Slashdot Mirror
US Wants UK Hacker To Pay To Fix Holes He Exposed
bossanovalithium writes "Gary McKinnon, whose tribulations we have followed for several years now, is the UK hacker trying to escape extradition to the US. It appears he is expected to foot the bill for the US Government patching holes his breaching uncovered — to the tune of $700,000. It's not really the norm for someone to pay for exploits to be patched — damages fixed, yes, but this is a very different thing." The article paraphrases Eugene Spafford as saying that the victim of a cybercrime should not take the blame. "If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door." Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?
...couldn't he fix them himself? With supervision, I mean.
"Our country is not nearly so overrun with the bigoted as it is overrun with the broadminded." -Archbishop Fulton Sheen
If I find a hole in my Government's IT security, I'll keep my mouth shut and let the government hear about it from the Chinese or the Iranians or the S. Koreans or ...anyone but me because they'll send me to jail and make me pay.
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
I wouldn't report any kind of crime or safety hazard if this becomes a regular tactic.
This is exactly like charging for a lock that was never there. Another analogy -- it is like forcing the thief to pay for the security system that the store owner now feels that he has to buy to prevent future actions.
If he damaged a system by hacking in, that's one thing. He should pay for that. But it's hardly his fault that the holes were there in the first place and he shouldn't be held responsible for funding the software improvements to prevent such actions in the future.
The holes aren't his "damage". The holes were already there. I don't care if a whole wall was missing, if an individual walks into a building and does damage or steals, the damage or stealing is what they are responsible for. Building the wall or replacing the lock is not their responsibility at all.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
Repaying any damage he would have caused: Expected.
Going to Jail for his actions: Expected.
Paying 700,000 Dollars to fix the hole he DISCOVERED (not created): Unlawful.
Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?
Rather like the lock company demanding he reimburse them the cost of redesigning their badly designed locks?
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
It's paying for the research, development, and possibly deployment of a new and improved lock.
Analogies should be correct to be effective. Sadly, the most effective ones are often incorrect.
South Korea (the one with Seoul) probably would tell Washington about it, but it's unlikely that China or Iran would. It's more likely that they would exploit the vulnerability in secret.
I like the lock analogy, but I think it would be more appropriate to say that they are charging him for discovering that the bolts that hold the locked door shut were missing. He simply pointed it out...
No, it is not simply like charging him to buy the lock that had been missing. If you entered someone's home uninvited and deliberately or accidentally caused substantial cost and damage to the homeowner, you should be liable for your actions.
I know, right?
Like last week, these kids walked uninvited across my lawn, and caused substantial damage to a number of blades of grass! And then to add insult to injury, their damned irresponsible parents just couldn't grasp their liability to pony up for the slab, four walls, roof, and two garage doors to "repair" the space their crotch-fruit just casually trespassed across!
Sure, some scofflaws would point out that I didn't have a whole garage there to start with, so why should they have to pay for the rest? But hey, I had the good solid dirt underneath a future-garage, at least.
These are legal matters we are talking about here.
This issue is a bit more complicated than you think.
The real crime is exposing sensitive data through the internet. If a hacker shows his concern and makes it clear that the government is exposing sensitive data, the criminal is the government, not the hacker.
The funny thing is that the real crimes are often not legally the real crimes. In the Netherlands, it is not a crime to have a system full of sensitive data that is hardly secured. But it IS a crime for anyone to expose this insecurity. The Dutch government has created a special "theft of processor time" law to ensure this.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
"Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?"
More like they want him to pay for a lock that wasn't there because he was the first one to tell them that the lock wasn't there.
Or even more obvious, somebody forgot to put in a front door and now the store wants him to pay for a new door because he was the first one to tell the store that they had no door.
Beer is proof that God loves us and wants us to be happy.
However what is at issue here is what if you walk up to your neighbor and say "Hey don't you think maybe you should have a door on that house? Someone could get in you know..." He then sends you the bill for the door, lock, security bars, and exterior gate.
D.
This is where dogmatic views and analogies really contrast with technological reality. Those security holes would have existed whether or not he abused them in some misguided and naive attempt at finding info about UFOs. This is clearly a very intelligent person whose skills are of immense value. He just wasn't mature enough to realize the consequences and he certainly wasn't paranoid enough to keep his mouth shut.
It makes no sense whatsoever to lock him up with dumbasses whose greatest accomplishment in life is learning that beating their girlfriends is a bad thing or that guns and drugs don't mix well. What a sad waste of talent.
No, instead, I say: let him pay that $700000, but let him do it in the form of consulting. And fire the idiots who made those security holes in the first place.
see a Text Widget
I'm sorry, you must state your question in the form of an Automotive analogy...
It must have been something you assimilated. . . .
"Great, now everyone knows we have the holes and we actually have to fix them. Everything was fine when people just assumed we had a secure system. Now this guy goes and rains on our parade. Let's try to get him to pay for fixing them."
Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?
Rather like the lock company demanding he reimburse them the cost of redesigning their badly designed locks?
From what I can find of his "hacking" abilities on the black vault:
Somewhat frustrated by the common avenues of UFO research, Gary began some basic computer hacking techniques from his girlfriend's Aunt's house in the mid-late 1990s. Soon he began using a system of scanning for blank administrator passwords on supposedly secure networks ...
Sounds more like the lock company distributed a working lock to many U.S. government entities and they put the locks on their sensitive possessions but some individuals simply forgot to close the clasp and had no policy for walking around double checking locks. If he did do $700k of damage and bring the system to a halt, he should pay for it. If they are charging him $700k for a script that scans for blank passwords on accounts on their systems and drop it in a chron job, I'll gladly fulfill the work order for half that price!
My work here is dung.
The fact that the systems are federal might not matter a whole lot, since the perp is British.
You know, not from the U.S.
He should pay to re-train the entire government technical staff.
Nullius in verba
Similarly, Ralph Nader should pay for the research, development, and deployment of a new and improved Chevrolet Corvair?
To have someone set some damn passwords? (10th Paragraph).
'Speak softly and carry a beagle'
You'll be hearing from our lawyers soon. The crashes involving our automobiles were entirely due to operator error. There is nothing wrong with our braking system!!
Danny Ubanti
President and CEO
Ubanti Motor Company Inc Ltd
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
I don't have a car, you insensitive clod...
A better analogy would be for me to have to replace the emperor's wardrobe
For justice, we must go to Don Corleone
From Wikipedia
"The US authorities claim he deleted critical files from operating systems, which shut down the US Army's Military District of Washington network of 2,000 computers for 24 hours, as well as deleting US Navy Weapons logs, rendering a naval base's network of 300 computers inoperable after the September 11th terrorist attacks. They claim the cost of tracking and correcting the problems he caused was $700,000.[15]"
So I don't see where the idea that the claim the $700,000 is merely to secure previously unsecured systems originates from.
If you break into a networkof military computers, it seems reasonable that the owners of the computers would feel that a complete audit of the network to asses damages would be necessary.
So I don't see where the idea that the claim the $700,000 is merely to secure previously unsecured systems originates from.
The imagination of slashdotters, who can never escape that techies-vs-the-rest-of-the-world mentality.
Many posters here seem to believe he just 'pointed out security flaws', akin to telling someone their door locks are easily picked, and then suddenly being held responsible for the owner wanting better lock.
That is clearly not the case here. He found security holes, -and exploited them-, and -damaged systems- as a result.
http://www.publications.parliament.uk/pa/ld200708/ldjudgmt/jd080730/mckinn-1.htm
Even if I leave my door wide open, if someone comes in and trashes my house, I'm going to expect them to pay for the repairs and clean-up. That's going to include me doing a complete inventory to figure out what might now be missing or broken. And that will take a while.
Weak security != permission to exploit
And the $700K amount is vague as to it's origin, I also saw nothing that specifically indicated that any of the $700K was specifically for -upgrading- security.
In other news, the emperor is demanding that the child who pointed out that he lacks clothes be the one to pay for them.