Call Yourself a Hacker, Lose Your 4th Amendment Rights

An anonymous reader writes "As described on the DigitalBond blog, a security researcher was subjected to a court ordered search in which a lack of pre-notification was premised on his self description as a 'hacker.' From the court order, 'The tipping point for the Court comes from evidence that the defendants – in their own words – are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act.'"

Comments

Stallman would have something to say about this

[twocows]

Aside from the obvious abuse of power, there's this: http://www.stallman.org/articles/on-hacking.html

Re:Stallman would have something to say about this

[girlintraining]

they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act.

I wasn't aware that capability implied intent. I suppose everyone who owns a gun now should just surrender their 4th amendment rights, since they have the ability to kill people. Someone find out where this judge is; let's put his name here and on as many web pages as possible so anytime anyone googles his name, they can point to this as a reason to have their case retried by a different judge who doesn't hate America.

Re:Stallman would have something to say about this

[Lithdren]

Came here to say exactly that. Reviewing what they say in the artical linked:
 
 

The Court has struggled over the issue of allowing the copying of the hard drive. This is a serious invasion of privacy and is certainly not a standard remedy, as the discussion of the case law above demonstrates. The tipping point for the Court comes from evidence that the defendants â" in their own words â" are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. (underline added) And concealment likely involves the destruction of evidence on the hard drive of Thuenâ(TM)s computer. For these reasons, the Court finds this is one of the very rare cases that justifies seizure and copying of the hard drive.

Way I read this...they were unsure if this guy stole code from the company he worked for, they were pushing to seize his computer at home because they felt he had stolen code to release as an open-source option to the software he helped write that they wanted to lease out instead. The court, torn on the issue, decides that because he calls himself a 'hacker' he's able to not only steal the code, but cover his tracks. So they better seize his equipment before he gets a chance.

I hope someone beats some sense into this judge, just being capable of something does not mean you might do it. We're all murders because we all own cars capable of running people over and killing them. We're all mass murders because we have bleach/cleaning fluids at home we could dump into local water supplies poisioning the entire area. Next time someone gets hit by a car while on their bike in a hit-and-run they'll need to bring in as probable suspects everyone in the tri-state area who owns a drivers liscence. What kind of insane crap is this?

Re:Stallman would have something to say about this

[Anonymous Coward]

I was recently involved as a third party in a lawsuit where similar allegations were made. They were entirely without merit and totally malicious, simply being made in order to cause the defendant the financial hardship of having to be drawn through the legal system.

Just because one party alleges intent, does not mean there is any.

Re:Stallman would have something to say about this

[Anonymous Coward]

"I wasn't aware that capability implied intent."

Exactly. Imagine: "By identifying themselves as CPAs, the suspects expressed an intent to launder the money and hide the evidence by manipulating the books."

Who elected this moron to be a judge?

By the judges own logic, he, as a certified legal expert (one hopes that to get to be a judge one is a legal expert but in this case I have my doubts), has the capability of knowing how to circumvent the law and evade prosecution for any illegal acts he is commits and since he has that capability he must be suspected of breaking laws...

Re:Stallman would have something to say about this

[AK Marc]

If I were the judge, I'd have likely made the same order, and informed the plaintiff that if nothing is found, then 10% of annual revenue will be paid to the defendant for reparations for civil rights violations from the unfounded accusations.

I hope someone beats some sense into this judge, just being capable of something does not mean you might do it. We're all murders because we all own cars capable of running people over and killing them. We're all mass murders because we have bleach/cleaning fluids at home we could dump into local water supplies poisioning the entire area.

The claim that someone who calls himself a "cleaner" might have the skills and means to hide a murder. The issue here is that someone is harassing an ex-employee by making accusations. If they are founded, then the judge did the right thing. If they are unfounded, then the employer should be held responsible for their false accusations.

One of the problems is that our system doesn't punish false accusations, only false statements. If the employer accuses someone of something so bad, they should be liable for damages if the accusations are found to be unfounded.

Re:Stallman would have something to say about this

[CanHasDIY]

The constitution specifically says congress has the right to regulate. It's IN the fucking amendment.

This argument will, of course, go nowhere because we both have a preferred interpretation of the 2nd amendment, but I at least have both grammar and history on my side. But the "fucking amendment"only refers to a "well regulated militia", not "a well-regulated firearm". More importantly, you have chosen the wrong definition of "regulated" to make that phrase better fit your worldview. Hint: Think "oil", not "laws".

Indeed, I'm beginning to think it's a moot point to tell people that 'regulated' didn't necessarily mean the same thing 260 years ago that it does today; they're going to believe what they want to believe, and no amount of fact or cited references will change that.

It's like tryin' to talk sense to a friggin' creationist...

Re:Stallman would have something to say about this

[RenderSeven]

What the fuck makes you think you have any right to "undermine his decision"?

As a citizen I have an obligation to call attention to poor legal decisions, and my suggestion for a NPOV Wikipedia entry linking to a citation was a call for moderation over rash action. And you should know that judges cannot be voted out, and can be cited outside of jurisdiction, so I have as much standing and interest as anyone else, and I did at least read the entire decision. Did you? While I am not an appeals judge (and pretty sure you arent either) I think there is a reasonable argument that there was a judicial error in the application of the term 'hacker', in that the court applied the term arbitrarily to motive; rather, in terms of motive all that mattered is how the defendant applied the term to himself, and the decision does not take that into consideration.

Re:Stallman would have something to say about this

[BlueStrat]

The constitution says nothing about gun registration. Stop making registration into something ti is not.

Also:
The constitution specifically says congress has the right to regulate. It's IN the fucking amendment.

I'm sorry, but are you duly-authorized & licensed to post political opinions on public forums?

The point is, your argument works for government licensing & regulation of speech as well.

It's OK if you don't believe citizens should be able to defend themselves and their families and must be rendered victims/slaves to the first nut(s)/criminal(s) that come around with a gun, and/or is physically much stronger and/or greatly outnumbers the possibly young & female victim. If enough people agree with you in electing to enforce the victim-status of the weak/infirm/aged and the majority of peaceful & law-abiding citizens, then you can amend the US Constitution, as has been done numerous times already.

Don't people understand?? You can't weaken/nullify/sidestep one part of the Constitution you disagree with without also having an equal destructive effect on the parts you do like.

Either all of it is valid as it was written, or none of it is and the USA has become an authoritarian State where "Constitutional Rights", "Rule of Law", and/or any other limits to what government can do are meaningless and empty words & concepts.

Maybe you value the 1st Amendment highly, but sharply disagree with the 2nd Amendment's protections of personal firearm ownership. That's fine and is your right to believe, and there's a provision for changing the 2nd Amendment (or any others).

*But*, attempting to "game the system" through judicial/executive/legislative/regulatory legal sophistry (much of which reads like the "Chewbacca Defense" and/or a never-published chapter of "Animal Farm") instead of following the established amendment process, destroys all of the rights, protections, and limits set forth in the entire document as the same can be done with *them* if and whenever those in government so desire.

Strat

Re:Stallman would have something to say about this

[girlintraining]

As a previous post said, "It's more like if you claimed to be a professional killer and later claimed you kill deer." I know reading TFA is terribly out of fashion, but I recommend it. His advocacy included repeatedly pushing employers to open-source their product. That's what showed intent, not his website.

Advocating doing something isn't evidence for having actually done something. That's the point that neither you, nor apparently this judge, understands. It's like saying "Good for those 9/11 terrorists blowing up the building!" ... Not exactly winning you any friends saying that, but it doesn't make you a terrorist and it isn't a crime. It's just incredibly poor taste to say, and that is all.

So let me get this straight... before an investigation, the investigators must already have their proof?

They must have some evidence of a crime, yes. When a cop pulls you over, he can't just search your car because of the "I LOVE WEED" bumper sticker. But if he smells it on you, or sees wrapping papers on the floor, smells marijuana, etc., then that gives him what's called probable cause to conduct the search.

What exactly do you think the point of the investigation is?

Hopefully the truth. In practice though, it's more often a witch hunt. Either way, a search warrant is issued to find additional evidence of a crime (or crimes). For example, "I hate the president," isn't enough to get a search warrant issued, but "I plan on shooting the president at 3:00pm after his speech with my dad's hunting rifle" is. But the defendant in this case didn't say "I have the source code and intend to release it". It's arguable whether there was any evidence that he had it. The intent to release is based solely on previous statements made in support of open source.

What this case lacks is credibility. The judge has made assumptions about motive which are not supported by the available facts. He has linked two separate statements together to form a third statement which supports his position. In layman's terms, he jumped to a conclusion. And this is specifically why search warrants require a judge's authorization -- to prevent exactly this from happening and thus violating a person's rights. Suspicion isn't enough for a search warrant; It's rarely enough to take any action, especially when this is a civil matter and there is no imminent threat to life or property.

The judge agreed that there was a significant risk of irreversible harm if the defendant kept his computer during the investigation, so it's been seized. Big deal. It can be checked in a few days, and should be returned, if not, then it's time for a countersuit.

You clearly haven't worked with law enforcement much. Even back in the 90s, when 'cyber crime' was in its infancy, Steve Jackson Games had all its computers seized and nearly went bankrupt over allegations that their game was a 'manual for computer crime'. The computers weren't returned until over two years later, at which time the computers were worthless and out of date and the data they contained had been painstakingly recreated with varying degrees of success by the employees. Once a computer is seized, it doesn't get turned over "in a few days"... For one, the forensic labs have a backlog of months to years, and for two, as it is now material evidence, it can't be released until and unless all legal action involving it is concluded which included appeals from both sides.

So yeah, it is a big deal. It means his computer, his primary method of income has now been locked up, along with all kinds of collateral damage -- his entire digital life, including copies of resumes, bank records, pictures, etc., are all now inaccessible to him. He won't even get a copy of the hard drive back because until it has been processed, the police won't take the chance of giving him back data he could theoretically use

Re:Meh, too alarmist

[Wycliffe]

In short, this isn't a "violation of the 4th amendment" so much as it is an excuse to try and get access to the guy's hard drive and recover stolen assets.

What do you think a "violation of the 4th amendment" is then? To me "an excuse to bypass the 4th amendment to gain X" is
exactly that. It is a violation and an attempt to bypass the 4th amendment. Whether he is guilty is not the point.
Now if they got a proper warrant and executed it correctly, that's a different story but if they are using an excuse to bypass
proper protocol then it very much is a violation of the 4th amendment. It doesn't really matter what the excuse is either.

Re:Sensationalistic, much?

[mrchaotica]

Maybe you might argue the court didn't really have reasonable suspicion, but thats for the defendant's lawyer to argue.

Well, you see, the defendant's lawyer never had the opportunity to argue because the defendant wasn't just ordered to give the hard drive up but rather was raided by police with no warning. That's kind of the entire problem...