Slashdot Mirror
Andrew Auernheimer Case Uncomfortably Similar To Aaron Swartz Case
TrueSatan writes "Andrew Auernheimer doesn't appear suicidal, no thanks to U.S. prosecutors, yet he has been under attack for his act of altering an API URL that revealed a set of user data and posting details of same. 'In June of 2010 there was an AT&T webserver on the open Internet. There was an API on this server, a URL with a number at the end. If you incremented this number, you saw the next iPad 3G user email address. I thought it was egregiously negligent for AT&T to be publishing a complete target list of iPad 3G owners, and I took a sample of the API output to a journalist at Gawker.' Auernheimer has been under investigation from that point onward, with restrictions on his freedom and ability to earn a living that are grossly disproportionate to any perceived crime. This is just as much a case of legislative overreach and the unfettered power of prosecutors as was Swartz's case."
The United States, collectively, has lost its fucking mind.
Simply put the guy in court, thus correcting the security hole once and for all.
Appears to be the American way of dealing with security breaches.
try to make an example out of someone.
This is where the problem starts. Nobody deserves or has earned to be treated differently in a legal system.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Regardless, US Attorney Wagner seems to think that seizing the assets of non-drug-related landowners will be sufficient to scare them all into doing the police work for him.
The problem is that the law makes it a crime for 'unauthorized' access, but allows the 'victim' to detrtmin whatwas 'unauthorized' *after* the fact and for a public offering that is automated.
It is as if someone puts a stack of newspapers on a sidewalk with a sign that says 'free' and then asking the DA to prosecute for 'theft' anyone they don't like that took them upon their offer and took more then one. I.e.they decide afterwards that one is The 'limit' and the sign just says 'free'.
Oh and these sleazy DAs count each URL issued as a separate count of the 'crime' with a penalty of 5 years and $300,000 possible on each count of 'unauthorized access'.
It is all to appear 'tough on crime' for their next election. And, yes, they have all the resources of their office to put on your case against you.
Fair? No. Disproportionate penalty for the 'crime'? Certainly. It is really a contract dispute - a civil matter, not criminal.
The law is just wrong. Make your vote count on these issues and hold your legislators and judiciary oversight officials accountable in the voting booth.
It looks like he was already nuking.
" I took a sample of the API output to a journalist at Gawker."
"I did this because I despised people I think are unjustly wealthy and wanted to embarass them."
"...We were able to establish the authenticity of Goatse Security's data through two people who were listed among the 114,000 names. "
I share his dislike for the telcos... but "Oh look, a leak", then "I'm pulling all the records and sending it to the media" is not responsible disclosure.
" it might be possible to spoof a device on the network or even intercept traffic using the ICC ID."
He was wrong, but despite thinking the breach were more serious than a privacy issue, he still published the information, then speculated on nefarious uses to reporters.
That said, it does not warrant the prosecution... his actions were only unethical.
Stephen Heymann is to "computer crime" prosecutorial zealotry like China is to Expionage hacking.
Stephen Heymann is the poster child for this kind of overreach when it comes to prosecuting so called "computer crimes"
He has written papers and lobbied for more harsher penalities and easier access to data without a warrant to prosecute "computer criminals"
They aren't clueless. They act as malicious enemies of the people.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
He embarrassed a large corporation. That makes powerful people upset. He must be punished.
"Responsibly" like the report of a Java vulnerability in August, that exploded in everyone's face after Oracle sit on that report for months?
The problem is not the people that find and report the problem in a way or another (and advising the users too, just because there are too many cases like Oracle). Is the ones that find and exploit it silently.
Law is (in some cases, literally) killing the messenger, if you find something that could be exploited, better don't tell anyone because even reporting it to the company could get you in trouble too. Eventually someone in the dark side will exploit it (if is not doing that already) but is not your problem, maybe is even designed that way to always get fresh 0-day exploits for the new generation of Stuxnet (lawyers are involved, you can't attribute that to stupidity)
This guy is nothing but an attention whoring internet troll. He did what he did for nothing more than to try to publicly shame AT&T in the most irresponsible way possible, and generally goes out of his way to cause trouble all over the internet. He had no sense of care for the data he was putting under the public spotlight instead of sensibly disclosing the vulnerability to AT&T. For him to suggest he did because of AT&T's "egregiously negligence" yet chose himself to make the most egregiously negligent response is hypocritical to say the least.
I have no sympathy for this Weev guy. Do not liken his situation to Aaron Swartz. That would be doing a massive disservice to his memory. Tools like this should get what is coming to them.
Here's what I've learned recently: If I ever discover a major security hole, do not even attempt to release it responsibly. Instead, layer up behind some proxies and Tor and leak it into a blackhat forum or IRC channel. That way the security hole will eventually get fixed, and I can't be prosecuted.
Cyde Weys Musings - Scrutinizing the inscrutable
So publishing personally-identifying data for 114,000 people is in the security interests of society?
At this point, yes.
There are three things that could have happened. He could have gone through the "proper channels," and, since a middle manager somewhere would need to be embarrassed, he'd still be up shit creek without a paddle. He could have did what he did, publicly humiliated AT&T and made the 114,000 individuals affected acutely aware that AT&T had failed them.
OR, he could have done nothing. Perhaps that's the correct response. Instead, some black hat in $scary_country would have discovered it and exploited it without making anyone aware.
The whole beef I have with prosecuting for "hacking" in this manner is that he merely asked AT&T's server for information, and it merrily complied. To me, it sounds like this case is even more clear-cut than Swartz's case. He didn't break and enter. He didn't place unauthorized equipment in a network closet. He didn't even abuse a relationship of trust between a publisher and a college. All he did was show that all you need to do is politely ask the server for information, and it would happily give it to you.
Auernheimer should've gone to AT&T to report the problem. I've done that myself several times and they've always been very receptive. They might not fix the problem quickly (they're a big company and move slowly), but I've never had them sic the US Attorneys on me for it.
Consider yourself lucky. Or perhaps they know you'd fight back because you're older and have the resources to do so. Going after successful professionals (I can only assume you are) isn't very good for bullies. Bullies need targets they know they can safely victimize. So here we are.
Join the Slashcott! Stay away entirely Feb 10 thru Feb 17! Close all tabs to prevent autorefresh!
There was never any serious question about Swartz commiting the crimes he was charged with (video tape of him doing it, his fingerprints on the HD inside the laptop, etc.),
There is absolutely reasonable doubt that the actions Swartz took were against the law. There is no doubt that he placed a laptop in a utility closet in MIT and downloaded articles for redistribution. But whether that was against the law is for a jury to decide. Note that no security, physical or electronic, was ever broken.
honestly a 6 month sentece would have been about right.
If a 6 months sentence was appropriate, he should gotten a jury trial on that 6 months charge. But if he wanted to exercise his right to a trial, he'd be hit with 35 years. Do you not see the problem with that? Plea bargaining is plainly unjust.
Give me Classic Slashdot or give me death!