend it from active a malicious attack that originating from the facility's own property and network by a person who is affiliated with your facility in violation of numerous policies of said facility, and this were nearly a decade ago and other suitable avenues for denying the attacker access weren't immediately available, then your emergency actions, too, may be considered appropriate by a court.

Does that help to answer your question?

Re:Correct decision

[woolio]

Indeed...

I'd saw remotely unplugging the room at the router is probably better than entering the room and unplugging the computer.

That way the admin would never obtain *physical* access to the computer (e.g. this removes a tiny amount of doubt that he could have tampered with the computer, e.g. with a boot disk/cd before the police arrive ).

Re:Correct decision

[Brad Eleven]

Right, exactly. The network, at least, and possibly the computer are/were the property of the University, so it has every right to inspect. This doesn't mean that the University was in its rights to turn over evidence to law enforcement, however; their rights end at the limits of their policy. That is, they could expel the student, even levy fines, penalties, whatever their policy provides for.

This is the same argument for not using resources at work for your own purposes. You can be fired, your employer can file civil suits, etc., because the computers, the network, the desk you sit at, etc., belong to the employer.

I think that the defense lawyer could have filed for suppression of the evidence obtained from the University, since it constitutes illegal search and seizure. Funny thing about these rights; they're subject to interpretation by judges, all the way to the Supreme Court. Even at that level, precedents can be set in their ultimate interpretation which are then used to apply to similar cases. Of course, these can be overturned in future by other judges, even by Constitutional amendment.

The long and the short of it seems to be that once the police have got you, there's very little you can do about it if you're denied bail--or worse yet, access to counsel and/or the evidence and the charges against you. The latter often require counsel, e.g., prosecutors can and do simply refuse to speak with non-attorneys.

There is the law, and then there is policy. The former is a set of ideals; the latter is a matter of practice.

Thank God

[normuser]

The court ruled today that such counter-hacks are allowable under the 'special needs' exception to the Fourth Amendment

Now I don't feel so bad about killing those zombies that keep trying to ssh into my box.

What?

[Spazntwich]

The court ruled today that such counter-hacks are allowable under the 'special needs' exception to the Fourth Amendment

So suddenly the retarded aren't protected by the bill of rights?

This is preposterous!

Implications for RIAA/MPAA lawsuits

[Anonymous Coward]

I'm a bit scared as to what this will mean for RIAA attacks against innocent people accused of file sharing. If "self help" is available for the university when someone hacked their server, why WOULDN'T the courts allow "investigators" working for the MAFIAA to hack into computers to determine if they were "pirating" music or movies?

Re:Implications for RIAA/MPAA lawsuits

[proxima]

I'm a bit scared as to what this will mean for RIAA attacks against innocent people accused of file sharing. If "self help" is available for the university when someone hacked their server, why WOULDN'T the courts allow "investigators" working for the MAFIAA to hack into computers to determine if they were "pirating" music or movies?

Well, one reason is that apparently this guy was connected to the university's network. He was using it to actively hack other systems, which is more clearly an "emergency" than copyright infringement (IANAL).

However, given that basically all major ISPs have user agreements such that you may not use their network for copyright infringement, they may be able to write in language that gives them the ability to not only shut down your network access but "counterhack" you at the behest of the RIAA.

Still, it's not clear that this would make their cases stronger. There might be some desire to actually have poked around in an alleged infringer's computer before they get a chance to wipe it clean, and it might reduce instances of "but someone was sharing my IP through my open wireless access point". Even so, it sounds like more trouble than it's worth, even for the RIAA.

Not at UW...

[daveschroeder]

Except for the fact that the University of Wisconsin isn't cooperating with the RIAA in its latest efforts:

University of Wisconsin-Madison Bucks RIAA
http://slashdot.org/article.pl?sid=07/03/20/015121 6

UW to RIAA: No way
http://badgerherald.com/news/2007/03/21/uw_to_riaa _no_way.php

It may be illegal...
http://www.doit.wisc.edu/news/story.asp?filename=8 12

Forensics Anyone?

[madsheep]

Ok this just sounds a bit ridiculous. This is essentially vigilante cyber justice. Now it had a bit more of a law enforcement/good guy vs bad guy twist, but I just don't see how this can be allowed. Where is this special need and why was this an acceptable method to go about anything?

Is anyone familiar with forensics? "Hacking" into another machine alters a ton of stuff..even if you're just logging in remotely with username/password you found. You've change login dates, profiles, logs, etc. How would this sysadmin have known this machine wasn't already compromised and was just being used a launching point?? If this was the case and the guy adamantly denied having been a part of it, he would have essentially *ruined* any and all evidence. This is just rediculous.

There they go again

[oldmacdonald]

Those darned liberals, always standing up for individual rights.

Not even a close question.

[Anonymous Coward]

The fourth amendment applies only to the state's action to investigate. So really the question here was whether the admin's knowledge of police activity made him an agent of the state. I don't see this case raising even a remotely close question. The admin did what any admins ought to do. Even if the admins' activities were illegal, he could get prosecuted, but the evidence is admissable

Just to hammer things home, if a thief breaks into your house and then turns in evidence of illegal doings over to the police, the fourth amendment won't exclude the evidence or any further evidence uncovered by the police based on a later search warrant.

Re:Question

[lys1123]

That would be a small group of Mac users, all of which have awesome nicknames like "Crash" and "Burn", who are lead by a fearless hacker leader who due to his previous hacking antics hasn't actually touched a computer in seven years.

DUH!

Re:Told you So...

[jonesy16]

A poetic response, so concise that I can't even comment about spelling or grammar. Anyhow, nice to see the world must be coming to an end if Slashdot's frontpage makes reference to a Linux box being hacked.

Regardless, as a former residential network admin at my college, I fully understand the position of the university. All students on my previous campus, anyway, were made to sign a use agreement prior to connecting their computers to the network. That agreement ensured the university's authority in maintaining a safe and legal network for all connected computers which included being able to shut down hackers, file sharers, etc. It is interesting to see that this sort of information can be submitted in a court case though. I still have no pity for this kid and hope he spends a lot of time in jail trying to build a computer from toothpicks and creamed corn. Watch your "backdoor" kid.

Now that I've read the ruling..

[Kythe]

...I have to modify my comments, above. It appears that the sysadmin wasn't involved in "vigilantism" under the normal definition of the term.

Re:Question

[Mister Whirly]

Chuck Norris

Re:Told you So...

[jonesy16]

RTFC, at no point did I promote/encourage/favor the unethical treatment of said convict's posterior. Secondly, you added the "violent" part all on your own. Sweet dreams.

Can't have it both ways

[imunfair]

You either leave the net as the wild west, and let every man fend for himself, or you set up concrete rules about hacking, etc and enforce them fairly.

I'm not defending the 'ebay hacker', but I think if he's in trouble then the sysadmin should be as well. There are a lot of physical solutions to cut off someone's net access if you have control of their building, in the event that you can't handle it on the technological side. The responsible thing to do if neither of those options were available would be to remove your server from the net, or actually make your system secure, and report the attacker through the proper channels.

And to all the people defending the sysadmin as justified, I would like to know why - if he thought blackholing the first ip was enough at the time - did he bother to find a working password on the system in question, and what methodology did he use to do that? Seems like he's just using the second attack as a CYA to hide his proclivity to hacking students machines when he wants to. (If you RTFA it says that he used a password from the first time to log in the second time and snoop around to verify it was the same computer)

Re:Told you So...

[Rosonowski]

Watch your "backdoor" kid. would imply that you would condone such things within our prison system. We're trying to rehabilitate people, and that's not going to help. As for violent, do you know of any other kind of rape?