Slashdot Mirror
Criminal Charges Filed Against AT&T iPad Attacker
Batblue writes "The US Department of Justice will file criminal charges against the alleged attackers who copied personal information from the AT&T network of approximately 120,000 iPad users, the US Attorney's Office, District of New Jersey announced Monday.
Daniel Spitler will be charged in US District Court in New Jersey with one count of conspiracy to access a computer without authorization and one count of fraud. Andrew Auernheimer will be charged with the same counts at the US Western District Court of Arkansas, which is in Fayetteville.
Auernheimer made headlines last June when he discovered that AT&T's website was disclosing the e-mail addresses and the unique ICC-ID numbers of multiple iPad owners. Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information. AT&T said that nobody from Auernheimer's hacking group contacted them about the flaw."
Uncle Sam and Ma Bell go wayyy back if you know what I mean. You don't sass the latter unless you are ready to deal with the former in a very bad mood.
They did switch from "Engaged" to "It's complicated" a while back; but that part didn't change...
AT&T illegally gives the DOJ your phone calls, emails, messages, and other personal information in an up-to-the-second interface, and when some kid notices a security flaw the same DOJ comes after him? The public that puts up with this deserves to be treated this way.
-- Prepared at the direction of, or to be sent to Legal Counsel, in anticipation of litigation. Attorney Client Pri
The site was exposing the information. There was no unauthorized access, writing a script to parse publicly available information is not hacking.
Anyone know what the fraud charges are?
AT&T has the fastest 4G network....trust us.
AT&T would NEVER compromise your data...trust us.
He who knows best knows how little he knows. - Thomas Jefferson
You're 100% right! He needed to scrape all the user information he could and go public with it! Your personal information wants to be FREE, and no corporation can stop its freedom.
I'm going to assume for the sake of argument that the facts will prove he broke the law. If they don't the rest of this post doesn't apply to this case but it is still interesting from an academic/hypothetical perspective:
It's hard to say what is "just" in a case like this.
Is it more just to officially sanction (in the form of a guilty verdict by a jury) his behavior even though it was done with good intentions, or is it more just to officially (in the form of a non-guilty verdict or a grand jury declining to indict even if the facts prove guilt) say that it's in society's best interest that this behavior be tolerated or even encouraged in this context?
Refusal to indict or refusal to convict in the presence of proven guilt is an important part of American jurisprudence. While such events should be very rare as prosecutors should never let cases get this far, no-bills and jury nullifications "in the interest of justice" are the people's last chance to say "the application of the law in this case is unjust -or- the law itself is unjust." Assuming the law or its application is not unconstitutional or otherwise illegal, once a jury convicts the now-convicted-criminal is at the mercy of the Executive Branch for a pardon or commutation.
The sad part is neither the jury nor the grand jury will likely be allowed to see anything but the hard evidence and most or all of both groups will be too technically naive to make an informed decision as to whether it is more just to release this person or to indict and convict him.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The federal prosecutor disagrees. If you follow the link in TFA, you'll find:
So, they found a flaw, then hid their identity, and didn't contact AT&T directly, instead disclosing the flaw to a third party (who can be trusted because ...?), because they thought AT&T might react differently than how they wanted it to. This is ethical exactly how?
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
That's not the problem.
Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information.
THAT'S the problem. Had he done this, then only sent the data to AT&T rather than publicly releasing it, they likely would be thanking him rather than trying to send him to the pokey.
It's that pesky "went public with the information" part that screwed him up.
Living With a Nerd
From the article:
In a blog post earlier today, Auernheimer spelled out Goatse's case. "All data was gathered from a public webserver with no password, accessible by anyone on the Internet," he wrote. "There was no breach, intrusion, or penetration, by any means of the word."
How did he do anything illegal?
Something thats bothering me is that I can't seem to find any notion that AT&T fixed the flaw.
Now I'm willing to take their word that the guy didn't put forth much effort trying to contact them - but it seems like this court case has made it easier for them to brush the issue under the rug rather than fix.
Auernheimer made headlines last June when he discovered that AT&T's website was disclosing the e-mail addresses and the unique ICC-ID numbers of multiple iPad owners. Claiming that he wanted to help AT&T improve its security, he wrote a computer script to extract the data from AT&T and then went public with the information. AT&T said that nobody from Auernheimer's hacking group contacted it about the flaw.
That pretty much sums it up. I wonder if the EFF will get involved?
There is a war going on for your mind.
There is probably a legal precedent somewhere. Laptops have been around for a long time enough, that someone whacked someone else on the head with a laptop.
Google is your friend.
Sapere aude!
IMHO, the problem is the desire to be famous NOW. Sign your leaks with strong encryption and leak them anonymously, and you will be safe.
You run a business. Your front door was open. Your office is open and it didn't say "private" or "employees only" on the door and there was no reason for me to think it was off-limits to the public. Printouts of your customer confidential data are on your desk in plain view.
I walk in and start taking pictures then share those pictures.
Did you do anything illegal?
I can probably beat a trespassing rap but I probably could not beat charges related to my copying and disseminating the information unless it was extremely clear what I was doing was in society's best interest.
Another example where justice demands no indictment:
You run a business. Your front door was open. Your office is open and it didn't say "private" or "employees only" on the door and there was no reason for me to think it was off-limits to the public. Printouts of records of your criminal or not-quite-criminal-but-shocking-to-the-conscience activity are lying around. Records of bribes or not-quite-bribes-but-clearly-influence-peddling payments to corrupt politicians.
I walk in and start taking pictures then share those pictures with a responsible news organization who then runs a story on them.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
... is doing the same thing over and over again and expecting a different result.
How many times on Slashdot have we seen the following scenario?
1) Hacker finds security hole.
2) Hacker uses security hole to login to system. He may or may not do questionable things there.
3) Hacker gets caught and there's proof he was on the system and he wasn't authorized to be there.
4) Hacker looks at a trial and possible jail time.
5) Hacker claims innocence, saying that he was "just trying to help get the problem fixed".
Really, if you haven't learned by now that logging into systems where you don't belong may get you into deep trouble, there is no hope for you.