Slashdot Mirror
Blogger Fined €3,000 for 'Publicizing' Files Found Through Google Search
mpicpp points out an article detailing the case of French blogger Olivier Laurelli, who had the misfortune to click links from search results. Laurelli stumbled upon a public link leading to documents from the French National Agency for Food Safety, Environment, and Labor. He downloaded them — over 7 Gb worth — and looked through them, eventually publishing a few slides to his website. When one of France's intelligence agencies found out, they took Laurelli into custody and indicted him, referring to him as a 'hacker.' In their own investigation, they said, "we then found that it was sufficient to have the full URL to access to the resource on the extranet in order to bypass the authentication rules on this server." The first court acquitted Laurelli of the charges against him. An appeals court affirmed part of the decision, but convicted him of "theft of documents and fraudulent retention of information." He was fined €3,000 (about $4,000).
You fsckup your own security then blame the guy for accessing and republishing something you posted for the world to see?! Stupid bureaucrats.
I HATE it when governments do this. They can't simply admit to having made a mistake and made those files public (albeit difficult to find). They have to fine this poor person just for coming across something interesting and posting it.
Fuck them. Fuck them hard with a chainsaw, every last one of them who pushed for this.
I guess my tech illiterate grandma is a hacker then because she can use Google too.
If clicking a link on google is all it takes for you to be branded a hacker now why don't they just lock up everyone that is not Amish (who in turn act as our jailers as they are the only one that can't google things).
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
In this scenario the Law worked perfectly.
Government sets rules on what you can and cannot do,
Government interprets those rules,
Government imposes punishments based on those interpretations.
You piss off the government, they use the laws to make your life hell.
Can someone post enough info .. to generate a Streisand effect? Would love to know what they have to say.
Often I marvel at how banal the American government is. Then, occasionally, the UK or French governments make me feel a little better.
I've always referred to myself as a lowly grinder, far beneath the vaulted hacker. I'm feeling pretty high on the geek scale now.
Having to work for a living is the root of all evil.
So what punishment was meted out to the webmaster who failed to properly secure the documents?
In France you can be acquitted then tried again?
Government information, presuming the government is actually for the people and by the people, should all be publicly accessible.
If you forget to lock your front door ( a lapse in security ) is it OK for anyone to come into your house?
Nah. This is more like a public library that wasn't supposed to be open on Sunday. But a researcher tried the door anyway and it was unlocked, took some photocopies, and left a note for the librarian saying "you should really lock the door on Sundays if you aren't going to be here".
Liberté, égalité, fraternité!
tr. "Meet the new boss, same as the old boss." aka "Lèse-majesté"
"National Security is the chief cause of national insecurity." - Celine's First Law
If you left a book on the street out the front of your house, but didn't give anybody your address, is it somebodies fault if they read the book?
There is no expectation of privacy here, it is a publicly accessible web page.
only if they wear uniforms and carry guns. i don't know about france, but in this country texting is a shooting offense. so you walk through a door you beter know whats behind it.
we only have whiny liberals to fool you.
A lot of the stuff in Bruce Sterling's "The Hacker Crackdown" comes under that category or close to it. The book can legally be read online.
Thank You. The very idea that there can be an analogy between a locked door on a (non-existent) physical structure and a link to an unsecured file on a web server is utterly absurd.
If liability should exist, it should be assigned either to Google or the agency of the government, itself. At which point, if anyone still believes the The People have any rights whatsoever, one must ask how a democratic government can justify keeping information from itself. The only rationale which stands the test of reason depends upon a distinction between the hoi polio and whichever upper class members might suffer harm as a result of daylight.
But if someone hangs "Public Entrance" over their door, then imprisons you and fines you after you show people what you saw inside, they might be the French government.
Am I a peeping Tom if I glance at your house while walking by and you're having sex in front of an open window?
Couldn't someone sue them for negligence in allowing these documents to be publicly accessible? Really if it was that sensitive, shouldn't the button monkey that allowed them to be indexed by google be the most responsible?
7GB of downloaded files doesn't sound like it was just an "accidental" downloading of some files.
Let's put it this way.
If you misconfigure your wireless access point and leave it open, does that mean that it should be legal for anybody to connect to your network and download all the files from your NAS without penalty? Including *those* pictures of you and ____ doing _____ to _____, and your tax returns from the past 5 years?
Naw a better example is the documents are stacked neatly in the park, covered by a fallen tree frond, and then snow fell on top of it.
So then Park Maintenance removed the snow and the Recreation Dept removed the tree frond, and there the documents were.
A little bit like leaving your belongings laying on the footpath outside your house, then having someone arrested for breaking and entering when they pick some of them up and walk off.
Having learned from previous mistakes, the agency had taken the precaution of encrypting the documents using an incomprehensible standard known as "French," so no one really paid it any mind.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
When has anyone accused the french of doing anything intelligent.
From the article
UPDATE: Laurelli ended up admitting in testimony that when he found the documents, he traveled back to the homepage that they stemmed from and found an authentication page. This indicated that the documents were likely supposed to be protected. That admission played a part in his later conviction in the appeals court.
The hung out an "authorized persons only" sign but forgot to lock the door.
And if someone instead let me in, let me look around, take pictures, and it later turns out that person was your crazy ex who still had a working key to your house?
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
Dude clicked on a search result. How do you tell by an URL alone that something is out of the public domain? Not exactly the same thing as leaving an open access point unprotected and downloading from somebodies computer.
They say he "stole" the documents...
Um, sorry google, I apparently stole your search page today. Several times. Now I feel bad. Do you need it back?
More like they hung out an "authorized persons only" sign on the front door, but forgot about the side door.
In this case, the "hacked" agency was not willing to sue, because they were ashamed of having published documents by mistake.
The case happened anyway because the general attorney wanted it, despite he did not understand what it was about.
The case will now probably move to the Cour de Cassation or the Conseil d'Etat, which are both french supreme courts.
Look I hate governemental abuse like everybody, but the fact is , if you find a house with open door, or an non working lock and you enter, you are still trespassing. Why do the hell some people on slashdot think this is not the same with a server, and then the next article try to say we don't need new law as existing law for physical items (mail/email comparison) are still good enough ? Well yadida, it is obviously that in such case trespassing law would be used.
Not the same thing. Not even close. Private dwellings on the internet are supposed to protected by some form of authentication.. Its a enormous library. If you want something kept secret don't be a luser and put it on the internet. I guarantee the root cause of this is some jackass who wanted to be able to access their data from home. He didn't go around url hacking, he used google. Its like they put it in the yellow pages and got pissed when someone saw it.
In particular, if the door is unlocked, that doesn't mean you can walk into the building and take photocopies of everything you find there, then publish the documents.
This is a prime example of the misuse of analogies to try and equate things which are not the same.
How is clicking on an online link in any way similar to walking into a building? A building has walls purpose built to keep people out. In the case of this French website, what is your "wall"? And to stretch your faulty analogy further, if an area appears to be public land, are you not able to stroll around and take photographs?
More like they hung a sign, locked the door, and forgot to build the walls.
Since medicine, technology, and businesses tend to attract the brightest people, sadly the leftovers end up in governments. Too bad they have so (too) much power over truly innocent people.
(my captcha is "insipid" - oh the irony...)
He admitted in court that he had been to the front page of the site where they were hosted and was aware that the documents were not intended to be available to the public. Finding them by accident on Google is one thing and not the point of contention here. Then downloading all of them and then republishing them knowing full well that what you are doing is definitely unethical and probably illegal is another matter. The blogger runs a security company and should have informed the company of the fault before blogging about it. This is not the kind of practice that is considered acceptable in the security community. Given that it could be considered as a criminal offence in Europe to access the documents without the requisite authorization you can take the fine (no prison time, no criminal conviction) as not a bad outcome. The issue here is that the court had no idea about the the online environment or what crime online is before the trial which speaks to a definite problem in regards to the training of judicial staff.
Hi, I am French, form what I read, he was convicted because he admitted he knew the files were meant to be protected by a password.
He stumbled on the files doing a google search .... ... ... Without telling the site! ...
But then, he went to the home page of the site portal and checked users were asked to login to access the site
Even though he found that anyone had access to the files using a url
Then he proceeded to get all the files he could from the site
That's why he was convicted : He knew he was doing something wrong! And still did it
You see a building with a broken lock, you loot it?
Disclaimer: IANAL
Just to be a little more complete on this topic, while interrogated by police, Olivier Laurelli recognized that when going up directory structure he found the login page of the site containing the documents and thus was aware that this site was intended to be protected (even if this protection was utterly flawed) before getting a copy of the documents. This knowledge made him fall under the French law regarding "fraudulently staying in an automated data processing system" ("se maintenir frauduleusement dans un système de traitement automatisé de données").
The other point regarding "theft of documents" is highly dubious though, because, as often in "hacking" cases, there is no real "theft" the original files being still on their server...
It will be up to the "cour de cassation" (higher French jurisdiction) to decide about this.
(or maybe even "European Court of Justice")
Legal explanation on this ( French) site http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut-pas-%C3%AAtre-condamn%C3%A9-pour-utiliser-Gougleu where the case is "dissected" by an attorney.
It should be the case that the uploader is the guilty party.
Moreover, the French government put the documents up. That'd by like Warner Bro.s posting Harry Potter online, and then yelling when people downloaded it.
If you first don't convict try try again.
What the fuck is it with autistic geeks, seriously?
You can't even be bothered to RTFA, but want to post your BS about it.
Your analogy is an epic fail!
He clicked on a google search results link for unrelated topics, and this turned up. He found the info interesting and used wget. He thought he was on a public site.
That is what happened, not an analogy.
A more accurate analogy:
The owners of the building stack the building contents out in the front lawn. Joe, walking past on the sidewalk, looks in the lawn and takes some pic's with his camera, thinking:'man, that's some wacky shit! Wonder what's going on? I know, post it online!' then getting arrested for taking the pic's, getting acquitted of any crimes, then another entity getting it moved in an appeal to a civil court, then Joe getting fined for it.
And Joe never left the sidewalk, just his bad luck to be walking down that sidewalk with a camera while the building contents where on the lawn that day.
It really depends on the legal system, part of the world, political and gov reaction to database/network entry in the 1980's to early 1990's.
Lots of countries had to drop cases due to that lack of any laws covering basic system entry and file transfer out of their system with logs been of little help.
So legal teams in many countries now face stiff new fines and very clear legal definitions regarding computer network access. The govs now have the experts, funding and political support to win.
Layer on legal systems that see the police spending time and cash looking into 'your' life as been something you have work your way out of legally - a legal system where you have to prove why your not guilty vs the gov having to show your guilty.
Domestic spying is now "Benign Information Gathering"
No no it's like the documents were in a park, and a bird used the paper to make a nest out them. Unfortunately the bird was an invasive species and so park rangers culled them and found the nest and removed it. Then the papers were taken back to the office where the secretary who was having an affair with the accounting guy typed them up thinking they were a report to the government on the office's productivity for the year. Meanwhile the wife of the accounts guy, who was s gold digging wench, came in and busted them. Wanting revenge, she took the documents, which were covered in bodily fluids because the secretary and accounts guy didn't clear the desk before their romp, and gave them to her lawyer.
Yea, that's pretty much how it is.
Don't they have a form of data protection act whereby, one is legally enforced to keep private data secured?
How can one claim the guy gained access to the data illegally if you are posting the data?
I'm finding it difficult to tie this to US policy somehow. Does anyone know how the US caused this? Was there some sort of US IP in the documents that were exposed?
I'd appreciate any help. Thanks.
Maw! Fire up the karma burner!
It's still a public-facing website, and his entry point was public. If you build a mall, provide multiple public-facing entrances, but only put a security guard on one of those entrances, it should NOT be a crime for someone to walk into your mall via one of the other entrances.
Also, he was convicted of "theft of documents and fraudulent retention of information." Theft? Fraud? WTF? Unless there's actual evidence of criminal intent, I agree with an earlier poster, they punished him because they were embarrassed, and they're the ones who've committed theft and fraud by taking money from him.
What would have happened if he would have instead made a blog post and then linked to the documents? Would that still have been unethical?
Around here we have at least 3 different levels of courts, I think 4 for some things. Both sides can appeal to higher court if they feel there was something wrong with the process of the lower court. The higher courts don't take cases simply on the grounds of " I think the verdict was wrong", they need some reason why the appealing side thinks the process went all wrong. It's not a bad system generally. Minor things will never get to appeals, unless the lower court judge was drunk or something. Also lower court judges can't just rule their friends free and then the friend becomes untouchable. Can't happen like that.
> Google makes links available, is not charged or fined
> Guy clicks links on Google search engine, is fined
Am I the only one who has a problem with this "logic"?
9/11: Never forget it was a false-flag operation
But instead he was fined because although he knew that he souldn’t have been where he was (he confessed he was in a normally login/password protected intranet), then he remained there, took documents, and then tried to sell them to newspapers or other journalists.
Due to the fact that he new about the authorization page he knew he he didn't ha authorization have the documents but copied them anyway that is theft.
The analogy with the open office is just stupid.
A server is not a physical place that you enter or leave.
If you search for an analogy with the people world, a server is more like a counter where you request documents and/or service. If the people serving at the counter deliver private document to honest people that did nothing to fool them, it's the responsability of the agency that put the counter into service.
BTW, it's not the agency which appealed. It's the government.
erhm.. with lack of a copyright statement, you are not able to republish, the copyright statement and license would GRANT you various rights, without it, you have none.
Hmm. It's not clear to me from reading the article whether he knew before downloading them that he was not authorised. That said, I will grant that as soon as he did find out, he had a problem and should have acted accordingly.
Concerning the court's competence, I found this part disturbing:
1. The first court ruled the Laurelli wasn't guilty. ANSES, the source of the documents, subsequently declined to pursue any civil action. Despite this, the DCRI appealed and pursued _anyway_, yet the prosecution didn't have a proper understanding of what they were prosecuting!
2. It was actually established by ANSES that those files (however inadvertently) were _accessible_, not inaccessible, to the public, so the court has rendered judgement directly contrary to the evidence presented by the same national agency from which the data was downloaded.
It is a question of intent.
Did the publisher *intend* the documentation to be private?
And did the reader understand that intention?
If he knew that the documents were supposed to be private, then it is a fault to reproduce it. Ethically, if nothing else. Downloading 7GB? Heh. He'd have to be pretty dumb to think that was intended.
One thing western Europe has going for it is that you are a lot safer from the police there than in USA. The US police just take peoples belongings because they "suspect" that they have been used in a crime. This can happen even without a trial or a conviction. IMHO your bill of rights has no meaning as long as that persists.
And the most perverse side of this is that the police departments get the money they take so it can be used to finance salaries and equipment.
They seize and retain property found on premises and persons in the UK too.
At one time, France was a shining example of social democracy. Now, it is beginning to acquire hints of american style neo-totalitarian heavy handedness.
More like he came in through an unlocked side door with no sign, thought "Uh is this for the public?" and left through the main door only to find that it needs a key to open from the outside and there's a sign saying "Authorized persons only". So far, a honest mistake on his part and not anything he could be blamed for. But when you go back in through the side door and start cleaning the place out, that's not a mistake anymore.
Live today, because you never know what tomorrow brings
Both wrong.
If the book contains obviously non-public information, then, as soon as you realise this, you're not allowed to read any further, and you're not allowed to re-publish any of it, and you should notify the home owner of the problem. This guy didn't do any of those things, even though he knew the files to be non-public, that's why they prosecuted him.
If he's downloaded a bunch of files, read them, and then told the agency that these files were publicly accessible and that he'd deleted the copies he had of them, he'd have been just fine. He knew they were non-public, but decided to make them public by republishing them. That's what made him a criminal.
One could argue that had he done the right thing, they'd have come after him anyway. That may be true, and one would hope that he'd be acquitted rather rapidly with the prosecution given a strong ticking off by the judge. I doubt it would be quite as happy and rosy as all that, but at least this guys would have had morality on his side.
No, it is not someone's fault if they read it. But your analogy isn't quite accurate. This is not a case of someone stumbling over a link, and innocently reading a bit. He knew it wasn't supposed to be accessible, he knew it was a mistake, but he copied it and then re-published bits in his blog.
Yes, those that left it there unsecured screwed up and should answer for that. And maybe it should have been public knowledge, I don't know. But let's not pretend it was all done in innocence.
So this is more like finding a private journal in the street that has obviously been dropped by accident, photocopying it, and then publishing bits in the local paper.
What do you expect from France, the country which made taking photos of people in the street illegal? My name is Chrysanthi Lykousi and I'm an international street photographer, I was arrested in Paris for privacy violations as I was taking pictures of women walking in the street with their children and I had to pay their stupid fines and contact the American embassy to return to America. Frenchmen told me this privacy law which made photography a crime was passed after a politician wanted to stop the press from publishing an incriminating photo of him. France has really some of the most crazy laws, but if you get to learn the politics it quickly becomes clear that every crazy law was in fact written to protect the French elite and maintain corrupt hierarchies.
In the USA? Yes. It's not against the law until you tell them it's trespassing at which point they need to leave immediately or they can be arrested and tried.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
The story said he downloaded 7 GB of files, that's hardly just 'clicking on an online link'. He knew what he had.
If you find somebody's front door is unlocked and you go inside just long enough to leave a note saying "you should really lock your door. I found it unlocked. I could have taken something", and the owners of the house find you and try to throw you in jail: that would be idiotic and wrong.
If, on the other hand, which it sounds like is more like what this guy did, you find somebody's front door is unlocked, go inside, and rifle through all their desk drawers looking for things they don't want you talking about, then posting what you find on the internet, you should get hit with something. You shouldn't get hit with a B&E charge, cause you weren't breaking anything, but you should get hit with *something*.
This should absolutely be appealed - copying freely available information is not theft. If the individual had actually accessed the machine, downloaded the files, and then deleted them from the machine perhaps that could be construed as theft. Is Google committing a crime by spidering the content? They found the content, read it, and indexed it - so how is that not identical to what Olivier did? If Google can't be prosecuted then neither can the blogger. The same thing applies in cases like what happened to Aaron Schwartz, or what Gary McKinnon had to go through.
Personally, I do this sort of thing all the time and will continue to do so. There are groups for us - open directory enthusiasts. Who knows what is out there?
This is France. What do you expect?
They like to slap bloggers with fines, especially out of country once.
To be fair, whether you lock your door, don't lock your door, or leave your door wide open ... if someone steals your stuff, it is still considered theft. However, whether you lock, don't, or leave wide open might determine whether the act is considered breaking and entering. It appears that the person did nothing abnormal to access the documents though. So at best, it would appear his charges should be distribution of copyrighted materials, if the materials were copyrighted.
Doesn't mean you should feel free to walk in and take my furniture.
He was fined for the crime he did commit. It should be obvious to anyone what was intended to be confidential.
The issue is that while he was inside the first time he copied a lot of data and when he realized he was not supposed to be there he didn't destroy those copies but made even more copies and gave them away.
http://www.guillermito2.net/ar...
http://www.zdnet.com/harvard-u...
Currently-assigned values are defined as follows:
0x0 If the bit is set to 0, the packet has no evil intent. Hosts, network elements, etc., SHOULD assume that the packet is harmless, and SHOULD NOT take any defensive measures. (We note that this part of the spec is already implemented by many common desktop operating systems.)
0x1 If the bit is set to 1, the packet has evil intent. Secure systems SHOULD try to defend themselves against such packets. Insecure systems MAY chose to crash, be penetrated, etc.
Hints:
Copyright is automatically granted at creation of a web page
Replace "evil" with "illegal content" in the above spec.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.