Slashdot Mirror
Some DNS Requests Ruled Illegal in North Dakota
jgreco writes "A judge in North Dakota has just ruled that requesting a zone transfer from a public DNS server is criminal activity within the meaning of the North Dakota Computer Crimes Law. A zone transfer is a simple request that a DNS server hand over information in bulk, and a DNS server may be configured to allow or deny such requests. That the owner of a DNS server would configure the server to allow such requests, and then claim such requests were unauthorized, is simply stunning."
This in effect means that you cannot set up a secondary DNS server in North Dakota. Any ISPs in the state should probably relocate!
Most states have computer crime laws that pretty much say this: It is illegal to access a computer that you are not authorized to access.
This basically means that if you don't have written permission to access a computer, you can't access it legally.
So everyone who uses computers breaks the law, and the law is only truly defined by who prosecutors decide to prosecute.
This state of affairs is completely ridiculous, but unless you find a tech savvy Judge, the situation is unlikely to be changed through the courts.
If you had super powers, would you use them for good, or for awesome?
Might want to read the actual court ruling instead of the populistic and alarmist comments surrounding it. As I read it, the defendant already had been told by the court to stop bothering the plaintiff, and he then proceeded to ignore that. In and of itself the ruling doesn't outlaw dns requests, altough the judge's grasp of the technology clearly could stand improvement.
I didn't mean for anyone to read this post on the internet. So it illegal.
It's a civil case.
The worst that can be said about it is that it's bad precedent and the judgment was wrong.
The judge did not make DNS requests illegal.
Those who can: write code. Those who can't: write laws.
Can you imagine if every politician in the house and senate knew how to program? Granted a good portion of them would still be writing awful spaghetti code... but for the most part at least they would not be able to compile it.
What I find interesting is that "computer systems" i.e. networks, disk drives, files, etc. ae well understood by us computer folk. What is "obvious" to us has come from a lot of experience and learning. More over, in constructing things like the internet, we develop a lot of "rules" that make sense within this context.
In the non-nerd world, a lot of the rules created by us nerds run afoul of what most people expect. DNS is a perfect example. To us, it is MADE to serve data. If you put data into DNS, you've made it public. To the rest of the world, however, that doesn't make sense. Its the same issue with HTTP. We see putting stuff on a web site as making it public, but non-nerds see things like deep linking a violation of their site because it does not promote the interaction they expect (viewing ads etc.) and have invested in. To them, you are circumventing their revenue model.
I'm not 100% sure we're 100% right. I don't think we are wrong in our views, but I see the gray area between the two.
If Ritz had previously been ordered to leave Sierra alone, and hadn't, then that's a basis for the ruling right there, completely ignoring any aspect of DNS. From the court documents, the guy sounds like quite a piehole.
What you're forgetting is that in most court cases, the defendant is there for one of two possible reasons: they really weren't responsible, or they were responsible but are now lying about it. And the plaintiff or complainant is there to make sure something "legal" happens in their favor, and they're not above lying to get their desired outcome, either. Usually there's a lot of both. That means the judges are professionally sitting at the mouth of a never ending river of bullshit, and they have to keep control of the situation.
It's not that judges can't or refuse to understand the technology; it's that the cases are about the people, which is where their focus must remain. The computer didn't act of its own accord. It operated under the direction of its owner. The question of "was there malicious intent?" has nothing to do with DNS or any other logic-based technology and everything to do with the two guys standing in the courtroom.
John
Why the hell aren't we celebrating this, people? Okay, for DNS, it sucks... but look at it this way...
It doesn't matter if you set up your system to 'automaticly' share the files you just downloaded... people who accessed them did so without authorization. It can't be considered 'sharing' if you didn't authorize people to download them from you... could this ruling be a tool agaisnt the MAFIAA?
I can lock my house, but even if I do not do so, you will still be trespassing if you enter my house.
Well look at it this way. If I walk into a laundromat and there is no attendant on duty I would not consider myself trespassing. No reasonable person would. I've been to laundromats without attendants on duty. I assume someone opens them up ion the morning, locks them up in the evening and periodically comes buy to refill the vending machines and the like.
If I am a reasonable person on the internet, and a server responds to a zone transfer request, I expect that I am authorized to look at this information,
--- Justin Dearing http://www.justaprogrammer.net/ We're just programmers.
Your DNS server is not your house. It's your store. Yes, it's private and belongs to you, but it has a public interface. People walk into your store when it's unlocked because the door is the public interface, and the lock on the door is how the owner meters or controls access. DNS servers are much the same. They serve up a public interface. Making a DNS request of an open server should be no more illegal than walking into the 7/11. If they don't lock it, how am I supposed to know it's closed?
I'm guessing you're young, under thirty at least. I only say this because the "the tag may only be removed by the consumer" bit is a change that was made about fifteen years ago, before that they read "Do Not Remove Under Penalty of Law" in bold, black letters. So most people grew up with these ominous tags on all their pillows and mattresses warning that if they removed them there were stiff penalties involved. Nowadays, not so much. Meh.
So who's the nerd now, huh?
I stole this sig from a more creative user.
As one of the people involved in this, I think I should take a minute to set the record straight.
Sexzilla was once one of the largest porn spammers on usenet. I wrote about them on my web site. The owner, Jerry Reynolds, sued me for defamation. I asked the other spam-fighters for whatever they had on Sexzilla so I could defend myself.
David Ritz responded with something along the lines of "Oh, it's true alright, here's the dns zone information that proves it." He also published his results on-line.
Reynolds then sued David for an "unauthorized zone transfer".
That zone transfer is the entirety of Reynolds' case against David. The rest of the stuff in the judge's decision was all a bunch of bullshit spoon-fed to the judge by Reynolds. Most of it has nothing to do with the case at hand, and most of it is either untrue or gross distortions of the truth. For example, the "hijacked" computer was an open relay that Ritz used to send one message to Verizon security, proving to them that they had an open relay.
You can read the whole sorry saga here.