Slashdot Mirror
You Are Not a Lawyer
Paul Ohm is starting a new "very occasional" feature on the Freedom To Tinker blog called You Are Not a Lawyer — "In this series, I will try to disabuse computer scientists and other technically minded people of some commonly held misconceptions about the law (and the legal system)." In the first installment, Ohm walks through the reasons why many techies' faith in the presence of "reasonable doubt" is so misplaced. "When techies think about criminal law, and in particular crimes committed online, they tend to fixate on [the 'beyond a reasonable doubt'] legal standard, dreaming up ways people can use technology to inject doubt into the evidence to avoid being convicted. I can't count how many conversations I have had with techies about things like the 'open wireless access point defense,' the 'trojaned computer defense,' the 'NAT-ted firewall defense,' and the 'dynamic IP address defense.' ... People who place stock in these theories and tools are neglecting an important drawback. There are another set of legal standards — the legal standards governing search and seizure — you should worry about long before you ever get to 'beyond a reasonable doubt.'"
A couple of considerations:
(1) the attorney author comes from the DOJ's Cymbercrime division -- the DOJ may have one interpretation of the law but the courts might have another;
(2) Academic lawyers generally have a slanted view on the world; and
(3) the facts and circumstances of your given situation are very important, blanket generalizations are risky. Facts can sometimes be fluid a good lawyer, can setup the playing field to the benefit of his/her client.
IANAL but I know some Law facts.
1 - dont trust cops.
2 - Dont trust judges.
3 - Dont trust lawyers.
4 - assume that everyone is trying to shaft you.
5 - Once you are in the legal system THEY OWN YOUR BUTT.
6 - If you are going to do something illegal, make sure you CANT GET CAUGHT.
7 - Dont do anything illegal.
Honestly, Judges hate you, cops hate you, everyone on a jury if you get that far hates you. you are considered Guilty until proven innocent. Dont even believe the Bullshit given to you as a youth that it's the other way around. It's not and never has been that way.
Finally, you cant talk a cop out of arresting you. You can make him think it's more bother than it's worth and let you go if it's not worth it and you're being a nice guy. They will let a nice guy in Abercrombie that says yes sir, no sir, thank you sir go with a warning way before the dont touch me pig screaming hoodie wearing blacked out eyesocket head shaved like the damned pincushion for a head guy. It blows my mind how stupid many criminals are, if you dress and look like a punk, the cops will treat you like a punk.
I never got in trouble as a kid. but then I was aware of my location and had a scanner in my pocket with a earphone in all the time. Friends learned that if I left a party or gathering, they need to as well.
Do not look at laser with remaining good eye.
Actually yes, a whole lot of people who call themselves techies are stupid. They also think they are far more intelligent then they are. On top of that, many who call themselves techies believe they are so far above blue collar 'mouth breathers' that with very little work they can completely confuse them. I mean, hell, you just did something similar here. You assumed that the article writer must be an idiot because, well, you said so. Go ahead and rethink your logic and consider that perhaps something happened, maybe even several times, that prompted the writer to write what he did.
Most people are idiots, that they call themselves a techie doesn't change that.
"I use a Mac because I'm just better than you are."
I don't think the point is getting involved, it is that many tech types, and more likely self proclaimed techies, will stray into gray areas and they need to know that their short sighted, I can't be punished theories aren't all that strong outside of their mind or circle.
I have seen this in the past where people on IRC serve ip copyrighted materials and think a simple warning "if you are a law enforcement or affiliated with them, you are not allowed in the server" will get any evidence thrown out if they are busted. It's stuff like that which people think justifies behavior or removes possible penalties from it that is being addressed. It's the I'm using Lime wire but I have an open access point which I will blame everything on, just to have your computer taken by warrant before you can delete the lime wire program or any of the files your sharing.
...navigate the twisted corridors of the law instead of technology or computer code.
That y'all built yourselves... talk about job-preserving legacy code... ;)
(1) you are not a lawyer.
(2) Lawyers think differently depending on the situation they are in. A "DOJ" lawyer might have completely opposing viewpoints to his employer when writing on a blog.
(3) The DOJ cybercrime division is not known for producing academic lawyers.
(4) Situations have common facts and courts often analogize.
Thank you for that. It's an interesting read but, for anyone who wants to save some time, here it is in a nutshell:
If your computer is targeted in a police investigation, your life is going to be a huge pain in the ass for a while even if you somehow manage an acquittal.
IANAL.
He's getting rather old, but he's a good mouse.
I basically agree with you, but I think your description of the problem is oversimplified and misleading. People are not monolithically "smart" or "stupid". Everybody's smart and stupid about different things. Like those wizards in the Harry Potter books that can master complicated magic spells, but can't mail a letter. What turns smart people into assholes is when they assume their smartness in one field automatically transfers to another.
I think computer techies are particularly bad this way because they tend to be self-taught. Often the most effective strategy for learning a technology is to just sit down and fiddle with it. Or they read a book that was probably written by another self-taught techie that often gets details wrong (how many of you can correctly define "ASCII"?) but gets enough essentials right to get the job done.
What techies don't get is that this style of learning just doesn't work with the law. Even if you understand a legal principle (and when techies try to understand something as abstract as a legal principle they often get it wrong) you don't have a practical understanding of its proper application in every context. Lawyers spend years studying and arguing about this stuff, and even so they have to specialize in order to develop any real expertise.
His point was that long before you ever get your day in court for "reasonable doubt", you will be arrested, jailed, your friends & family will be questioned about you, your stuff searched, etc... all with a much lower burden than "reasonable doubt".
So while you may ultimately prevail with "reasonable doubt", the police/prosecutors can your make you life a living hell until you get your day in court.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
You left out expensive - A huge expensive pain in the ass.
Here is one more:
(4) If you are not in the US, US law does not apply.
Tell that to Gary McKinnon and Hew Raymond Griffiths.
When information is power, privacy is freedom.
For real.
To use the open wireless access point as an example. If someone sits outside your house and downloads kiddie porn, or starts running brute force attacks against NSA through your connection, the feds will show up and confiscate every electronic computer and storage device in your house so they can run forensics on it, which may take them 2-3 years to get to. Meanwhile all your stuff is sitting in an evidence room depreciating.
Sure you might not get into trouble if there's no evidence on any of your gear or storage, but by the time you get it all back, it will be useless and way out of date.
If you factor this depreciation, and you have a lot of gear and storage, the cost is huge. Then you have attorney bills and your reputation to worry about. You will never fully recover your reputation even if you are 100% innocent.
Leaving that default password on your router has a lot of potential to screw your life up in ways you wouldn't expect.
-Viz
Don't kid yourself. It's the size of the regexp AND how you use it that counts.