Jail Looms For Man Who Revealed AT&T Leaked iPad User E-Mails

concealment sends this quote from MIT's Technology Review: "AT&T screwed up in 2010, serving up the e-mail addresses of over 110,000 of its iPad 3G customers online for anyone to find. But Andrew Auernheimer, an online activist who pointed out AT&T's blunder to Gawker Media, which went on to publicize the breach of private information, is the one in federal court this week. Groups like the Electronic Frontier Foundation worry that should that charge succeed it will become easy to criminalize many online activities, including work by well-intentioned activists looking for leaks of private information or other online security holes. [Auernheimer's] case hasn't received much attention so far, but should he be found guilty this week it will likely become well known, fast."

Comments

He did it wrong, obviously

[Anonymous Coward]

Anon pastebin is the way.

Prosecutors, these days....

[stox]

seem to be having increasing difficulty distinguishing the letter of the law versus the spirit of the law. Anything to add yet another successful prosecution to their resume with no concern as to the effects on others or the betterment of society.

Re:Prosecutors, these days....

[jklovanc]

Would you be saying something different if someone found a warehouse door open and reported it on a scrounger web site before they reported it to the owner of the warehouse? Data has value just like merchandise. The issue is not what they did but the way they did it. A true White Hat hacker would have told the company first and given them a chance to fix it before publicizing it.

Re:Prosecutors, these days....

[Mitreya]

Would you be saying something different if someone found a warehouse door open and reported it on a scrounger web site before they reported it to the owner of the warehouse?

Neither of his charges is about publicizing the the info. I could probably get on board with that

It seems that his charges are:
1. "by being in possession of the e-mails from AT&Tâ(TM)s leaky system he handled 'identification information'"
2. "case is based on the Computer Fraud and Abuse Act, which forbids 'unauthorized access' to a computer." (definitely the equivalent of being charged for trespassing)

Show me which charge involves disseminating information on a scrounger website? Up to 5 years for trespassing in an open warehouse seems ridiculous (each charge carries up to 5 years)

If he is guilty of publishing the info - let's see a law that charges him with disseminating "identification information". But trying to make marginally related things stick is very, very dangerous.

Weev is not an online activist.

[Hatta]

Weev is a troll. He's better known to /. as one of the "president" of the GNAA. An all around unpleasant fellow.

The unfortunate thing about this case is that Weev didn't actually do anything wrong here. AT&T published the email addresses, it should be AT&T facing prison time.

Re:Weev is not an online activist.

[NewWorldDan]

He did do something wrong here. Whatever his intentions, he was poking around AT&T's web server in a way he knew he shouldn't have been. Just because AT&T was wrong doesn't make him right. As an analogy, I often leave my car unlocked. If you take it, you're still a car thief, even if I should have taken better care of my car. In any event, you don't have to harvest 114k emails to demonstrate a problem.1 or 2 is adequate proof that there's a problem.

Re:Weev is not an online activist.

[quacking duck]

Better analogy is if you left confidential info clearly visible and readable in your car, and someone came along and saw it through the window, then told a nearby reporter about it, etc.

This guy didn't steal AT&T, after all.

Unfortunately, the car's owner is politically connected and his prosecutor buddy brings charges against you to cover up the owner's embarrassing blunder.

Re:Weev is not an online activist.

[grasshoppa]

The car analogy doesn't work here, as a website is inherently a publicly offered service, whereas your car is not. There really isn't a good analogy for this situation, as it doesn't really require an analogy in the first place.

AT&T put private information on their public website. Mistake or not, their actions made the information public, not the defendant in this case.

AT&T is obviously to blame here.

Re:Weev is not an online activist.

[jklovanc]

Even better analogy;
1.Leave confidential material in a folder in an unlocked room.(create an mechanism on the server to access info without proper security)
2. Someone come along and search the room (make semi-random requests to the server)
3. Copy the information in the folder (record the server responses)
4. Publish where the room is, where the folder is and the contents of the folder. (put the server name, request format and received data out on the internet)
A true White had would have told the company before publishing the breach and they would not have tried hundreds of thousands of requests. Just because there is not a lock on the door does not mean one can rummage through the room, copy the information and publish it.

Paul J. Fishman

[Anonymous Coward]

I know little of the case, but it looks like this case is being brought by Paul J. Fishman, the U.S. District Attorney for New Jersey. According to Wikipedia (it's always correct), he used to work for Friedman Kaplan Seiler & Adelman. A firm that represented the Communication Workers of America. Not surprisingly, the CWA regularly deals with AT&T.

Mr. Fishman was appointed by President Obama in 2009. If you don't like his actions, contact the Whitehouse and your representatives and let them know. Not that it'll matter, but maybe it'll make you feel better.

Or if you'd prefer, you can always contact his office directly for more information on the case: http://www.justice.gov/usao/nj/contact.html . Though, again, not that'll it matter.

Re:Why aren't whistleblower laws shielding him?

[Mitreya]

AT&T wasn't breaking the law, whistleblower statutes do not apply.

It must have. From TFA:

One alleges that by being in possession of the e-mails from AT&Tâ(TM)s leaky system he handled 'identification information' in breach of a law intended to protect against identity theft,

I am certain that laws protecting us against identity fraud mandate that the "identification information" is shielded from theft. AT&T has clearly failed to protect the information.

Re:Who in their right mind prosecutes this?

[Anonymous Coward]

Actually, no. There is no such thing as "the feds" in the USA.
There are service organizations for companies to use, which protect industry interests, but are paid by you.
An actual government would defend you against the companies, and put everyone in jail even tries to "lobby".

But hey, in the US, many people loudly yell and proclaim they want a "small government" and "free market", because they confuse that industry instrument with an actual government, and confuse freedom for companies to abuse them with freedom for people to live their lives. And they don't realize that that "free market" is what results in what they perceive in an "evil government" in the first place. (Like not only the ability to openly buy a president [aka "campaign donations"] but that somebody can't even get into said "government" without being bought with huge sums of money.)

But I don't blame them. Try keeping your mind free of social/media conditioning with TV and news constantly repeating the same lies. It's a simple neurological fact which has been studied since the 60s, that a human brain can't withstand that forever. If you think you're free of it (like I often did), you've only fallen for a different version of the trap.
The best is, not to listen/watch any of it at all. Including websites/blogs/etc. (Because falling for Alex Jones instead of Fox News or MSNBC is not better.)
Just observe. With your own eyes. And be careful about who you trust. (And who they trust!)

Re:Who in their right mind prosecutes this?

[sdnoob]

at&t probably pursued and lobbied for charges to be filed so THEY look like the victim here instead of the people at the other end of those 110,000+ email addresses.

Re:Who in their right mind prosecutes this?

[deathlyslow]

The best is, not to listen/watch any of it at all. Including websites/blogs/etc.

Says the AC posting on /.