Blogger Fined €3,000 for 'Publicizing' Files Found Through Google Search

mpicpp points out an article detailing the case of French blogger Olivier Laurelli, who had the misfortune to click links from search results. Laurelli stumbled upon a public link leading to documents from the French National Agency for Food Safety, Environment, and Labor. He downloaded them — over 7 Gb worth — and looked through them, eventually publishing a few slides to his website. When one of France's intelligence agencies found out, they took Laurelli into custody and indicted him, referring to him as a 'hacker.' In their own investigation, they said, "we then found that it was sufficient to have the full URL to access to the resource on the extranet in order to bypass the authentication rules on this server." The first court acquitted Laurelli of the charges against him. An appeals court affirmed part of the decision, but convicted him of "theft of documents and fraudulent retention of information." He was fined €3,000 (about $4,000).

Comments

Hacker??!!

[bogidu]

You fsckup your own security then blame the guy for accessing and republishing something you posted for the world to see?! Stupid bureaucrats.

Re:Hacker??!!

[presidenteloco]

Hey!

The world wide web was designed to make accessible via hyperlinks (URLs) a whole bunch of documents / generated content. Key word being accessible. If someone is stupid enough to put documents intended not to be public on the public world wide web, that's their issue.

It is not a transgression on the part of the person who used the URL to access the content, doing nothing more than the technology is explicitly designed to do.

This is just another example of judges who got an A in social studies and a C in technical subjects making asinine rulings about use of technology they don't understand.

Re:Hacker??!!

[icebike]

Just because you CAN do something, it doesn't mean it's okay to do it. This creates a horrible survival-of-the-fittest arms race techno-bureaucracy where values are absent.

In this case, when a PUBLIC agency violates their own security protocol, and turns over all its internal documents to the internet, it means EXACTLY that it is OK to do so.

Your analogy of walking into an unlocked office fails the sniff test. (not to mention the stupid analogy test).

He did not break. He did not illegally enter. There was no door. He didn't deprive them of anything. The documents might as well have been stacked neatly in the public park, with signs and arrows pointing to the juicy bits.

The government agency already published the documents.

Re:Hacker??!!

[presidenteloco]

Ok I'l give you another analogy.

This is pretty much like leaving a stack of pamphlets on a table in a train station, then arresting those who pick one up for possession of classified material.

I can't make it any clearer: Content that is behind a URL in a publicly searchable server directory, with no password or secure session protection, has been placed in plain sight in public. There is no fault in accessing it, nor in republishing it (posting the pamphlet on the door of your house) unless it contained an explicit copyright restriction statement.

Re:Hacker??!!

[dnavid]

In the absence of any keep out signs, (there weren't any), even in France, public items are for free for public consumption.

The only strawman around here is you, and you seem to have most of it in your head. This guy did nothing wrong. The documents were freely available on the web. There was no security on the site, and no copyright on the documents.

As he states on TFA:

The article has an update posted:

UPDATE: Laurelli ended up admitting in testimony that when he found the documents, he traveled back to the homepage that they stemmed from and found an authentication page. This indicated that the documents were likely supposed to be protected. That admission played a part in his later conviction in the appeals court.

In other words, he admitted to the court that he deliberately attempted to determine if the documents were intended to be publicly accessible or not, and had determined *to his own satisfaction* that they were likely not intended to be made public. That's probably why he was not acquitted on the basis of the documents being public. They were, to an uninitiated person. But Laurelli actually knew what he was doing and admitted to the court that he himself believed the documents were not intended to be publicly accessible. So while he thought they "ought to be" public, he also knew they were not intended to be. So by his own admission, he had the requisite intent to steal them from people who did not want them taken.

It seems the lower court acquitted him because all they knew was he got the documents through a public search, and did the right thing by acquitting him. And the appeals court also did the right thing in upholding that acquittal. What they convicted him of was the different crime of retaining and disseminating those documents *after* he realized they were not intended to be public.

Re:Hacker??!!

[noh8rz10]

Thing is. In the US you can be tried twice for the same crime. It all depends on how far the prosecutor (and you) want to push things. This is what various appeals courts, all the way up to the Supreme Court are.

nopee. the first court is the only court that hears matters of fact, i.e. evidence, witnesses, etc. all the appeals courts only hear matters of law, i.e. whatever. further, if the defendant wins a court case, the prosecutors can't appeal. So, no you can't be tried more than once.

In the US, you can be convicted in absentia as well. Take Andrew Luster as an example.

The supreme court has ruled over and over and over again that people have the right to be present at trial, and if a trial happens without them it is a violation of due process protections. Congress codified this in 1946 to lay out specific protections and enumerate specific exemptions. One exemption "the defendant waives his or her right to be present if he or she voluntarily leaves the trial after it has commenced". Your dude Andrew Luster bolted from the trial and fled the country. He got sentenced anyway.

You sir are my chief pedant of the peasant's pedant brigade. USA is an exceptional nation.

Saving face by hurting innocent people

[ZorinLynx]

I HATE it when governments do this. They can't simply admit to having made a mistake and made those files public (albeit difficult to find). They have to fine this poor person just for coming across something interesting and posting it.

Fuck them. Fuck them hard with a chainsaw, every last one of them who pushed for this.

Re:Why is anything accessable on the internet rega

[Anonymous Coward]

If you left a book on the street out the front of your house, but didn't give anybody your address, is it somebodies fault if they read the book?

There is no expectation of privacy here, it is a publicly accessible web page.

Re:French government

[Anonymous Coward]

Uh, no, they cannot. In the US that is known as "double jeopardy" and is not allowed. If you're acquitted, you're done. They can find new evidence, you can write a full confession, it doesn't matter. When that gavel comes down on the "not guilty" verdict, you're no longer capable of being held criminally liable for that particular crime.

If a case is dismissed without prejudice, it can be retried. There is no verdict in that scenario. There's also a separate sovereigns exception, which in some circumstances could allow the feds their own shot at prosecuting, though that wouldn't be applicable here since this would have been tried as a federal crime to begin with.