Slashdot Mirror

← Back to Stories (view on slashdot.org)

Punishing Security Breaches

Posted by CmdrTaco on from the it-has-to-happen dept.

Schneier has a story on his blog this morning about punishing security breaches. This one is in response to the tale of Gray Powell, the Apple engineer who left an important bit of technology in a bar recently. You might have heard of it. You also might have been on either the breacher or the corporate side. I'd hate to be in either position myself.

8 of 151 comments (clear)

  1. Gizmodo May Face Felony Charges by eldavojohn · · Score: 4, Informative
    I caught a an article on NY Times that outlines the San Mateo police's options for prosecuting Gizmodo for purchasing the leaked iPhone. From the article:

    California law prohibits the sale of stolen goods and states that a person who uses someone else’s lost property without permission may be guilty of theft.

    And since it's over $950, it's a felony. Even if they didn't know it was stolen, they could face a lesser charge of "misappropriation of lost property" which is a crime but not theft. Charges haven't been pressed yet but the police say they're investigating the options.

    --
    My work here is dung.
    1. Re:Gizmodo May Face Felony Charges by Sandbags · · Score: 2, Informative

      I'm not an expert in CA's version of this law, but here, it;s only stolen property if its REPORTED stolen, or if the owner comes to claim it and wishes to prosecute. Apple admitted they're not interested in filing criminal charges against Gizmodo (they could not buy publicity like they got, even if they didn't want it on that day). Since there's noone to make the charge, the police can not act on their own. Cops can't bust you for unreported crimes unless they're under certain statuates.

      --
      There is no contest in life for which the unprepared have the advantage.
    2. Re:Gizmodo May Face Felony Charges by SharpFang · · Score: 3, Informative

      The seller spent a pretty long time in the bar asking the patrons and the barman about the phone. He made it pretty certain this was a found item, not a stolen one and went to quite a bit of lengths to find the owner, and has a bunch of witnesses to confirm it.

      --
      45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
    3. Re:Gizmodo May Face Felony Charges by stonewallred · · Score: 4, Informative

      Which ever one that allows the DA to charge you with a felony. Unless of course you are connected, then it is which ever one that allows the DA to charge you with a misdemeanor which he'll drop under a prayer for judgment. The amount of leeway a DA has is what makes the US legal system appear to be so uncorrupted when compared to the rest of the world. But the corruption lies within the system, at the level of discretion the DA and judges have.

    4. Re:Gizmodo May Face Felony Charges by xeoron · · Score: 2, Informative

      I, Cringely, has a post saying it that this was a calculated Apple PR stunt. The only way to prove this would be if the engineer gets fired or Apple files charges against one or more parties.

    5. Re:Gizmodo May Face Felony Charges by Bakkster · · Score: 2, Informative

      Meh.. in most cases I would agree with you, but Gizmodo made it known that they had the property (after the finder himself tried to contact Apple), and returned it to the rightful owner when asked.

      After disassembling it, and posting the disassembly photos on their website, earning a huge wad of cash from advertisers in the process.

      Purchasing the property may have been an offense within the letter of the law, but it's a very weak chain of events for claiming damages when the property was promptly returned.

      Actually, the letter of the law prohibits the user from any use (I believe the statute says 'realizing benefits from') of the solen property as well. If they purchased the iPhone in order to funnel it directly to Apple to preserve their confidentiality, you would be right. However, they made money off the prototype, putting them clearly in violation of the law.

      That said, I doubt Apple will press charges, but it seems they are clearly within their rights to do so.

      --
      Write your representatives! Repeal the 2nd Law of Thermodynamics!
    6. Re:Gizmodo May Face Felony Charges by Jawn98685 · · Score: 1, Informative

      The question is: will they simply pay a fine, or will someone actually get to face a criminal charge? All too often (in the US) people get off free because the offense is blamed on the Corporation® and not the individual acting on behalf of the corporation. If this is knowingly purchasing stolen goods, then it should be treated like any other case of the same.

      You don't understand. The Supreme Court of the United States has determined that corporations (e.g. "big business") get to enjoy all the benefits of citizenship with none of those annoying responsibilities (paying taxes, obeying the law, etc.). If you think that''s wrong, you must be some kind of socialist.

  2. Punishment prevents or delays fixing the problem. by zerofoo · · Score: 2, Informative

    Long ago we decided that if anyone in our company breaches security by losing an access card, or sharing a password, we would not punish the person responsible if they came forward immediately.

    This policy encourages a quick resolution to the security breach. A lost security card or password can be disabled or reset thereby limiting the damage the mistake caused.

    Persecuting people that make mistakes only delays the notification process, and then delays the fix - putting more people/things at risk.

    People make mistakes, they happen, and there is nothing you can do to prevent them.

    -ted