Slashdot Mirror
41 Months In Prison For Man Who Leaked AT&T iPad Email Addresses
In 2010, querying a public AT&T database yielded over 114,000 email address for iPad owners who were subscribed to the carrier. One of the people who found these emails, Andrew 'weev' Auernheimer, sent them to a news site to publicize AT&T's security flaw. He later ended up in court for his actions. Auernheimer was found guilty, and today he was sentenced to 41 months in prison. 'Following his release from prison, Auernheimer will be subject to three years of supervised release. Auernheimer and co-defendant Daniel Spitler were also ordered to pay $73,000 in restitution to AT&T. (Spitler pled guilty in 2011.) The pre-sentencing report prepared by prosecutors recommended four years in federal prison for Auernheimer.' A journalist watching the sentencing said, 'I felt like I was watching a witch trial as prosecutors admitted they didn't understand computers.'
Know I'll get modded down for going against Slashdot groupthink. But what is the argument suggesting? "It all happened on a computer, it shouldn't be prosecuted?" Stealing private information and releasing in publicly isn't just obviously illegal, it caused grief for 114,000 people.
Even if AT&T has a shitty security system, that doesn't make it legal to break in. I'd love to see Slashdot do more mundane crimes. Maybe the home had a sign saying "beware of dog," but the dog was actually at the vet, so the robber was just publicizing a security flaw.
Slashdot: providing anti-social weirdos a soapbox, since 1997.
The purported target, AT&T, is hardly the nicest organization, but the actually affected people were just regular people. This doesn't seem especially out of line with the USA's normal unhealthy sentencing. We want to punish, not correct, those convicted here.
As long as that attitude remains dominant, miscarriages of justice will occur within every branch of justice(except for the super-rich).
In an interview Weev says he wants to run for Congress, despite regarding the government as "seditious thugs". http://www.techweekeurope.co.uk/interview/angel-or-demon-hacker-would-the-real-weev-please-stand-up-110637
Strictly hypothetically, what rock is this key under? And what's your street address? Just hypothetically, so we can look up the laws in your jurisdiction, and understand which rock not to touch.
Two young men in steubenville rape a young women and get 1 - 2 years in jail. A man writes a script to get email address from a website and gets 3.5 years in jail. Something's not right.
That the defendant did not "break in". He did not circumvent any system or other contrivance designed to secure sensitive information. Those systems and contrivances simply did not exist. The worst that can be said of what he did was that he was irresponsible in sending the clearly sensitive information to someone else. The right thing to do, of course, would have been to contact AT&T. Had he done that, there wouldn't even be a case for restitution, unless maybe it was to compensate the defendant for doing the work that AT&T failed to do.
If you find my key under a rock in my backyard, it is still theft if you break into my house with it and steal things.
The analogy is not really applicable. This is more like writing all your secrets into a notebook and putting it into a library (in a section accessible to everyone). Then you sue the person who found the notebook.
Leaving the data open to any web request is the true crime here. I do not know about the US, but in Europe that would have been a violation against the Data Protection Act.
The right thing to do, of course, would have been to contact AT&T. Had he done that, AT&T would have threatened him to keep quiet and then never fixed the flaw
FTFY
Your political party doesn't care about your rights and only represents corporate interests.
They would only be fined 1 days worth of profits...
Corporations are people too? Bullshit. Corporations are treated better than people, under the law. I seriously suggest that every individual incorporate themselves and, when accused of any wrongdoing, claim it was via the corporation, and suggest that the law take it up with the board of directors.
If telephones are outlawed, then only outlaws will have telephones.
And you don't understand how rational people work.
A naked woman standing in the street doesn't mean you suddenly have the right to sexually assault her, or does that sound like its okay in your mind as well?
And lets be clear. Data doesn't give a fuck, so stop that bullshit.
And to be more clear: He took distinct actions to access data. Applying reverse engineering and some packet sniffing he SEARCHED FOR AND FOUND the data in question. It wasn't linked from any normally accessible location or anything else.
His only possible logic for 'not knowing' is if he was so stupid that he didn't understand what he was doing, but being that he got past turning the computer on, we know thats not the case. He intentionally sought out, downloaded, and distributed the data to someone else.
If you can't understand why thats wrong, I really feel sorry for you. I hope you get taken advantage of in the same way so you can get the point.
You can argue that the punishment was retarded, which it was, he wasn't actually malicious, but he DID commit several crimes.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
The same type of reckless design that went into AT&T's website for registration is symptomatic of the direction the industry has been heading. It represents that YOUR PRIVACY in the hands of a monopoly is not worth two-shits to them. Even if it was "only an email address" it could have easily been your SSN# on a CD, or medical record on an unencrypted laptop, voting record or ballot on a voting machine, whatever. Weev sounds like a jackass, but I would have expected better security from AT&T. If you're going to take the place to be a reactionary "victim" then maybe you should ask yourself who victimized you first -- AT&T perhaps? If AT&T left your car unlocked, would you still blame the thief?
Join the Slashcott! Feb 10 thru Feb 17!
We have convicted rapists and murderers that seem to get off with lighter sentences than people that do anything that involves a computer these days, even if the results don't hurt anyone and only embarrass a company or some govt. personnel.
Show me the numbers and then we can talk.
Real stats for the rapist and murderer. Real stats for the geek whose computer-related crimes earned him hard time.
In the American federal system, crimes of violence are almost always prosecuted under state law.
Execution List 2012 Each state on this list, for example, has executed between 1200 and 1300 death row inmates since 1976.
Federal Executions 1927-2003: 23.
The DOJ's Computer Crime & Intellectual Property Section archives its press releases of charges and convictions dating back to 2000. It's a useful corrective to the notion that the geek's crimes are victimless. That he hasn't hurt anyone.
CCIPS Press releases
Indulge me in a little hyperbole: for a friend of mine, hacking AT&T was a death sentence.
Lance Moore was involved with LulzSec, foolishly no doubt. As an AT&T technician of some sort, he acquired and subsequently distributed some internal corporate documents. The Justice department is liable to be a more accurate source of the specific complaints. He was caught. The FBI seized its opportunity to bring the hammer down. I've seen various figures given for the amount of jail time he was facing; somewhere between five and thirty. He was found dead by his own hand on February 24 of last year. His crime has by now likely been forgotten by all that were involved with it.
Sixteen other people were arrested the same day that he was arrested. I don't know their stories. The reader may judge whether justice was served.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.