Reporters Threatened, Labeled Hackers For Finding Security Hole

colinneagle writes "Scripps News reporters discovered 170,000 records online of customers of Lifeline, a government program offering affordable phone service for low-income citizens, that contained everything needed for identity theft . Last year, the FCC 'tightened' the rules for the program by requiring Lifeline phone carriers to document applicants' eligibility, which led to collecting more sensitive information from citizens. A Scripps News investigative team claims it 'Googled' the phone companies TerraCom Inc. and YourTel America Inc. to discover all of the files. A Scripps reporter asked for an on-camera interview with the COO of TerraCom and YourTel after explaining the files were freely available online. That did not happen, but shortly thereafter the customer records disappeared from the internet. Then, the blame-the-messenger hacker accusations and mudslinging began. Although the Scripps reporters videotaped the process showing how they found the documents, attorney Jonathon Lee for both telecoms threatened the 'Scripps Hackers' with violating the Computer Fraud and Abuse Act (CFAA)."

Comments

Try to do something right

[Anonymous Coward]

That will teach you to use responsible disclosure.

Re:Try to do something right

[Anonymous Coward]

I'll beat the others to this.

This is one of the reasons for why being anonymous is important. This lawsuit is stupid, and since they have a video showing the method, it should be easy to throw out the charge.

Could the reporter have a rebuttal about them taking down the evidence, saying they destroyed evidence pending the lawsuit?

Re:Try to do something right

[Synerg1y]

and yet people keep falling for the same traps...

Re:Try to do something right

[Anonymous Coward]

But the reporter can't be anonymous and trustworthy. The press are as full of shit as every other profession, so a reporter needs to put her/his name to it or it's worth as much as an empty cup of coffee. By attaching their reputation (good or bad) to a story they can defend (rightly or wrongly) what the've published.

Re:Try to do something right

[kasperd]

But the reporter can't be anonymous and trustworthy.

Sometimes the evidence itself is more important than the source. In the particular case, it sounds like the evidence was strong enough that it wouldn't matter which source it came from.

But the trend with threats and lawsuits against those, who discover security holes, must stop. That trend is a major threat against data security across the entire IT industry.

People will keep finding security holes. Sometimes you just stumple upon them, without even looking. What are you going to do, once you have found a security hole? Report it and try to get it fixed? Ignore it? Abuse it? If those who do the right thing are going to be the target of threats and lawsuits, that certainly removes incentive to do the right thing. So fewer people will report security holes. And some of those who would have reported it, might instead decide to abuse it.

If we ever get to the point where doing the right thing is more likely to get you into a lawsuit than abusing the security hole for personal gain is, then the industry is in big trouble.

Luckily a few companies are taking steps in the opposite direction and are offering cash rewards to those who find security holes. At some point users will have to start taking that into account when deciding what software to trust. But it is a very real problem, when the systems you don't trust are those used by any branch of government. You can't just go somewhere else. And the lack of competition has lead to situations where security concerns are just ignored.

Re:Try to do something right

[Synerg1y]

Or you know... people could start writing decent secure code to begin with... :)

I mean SQL Injection attacks, and buffer overflows aren't exactly zero days at this point.

Re:Try to do something right

[Jane Q. Public]

"Sometimes the evidence itself is more important than the source. In the particular case, it sounds like the evidence was strong enough that it wouldn't matter which source it came from."

Fortunately there have been a few judges lately who have an actual head on their shoulders, and who have ruled that simply telling somebody their fly is open is not the same as rape.

But these B.S. laws, like CFAA and DMCA, need to disappear. They were ill-conceived and we KNOW that they cause problems. Not little problems, big ones.

I would keep the safe-harbor provisions of DMCA, and scrap all the rest of it. Same with CFAA.

Re:Try to do something right

[Ungrounded Lightning]

Or you know... people could start writing decent secure code to begin with... :)

Did you ever write a program? Did it work the first time, doing exactly what it was supposed/specified to do?

Took a lot of debugging and error correction, didn't it? Even if you are a programming expert.

Now write a program where "what it's supposed to do" includes "not get cracked and used by any malware, known or unknown, past or future".

Think you'll get THAT right the first time? Even if you are a security expert?

Re:Try to do something right

[flimflammer]

I want to agree with you here, but what the story simply calls "mudslinging" does give me room for pause. According to their legal representation, this access has happened over the period of several weeks, and they systematically downloaded all the records it could in this period of time while attempting to get into even more nooks and crannies of the servers.

Why would they be sitting on this, continuously prodding the site for over a month while downloading all the records if they were simply practicing responsible disclosure with nothing more than journalistic intent?

You would think accessing even one or a couple of these sensitive files would have been enough to judge that this content is facing the public and should be reported, rather than downloading all they could over the span of a month (and maybe even longer since these access records seemed to be pruned after 30 days).

Re:Try to do something right

[kiwisteve]

Things are rarely "right" the first time. That's why we test stuff before putting it live. Sounds like there wasn't much testing done if it was that easy and obvious to hack.

Re:Try to do something right

[Anonymous Coward]

if by "not get cracked and used by any malware, known or unknown, past or future" you mean
"not list people's SSN addresses and financial data in a google search result"

then yes i think i can get that right on the first try.

Re:Try to do something right

[kasperd]

there needs to be an outside agency or association which rewards those who expose these security holes and maybe even funds the court case against those targeting the messenger.

The law should be modified to ensure the following three properties:

• It should be illegal to deploy a system, which stores personal data in an insecure way. But as long as security holes are only left open accidentally, and are patched when pointed out, violations should only be punishable by fine.
• It should be legal for an outsider to take the necessary steps in order to verify the existence of a security problem in the system, as long as such action cannot be expected to damage data in the system.
• Any attempt by the owner of the system to persuade the finder of a security problem to keep it secret should be illegal. Such action should be punishable, plus the finder should receive compencation.

All of this is only applicable when the security problem is found by an outsider. It is reasonable to apply different rules when the security hole is found by an insider. If the security problem is found by an insider, it is acceptable if the company try to keep the problem secret indefinitely. But it is still not acceptable to leave the vulnerability unpatched.

Re:Try to do something right

[Midnight Thunder]

This is why a good QA team is always worth having. Sure it won't isolate you from every issue, but it should protect you from some of the obvious stuff.

Sometimes the problem isn't even to do with software, but with information policy and what can be placed on a server that is on the outside of a firewall.

Re:Try to do something right

[dcollins117]

Think you'll get THAT right the first time? Even if you are a security expert?

Well, yes, that's what makes me an expert. However, TFA is abiout a company putting all of its customer records online, unencrypted and searchable through a simple Google query. There is no excuse for that level of malfeasance.

Re:Try to do something right

[Ol Olsoc]

Did you ever write a program? Did it work the first time, doing exactly what it was supposed/specified to do?

Did you ever figure that was an adequate excuse?

Not in what you say isn't the truth, because any software that hasn't been shaken down is usually pretty bad, but using the "first time" as an actual reason for insecure software? Completely unacceptable. If you worked for me with that attitude, you might end up in the mail department where you could have an easier job.

Re:Try to do something right

[Bloem]

A defense is easy: Does the so-called hacker have a handle? If not, it is not a hacker! Seriously most reporters spend more time recovering handles or other goes-by-the-name-of-references than describing the issue at hand.

Re:Try to do something right

[Ungrounded Lightning]

Did you ever write a program? Did it work the first time, doing exactly what it was supposed/specified to do?

Did you ever figure that was an adequate excuse?

Of course not.

Not in what you say isn't the truth, because any software that hasn't been shaken down is usually pretty bad, but using the "first time" as an actual reason for insecure software? Completely unacceptable. If you worked for me with that attitude, you might end up in the mail department where you could have an easier job.

You obviously both misparsed my statement and aren't aware
of how *I* do software development.
It includes beating the HELL out of any piece of software before
releasing it (with a full coverage test suite built into the make
mechanism in a way that causes the build to fail if a unit test
fails.)

I've developed a methodology that lets me deliver such a fully
debugged software components, with test suite blazingly fast,
as well. It takes me about three times as long as it takes a
more typical programmers to get a new component of similar
size and complexity to successfully compile and link (but not
run correctly) after a moderate feature change.

And I'm thus familiar with some of the pathologies of
people who administer programmers with insufficient
insight into what they're doing and their modes of talking
about it. Because I'm so fast I don't generally report
progress until a component is DONE. Result: Some
administrators have compared my delivery of a complete,
polished, from-scratch, component to one debug iteration
of other team members. This lead to actual publication of
a statement to this effect: "[Ungrounded Lightning Rod]
takes three times as long as anyone else, but his stuff
usually works the first time."

I've been referred to as "a god" in hushed tones (over a
nearly non-existent bug rate in a ten thousand line application),
and had a colleague comment that I was the only person he'd
rust to program an artificial heart for him.

So I'm quite aware of how to make software solid.

My point was not making excuses for poor programmers.

My point was that commercial software operations usually
have management pathologies that lead to measuring
function and not measuring (or rewarding) security.
There's a lot of WORK involved in making software secure
and doing it is usually penalized rather than rewarded. So you
have to expect commercial software to USUALLY be riddled
with security bugs.

(Which is why I migrated to hardware design about 15 years ago.
The non-recurring costs of a bug-fix respin as SO high that
administrators often appreciate and reward solid design and
execution.)

Re:Try to do something right

[Sam H]

It might take a security expert to write code that works as specified the first time, but it takes a fantastic idiot to put any kind of code in production before it's been debugged and error-corrected.

Re:Try to do something right

[Big Hairy Ian]

"not list people's SSN addresses and financial data in a google search result" then yes i think i can get that right on the first try.

And will that stop some fucktard fax monkey from uploading a spreadsheet full of this info to your DMZ where google & everyone else can read it? We don't even know if this was a software fault.

Re:Try to do something right

[oreaq]

The only responsible disclosure is full public disclosure.

Re:Try to do something right

[kasperd]

That's all nice and everything, but the real issue here is that people expect to receive preferential treatment by calling themselves "reporters".

I have never implied the press should receive special treatment. Anybody who finds a security problem should be free to publish it as they see fit (unless they have entered an agreement about confidentiality, before they found the problem). Of course the right thing to do is to tell the responsible people about it in private, such that they have a chance of fixing the issue before you go public. But that is a matter of ethical conduct, and should not be part of the law.

Companies who want time to fix issues before they become public should give something in return to those who find the problems.

The law of course should impose some limits on how you can legally abuse a security hole. Finding an SQL injection and dropping all tables from the database should not be legal. But perhaps finding an SQL injection and shutting down the database server before somebody else starts dropping tables should be legal. Using an SQL injection to have the database add up two numbers (just so you can verify that there is truly an SQL injection) should definitely be legal.

Re:Try to do something right

[kmoser]

But the reporter can't be anonymous and trustworthy.

But how can we trust that this is true since you posted as AC?

Never expose any security holes

[Anonymous Coward]

In America, two business principles apply:
1. It is none of your business when shit hits the fan, and
2. It is never our fault.

Re:Never expose any security holes

[game kid]

...and when those fail:
3. I need to spend more time with my family.

No good deed...

[Anonymous Coward]

goes unpunished.

But of course.

[Black Parrot]

Company Spokesman: Surely you don't think it's our fault.

Company Spokesman: Especially if it's going to cost us money.

Re:But of course.

[t0qer]

Company Spokesman: Especially if it's going to cost us money, and don't call me Shirley.

Quick! Someone Call...

[Anonymous Coward]

Stephen Heymann and Carmen Ortiz to make sure these neferious cyber criminals get what they deserve!

PR, lawyer greed, revenge, or abject incompetence

[interkin3tic]

I honestly can't understand the point of shooting the messenger here. Is it entirely to try to convince their customers (who are likely not very tech savvy) that they have nothing to worry about? I can understand the letter they sent out blaming the reporters for that, but to actually sue them doesn't make sense. Do they actually believe they can spin this to the FCC as the reporters going all James Bond to access files that were reasonably secured? Or is this just a lawyer who is racking up more billable hours, and his clients are too stupid to realize what a waste it is? Is this actually a roomful of executives saying "FUCK THOSE GUYS! Send the lawyers after them! That'll learn the press to google us!"

I realize these companies have made some seriously bad decisions, and dumb decisions by committee are even worse, but this makes no sense.

WGET? The Devil's Tool!

[eldavojohn]

Lee added that the Scripps Hackers eventually used Wget to find and download "the Companies' confidential files." (Wget was the same tool used by Facebook's Mark Zuckerberg in the film The Social Network to collect student photos from various Harvard University directories.) The rest of the letter pretty much blamed the "Scripps Hackers" for the cost of breach notifications, demanded Scripps hand over all evidence as well as the identity and intentions of the hackers, before warning that Scripps will be sued.

Folks, there was a big bad security breach. Now, *adjusts his massive belt buckle* we're investigating this like we would any other serious crime. And right now we're just trying to identify weapons used in this heinous attack. Now, we've discovered that the hackers were using a very vicious mechanism in this attack. In a murder, you might find a revolver used to put two bullets into the back of a poor old defenseless lady's skull in order to get all her coupons and a couple of Indian head pennies out of her purse. Or perhaps in a pedophile case, you'll find the "secret candy" that was used to lure the children into a white panel van with painted over windows.

*expels a long tortured sigh*

Well, I gotta say, in my thirty years on the force, I wish we were only dealing with something like that today, honest to God Almighty I really do. Instead this artifact was discovered at the scene of the crime. Now, I'm not asking you to understand that -- hell, I'd warn you against even openin' up your browser to the devil's toolbox. But let me, a trained law enforcement professional, take the time to explain the gruesome evidence just one HTTP request away from you and your chillun'. The page is black. Black as a moonless night sky when raptors swoop from the murky inky nothing to take your kids and livestock back up with them silently. On it is a bunch of white text that makes no sense to any God fearun' man on this here Earth. That's what they call a "man page" probably because it is the ultimate culmination of man's sin and lo and behold it displays a guide to exact torture on innocent web servers across this great and holy internet.

Even if you want to use this "man page" for WGET to learn how to use Satan's server scythe, you would have to read through almost twenty pages of incomprehensible technobabble like what that kraut over in Cali -- the one who took his wife's life -- spoke. And if you want to just see an example, it's not at the top! No, why, it's all the way down at the bottom. For this one, they don't even have examples. Just enough options to kill a man. Probably gave Steve Jobs cancer, they never proved all these options in these pages didn't. Buried in the mud of a thousand evils lie more evils.

And why, oh why are we even wasting taxpayer money on these Scripps Journos? Who needs a trial when the evidence is in the tools they used? Folks, I think it's time we WGET one last thing, I'll WGET a rope and you WGET your pitchforks and torches ... let's go down to Scripps and put all this computer business behind us. Okay?

Typical distraction

[intermodal]

Call 'em hackers enough time, and people will be distracted by their alleged malice to the point where they forget or don't even believe anymore that the files were literally just out there for anyone to see. It's like leaving a $100 bill on the sidewalk and waiting to see who turns it in at the lost and found so you can call 'em a thief to distract from your own leaving it lying around.

Re:Typical distraction

[VortexCortex]

Click this link from your seats...
That's right!
You get to be a Hacker,
And You get to be a Hacker,
And You get to be a Hacker ...

Re:Typical distraction

[Krishnoid]

Doesn't even have to be all of $100.

Re:Typical distraction

[Isaac Remuant]

What the fuck. Entrapment of the worst kind. I guess they're following the FBI's game, catching made up criminals is far easier than actually catching criminals.

Re:WGET? The Devil's Tool!

[zlives]

the nerve of those... terrorists?

Left the goods out for anyone to see

[LaughingRadish]

The management of First & Only Bank would like to let everyone know that all the money has been piled on the front lawn, and also that they're very upset that it has been disappearing.

So if you are a robber, please don't the take the money. It's very rude.

The money has been placed on the front lawn to get it out of the way while the vault is being repaired.

Mandatory study for Lawyers and Judges...

[Moppusan]

...should be a course in Computer and Internet Obviousness (naughty words omitted to make it sound more official, fucking god dammit). And certified as passing this course should be a requirement to be a judge or lawyer in the US with a 6 month renewal term. Any lawyer not holding a certificate should be disbarred post haste and any judge should be removed from his/her seat post haste. Post haste. Haste.

Re:WGET? The Devil's Tool!

[Cormacus]

I read this in the voice of Sheriff J.W. Pepper (see The Man with the Golden Gun and Live and Let Die)

Re:PR, lawyer greed, revenge, or abject incompeten

[DougOtto]

It's deflection.

If they were "hacked" then the folks who's data was leaked blame the wily hackers. If they let it stand that the data was just freely available on the web, it's a liability to the telecoms involved; i.e. "it's not our fault, it's THOSE guys."

Re:WGET? The Devil's Tool!

[ColdWetDog]

Is this a screenplay? CIS:Tennessee?

Re:WGET? The Devil's Tool!

[fredgiblet]

And here is me, with no mod points for the day.

over the top but!

[Anonymous Coward]

While the threats are over the top people need to get it right. They didn't just report a security hole, they EXPLOITED the hole after discovering it and downloaded the data, that is where they crossed the line. It is like the difference between pointing out to a bank that their bank vault was left unlocked and walking in and taking all the money and saying "look guys I can walk in and take everything because your door was open". One will get embaresment from them the other will invoke rage and you in handcuffs.

Re:over the top but!

[mrbester]

So you would prefer they'd taken all the data and kept quiet about it?

No. Full disclosure is warranted because full access was granted. It's not like just a few details were available. Fuck them for allowing this to happen. Fuck them serially and severally.

Re:over the top but!

[Ungrounded Lightning]

And the other side of that coin is finding it and reporting it. Then checking back x time later. Where they did nothing then say, why were you looking again?

How about:

1) To find out if the data was pulled down yet.
2) To be even nicer guys by waiting until the data WAS pulled down to run the story that would give tens of thousands of identity thieves a valuable present.

Re:PR, lawyer greed, revenge, or abject incompeten

[fuzzyfuzzyfungus]

I suspect that it's a mixture of technical cluelessness and PR. The people who actually made the mistake that led to the records being exposed probably realize(now, I'm sure it was either an oversight or 'just temporary' at the time) that they fucked up; but they have little to gain by pointing that out.

People higher up the food chain probably have only the haziest distinction between 'something I didn't want happening' and 'something that you circumvented an access control to achieve' and, again, not much incentive to clarify the situation. "Getting hacked" isn't good; but it's a bad thing that just happens sometimes. "Being massively irresponsible" sounds like something that might incur liability.

Re:WGET? The Devil's Tool!

[webmistressrachel]

Wow, I'm scared to fire up my console now. GUIs only from now on for me - I had no idea that I was invoking the devil with my black backround and myriad switches and parameters passed!

Having been a "builder" from a very young age, I can identify with being considered "heathen" for being able connect things that other people had no idea could work together (yet obviously could work together - for example I've used a decent amp and speakers with whatever source was playing since I left home, but using the AUX input with my NICAM video recorder was blasphemy to my parents - and connecting the computer (Amstrad CPC464) to the speakers must have been like summoning demons - because they put a stop to that quickly - and no, it wasn't loud either.)

This perception of me as "hacker" carried on through school and college. Despite me having more integrity than anyone else around me at the time, and an innate sense of "right" and "wrong" and natural justice, I found myself distrusted because people couldn't understand how I did the things I did with so little (and such a crap background. Computer books were NOT on any shopping lists. I had the CPC464 manual, and POKE.)

First they came...

[Jah-Wren Ryel]

First they came for Weev.
Then they came for the reporters. ...

Re:First they came...

[PRMan]

First they came for Weev, and most reporters called him a malicious hacker...
Then they came for the reporters. ...

This is good news

[gr8_phk]

Usually reporters tell stories of "hackers" finding such things and we wonder weather the reporters understand how "non-hacking" the activity really was. Well in this case it's abundantly clear to them since it was they who discovered the data in plain sight. No question the reporters see the absurdity of the "hacker" label in this case.

Re:This is good news

[PRMan]

This is good. I still don't understand how weev could have been found guilty, other than that he's a complete sociopath...

Been to the web site?

[Frosty Piss]

First of all, both these comapnies web sites are identical. Second of all, they look like some 14 year old put them together.

Look, this is just some sweatshop lawyer who wrote q $200 threatening letter. The threat has no value, and should be ignored.

Re:Been to the web site?

[Anonymous Coward]

The threat has no value, and should be ignored.

No, it should be forwarded to the relevant authorities (and bar association), the lawyer disbarred, whoever ordered it sent to jail (even only a week actual locked up will do, as long as it also brings a lifetime criminal record) and the company fined an RIAA style figure (e.g. millions) for the threat. Then the company should be prosecuted for disclosing the information in the first place with another RIAA type figure ($10k/person's data leaked should do it).

Re:Been to the web site?

[Frosty Piss]

No, it should be forwarded to the relevant authorities (and bar association), the lawyer disbarred, whoever ordered it sent to jail (even only a week actual locked up will do...

It's nice to be "outraged", but connection to reality generally drives the actions that people who have something to spend and something to lose do.

A lawyer sending a uppity letter alleging this and that is not illegal. Everyone is entitled to an opinion.

But by all means, become "outraged", it's what the Internet is about these days, not rational clear thinking, apparently.

Re:Been to the web site?

[AK Marc]

That's not how threatening letters work. Threatening letters are there to scare, and I didn't read this specific one, but the sweatshop lawyers writing them generally have a better grasp of legal than some Internet A/C. It has no weight, and not a reason for action against the lawyer.

Re:Been to the web site?

[AK Marc]

"As a lawyer, I find your post annoying and incorrect to the point that Frosty Piss (770223) would likely win a lawsuit against you. I *highly* recommend you remove your post or edit it before Frosty takes action."

There's no threat in there. There's nothing in there actionable for any reason. Even "I find your comments to be so obscene as to be illegal" wouldn't be actionable. Now I'm curious enough, I may have to read the letter in this case. I've seen hundreds, and they are all similarly vague and without meaning. You might as well ask a CIO what he thinks about software as a service in the cloud.

Re:Been to the web site?

[sjames]

Actually, if a lawyer letter is incorrect on it's face or with a cursory look at the evidence, it should be grounds for sanctioning. They are supposed to keep crap like that out of the court system. And if they argue they never actually intended to take it to court, they admit to serious ethics violations. Lawyers also aren't supposed to use intimidation to win when they know they couldn't win in court.

Re:Why use wget?

[mrbester]

1. wget is just a means to automate. Would you type all the URLs manually?
2, 3, 4. As insecure as anybody else downloading it. They have no duty of care that publicly available data that shouldn't be publicly available is not publicly available.
5. A blurred screenshot allows plausible deniability. After all, the blurred bits could be anything. It could even be a completely different page blurred in Photoshop to smear the good name of these dickheads^W fine upstanding members of the community.

If they have a complete data dump, it is most likely someone else does as well. Someone who is more interested in profiting from shoddy practices.

FA

[AndyKron]

In my opinion, attorney Jonathon Lee is a fucking asshole.

Good Deeds

[ThePeices]

No good deed goes unpunished

Re:WGET? The Devil's Tool!

[Cosgrach]

For me, I heard Buford T. Justice's voice...

Re:PR, lawyer greed, revenge, or abject incompeten

[Anonymous Coward]

Reminds me of: http://www.despair.com/meetings.html

Good luck with that...

[mikeiver1]

"...attorney Jonathon Lee for both telecoms threatened the 'Scripps Hackers' with violating the Computer Fraud and Abuse Act (CFAA)." Good fucking luck with the subterfuge assholes. You shit the bed and now you are trying to say it was the guy from the next town over. So typical of companies now days. I agree that the more anonymous you can stay the better. We seldom if ever give our info to anyone unless it can't be helped. Most of the time it can be and so we don't. I worry more about these shit bag companies having my info more than I do nefarious characters now days.

Re:WGET? The Devil's Tool!

[gmhowell]

I read this in the voice of Sheriff J.W. Pepper (see The Man with the Golden Gun and Live and Let Die)

Buford T. Justice is also acceptable.

Re:WGET? The Devil's Tool!

[Ultracrepidarian]

PEEK and POKE are on the short list of Bill Gates' truly original contributions. Clearly tools of the Devil.

Using google

[Anonymous Coward]

Use google to find information, use that information to exploit certain weaknesses in a system. Isn't that exactly what hackers do? How are they not hackers? Because they also wear the hat of news reporters? Maybe that's what current hackers have been doing wrong. They need to get jobs as reporters.

Streisand calls in Anonymous?

[dutchwhizzman]

The Streisand Effect will be in place here. Cue Anonymous hacking these companies upside down in 3...2...1......

Re:Pray for Oklahoma City

[Teun]

Judging by the ideas of these same religious quacks Europe should have been leveled years ago :)

I feel with the people in the affected areas and wish the religious intolerant (or is it intolerable?) would no longer be allowed to use others' misery for their own sick agenda.

Makes you wonder

[ThatsNotPudding]

How many anonymous 'hackers' are decent folks just pointing out glaring flaws while wisely protecting themselves from idiot lawers and lawmen?

The records were never there

[zeroryoko1974]

I worked for an outsourcing IT company, and one of the guys I work with filed invoices for the customer. The application he was using (SAP if I recall), also was used by payroll. At some point he got access to view quite a few peoples payroll records. He called the customers SAP support and they denied that he could possibly have access to those records. So he told them, well, why don't we ask some of the people in this list if this is what they make and see if it is accurate. They declined, and the records disappears shortly after. When he called them back about it, they were like we didn't do anything, you must have been mistaken about having access

Re:WGET? The Devil's Tool!

[Legion303]

Are you sure about the genesis of PEEK/POKE? I was using them in Integer BASIC, before MS came out with Applesoft.

Re:WGET? The Devil's Tool!

[webmistressrachel]

Locomotive Software called. They want their code back...