Slashdot Mirror
US Wants UK Hacker To Pay To Fix Holes He Exposed
bossanovalithium writes "Gary McKinnon, whose tribulations we have followed for several years now, is the UK hacker trying to escape extradition to the US. It appears he is expected to foot the bill for the US Government patching holes his breaching uncovered — to the tune of $700,000. It's not really the norm for someone to pay for exploits to be patched — damages fixed, yes, but this is a very different thing." The article paraphrases Eugene Spafford as saying that the victim of a cybercrime should not take the blame. "If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door." Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?
...couldn't he fix them himself? With supervision, I mean.
"Our country is not nearly so overrun with the bigoted as it is overrun with the broadminded." -Archbishop Fulton Sheen
If I find a hole in my Government's IT security, I'll keep my mouth shut and let the government hear about it from the Chinese or the Iranians or the S. Koreans or ...anyone but me because they'll send me to jail and make me pay.
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
I wouldn't report any kind of crime or safety hazard if this becomes a regular tactic.
This is exactly like charging for a lock that was never there. Another analogy -- it is like forcing the thief to pay for the security system that the store owner now feels that he has to buy to prevent future actions.
If he damaged a system by hacking in, that's one thing. He should pay for that. But it's hardly his fault that the holes were there in the first place and he shouldn't be held responsible for funding the software improvements to prevent such actions in the future.
The holes aren't his "damage". The holes were already there. I don't care if a whole wall was missing, if an individual walks into a building and does damage or steals, the damage or stealing is what they are responsible for. Building the wall or replacing the lock is not their responsibility at all.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
Repaying any damage he would have caused: Expected.
Going to Jail for his actions: Expected.
Paying 700,000 Dollars to fix the hole he DISCOVERED (not created): Unlawful.
Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?
Rather like the lock company demanding he reimburse them the cost of redesigning their badly designed locks?
"In prison you just have to shut your eyes and take it. Here you have to shut your eyes and give it."
It's paying for the research, development, and possibly deployment of a new and improved lock.
Analogies should be correct to be effective. Sadly, the most effective ones are often incorrect.
No, it is not simply like charging him to buy the lock that had been missing. If you entered someone's home uninvited and deliberately or accidentally caused substantial cost and damage to the homeowner, you should be liable for your actions.
I know, right?
Like last week, these kids walked uninvited across my lawn, and caused substantial damage to a number of blades of grass! And then to add insult to injury, their damned irresponsible parents just couldn't grasp their liability to pony up for the slab, four walls, roof, and two garage doors to "repair" the space their crotch-fruit just casually trespassed across!
Sure, some scofflaws would point out that I didn't have a whole garage there to start with, so why should they have to pay for the rest? But hey, I had the good solid dirt underneath a future-garage, at least.
You'll be hearing from our lawyers soon. The crashes involving our automobiles were entirely due to operator error. There is nothing wrong with our braking system!!
Danny Ubanti
President and CEO
Ubanti Motor Company Inc Ltd
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
This is clearly a very intelligent person whose skills are of immense value.
From Wikipedia: McKinnon claimed that he was able to get into the military's networks simply by using a Perl script that searched for blank passwords; in other words his report suggests that there were computers on these networks with the default passwords active.
Note that this is never ever reported in news articles. It is always that he 'hacked into' the computers. I think most people would agree that trying blank passwords doesn't really count as hacking, and most people have probably done it at one point in their lives. It is completely ridiculous that he could be extradited over this.