Is Weev Still In Jail Because the Government Doesn't Understand What Hacking Is?

Daniel_Stuckey writes "Last March, weev, the notorious internet troll who seems to be equally celebrated and reviled, was convicted of accessing a computer without authorization and identity fraud, and sentenced to serve 41 months in prison.'He had to decrypt and decode, and do all of these things I don't even understand,' Assistant US Attorney Glenn Moramarco argued. Here, on a Wednesday morning in Philadelphia, before a packed courtroom, the federal prosecution argued that a hacker should spend three and a half years in prison for committing a crime it couldn't fully comprehend. Previously, Orin Kerr, a law professor at George Washington University and weev's defense attorney, had argued first and foremost that there was no criminal hacking to speak of. According to Kerr, what weev and Daniel Spitler (who pleaded guilty to avoid jail time) had done while working as an outfit called Goatse Security was entirely legal, even though it embarrassed public officials and some of the country's biggest corporations."

Comments

Goatse Security???

[wisnoskij]

They totally sound trustworthy.

Re:Goatse Security???

[ATMAvatar]

Why not? They know all about gaping holes... in security, among other things.

Re:Goatse Security???

[Anonymous Coward]

They totally sound trustworthy.

Some use security-by-obscurity
Others prefer security-by-scarity

Re:Goatse Security???

[killkillkill]

Maybe they are, but I'll never find out. There's no way I'm clicking that link to learn more about them... Then again, it still might be easier on the eyes than Beta.

Re:Goatse Security???

[artfulshrapnel]

And backdoors.

Re:Goatse Security???

[Joe_Dragon]

Goatse Security we do pron and other sites that the other People will not touch with a 10 foot pole.

Re:Goatse Security???

[wisnoskij]

Did you see their subtitle?
"Gaping Holes Exposed"

Re:Goatse Security???

[Bacon Bits]

And exposing both. Gratuitously. Whether we want it or not.

Re:Goatse Security???

[Jeremiah Cornelius]

FREE WEEV!

Stand up for your principles, over the objections of your principles.

Re:Goatse Security???

[Anonymous Coward]

They don't need to understand the biology of neurotoxins to convict someone, either.

Weev is a racist, neckbeard troll, and still got a fair trial, and was convicted of crimes he committed with intent. The end.

Re:Goatse Security???

[yurigoul]

And trust! Haven't you never noticed the golden ring on his finger? The guy is a married man, a family man. That is a man we can trust, for sure!

Re:Goatse Security???

[lsatenstein]

Is this a blatent example of "Kill the messenger!"?

No.

[RyuuzakiTetsuya]

He's in jail because he accessed a crapload of records from ATT he shouldn't have.

Not to say ATT shouldn't have used better security, mind you, but thems the breaks. It's not like the end point he found was big P public. He found it snooping on the traffic from an ipad during sign up.

Further more instead of going to ATT, he went to Gawker first.

So. No.

Re: No.

[Anonymous Coward]

Any public URL that is unencrypted is not a secret. Snooping on plaintext is not snooping at all. And he had no legal requirement to notify AT&T first. Besides, even if he had, they don't care about security until it goes viral. I notified them of a information leak on their iOS translation app that allowed other apps access to your translations and location data. Not only were they unable to figure out who was responsible for the app, they ultimately told me to call Apple. I tried the support for the app as well as customer service. I email their PR rep too. Zero response.

Re:No.

[Charliemopps]

Ah... no. If I can type the exploit into the address bar and I need no more than autohotkey to download their entire god damned database then that's not a hack. They made their bathroom walls out of glass and then complained that he was a peeping tom for setting up a webcam from across the street. Scuzzy? yes, but not illegal. The government shouldn't have to protect you from what common sense should.

Re:No.

[Frobnicator]

Further more instead of going to ATT, he went to Gawker first.

This, a thousand times.

When you discover a vulnerability:
* Do not go to the vendor. They will often ignore it or sue.
* Do not go to the school or business. They will ignore it, sue, fire, and expel.
* Do not go to the government. They will imprison.
* Do not go to the Interwebz at large. You get everything above.

Take the exploit and related proof to a trusted, large, well-established security company that accepts anonymous submissions and will publicly disclose the exploit if not addressed within a specific number of days.

Re:No.

[Darinbob]

Can we prosecute the NSA for the same crime? Presumably if the prosecutor doesn't fully understand what NSA actually did then that should be good enough to convict.

Re:No.

[Anonymous Coward]

So they can put HIM away for a crime they can't understand, but they can't do that for the bankers apparently.

Once again, evidence of two sets of laws, depending on how connected/rich you are.

Re:No.

[Anonymous Coward]

Further more instead of going to ATT, he went to Gawker first.

This, a thousand times.

When you discover a vulnerability:

* Do not go to the vendor. They will often ignore it or sue.

* Do not go to the school or business. They will ignore it, sue, fire, and expel.

* Do not go to the government. They will imprison.

* Do not go to the Interwebz at large. You get everything above.

Take the exploit and related proof to a trusted, large, well-established security company that accepts anonymous submissions and will publicly disclose the exploit if not addressed within a specific number of days.

Or you could sell it, and make potentially a lot of money, and not have to deal with any of the above consequences.

I believe this is what is called a perverse incentive.

Re:No.

[amiga3D]

Better yet, sell it to the highest bidder.

Re:No.

[epyT-R]

Fuck that. If disclosing it to these people puts yourself at great risk, it's no wonder it just gets uploaded to the most convenient 0day full disclosure community. Then they HAVE to take it seriously. The broken dynamic is the fault of corporates and governments, not 'hackers.'

Re: No.

[ShieldW0lf]

He should not have been found guilty of hacking.

But, he's a sadist who spreads misinformation and lies. Lethal injection.

Re:No.

[RyuuzakiTetsuya]

It's like walking through a door you know to be private property, you have no right to access, but because it's unlocked, you just walk through and start taking pictures of everything you see.

In reality, this is still trespassing and you're accessing something you have no authorization to access.

Granted, like I said, AT&T isn't off the hook for lousy security, but this doesn't forgive what weev did.

Re:No.

[jklovanc]

Ah... no. If I can type the exploit into the address bar and I need no more than autohotkey to download their entire god damned database then that's not a hack

Too bad that is not what happened. He tried millions of possible IMEIs to get the information. That is not far off from a brute force password attack. That was also where the identity fraud charge came from. The IMEI is used to identify the owner of the phone and by using someone else'es IMEI her was fraudulently acting as the owner of the phone.

Re:No.

[phantomfive]

Ah... no. If I can type the exploit into the address bar and I need no more than autohotkey to download their entire god damned database then that's not.....not illegal.

It absolutely is illegal. You are trying to argue that it shouldn't be illegal, and you might be right, but that's a different topic. He's in jail exactly because it's illegal.

This guy's a griefer. He goes around trying to hurt people, trying to stay within the bounds of legality. In this case he accidentally crossed the line without realizing it, and now he's in jail. That's what happens when you are a griefer; because you make enough people mad, they'll be watching and waiting for you to make one mistake.

Re: No.

[dnavid]

Any public URL that is unencrypted is not a secret. Snooping on plaintext is not snooping at all. And he had no legal requirement to notify AT&T first. Besides, even if he had, they don't care about security until it goes viral. I notified them of a information leak on their iOS translation app that allowed other apps access to your translations and location data. Not only were they unable to figure out who was responsible for the app, they ultimately told me to call Apple. I tried the support for the app as well as customer service. I email their PR rep too. Zero response.

I'm really uncomfortable with that logic. First of all saying that if all it takes is typing in a URL, then of course its public belies a level of ignorance just as high as the government in this case. "Just a URL" in the modern internet could be anything. SQL-injection is programmatic hijacking of a database server, but it often requires "just a URL." Buffer overflow attacks require just a URL, many apache worms required just a URL to propagate because of the way URL content can be processed. Just a URL is like saying all programs are just notepad documents. It cannot be the case that "if I can get there, then I get to take whatever I want" is the rule of the internet. I read in another article the analogy that AT&T basically put the material on a library bookshelf for anyone to read. That's not a good analogy: a better analogy is weev went to a public library, found that someone forgot to lock the door to the reserve stacks, and decided to go there and take a bunch of books home with him just because he could.

That is not the person I want to be the flag-bearer for my sense of fairness.

Second, giving anyone who points out a failing in others a free pass to point it out by any means is also something I'm really uncomfortable with. If its okay when done to big companies like AT&T and Apple, then its just as okay to do to smaller organizations like your neighborhood grocery store, or your house.

Re: No.

[artfulshrapnel]

I mean, fair enough. But if you can access every customer's record on a massive nationwide system by incrementing a single digit? That strikes me as "basically public". I sometimes exploit the same "hacking" to find the page of a webcomic I want to read if I forget the bookmark.

As the article says: Does he deserve to go to jail? Probably. For this? No.

Re:No.

[Anonymous Coward]

This approach worked pretty well against the NSA in the court of public opinion

Re: No.

[cheater512]

You think there should be defences for someone codes a SQL injection in this day and age?

Because by penalising the 'attacker', you are creating a defence for it. They are the bad person, we are the victim.
When in reality it is pure incompetence - like leaving the till open and realising a hour later that it is empty.

Now I'm not saying that hacking websites is maliciously is right, but there needs to be a *greater* punishment against whoever allowed it to occur to begin with.
Someone who leaves the till open for an hour certainly will not keep their job for example.

Re:No.

[arth1]

Better yet, sell it to the highest bidder.

That would presumably be a three letter agency, which might not fit with your ideology.

Re: No.

[Anonymous Coward]

> "Just a URL" in the modern internet could be anything.

Intentional or not, the interoperability is there. There are no guidelines indicating proper use of that api.

Re: No.

[Anonymous Coward]

yep, there's the good ol hacker "she was asking for it" defense.

the egg would have been all over at&t's face if this info had been released anonymously. but weev had his awesome internet persona to worry about.

someone forgot to tell him the cool part of hacking is not getting caught

Re:No.

[TrollstonButterbeans]

> "If I can type the exploit into the address bar and I need no more than autohotkey to download their entire god damned database then that's not a hack"

Quit being a weeny and go do it!

Then you can be cell-mates with weev, and everyone can point fingers at you and laugh.

["Yout honor, I didn't burn down that house, it was the house being made of wood that was unsafe because fires occur in nature ..."]

Re: No.

[Anonymous Coward]

How is this any different from someone just unlocking your front door because the lock mechanism is stupid and helping himself to all your belongings? Or how would you feel if you left your house and you left one of the windows open and so someone decided because the window was open, he is basically invited in to your house and can take whatever he wants? Only a fool would make that argument the thief has any right to be in your house. You can argue the homeowner should be more careful and get a better lock and close all his windows. You can argue that someone walking by and leaving a note to the house owner warning about the perils of being reckless is being a good citizen. However, the second this good citizen decides to actually enter the house and look around and take stuff, he is being a criminal.

Re: No.

[king neckbeard]

The notion is more that AT&T has a responsibility to its customers to diligently protect its customers' sensitive information. It's not really saying that there is nothing wrong with the actions, but rather that the far greater concern is the irresponsibility of the party whose security was so poor.

Let's take this idea to an extreme scenario, albeit one that's not too improbable. For a very long time, a nuclear launch code was actually '00000000.' Let's say some hacker had accessed their network, determined this was the case, and made all of the machines with displays on the network say 'Change the fucking password before you doom us all, you stupid fuckwits.' Who are you going to be angry at, the hacker who intercepted their network, or the party that ignored their responsibility in protecting something that could have potentially destroyed civilization as we know it?

Re: No.

[sjames]

For the most part, on the web it really is up to the server to tell you if you're going somewhere forbidden. It's the only way to positively know.

I acknowledge that in this particular case, it could be argued that he should have soon realized that he was in a restricted area. However, given the convention (for the web AND for a physical business presence) and the ambiguity, it sounds like a misdemeanor charge at most to me.

If you're going to talk about fairness, you must address a 3.5 year prison sentence for discovering a few email addresses (and then not actually publishing them) in an unlocked back room.

Re:No.

[marcello_dl]

This is irrelevant.
A troll jailed for no reason is a fitting punishment for a troll anyway, so there.

Re:No.

[Aviation Pete]

The broken dynamic is the fault of corporates and governments, not 'hackers.'

Let's be more specific. It's the fault of lawyers. There are many decent people in corps and governments, and even decent lawyers, but the bad ones poison the well for all others.

Re: No.

[Anonymous Coward]

a server is not a fucking house, stop comparing apples with oranges

Re:No.

[Anonymous Coward]

It's private property, but it's a company. Most companies don't arrest people from walking in the front door.

Once he entered through the front door (http port), he asked the security guard (web server) for access to a specific room (page). The security guard said "yes, let me show you the way".

Lousy security we can agree on, but when exactly does it become trespassing?

Re:No.

[Anonymous Coward]

He's in jail because he accessed a crapload of records from ATT he shouldn't have.

Not to say ATT shouldn't have used better security, mind you, but thems the breaks. It's not like the end point he found was big P public. He found it snooping on the traffic from an ipad during sign up.

Further more instead of going to ATT, he went to Gawker first.

So. No.

My understanding is that he's in jail not really because he accessed the records but because he went onto irc and bragged about it while making statements that he was doing it to injure the AT&T stock price. It was one of the people in that irc channel that turned his ass in and provided the logs.

Re: No.

[gnasher719]

And the court decided otherwise. So you can argue here all you like, it doesn't change the fact of what he did, and that the court decided it was illegal. And plenty of people here will agree that he deserved to be punished - all those who don't see it as an attack of a genius hacker against a huge evil company, but as an attack by a geek with an exaggerated sense of entitlement on random customers of that company.

Re: No.

[anegg]

But - if the court doesn't really even understand what was done, how is it possible for the court to know what the right sentence is? I think 3 1/2 years may be a bit much. People convicted of violent offenses against other people may not get 3 1/2 years.

Re: No.

[ultranova]

But, he's a sadist who spreads misinformation and lies. Lethal injection.

Americans are never happy unless you're getting your human sacrifices, eh?

Re: No.

[Anonymous Coward]

Americans are totally forgiving to sadists spreading misinformation and lies in official positions, like Eric Holder, Keith Alexander, James Clapper.

Re: No.

[RyuuzakiTetsuya]

ICC-IDs are not sequential. You'd have to try a lot of them before you get a successful hit.

Plus, if the API wasn't told to you by AT&T, then it's not public.

Re:No.

[RyuuzakiTetsuya]

No, he was walking through a side door he found by snooping on the behavior of the building.

If weev hit an API end point that was being advertised on ATT.com, that's front door

If weev had to snoop on the traffic from an iPad that was registering itself with AT&T then that's certainly not front door. Front doors are obvious. This end point wasn't.

Re:No.

[Zero__Kelvin]

No. You are arguing against basic principles of the Internet. How he found it is completely irrelevant.

" It's not like the end point he found was big P public"

That statement literally makes no sense whatever, and brings to the forefront and amplifies your complete lack of understanding of the situation. The minute we start saying that what is an isn't publicly available varies on the whim of the company the whole system breaks. I can create a publicly facing website and allow people to access it, then one day just announce that it is now misuse of my site to access it and report everone I don't like for "Hacking / Unauthorized Use". If he didn't circumvent an auth system, which he didn't, then he accessed information that the company made public. That's how the Internet works. Maybe they made it public out of incompetence or just a mistake, but they made it publicly available none the less.

Re: No.

[Zero__Kelvin]

"I'm really uncomfortable with how the internet works."

FTFY

Re: No.

[Yebyen]

If you can go to the store and buy one, and put it on your network, and your network monitoring software can show you what it's doing, and it's unambiguously doing something that's easy for you to do, and makes it easy to get something that arguably ought to be a secret without your having performed any heavy duty rocket surgery...

It's public! Any of your customers can gain this knowledge without anything you didn't just plain give over to them! If responsibly disclosed and the company won't do anything about it, then they ought to be exposed. Now what is it that was exposed again? "Private" e-mail addresses?

Come on!

Re: No.

[DarkOx]

I am sorry but going to have to disagree here. A url with an obnoxiously long query string, that is plainly designed to be used by a web service etc and not published isn't public. Using in what you can reasonably know is an unintended and potentially abusive way isn't right. Just like walking off with someones property they left in their yard is not right, but its also not as severe as breaking and entering. Ditto if I leave my house unlocked, if you enter you are trespassing, if you take something its theft but its not a B&E because there was no breaking.

The law should recognize the difference, between 'hacks' of opportunity like this were someone happens to spot something unprotected by any kind of authentication or authorization system yet is something a reasonable person recognize is not intended for public use and takes advantage verses someone who say crafts a buffer overflow and injects code or designs a SQL injection etc, breaking a lock so to speak.

Companies like AT&T though need to be exposed to civil suits for stuff like this, we should have laws that say you are responsible for personal information you collect and if you are negligent about protecting it or someone you in turn give it to is, you can be liable for any damages to persons you collected the information from resulting from the leak.

If we want to see security improved we need to make PII a hot potato. Hopeful lots of companies, advertisers etc would just decide its better not to collect it rather than risk law suits or class action law suits should it leak, companies that genuinely need that information would be less inclined to sell it, again to avoid the risks associated, and more inclined to secure and not do things like AT&T did here just because its easier than doing it safely.
 

Re:No.

[RyuuzakiTetsuya]

If you have to go out of your way to find it, it's not public. If you break in because of lousy security, it's still not public.

Read the law.

http://www.law.cornell.edu/usc...

(a)(2) and (e)(2)(B) are relevant here.

Note: protected is not defined as having any security measure in place, it seems to me that protected means protected by the law at hand

Re: No.

[Shalaska]

However, the problem is there are also simple solutions to stop this sort of attack from being possible. For instance on the web page I run I have session variables that are checked on every page load, and if they do not match what I expect then they get thrown back to the log on screen. I also don't execute anything from the address bar outside of quotes and I strip any ' characters from the address bar to ensure that no-one can simply escape to their code. That said I am sure I have missed something, but I am a one man developer at a small company that handles mostly public information. There should be laws enforcing companies like AT&T to pick up their act when it comes to security, not to crush those who find the holes in said security. While I don't condone what he did, I also agree that he should not be spending 3 years in jail for it, at worst their should be a fine, but at the same time AT&T should also be fined for every record that was stolen in this method in the same way as the HIPAA laws call for.

Re: No.

[Shalaska]

While I do agree that the company that leaked the data should be fined for every record that was stolen, hacking does have to have a punishment to curtail it. It is true that there is no perfect security, at some point there exists some hacker who given the time and will to crack your system, they will probably get in. Combine that with the fact that the cost to secure a system is exponentially higher then the tools it requires to crack the system and you run into the case that if hacking were legal none of our information would ever be safe again.

Re: No.

[countach]

You've got a point, but on the other hand, what if someone codes up such a "hack" and puts said URLs into some harmless looking web page, and I click on it. Am I now guilty of hacking AT&T?

I'm tempted to say that at the very least, URLs that don't involve remote code execution should at the very least be not considered hacking. If the URL calls a server which executes code in exactly the way it was designed to if you access that URL, then it shouldn't be hacking.

If the URL causes the server to execute a code of logic it wasn't designed to, and wouldn't have done without injection of code... well, maybe its hacking.

I'm not completely happy with this definition because I'm sure there is a blurry line here somewhere, but its a heck of a lot more sensible than just some attorney general arbitrarily saying some URLs are OK, and some are not.

Re: No.

[BlueStrat]

How is this any different from someone just unlocking your front door because the lock mechanism is stupid and helping himself to all your belongings?

The law on trespassing is that if your property is not plainly posted according to certain detailed legal requirements and you leave your door open or unlocked and someone enters your premises and/or if they cross onto your property, you may order the individual(s) to leave, and if they comply without delay, they have not committed a crime, regardless of what they may have seen while on the property and/or in the premises, and are under no legal obligation to keep it secret barring a court's order.

An internet address typed into a browser's address bar is in no way a closed or locked door, there are no signs warning against trespassing, not even any sign that there may be any private property there at all until 'enter' is pressed, nothing that's required to be present at the property owner's responsibility and cost in order to convict someone of a crime.

The whole concept being used to criminalize typing the "wrong" URL into your internet browser violates basic tenets of common law and civil rights.

This is big money working with a corrupt government and politicians of both of the major parties to both offload the security burden onto the populace, but also using the power of law and threat of lethal force to do it, which gives the government even more ability to intimidate, threaten, control, and to jail people selectively.

Gotta keep the trial lawyers, the politicians, and the private prison industry fat cats in plenty of hookers & blow while expanding their power over the population more and more.

Strat

Re: No.

[Anonymous Coward]

a server is not a fucking house

While there is a problem with the analogy, that is not the problem. The problem comes from the introduction of the "unlocked door". This is much more like you forgetting to change the locks after breaking up with your crazy ex, and then the crazy ex holding a garage sale while you are out of town. How was I to know the crazy ex had no right to be giving me access to all that stuff?

Re: No.

[Anonymous Coward]

That's because they can't face what their country has become.

Re: No.

[Anonymous Coward]

not only that, but what if it IS a totally innocent fat-finger flub that lands you in some URL you had no idea about ?
are you 'liable' for that ? that seems wrong...

Re:No.

[Anonymous Coward]

That might work, if the entire justice system wasn't made of NSA plants

Re: No.

[Anonymous Coward]

The whole concept being used to criminalize typing the "wrong" URL into your internet browser violates basic tenets of common law and civil rights.

This isn't a case of accidentally typing the "wrong" URL. This is not someone who got lost in the woods and accidentally stumbled onto your private property. This is someone who saw your property lines and meticulously probed around your property looking for various ways to enter.

Re: No.

[dougmc]

Snooping on plaintext is not snooping at all.

That's a pretty creative position.

So if I pick up another (analog, wired) phone in the house and listen to somebody else's phone conversation, that's not snooping? It certainly used to make my sister upset ...

How about if the government adds some wiring to listen to these conversations back at the phone company? That's not snooping? (Hopefully they had a warrant for it, but that's another matter.)

Now, if my sister was talking in pig Latin rather than plain English, would *that* elevate it to snooping? Does it matter that I can decrypt pig Latin without additional hardware in realtime as long as the data rate is relatively low?

Re:No.

[alexo]

decent lawyers

Syntax error.

Re:No.

[Anonymous Coward]

Can we prosecute the NSA for the same crime?

What the NSA did is not illegal since Congress passed a law making it legal for them. There is no such law declaring what Weev did. In fact there are laws making it explicitly illegal. He deserves to rot in prison.

Re: No.

[Anonymous Coward]

That's kind of like saying if you put a ladder up against your neighbor's house and peek into the window while their 14 y/o daughter takes a bath it's okay, because you could see in the window.

Re: No.

[Anonymous Coward]

So all he did was type in the URLs? I guess he didn't collect information and distribute it publicly then?

As far as trespassing goes, what if people enter your front door because it is unlocked and then take your stuff. Have they committed no crimes? They know that the stuff belongs to someone other than themselves regardless of whether or no they are trespassing. .

Had he merely entered a few URLs he would not be in jail.

Re: No.

[Anonymous Coward]

He should not have been found guilty of hacking.

Well, good thing he wasn't! He was "found guilty of identity fraud and conspiracy to access a computer without authorization." Which is exactly what he did. He faked the ID numbers of other users to gain access to information he wasn't authorized to access. Plain and simple. Not much of a hack at all. Just him being a total asshole, again and for once he got caught doing something illegal.

There is no law against hacking. There never has been.

Re: No.

[idontgno]

False equivalence. Trolls aren't human.

Re: No.

[david_thornley]

On the one hand, the "just a URL" excuse fails for the reasons you give. On the other hand, this was a case of the URL doing exactly what it was planned to do. All the examples you gave were URLs designed to make the server do something it was not intended to do. I'm really uncomfortable with a ruling that typing in a URL that just asks for a web page is criminal.

To further bash an inadequate analogy, it's like the material was on a library bookshelf in another room that was not marked as anything special. Or a rack of books that should have been behind a lock (presumably in a reserve room) that was left in the regular part of the library.

I would be happier if the ruling was clearly that, while accessing private information this way is legal, deliberately downloading lots of private information is not.

Re:No.

[Zero__Kelvin]

"If you have to go out of your way to find it, it's not public."

You must be new to the internet. Seriously. I don't just have to go out of my way to find stuff on the Internet, I have to go out of my way to find things in the grocery store too. Is Google a hacking tool now (hint: by your absurd definition it is, as it turns up content that isn't linked to directly or indirectly from the home page)

" If you break in because of lousy security, it's still not public."

What the hell does that have to do with this case. Which part of: "He didn't break into any systems" are you having problems understanding. To hear you tell it, if I have a URL: summer.mysite.com and I change the summer to winter to see if there is publicly available content there I just hacked their friggin system and broke in if they didn't have a link to it, or if I had to "go out of may to find it."

You literally have no idea how the Internet works, so stop thinking you can apply laws to it. You have no ability to interpret any law regarding the Internet, because you have no idea what basic terms mean.

The fact that you think an unprotected system hooked to the internet can be considered "secure/private by decree" would be laughable if it weren't such a dangerous form of ignorance.

Re:No.

[RyuuzakiTetsuya]

I know how the Internet works. Running wire shark on a device and sniffing the http requests isn't the same fucking thing as googling.

I'm so glad none of you are lawyers.

Re:No.

[david_thornley]

a(2) depends on what "authorized" means. For something to be illegal, there really should be a bright line definition of "authorized" that doesn't forbid normal web browsing. The term "exceeds authorized access" uses the word "entitled" without defining it. A HTTP request is a request for information. e(2)(B) defines almost any site open to the public as a "protected site". /. is used in (and affects) interstate and foreign communication. I doubt AT&T is a financial institution under (e)(4), and it certainly isn't a government agency, so we're using what seems to me to be a ridiculously broad definition of "protected site".

Personally, I'd like definitions that didn't make innocently typing in a URL for a public site into a possible felony. I'm not trying to defend Weev here, but laws that can be abused will be abused.

Re: No.

[gordo3000]

they won't keep their job, but the person who actually steals the money, if caught, is arrested and prosecuted for theft. the jail time will be less than if they forcibly took the money (say, with a weapon or threat of violence) but we punish both. the difference is the person who loses their job is punished by their boss, and if the boss continues on with incompetent people, then his store will go out of business because all their revenues are being stolen and getting them back is a real problem.

Re: No.

[gordo3000]

yes, no one disagrees that the customers of AT&T have a legitimate issue with their security and should be able to seek compensation from them if their data security was lacking.

If a bank I deposit money at is mismanaged in such a way that I lose my deposit, I can seek restitution from management if their actions are found to be criminal/negligent. If someone points out they are being cavalier with my money by say, getting access to it and showing everyone they could, then again, I can leave and not do business with that bank and seek some form of restitution.

But that doesn't mean the kind civilian who helped himself to my information or money has a free pass. Two wrongs do not make a right. whether his punishment was fair, considering the damage done, I don't know (because I'm not familiar with what his punishment was).

Re: No.

[niftymitch]

ICC-IDs are not sequential. You'd have to try a lot of them before you get a successful hit.

Plus, if the API wasn't told to you by AT&T, then it's not public.

Most API (interfaces) are in fact very public and visible in the URI you see when you hover
over a link. Further all firewalls in schools and most companies inspect the URI as well
as most data that is sent and returned.

I would assert(tm) that interfaces like this are astoundingly public
and used by firewall service companies to protect corporate america
an the squinty little yes of children that might see something they
see all the time at home and in school (their own locker rooms).

There are problems with the law here that need to be fixed.
That is not to say that his actions were legal or not but that the law
is terrible and because he died on the dunking chair proves
he is a witch/warlock.

Re: No.

[niftymitch]

Any public URL that is unencrypted is not a secret. .......

OK I am confused is this https or http or the decorative baggage on
the URI or CGI input.

I suspect that anyone that can see their own numeric ID in the URI or
more interestingly in CSS JavaScript and in cookies including Adobe poo has seen a public
interface that is broken.
    https://mail.go0ogle.com/mail/....

Re: No.

[ShieldW0lf]

But, he's a sadist who spreads misinformation and lies. Lethal injection.

Americans are never happy unless you're getting your human sacrifices, eh?

Did you just call me an American?

Fuck you.

Re: No.

[Anonymous Coward]

Why shouldn't he? You act more like the stereotype of Americans than most actual Americans.

Re:No.

[Zero__Kelvin]

" a(2) depends on what "authorized" means."

No. That is the whole point. There is no question what 'authorized' means in an internet context. In an internet context 'authorized' means that an auth system has been used. Unauthorized use means that they circumvented the auth system. If there is no auth system to circumvent, it is literaly impossible to use the system in an unauthorized fashion.

If the lawmakers don't know that they are unqualified to make the law. In any case, the law they wrote is quite clear, even if they are too ignorant to know what they wrote. We can't start saying "The lawmaker meant this even though he wrote that". The reasons for this should be clear.

Re: No.

[BasilBrush]

He DID publish them.

http://www.dailytech.com/ATT+A...

Re: No.

[BasilBrush]

A court doesn't have to understand how a lock works to convict someone who took something that didn't belong to him.

Re: No.

[jwhitener]

It seems to me that we don't really have any good physical analogies for some of the ways that information is accessed on the web now. Some google searches can lead you to documents that site owners believed were private. And those site owners may have even had wording and legalese letting visitors know what is OK and not OK. But if you search for "index of" you might reach web server directories, browse around and reach those documents, and never know it was not authorized by the site owner.

Is searching for "index of" really much different than trying different URL combinations? Look, google even provides a list of URL parameters to use when embedding youtube: https://developers.google.com/youtube/player_parameters.

I know as a developer that I'll often guess at URL parameters when trying to accomplish projects. (For instance, for a long time a segment of this user community, http://www.jasig.org/uportal , was trying to figure out how to open a portlet channel in full screen mode using a URL .)

We really need some new specific laws to handle some of these subtle situations. One condition, which may be part of law already if I recall correctly, is intent. Did the person manipulate a ULR with the intent to reach material that they knew was not allowed? That is way different than google searching for 'index of' and just browsing around.

Its due to the courts' zeal for punishment

[Burz]

...particularly for punishing small fries who get in the way of large corporate interests and other big shots.

Along the same lines, we can ask why 'Bidder 70' went to jail for stopping the illegal sale of public land.

Re:Its due to the courts' zeal for punishment

[Anonymous Coward]

yeah, but, bro he can write a book and become a pundit on the geek circuit after he gets out. this is the greatest thing that ever happened to his career.

Re:Its due to the courts' zeal for punishment

[Anonymous Coward]

and well..

quite frankly due to the prosecutor not understanding what he had been doing it's just about punishing for joking around. it should be illegal to prosecute something you can't understand. "I don't know what he did but he sure looks guilty, right!? you must convict!".

circa 1997 this happened to me, sort of. ran a traceroute on the wrong night to see where my emails were routed through(our school mandated the use of an internal email system where server wasn't internal and there was no encryption on the email clients(email client was mandated to be a certain windows email reader). now of course I had my machine full of warez(games and early music warez), winnukes, jolt of the day etc(and had winnuked some people so not totally innocent really of everything).

but what shocked me was the police interrogation, because they tried to make me sign something I had not said, because they did not understand the claims made by the "victim"(city) were impossible to have happened from my actions(and claiming shit like me crashing hospital internal network, hopping a supposed airgap and other stuff that I did not do, they just had some internal meltdown of the windows servers routing the traffic on the same day). the way the interrogation went was "you know what you did, tell us" and 16 year old me going "what the fuck dudes?".

originally they wanted me to confess to something technically impossible and it took them nearly 2 years to figure out that they did not know what to charge me with(and for the prosecutor to deem the investigation incompetently done and drop it, and it cost the state quite a lot for nothing...). I mean, the

posting anon but it's not too hard to figure out who this is for those who know.

anyway, doesn't matter which western country you live in always check what the coppers want you to sign and ask the fuckers to rewrite it to match what you actually said. after that ordeal I was convinced 20-30% of "solved" crimes are just pinned on some druggies in withdrawal who don't read what they sign.

Re:Its due to the courts' zeal for punishment

[Burz]

He's no Tony Blair or even a Mitnick or a Zimmermann. He might make $10k if he's lucky.

Re:Its due to the courts' zeal for punishment

[Burz]

and well..

quite frankly due to the prosecutor not understanding what he had been doing it's just about punishing for joking around. it should be illegal to prosecute something you can't understand. "I don't know what he did but he sure looks guilty, right!? you must convict!".

circa 1997 this happened to me, sort of. ran a traceroute on the wrong night to see where my emails were routed through(our school mandated the use of an internal email system where server wasn't internal and there was no encryption on the email clients(email client was mandated to be a certain windows email reader). now of course I had my machine full of warez(games and early music warez), winnukes, jolt of the day etc(and had winnuked some people so not totally innocent really of everything).

but what shocked me was the police interrogation, because they tried to make me sign something I had not said, because they did not understand the claims made by the "victim"(city) were impossible to have happened from my actions(and claiming shit like me crashing hospital internal network, hopping a supposed airgap and other stuff that I did not do, they just had some internal meltdown of the windows servers routing the traffic on the same day). the way the interrogation went was "you know what you did, tell us" and 16 year old me going "what the fuck dudes?".

originally they wanted me to confess to something technically impossible and it took them nearly 2 years to figure out that they did not know what to charge me with(and for the prosecutor to deem the investigation incompetently done and drop it, and it cost the state quite a lot for nothing...). I mean, the

posting anon but it's not too hard to figure out who this is for those who know.

anyway, doesn't matter which western country you live in always check what the coppers want you to sign and ask the fuckers to rewrite it to match what you actually said. after that ordeal I was convinced 20-30% of "solved" crimes are just pinned on some druggies in withdrawal who don't read what they sign.

Thanks for the advice.

Re:Its due to the courts' zeal for punishment

[SuricouRaven]

Investigations cost time and money, and can potentially be embarassing. So prosecutors really want to skip all of that and just get a nice simply guilty plea. They have a few tricks to make that happen, the most obvious being the use of threats - they'll come up with a list of charges long enough to get you jailed for fifty years or more, but then generously agree to drop almost all of them if you back down then and there and agree to plead guilty to the most minor ones and just do a couple of years or pay a big fine. Often the charges they threaten with are unlikely to hold up in court, but it doesn't matter - the possibility alone can be sufficiently intimidating.

The police themselves are just doing the groundwork. If they can secure the confession first it saves prosecutor-time, and they get all the glory for themselves too.

Mechanical rodent

[Anonymous Coward]

"He used some sort of mechanical rodent attached to an electric typewriter to 'click' on some things. It was way over my head so he's guilty of something!"

Everyone on /b/ needs jailtime

[Anonymous Coward]

Purposely trolling, but my point is that the majority of /b/ 's content is illegal, endorsing criminal behavior, or inducing people to kill themselves.

If someone was thrown in jail for something they posted on /b/, they certainly deserve it (if only to send the message that there are consequences to bad behavior,) but as for lenght of jailtime, probably should not be treated the same as ... you know holding a gun to someones head in a game of russian roulette.

The act of dox'ing is often done by people who are "4chan fags" and work for mobile carriers or ecommerce sites, have access to an extremely large amount of identity information, enough to screw over the real people's identity they mess with.

Trolling stops being a "joke" when someone suffers emotional, financial or physical harm. Unfortunately the only the last two have consequences.

Re:Everyone on /b/ needs jailtime

[Anonymous Coward]

Your freedom end where my feeling begin! That may be as little I feel like, and tomorrow I may feel otherwise. Emotional suffering is the worst of all because it affect mostly women.

Trolling are always funny. If you don't have the maturity to laugh it off or ignore speech that offend you, then get off the tubes. The interweb are for adults, not whining children.

Re:Everyone on /b/ needs jailtime

[arth1]

you know holding a gun to someones head in a game of russian roulette.

You're doing it wrong.

Goatse security

[iamacat]

No idea about the legal aspects, but given the images that the name brings to mind I think I would pass on its services.

So if you forget to lock your front door

[Sycraft-fu]

And it blows open in the wind, I can just hop on in to your house and nose around?

The answer, in case you are wondering, is no. While you should take precautions to secure your house, your failure to do so is not the same as permission to enter or do as I please.

Re:So if you forget to lock your front door

[Urza9814]

This isn't a house, it's an office building.

And he didn't just walk in, the server provided the information to him.

So, he walks into an office building, asks the security guard if he can walk right up to the conference room, and the guard says 'yeah, sure, why not' so he does...and now he's being arrested for trespassing.

Re:So if you forget to lock your front door

[amiga3D]

He never entered. He took pictures through the open door. Hell, they didn't even have a door, just a bead curtain that fell down.

Re:So if you forget to lock your front door

[Cramer]

the server provided the information to him.

Right. He was just sitting there looking at a gmail screen when an AT&T server just started filling his browser with ICC's and email addresses.

He had to *request* the address for each, individual, ICC, through an internal interface that is not publicized. An interface he found while digging through the activation process (looking at the network traffic), apparently. The CFAA has no requirements for a lock-and-key system to constitute unauthorized access; without authorization is just what it says on the tin... no "authorization" has been given. (the old "well, they didn't tell me I couldn't" argument.)

Re:So if you forget to lock your front door

[jklovanc]

So, he walks into an office building, asks the security guard if he can walk right up to the conference room, and the guard says 'yeah, sure, why not' so he does...and now he's being arrested for trespassing.

A closer analogy would be the following;

Walk into an office building a few million times each time asking for different room numbers and when he find one that exists the security guard says "yeah, sure, why not"...

By the way the security guard is blind so he has no way of knowing if you have been there before.
It was the act of brute forcing the IMEIs with millions of attempts gaining over 100k email address that got Weev into trouble. The judge even said that had he stopped a few he would have gone free.

Re:So if you forget to lock your front door

[jklovanc]

How about if I did lock the door but you made a really fast key cutter and tried a million different keys on the lock and a few of them worked.

Re:So if you forget to lock your front door

[bunratty]

Joshua called me!

Re:So if you forget to lock your front door

[Anonymous Coward]

Well since you want to use that analogy. The whole client server part of the equation would make it more like this.

me: Hey can I come in (send the request url)
you: Yes come on in (you send the requested info)
me: Thanks, I see you are really into german scat porn

See no law broken yet your still embarrassed,

Re:So if you forget to lock your front door

[Cramer]

Hah. Only because David called him first and hung up.

(by today's screwy courts, we'd add identity theft/fraud to his charges for pretending to be Prof. Falken, i.e. not correcting WOPR/Joshua when it asked.)

[I know, I'm ruining the movie.]

Re:So if you forget to lock your front door

[currently_awake]

Step in your house, no. LOOK in your house from the curb, sure. If the doors are open it's a public place.

Re:So if you forget to lock your front door

[bzipitidoo]

Worse than that. Someone is walking along a public street, waving a sign at passing cars. This person didn't dress properly before going out in public, and has no clothes on. He does not get to sue all the drivers for being peeping toms. He can't complain if someone takes a picture. Instead, the police can arrest him for indecent exposure.

Anyone who hooks a server up to the Internet is going out in public. Dress appropriately.

Re:So if you forget to lock your front door

[sjames]

The rules have always been different for a private home vs. a business open to the public. In particular, the default for a private residence is that you may not enter without invitation. For a business open to the public, the assumption is opposite.

It's why you don't have to ring the doorbell to go in to a shop when the door is unlocked and no closed sign is displayed.

Re:So if you forget to lock your front door

[hobarrera]

But he didn't walk in. He just peeked from outside, and didn't touch anything. It's not ilegal to LOOK inside your house from outside if the wind blows the door open.

Re:So if you forget to lock your front door

[jareth-0205]

Step in your house, no. LOOK in your house from the curb, sure. If the doors are open it's a public place.

At the risk of propagating this analogy-hell, I'm pretty sure that if your door is open, your property is still not a public place.

In the UK for example, if you point a camera at a building with a normal lens, that is fine. If you point a camera at a window with a high-zoom, that is not. Intent matters!

Re:So if you forget to lock your front door

[Pieroxy]

In France we actually got someone behind bars for something very similar with a law that I find pretty smart that says approximately: "If you are somewhere where you *know* you shouldn't be, and you don't get out immediately but you *knowingly* stay there and snoop around, then you're guilty."

I think that's the expression of common sense. It might be just me.

Re:So if you forget to lock your front door

[Pieroxy]

So all upskirts pictures are legit and we should encourage people to take them?

After all, all those panties are out in public and protected by just a skirt which you can look below... from a public place.

Your vision of what is right and wrong seems to be broken.

Re: So if you forget to lock your front door

[Anonymous Coward]

Right/wrong vs legal/illegal are two different concepts. Related, to a large degree, but absolutely different.

Re:So if you forget to lock your front door

[L4t3r4lu5]

The server provided information at his request, and only after many hundreds of thousands of unsuccessful attempts. Yes this data was erroneously accessible by unauthorised users, and that is a problem AT&T should be punished for. That doesn't detract from the fact that he was not authorised to access the information, and it's the accessing of that information for which he has been convicted. In the UK the Computer Misuse Act is quite clear on that; Unauthorised access is the crime. I'm almost certain your law is similarly worded.

Re:So if you forget to lock your front door

[Qzukk]

He had to *request* the address for each, individual, ICC

If he had walked into the office building and asked the receptionist at the front "hey what is the email address for customer #1234" and it was given to him, would that be identity theft? Trespassing? What if he asked for all the customers' email addresses, and got them?

The CFAA has no requirements for a proof of authorization

Oh right, you have the CFAA. It's different because it's on the Internet. Thanks to all our representatives who are scared witless by the Internet.

Re:So if you forget to lock your front door

[Anonymous Coward]

That's actually a fairly good summary of Weev's guilt imo. My issue is more with the charges and the sentence. Identity fraud? Hardly. Accessing a computer without authorization? Yeah, I'm willing to let the government have that one. It's pretty obvious he wasn't supposed to be there, and he certainly had no need to keep on snooping around enough to pull out over a 100k records.

Also, AT&T should be fined for the breach. It was clearly a willful act of negligence that allowed it to happen given how few fucks were given over there.

Re:So if you forget to lock your front door

[countach]

The problem is, you don't know what someone else knows. And while you might say most people ought to know they oughtn't be in a certain place, not everyone has the same sense of boundaries as you do. Or in other words, this law that sounds very clever is in fact incredibly vague. I mean just for starters, define "shouldn't be". Shouldn't in what sense?

Re:So if you forget to lock your front door

[countach]

I do that all the time. For example, I surmised that Apple corp might have an Australian office, and lo and behold, apple.com.au worked. I surmised something else. Their products might be at apple.com.au/products or maybe apple.com.au/store, and lo and behold, that worked too. Guessing URLs is not generally a crime.

Re:So if you forget to lock your front door

[countach]

Yeah, but on the WWW, how are you supposed to know what is public or private? It's not like there are web sites with a banner saying "Don't come to this web site". No, if the URL works, the assumption is its public. If the URL asks for a user name and password, then you shouldn't go beyond that if you don't have said password. If the WWW wasn't like that, then you'd have to make a phone call to Coca-Cola to see if they're happy for you to go to coca-cola.com.

As for the UK and your claim about "normal lens", what in the heck is a normal lens? What is a high zoom? Really? There's really a crazy law like that?

Re:So if you forget to lock your front door

[jareth-0205]

Of course you can know. This guy knew. He was deliberately trying to find stuff that he knew wasn't supposed to be public. If you didn't know then that would be a defence, but I can't see that being the case here.

The law isn't technical absolute booleans, intent matters, and what the person is trying to do is part of it. What a reasonable person expects and would I don't see the photography thing as a crazy law, should you be allowed to pry into my house just because technically you can and there's no cast-iron technical way to say not to?

Re:So if you forget to lock your front door

[jriding]

The big problem with using the house analogy is that everyone forgets the first part.
The first part is I put out a sign in my yard saying everyone please come into my house and take what you want. I also post on craigslist and in the newspaper my address and let them know to come in and take what they want.
Then when they come in what I really mean is come into the living room and take what you want. They went into the bedroom and took stuff and now I am upset.

Almost every system that is not for public connection but is connected to the internet now has a legal banner stating you are not allowed in unless authorized.

Re:So if you forget to lock your front door

[Ash Vince]

This isn't a house, it's an office building.

And he didn't just walk in, the server provided the information to him.

So, he walks into an office building, asks the security guard if he can walk right up to the conference room, and the guard says 'yeah, sure, why not' so he does...and now he's being arrested for trespassing.

I agree with your analogy right up to the security guard bit, in this case they didn't have one. The problem is that legally it is still possible to trespass on private property when the property is not protected by any sort of lock. I am not saying that ATT were not utterly crap and lax, but what this guy did was also illegal.

The other problem he seems to face though is that he is bit of a caustic twat. I have a feeling that any half decent lawyer could easily bate him in court into saying something stupid and that is probably roughly what happened for him to be convicted. Once he had alienated the jury he was screwed, since based on the embarrassment he had caused the judge was obviously going to throw the book at him.

Re:So if you forget to lock your front door

[Anonymous Coward]

Isn't this the entire reason we have judges and juries? There is subjectivity in every law, it isn't simply a rule engine where you can input actions of defendant and output guilty + sentence or not guilty. It should not aspire to be that either, every situation should be considered on its own merits or you get zero tolerance/zero intelligence type rulings. Seriously he pulled 100k records, a reasonable person would have known better.

Re:So if you forget to lock your front door

[marcosdumay]

Did you get authorization for reading /. today?

Re:So if you forget to lock your front door

[Anonymous Coward]

what authorization do you have to go to slashdot.org? did Dice call you up and say he i here by give you permission to access this particular URL. No you had implied authorization but like you don't need authorization to enter an open WalMart. Until asked to leave you are authorized.

Re:So if you forget to lock your front door

[Anonymous Coward]

How is he not authorized to access that information. are you authorized to access slashdot.org's homepage? If so who authorized you? what documentation is there to prove you are authorized? Its like if he decides to walk into an open WalMart he has an implied authorization to be there. If he is bothering the cashier by constantly asking questions they can ask him to leave but if they don't why should he be able to continue asking the cashier all the questions he wants. Thats what he did to the server asked it many, many questions, but the server never asked him to leave.

Re:So if you forget to lock your front door

[Anonymous Coward]

No, it's much closer to this.

me: Hey can I come in (send the request url)
crazy ex whom I cannot possibly know should not be granting access: Yes come on in (server sends the requested info)
me: Thanks, I see you are really into german scat porn

See no law broken on the part of the requesting party.

Re:So if you forget to lock your front door

[Cramer]

As it was provided by a human being, who is presumed to have the capacity for rational thought, that would be sufficient as "authorization". If they were not actually authorized to provide such "confidential" customer information, then they would be on the hook, not use you as the receiver of the information. Computers, on the other hand, do exactly as they are programmed; programmers do make mistakes. Those errors are not authorization.

If we return to the office building example, this would be equivalent to walking into a building, past a security desk (manned or not), through a set of doors with no locks or signs, down a corridor to a common printer and taking whatever unclaimed output is still there.

Re:So if you forget to lock your front door

[Glothar]

I always found this confusing about people. I don't know if its greed or selfishness, or an utter lack of personal morals, but at least in the US, there seems to be a common belief that failure to try and stop you from doing an action means that the action is legal.

Example: If I walk into a store and the cashier station is empty, with the register open and a stack of $20 lying on top, is it okay and legal for me to grab the money and walk out?

Of course not. That's not my money.

Somewhere, loads of people have gotten the idea that its only immoral or illegal if someone is actively trying to stop you from doing something. If I leave my car door open, that doesn't make it legal for you to drive off with it. If I leave my phone on a bench and look away, that doesn't mean that its okay for anyone passing by to take it. ATT didn't tell weev it was okay to take the info. Any person with half a brain knows that it wasn't intended to be public. The fact that it was easy to do doesn't make it legal

Should ATT get in trouble for lax security? Sure. But that doesn't absolve weev, either. If I build a house without a door, my insurance company might decide to deny my claim if I'm robbed. However, that doesn't mean that the robber didn't commit theft and shouldn't be punished.

Re:So if you forget to lock your front door

[Cramer]

I have an account, for one.

Re:So if you forget to lock your front door

[Glothar]

However, It is illegal to take ladders around to every window and door looking for one which will give you a glimpse of what is inside.

Again: Intent matters

Re:So if you forget to lock your front door

[jklovanc]

It all depends on how you look at it. If you look at the IMEI as a password then it is very different. There is also a huge difference between typing a few characters differently and writing a script to try millions of different combinations. The latter looks very much like a brute force crack.

Re:So if you forget to lock your front door

[jklovanc]

That is why there is the legal term "reasonable person" and that is what juries are assumed to be.

Re:So if you forget to lock your front door

[Anonymous Coward]

Ask your insurance company about that.

Re:So if you forget to lock your front door

[Urza9814]

I agree with you completely on those analogies. Where we disagree I think is our perception of how the internet functions.

The way I see it, AT&T *publicly published* that information. They shouldn't have, but they did. If they took all that information and stuck it in a book and sold that book to Barnes and Noble and I then went in and purchased that book, am *I* the criminal? That's absurd! The way I see it, if it's posted on a unsecured web site, that's the same as having it published in a physical book or newspaper.

AT&T made that information public. Once they do that, there can be no such thing as "unauthorized access". Weev did not commit a criminal act, he merely *discovered evidence of one*.

Re:So if you forget to lock your front door

[Urza9814]

If you didn't see it, go read the reply by an AC, it's basically the same argument I'm gonna make:

There is an implication on the internet that everything is authorized until it states otherwise. Nobody ever gave me permission to access Slashdot or Google or Facebook. I typed in the URL and it gave me access. Had I typed the URL and it came up with a password prompt and I went searching for a back door to get access to it anyway, THEN it would be unauthorized access.

I'm not saying no crime was committed here. There certainly was. Weev certainly knew that as well. But Weev did not commit the crime, he merely discovered it. AT&T *did* authorize him to access that information, and *that* is the crime.

Re:So if you forget to lock your front door

[L4t3r4lu5]

implication

Has precedent been set in a criminal case? If not, implications are moot. Plus, where does "the internet" stop? Does "the internet" stop at the consumer-oriented WWW? Or does it include badly implemented security as well? Open SMTP server in your DMZ; Is that fair game? Where is "the line"?

Re:So if you forget to lock your front door

[david_thornley]

It seems to me more like getting the best angle to look down her blouse without actually violating her personal space or climbing stairs. Or noticing she's got a wraparound skirt and watching her on a windy day. Upskirt is taking a vantage point that's not socially acceptable and certainly not expected, while the others are taking advantage of what she's showing to the public.

Or taking a long look into a car's window. Or something. On /., cars are like analogies.

Re:So if you forget to lock your front door

[BasilBrush]

If he had walked into the office building and asked the receptionist at the front "hey what is the email address for customer #1234" and it was given to him, would that be identity theft?

The request would most probably fail, because #1234 would be an invalid customer number. Most of the guessed at ICC-ID numbers would not correspond to an AT&T iPad.

Your analogy is flawed because not only would a human receptionist be extremely unlikely to give out the information without credentials, after a number of incorrect guesses at ICC-ID numbers, the receptionist would certainly refuse to give out any correctly guessed numbers.

The fact is humans and computer software is not the same, and such a naive analogy does not trump a properly thought out consideration in a court of law. Which we already have.

Re:So if you forget to lock your front door

[BasilBrush]

I for one was granted authorisation until further notice at the point at which I applied for and was granted a Slashdot account. As were you.

However it doesn't even go as far as that.

It's reasonable to assume that you have authorisation to any homepage any page you get when you access an unadorned domain. And any page that can be accessed by a series of links from there.

It's unreasonable to assume that you are authorised to pages that you can only access by spoofing a Agent-ID, and making educated guesses at ID numbers embedded within a script generated URL.

(And there's lots of grey in between those. But we don't have to consider them, because the latter is what Weev did.)

Re:So if you forget to lock your front door

[BasilBrush]

The problem is, you don't know what someone else knows.

Actually, often you do. They may have said, written or done something that demonstrates what they know.

But not always. And in that case it's a question of reasonableness. What can a person be reasonably expected to know. In England we call this hypothetical reasonable person "The man on the Clapham omnibus."

http://en.wikipedia.org/wiki/T...

Re:So if you forget to lock your front door

[BasilBrush]

There is an implication on the internet that everything is authorized until it states otherwise. Nobody ever gave me permission to access Slashdot or Google or Facebook.

No more so than physical premises. You have the implication you have access to a store with the lights on and an unlocked door. You don't have the implication you are allowed behind the counter, or in the stock room, even though there are no locked doors in the way. And any obviously private information that you picked up whilst behind the counter or in the stock room, would obviously not have been authorised.

Considerations of reasonableness are every bit a part of the exercise of law. And it is only reasonable to say that weev knew full well he was not authorised to access the private information he got access to. Even if there were no locks. Just as in the physical world.

Beta is broken and just doesn't work why even call

[MeNeXT]

Can we please stop this foolishness. Now I'm off to reddit where I can enjoy my free time.

Once more in plain English Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.

Quick, somebody tell the admin of goatse.fr

[Anonymous Coward]

A link to his site is on frontpage of the slashdot... I mean, this is gross loss of such an opportunity to redirect.....

Donning CBR Gear

[IonOtter]

Weev is whale turds. He's the lowest of the low, he knows it, and he relishes it. He's like a wolverine, pissing and shitting on the carcass he found, so nobody else will try to eat it, even though he can't stand his own stench.

Which is why it sucks so God Damned much to have to defend his useless ass!

But then, if you can't defend the worst of the worst from clear injustice, then we don't even have the hope of having a republic.

Re:Donning CBR Gear

[AudioEfex]

Idealism is noble and all, but sometimes in general when I read /. comments these days I feel like folks are missing that "ideal" is mostly an imaginative concept. Combined with the slippery slope fallacy, a spoonful of pseudo-anarchy idolatry, and a dollop of moral relativity, it would seem that we are in the face of impending doom with every little tiny ripple in the vast ocean of life.

This guy is a complete, disgusting, repulsive, degenerate, piece of garbage that deserves what he is getting right now. And I'm sure he is getting it quite regularly, quite possibly for the first time in his life.

Is how it happened ideal? No. Is it the beginning of the end of Western Civilization? No. Is it just? You bet your ass it is.

What you have here is an idiot prosecutor, who didn't know enough not to admit what he didn't know. Is the law often ignorant of technology? Yes, particularly this time, but the world self-corrected in this case (it tends to do that) and still stuck this little bastard in jail. Would it have been more ideal if he had been held accountable for the countless other things he likely deserves to be punished for (a lot of which we don't have laws for yet but should be punishable)? Of course. But it didn't go down that way, it went down this way. The end result is the same - he's some bad man's bitch right now, and getting a nice taste of the bitter he has put countless others through. He's lucky that thus far this has been the worst repercussion of his actions.

Civilization will continue to march on, this guy is getting what he deserves. Sometimes, the means don't matter nearly as much as the end result - regardless of the idealistic thinking that everything needs to happen "the right" way. And though AT&T also should be taken to task for not locking the door properly, he knew what he was doing when he was entering, and all this moral relativist bullshit I see in a lot of these posts (not yours in particular) is just that - bullshit. He's no white hat, he's no whistle-blower - he's a creep who was likely trying to "legitimize" himself as more than the grade-school "haxor" he is (which is why he chose the venue he did and did not take any steps to conceal his identity). He got burned. And the world is a better place with him locked up in a jail cell. That's what matters, and no slippery slope has begun.

Re:Donning CBR Gear

[phantomfive]

Intent matters. He wasn't trying to help AT&T expose a security weakness, he wasn't trying to help the users whose data was exposed.

You don't need to defend people who are only trying to hurt others.

Re:Donning CBR Gear

[king neckbeard]

Actually, it is a big concern when the justice system is perverted against its fundamental ideals. We used the whole 'ends justify the means, so fuck the rules' crap to take down some mob bosses, and now we have all the RICO crap and civili forfeiture is commonplace. This allows unjust and impractical laws to stand unchallenged because the state can nail anybody if they really want to, and they have the leverage to make most people plea bargain out. We commit crimes on a regular basis because of our incredibly complex legal system, the NSA tracks every time we wipe our ass, and they drop information to locals for 'parallel construction.' That means that, absent sufficient public outcry and scrutiny, they can put anyone in jail whenever they want.

Our justice system was set up the way it is for a very good reason, and it's incredibly naive of you to think that this is okay because weev is an asshole.

Re:Donning CBR Gear

[Anonymous Coward]

Is he getting what he deserves? He did not put anybody in jail and what he did is certainly nothing compared to the barbary of putting a person in a closed space with all sort of criminals and psychopaths - even if he is a criminal. He created mostly financial problems, so why should he be punished any other way than financially? Jail is wrong in principle, since people there do not change for better so it does not serve its purpose. Bet your ass in 3.5 years he will be even a bigger assholes, with enough criminal connections to cause even bigger and more serious harm once he is out. We do not have "justice" we have "revenge", and this is sad.

Re:Donning CBR Gear

[gnasher719]

What you have here is an idiot prosecutor, who didn't know enough not to admit what he didn't know. Is the law often ignorant of technology? Yes, particularly this time, but the world self-corrected in this case (it tends to do that) and still stuck this little bastard in jail.

Actually, what you have here is an idiot slashdot poster who didn't know enough not to admit what he didn't know. Is technology often ignorant of the law? Yes, particularly this time.

Now according to what others posted here, this "weev" seems to be the kind of person that everybody should punch in the face wherever they see him.

Re:Donning CBR Gear

[PrimaryConsult]

In sortof agreement with what you said: this seems to be a simple case of jury nullficiation, but in the opposite direction /. seems to desire. People here like to advocate it as a way of getting someone who was arrested under an unjust law out of trouble. But the truth is, far more often it is used in a matter that results in convicting those who exhibit scummy behavior, regardless of the evidence.

Re:Donning CBR Gear

[Anonymous Coward]

What you have here is an idiot prosecutor, who didn't know enough not to admit what he didn't know. Is the law often ignorant of technology? Yes, particularly this time, but the world self-corrected in this case (it tends to do that) and still stuck this little bastard in jail. Would it have been more ideal if he had been held accountable for the countless other things he likely deserves to be punished for (a lot of which we don't have laws for yet but should be punishable)? Of course. But it didn't go down that way, it went down this way. The end result is the same - he's some bad man's bitch right now, and getting a nice taste of the bitter he has put countless others through. He's lucky that thus far this has been the worst repercussion of his actions.

A system where someone can be tried and convicted, even if they aren't guilty of the charges, just because their actions are unpopular, is prone to abuse.

The system that locked up a foul-mouthed despicable troll this time because he had to be guilty of something is also the same system that disproportionately locks up minorities and the poor, while eliminating or giving greatly reduced charges to the rich, wealthy and white.

Re:Donning CBR Gear

[Anonymous Coward]

"Now according to what others posted here, this "weev" seems to be the kind of person that everybody should punch in the face wherever they see him."

which *then* leads to: *THIS* guy is the type of guy who doesn't care about urging others to do ILLEGAL violence to people he doesn't like, THEREFORE -wait for it- ANON COWARD is the kind of person everybody should punch in the face whenever they see him/her/it...
see how that works, einstein ?

really, the number of *SUPPOSEDLY* mature adults (a dolts?) here who insist this weev guy should catch hell, just because, well, just because THEY DON'T LIKE HIM, is quite discouraging... HOW MANY TIMES do you have to see where the powers-that-be 'go after' someone hammer and tong just because The Man doesn't 'like' them, NOT because of any real harm to society, or any laws traduced, just because they don't 'like' them...

when you jump on the vigilante bandwagon, doesn't it worry you WHO the auth-or-i-ties will target NEXT TIME ? ? ?
as per usual, we MUST defend the rights of the most vile, evil people to secure those rights for ALL OF US...

stupid fucking nerds, know the undocumented options to obscure programming languages that no one ever uses, but don't have a lick of common sense...

Re:Donning CBR Gear

[Anonymous Coward]

> And I'm sure he is getting it quite regularly, quite possibly for the first time in his life.

Oh a rape joke, how mature.

He should not have said who he is

[Anonymous Coward]

If he wanted them to fix their site, he could have offered money. If they ignore, then *anonymously from an internet cafe*, get onto their site, and put up pictures of Goatse with the words Pwned in blinking red neon, and "their site security suxor!" At some point, they will either clue up, or if they don't, start using their site to push illegal content. If the RIAA/MPAA goes after them like it goes after Google, then after seeing money sucked out the door, their CXO's will clue up about security (or maybe not, they aren't that clueful to begin with).

He did the wrong crime

[DigiShaman]

If he raped, stole, did drugs, mugged someone, I bet he would get far less time. There are even whole groups of people that get arrested over 60+ times!!!

Don't hack. To do so might mean maximum prison in solitary confinement. You think I'm joking, but that's how afraid these clueless people are. They view hackers as some magic wizards that can open cell doors with thought alone.

He's a useless fucktard

[Anonymous Coward]

I see no reason why we shouldn't let him rot. The internet is much improved without him around it.

Prosecutors did a Google search...

[Nova Express]

...for the name of his security company, clicked on the first link, and said "OK, asshole, now you're going down!"

Now insert your own PMITA Prison/Goatse joke here...

Good!

[Anonymous Coward]

I'm glad they finally got this dickhead for something. He deserves every minute of incarceration.

An NPR reporter confessed to the same crime

[Anonymous Coward]

http://www.reddit.com/r/netsec/comments/1w5cfe/npr_reporter_confesses_to_same_crime_as_andrew/

And hasn't been caught yet.

Re:An NPR reporter confessed to the same crime

[RyuuzakiTetsuya]

Because Netflix isn't pressing charges.

If person A trespasses on person B's property, and then charges them for trespassing, it's not hypocrisy when person C walks in on person D's property and they don't care.

Further more, Alexis Madrigal didn't scrape 110k+ emails from Netflix's customer database.

Re:An NPR reporter confessed to the same crime

[jklovanc]

Here are a couple of differences between what Weev did and what the reporter did.

Reporter
Tried a sequence of numbers totaling maybe 100k in sequence of which most were valid.
The data retrieved is movie genre tags. The use of the data is to translate a number into a string of text to display the Netfix genre code on browsers and apps. There is no privacy concerns or profit potential for this data.
Each data point retrieved is designed to be used by millions of people. Anyone with "Japanese Horror Movies" in their list would use code 10,000.

Weev
Tried millions of possibilities of which most were invalid
The data downloaded was valid email addresses of over 100k people. This is a serious privacy breach as these emails can be used as identity on many web sites and sold to spammers which will facilitate spam.
The data is designed to be used by the owner of the phone as identified by the IMEI and not anyone who can spam enough possible IMEIs to fins a valid one.

Sorry but these are very different things. The Netflix database was meant to be public while the iPad one was not.

Re:An NPR reporter confessed to the same crime

[theArtificial]

Sorry but these are very different things. The Netflix database was meant to be public while the iPad one was not.

The fact is both were on web servers. The entire point of a web server is to handle requests, if you don't want something publicly accessible, begin by not putting it online. How are we to determine what is or isn't authorized? If you put something online, and later say that someone wasn't supposed to access it, who is liable?

The data is designed to be used by the owner of the phone as identified by the IMEI and not anyone who can spam enough possible IMEIs to fins a valid one.

If only there were some way to flag and block repeated attempts... this is about as brilliant as those folks who decided using a Social Security Number as a means of identification.

TL;DR Defending negligence will not improve things.

Re:An NPR reporter confessed to the same crime

[jklovanc]

if you don't want something publicly accessible, begin by not putting it online

So no online banks, credit card companies, etc. Just because it is on the web does not mean it is public.

Defending negligence will not improve things.

Defending people who exploit negligence does not improve things either. In my opinion there should be consequences for both Weeve and Apple.

Re:An NPR reporter confessed to the same crime

[theArtificial]

So no online banks, credit card companies, etc. Just because it is on the web does not mean it is public.

Absolutely it does, it's implicit when it's on the web (short for World Wide Web) especially without authentication (doesn't that usually involve username + password?). Ultimately I believe you're arguing about intent of the organization, something the web server and client know nothing about. Requests (not demands) are received, and the web server replies. Private networks are just that, not publicly accessible. This is the digital equiv. of driving down various streets (publicly accessible addresses) incrementally and being provided with information at the end.

How is an organization not responsible for what they put online, after all are they not the ones solely authorized to determine what they want to provide others access to? It's not like this involved a username and password like the online banks or credit cards do.

Remember those folks who would share out their entire drives on file sharing networks? It's not up to a client to determine validity of who is or isn't authorized - that's the job of the people configuring the server. It is up to the entity operating the server to ensure that data is protected, authentication isn't anything new, especially robust systems. Would you defend the government for making a system where simply using a street address would allow one access to information (taxes etc.)? How about your Bank? Explain your reasoning, please.

Defending people who exploit negligence does not improve things either.

What does this have to do with my point, you think I like this asshole? Are you under the impression that making an example out of this guy will somehow improve things? If that were the case simply putting a guy through the system, the first time, would've sent the message loud and clear! If you're a customer of this company after this, you're crazy but I can understand how you'd be upset; although you should really focus on WHY THIS HAPPENED. You're ready to punish him for what amounts to an embarrassment. Also, you included email addresses in your rant, FYI email addresses are not private information. They're as private as a phone number is (something listed in directories and/or published in books).

You make a point of mentioning that this occurred thousands of times. What if you clicked on a link via a URL shortening service that directed you to one of these links, do you think you should be put in jail? Is it an exploit only if you do it x number of times? Do you think you should be liable for fraud for entering IMEI#s? What about accessing a website or service when its really busy (DDOS)? What about visiting slashdot and typing in an account name that's a misspelling of yours which happens to have the same password? Swap out slashdot with your bank of choice. Is it criminal now since it's "unauthorized access" of a computer system?

Lazy/incompetent/unprofessional people get no sympathy from me, they've earned this, and the company (developers, sysops, and managers in charge of these systems) need to own up to their shitty half baked design and policies. They deserve to get their feet held to the fire. If they're unable to perform, there isn't a shortage qualified people who would jump at a chance to take their places in a fucking heartbeat.

Re:An NPR reporter confessed to the same crime

[king neckbeard]

If the consequences for weev and Apple/AT&T were roughly proportional, there would probably be a lot less outcry. However, as far as a cursory search reveals, they didn't receive any kind of reprimand other than looking like idiots.

Re:An NPR reporter confessed to the same crime

[jklovanc]

Would you defend the government for making a system where simply using a street address would allow one access to information (taxes etc.)? How about your Bank? Explain your reasoning, please.

I am not defending AT&T. I think they should be heavily fined and hopefully someone go to jail. I also think that someone who exploited the hole should also be sent to jail and heavily fined. The only people I am defending are the ones who had their information stolen.

Absolutely it does, it's implicit when it's on the web (short for World Wide Web) especially without authentication (doesn't that usually involve username + password?)

There are some authentications that do not use user/password. For example, Paypal Payflow uses a signature which is a single long number that identifies that account and gives authorization for access. It is a single number somewhat like an IMEI.

FYI email addresses are not private information.

Have you ever seen an directory of email addresses? There may be a reason for that. I have looked and I have not found a legal definition one way or the other. By the way, the parallel with phone numbers may be flawed as some numbers are unlisted and not allowed to be published in directories. I believe that the owner of the number must authorize listing the number.

You make a point of mentioning that this occurred thousands of times.

Make that millions of time with millions of different combinations.

What if you clicked on a link via a URL shortening service that directed you to one of these links, do you think you should be put in jail?

That is one URL and not millions of different URLs.

Do you think you should be liable for fraud for entering IMEI#s?

Yes, if the IMEI does not belong to you or you have not been authorized by the owner to use it.

What about accessing a website or service when its really busy (DDOS)?

If most of that load is caused by your servers hitting their servers then yes. If it is by normal browser traffic then no.

What about visiting slashdot and typing in an account name that's a misspelling of yours which happens to have the same password?

Don't you see how this is very different from trying millions of different password combinations? One of the precepts of law is intent. It is pretty easy to show no intent when typing in a few incorrect characters. It is easy to show intents when you create a script that generates millions of possible IMEIs and spams a server with them.

Lazy/incompetent/unprofessional people get no sympathy from me

I completely agree. I also think that people who exploit flaws for the purpose of profit and/or self aggrandizement should be held accountable for their actions.
We are actually not too far apart. In my view the problem was caused by both Weev and AT&T they both should be prosecuted. What do you think?

Re:An NPR reporter confessed to the same crime

[jklovanc]

Agreed. If more people took the stance of "both are wrong and should be punished" maybe something would happen. The "Weev is innocent" chant just muddies the waters and dilutes any pressure to prosecute AT&T.

Re:An NPR reporter confessed to the same crime

[theArtificial]

I am not defending AT&T. I think they should be heavily fined and hopefully someone go to jail. I also think that someone who exploited the hole should also be sent to jail and heavily fined. The only people I am defending are the ones who had their information stolen. ... In my view the problem was caused by both Weev and AT&T they both should be prosecuted. What do you think?

Jail I believe should be for violent offenders exclusively, jail time for accessing something, even millions of times is ridiculous. If he obtained protected information (cardholder data, SSNs) maybe, but if it isn't "protected" (say an email, first and last name, type of phone etc.) or doesn't come with any terms, it's fair game and the blame for the boring disclosure resides solely with the company since each request was authenticated by them. We have far too many people in Jail as it is. We're the world leader's in incarcerations and it's a dirty ass privatized business which I don't want to support when we can put these people to work, and fines do a wonderful job along with some community service. If that's the case Google needs to go to jail for indexing, and bing too since bing fed itself off of google. There was no exploit, this was the system operating as intended, supply it with an IMEI and get info. You want someone in jail for randomly trying publicly accessible page, incrementally, much like what google does with google maps mapping vehicles. Why isn't this illegal, it's occurring on public roads, too!? They make copies of the data accessible at these locations, or to use your words, they "steal the information" (addresses are personally identifiable information, but also public).

There are some authentications that do not use user/password. For example, Paypal Payflow uses a signature which is a single long number that identifies that account and gives authorization for access. It is a single number somewhat like an IMEI.

Authentication is a fuzzy thing, quick google returned: Authentication is the act of confirming the truth of an attribute of a datum or entity. By entering the IMEI this satiated the authentication, pretty shitty authentication. "Yup, address is good!". In regards to the paypal thing, btw paypal isn't a bank in the majority of the countries they do business in. In order to obtain this signature you need to create an account though, which requires a few pieces of information something an IMEI doesn't require. The signature seems like a token and is part of an authentication scheme, not simply a (terrible) username. The first 8 digits of the IMEI are assigned to manufacturers and made public (pretty good for something "private"!), and Apple, for instance, tends to do 'batch' naming for the rest, so if you have one iPhone IMEI you can guess all the others from that batch just by incrementing. That's a terrible authentication idea there, lou.

That is one URL and not millions of different URLs.

So if each person (in a large pool of say 250k) accesses one URL, with an IMEI that was generated, it's cool? Rape is cool the first time around then too, eh? This conflicts with below :P

Yes, if the IMEI does not belong to you or you have not been authorized by the owner to use it.

Why would I need permission since they can be derived? It's not something that's secret, or is protected, or has any expectation of privacy, it's even broadcast (to the carrier). Otherwise sites like this http://www.imei.info/ wouldn't exist. Think they burn all of those "passwords"?

Don't you see how this is very different from trying millions of different password combinations? One of the precepts of law is intent. It is pretty easy to show no intent when typing in a few incorrect characters. It is easy to show intents when you create a script that generates millions of possible IMEIs and

Re:An NPR reporter confessed to the same crime

[gl4ss]

Ok then is it hacking if I open http://facebook.com/Some.Rando...

what makes it hacking or not? if theres a direct link on other page?

Re:An NPR reporter confessed to the same crime

[Qzukk]

So no online banks, credit card companies, etc.

Sure, if your bank is dumb enough I can walk up to a teller and say "hey, my account is 1234 give me all my money" and they do so, no questions asked, and not even asking to see my ID. And then I walk to the next teller and say "hey my account is 1235..."

In that case we're doing the world a favor by banning them from the internet.

Re:An NPR reporter confessed to the same crime

[gnasher719]

Sure, if your bank is dumb enough I can walk up to a teller and say "hey, my account is 1234 give me all my money" and they do so, no questions asked, and not even asking to see my ID. And then I walk to the next teller and say "hey my account is 1235..."

Remember it's not the bank's money. It is the money of the account holder.

Re:An NPR reporter confessed to the same crime

[Anonymous Coward]

> What if you clicked on a link via a URL shortening service that directed you to one of these links, do you think you should be put in jail?

The stupidity of this statement astounds me.

Let's say you clicked on a shortened link that exposed you to child porn in a jurisdiction where that's legal. What do you do? Assuming good faith, you thank your deity that mens rea is a thing and go through the motions of saying "hey, I found this bad thing" in some sane order of escalation through the system as a matter of covering your own ass.

http://en.wikipedia.org/wiki/Mens_rea

Read. Be less retarded in the future. Fuck.

Re:An NPR reporter confessed to the same crime

[jklovanc]

No because you did not run a script to try millions of different character combinations to find the link. Also the information is obviously meant to be public.

Re:An NPR reporter confessed to the same crime

[jklovanc]

Did you read what I was replying to?

if you don't want something publicly accessible, begin by not putting it online

The poster's contention is that anything online is public and I was showing how some private things are also online.

Re:An NPR reporter confessed to the same crime

[david_thornley]

Legally, I believe it's the bank's money. I'm just a high-priority creditor, and my agreement with my bank makes it my prerogative to put money in my checking account and take it out again at will. In event of bankruptcy, the bank is not criminally liable for not having enough money around to pay all of its depositors.

Exactly.

[Anonymous Coward]

What I find hilarious is that I have a biology professor, biology not computer science, who advises his students to access the yet unreleased class schedule for future quarters by entering the URL for existing ones just a little differently.

Re:Exactly.

[Anonymous Coward]

You are easily amused.

The Free World Defense?

[fullback]

Maybe they should have told the court that they had no authority to charge or even know any information about the case or the defendant's actions since national security and the safety of entire free world was at stake. That seems to scare every other court off, right?

Wait...

[koan]

You're telling me slashdotters don't want to see a troll go to prison?

The screwup of law

[the_Bionic_lemming]

If someone dangles their genitals while traffic passing by can see, take a picture of, and release publicly while informing the police of the infraction can be arrested for dangling their genitals in public view - I find it completely mind boggling that the same enforcement can't be brought against a company that dangles their genitals on the intraweb.

A hundred years from now...

[FuzzNugget]

We will look back on things like this and think, "Holy shit, we imprisoned people for that? Man, that was stupid. I'm sure glad I didn't live in that barbaric era of witch-huntery!"

Re:A hundred years from now...

[JockTroll]

You're wrong: we will look back on things like this and mutter "this is how it started". And then a friendly security patrolman (they will be called that way) will look at us sternly from behind a dark visor and growl: "Are you harboring illegal thoughts, citizen? We are watching you."

Re:Beta is broken and just doesn't work why even c

[Anonymous Coward]

Can we please stop this foolishness. Now I'm off to reddit where I can enjoy my free time.

Once more in plain English Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.

Dude. It's not that difficult:

  1) Enable cookies and javascript in your browser of choice.
  2) go to beta first
  3) Now you can access classic.

If you get tripped up following the above instructions, you may want to lay off the Dew.

Re:Beta is broken and just doesn't work why even c

[phantomfive]

Classic works for me, remove the 'beta' stuff from the url

change url in your browser to...

[Anonymous Coward]

fuckbeta.slashdot.org/blahblah

Gives you original view.

Leaves a nice record of your opinion.

Re: Beta is broken and just doesn't work why even

[AudioEfex]

"Classic works for me, remove the 'beta' stuff from the url."

Be careful, or you'll be tossed in jail for hacking /.

Re: Beta is broken and just doesn't work why even

[phantomfive]

If I find a bunch of people's personal information, and throw it online somewhere, I probably will be.

I don't know whether it's illegal or not.

[Vellmont]

What he did seems rather grey to me. I don't exactly buy the argument that this was legit access. Especially when he went and downloaded 140,000 some email addresses.

41 months does seem like a ridiculous sentence for stealing some freaking email addresses though. Is it really supposed to be worse just because he got Michel Bloomberg's email address? Isn't punishment supposed to be based on harm done? For a crime, this sounds pretty penny-anty.

I did exactly the same thing.

[Anonymous Coward]

In 1997, MT&T launched RADSL service Mpoweredpc.net(7mbps down, 1.088mbps up $45mo)t; As a customer they gave me a printout of a url for my account information. I modified a few random looking numbers on the URL and sure enough, it was an ID for other customers profiles(could go through them all)!! I even had access to their original email passwords(if they had not changed them, I knew this from my own profile).
I immediately reported it to the company, and even sent several follow up emails, yet it took them a good 6 months for them to close the security 'hole'.

There's something to be said for going public, it makes companies get their asses in gear... Better news sites than hacker ones of course, not that back then it would have done anything, as IT news was pretty weak).

Re:I did exactly the same thing.

[Trax3001BBS]

In 1997, MT&T launched RADSL service Mpoweredpc.net(7mbps down, 1.088mbps up $45mo)t; As a customer they gave me a printout of a url for my account information. I modified a few random looking numbers on the URL and sure enough, it was an ID for other customers profiles(could go through them all)!!

The old slip accounts were great for this, there was trust back then you could do a "Who" and see who was online (from that ISP), finger worked, and lots of Unix commands available to work with. I asked why I didn't have that access a few years later and almost laughed at, well we don't allow that anymore.

Even then a web address you could back track into their directories, guess a /address and get lucky, (a few hack sites ever required it). It was easy going, you just can't do that anymore, you can guess a /address but your only going to get what you were suppose to get.

THIS works... apk

[Anonymous Coward]

Put these hardcoded lines into your hosts file:

216.34.181.45 slashdot.org
216.34.181.45 beta.slashdot.org
216.34.181.46 images.slashdot.org
216.34.181.48 it.slashdot.org
216.34.181.48 developers.slashdot.org
216.34.181.48 yro.slashdot.org
216.34.181.48 mobile.slashdot.org
216.34.181.48 news.slashdot.org
216.34.181.48 ask.slashdot.org
216.34.181.48 tech.slashdot.org
216.34.181.48 apple.slashdot.org
216.34.181.48 books.slashdot.org
216.34.181.48 games.slashdot.org
216.34.181.48 hardware.slashdot.org
216.34.181.48 interviews.slashdot.org
216.34.181.48 linux.slashdot.org
216.34.181.48 science.slashdot.org
216.34.181.48 idle.slashdot.org

* Don't use anything that takes a cookie either (registered 'luser' accounts) & you're in (you can still use javascript, but it only slows you down really)... NO MORE "BETA", period!

APK

P.S.=> It works - I never, EVER, see the beta they were redirecting me to (without my consent or even asking me no less)... apk

Re:THIS works... apk

[Anonymous Coward]

i'd just like to say: THANK YOU, apk, for your efforts to educate us...
seriously, in spite of the random snark you endure, you are providing a valuable service, thank you...
keep on resisting The Man, man...

In the 18th century ...

[Taco Cowboy]

... people can claim that they did not know how to do witchcraft, but they could point out to the judge which person were witches which were not.

In the 21st century, people can claim that they do not know how to hack, but they can tell the court who are the hackers and who are not.

As if people never learned any lesson from what had transpired three long centuries ago.

Re:In the 18th century ...

[flyneye]

Actually, its not a very good idea at all, to name names, when you are headed for prison.
You might think you are getting a shorter sentence and you might, but, it just wont matter.
With the tag of snitch stuck to you, you enter a world of men who fear snitches. These men kill what they fear.
So it doesnt matter if you got 10 years or 1. It doesnt take that long to die. Punk City (p.c. or protective custody) wont save you either, especially if you are a high profile snitch. Just get over the tellin on people bullshit. Leave that to the free.

Re:In the 18th century ...

[WhatAreYouDoingHere]

from the summary:

the federal prosecution argued that a hacker should spend three and a half years in prison for committing a crime it couldn't fully comprehend

from taco cowboy (5327):

In the 21st century, people can claim that they do not know how to hack, but they can tell the court who are the hackers and who are not.

from flyneye (84093):

Actually, its not a very good idea at all, to name names, when you are headed for prison.

from me:
attempting to clarify this... I believe that taco meant the prosecutors could tell the court who is a hacker without understanding what hacking is ... not that the person going to prison would accuse others of hacking to reduce their sentence.

Re:In the 18th century ...

[flyneye]

Thank you, a helpful post, you are truly a rarity.

hot

[Anonymous Coward]

http://3gp2orn.blogspot.com/

No thousand time no

[aepervius]

There is no difference to physical entity to electronic entity. Or are you pretending we need MORE law to regulate electronic/internet entity ? No ? Then imagine if I was telling you this :

"Any door that is unlocked is not a free for all. Openning and entering that door is not trespassing at all. And he had no legal requirement to notify the door owner first. "

We have already enough law on the book. If youa re accessing a direct URL and manipulate URL to see what is not normally accessible thru the public portal by a link, you are trespassing. Any "but it is not behind a lock / password" is a bullshit defense.

Re:No thousand time no

[david_thornley]

Opening an unlocked door and entering is not always illegal. I've done it thousands of times in commercial establishments.

Re:No thousand time no

[Anonymous Coward]

Wait? You argument that there is no difference between a physical entity and an electronic entity is posited on the enormous gaping difference between physical security and electronic security.

You sir, are an idiot incapable of reason.

In my opinion...

[Anonymous Coward]

IMO, you shouldn't be able to prosecute a crime you can't comprehend. They need a lawyer with a brain for something other than just law.

It's a public building

[Anonymous Coward]

IT's like some public building where you are trying to find some desk or some info that you need and have permission to have, and wander in some door that was open. Then everyone jumps on you, claims you broke in, and you are spying, and stealing, and deserve to spen several years in jail. Completely different than private houses.

Weev = Miserable Internet Troll (New York Times)

[PocketPick]

Honestly, based on all indicators from the press over the last couple years, Weev has been a fairly miserable human being on most accounts, interested in causing disruption and not much else. The New York Times in particular did a very good expose on a number of individuals (Including Weev), covering their behaviors over the last couple of years, and their admitted trolling behaviors.
  * http://www.nytimes.com/2008/08...

Here is a gem, highlighting some of his conduct.
Weev, the troll who thought hacking the epilepsy site was immoral, is legendary among trolls. He is said to have jammed the cellphones of daughters of C.E.O.’s and demanded ransom from their fathers; he is also said to have trashed his enemies’ credit ratings. Better documented are his repeated assaults on LiveJournal, an online diary site where he himself maintains a personal blog. Working with a group of fellow hackers and trolls, he once obtained access to thousands of user accounts.

I first met Weev in an online chat room that I visited while staying at Fortuny’s house. “I hack, I ruin, I make piles of money,” he boasted. “I make people afraid for their lives.” On the phone that night, Weev displayed a misanthropy far harsher than Fortuny’s. “Trolling is basically Internet eugenics,” he said, his voice pitching up like a jet engine on the runway. “I want everyone off the Internet. Bloggers are filth. They need to be destroyed. Blogging gives the illusion of participation to a bunch of retards. . . . We need to put these people in the oven!”

I don't know why people would do, or admit, things such as what the New York Times describes (usually it involves some kind of mental disorders)...but in the end, it all caught up to him.

NYtimes, I never got to Weev

[Trax3001BBS]

I started at the NYtimes link and it wore me out; it was supposedly about Weev, going from "a hero", to /b/, to Lulz and that was just the prep, I didn't care to read any more about it.

http://www.nytimes.com/2008/08...

Die Weev.

[Anonymous Coward]

Nope. He's still in jail because he is an unrepentant asshole. The useless cunt deserves to die in custody.

Re:Die Weev.

[Anonymous Coward]

Weev, I hope you choke on the next dick you suck. Fuck you prison boy.

Captcha: Pervert (rofl)

I hope he dies in prison.

[Anonymous Coward]

Seriously. He's one of the worst people I have ever had the displeasure of meeting.

Re:Weev = Miserable Internet Troll (New York Times

[marcello_dl]

BTW The New York Times is a troll generator, it causes imitation by feeble minded losers by devoting articles to these rookies.

Re:Weev = Miserable Internet Troll (New York Times

[Anonymous Coward]

but in the end, it all caught up to him.

every verdict creates legal precedent. If you put a fucktard into prison for $x, then the next nice person doing $x will get the cell next to him.

Being in will be better than being out.

[Anonymous Coward]

He's an internet troll and I hope he gets ass-raped multiple times a day. And, I might be waiting for him with a taser, a hood, a pair of pliers, a blowtorch, and a baseball bat when he gets out. Maybe I will makean example out of him. And, I might just take some video of what I do to him and post it on /b/ for all the kiddies to enjoy.

Just because it's easy.

[Anonymous Coward]

Any public URL that is unencrypted is not a secret.

A few years ago, when I left home one morning, I accidentally left my house keys in the lock, dangling from the door in plain view of anyone walking past. I can't tell you why; maybe I was tired, or in a hurry, or just had a momentary lapse. But the fact is my house was completely unsecured, and visibly so to anyone walking past.

The point is: if someone had seen that, and decided to go snooping around my house, it would not have been okay. Just because my security was obviously broken would not have made it okay. There's no difference legally to the crime just because I've made it easy fro you (*) Why would it be different for my web site?

(* Yes, it might have made a difference to my insurance claim if I'd needed to make one, but that's a different issue entirely)

Now I'm not arguing anything about this specific case -- I know next to nothing about it, so I'm not in a position to judge one way or the other -- but I do get annoyed by the self-righteous junk that some some people use to justify hacking. The comment I've quoted above isn't the worst example by any means, but it's the kind of thinking that leads people to think it's okay to break into systems just because it's easy. Call yourself a "white hat" if you like, from where I'm sitting all the hats look gray.

Re:Just because it's easy.

[Anonymous Coward]

A few years ago, when I left home one morning, I accidentally left my house keys in the lock, dangling from the door in plain view of anyone walking past. I can't tell you why; maybe I was tired, or in a hurry, or just had a momentary lapse. But the fact is my house was completely unsecured, and visibly so to anyone walking past.

A few years ago, when I broke up with my crazy ex, I forgot that I gave her a key to my house and did not bother changing the locks. I can't tell you why; maybe I'm just absent minded. But the fact is there is no possible way for anyone else to know that she should not still have access to my house.

The point is: if someone had seen that, and decided to go snooping around my house, it would not have been okay. Just because my security was obviously broken would not have made it okay. There's no difference legally to the crime just because I've made it easy fro you (*) Why would it be different for my web site?

The point is: if my crazy ex later came to my house while I was out of town, and had a garage sale, it would not have been ok, but it also would not have been the fault of the people purchasing my things. Why should it be any different just because instead of a person that I failed to remove access from, it was a server that I failed to set up properly?

Ignorance

[Anonymous Coward]

If ignorance of the law is not a defense, then shouldn't it be that ignorance of the crime is not a prosecution either?

Prosecuting someone for doing something you don't understand sounds a lot like what happened in Salem.

Bad analogy

[Anonymous Coward]

I think a better analogy to what was done would be seeing that your neighbor likes to be undressed in front of their windows and then posting a full page ad about it with directions to your house. Is it illegal to promote something that can be seen publicly?

Apparently insurance companies are fools

[Anonymous Coward]

many insurance companies will find you liable if you don't properly secure your house and will fail to compensate you for your loss. I don't think you realize that there is a burden on the victim to ensure that they practice adequate security.

So we are back to this

[sycodon]

Seems there is a prevalent feeling on Slashdot that if you leave yourself exposed, wittingly or unwittingly, then the folks who take advantage of that exposure should not be held accountable, should get the benefit of the doubt, or in some cases, even celebrated.

The principal at stake here is the social contract of Trust. We trust each other to not harm one another in everyday life. I trust the clerk at the gas station to not bash me in the head with a bat. He trusts me to not do the same. I trust that the people I invite into my house won't go through my stuff, that they will respect my privacy, and won't steal anything, etc.

People who violate this trust are called criminals, thieves, murderers, etc. Despite what the News says, this does not occur all that often. If it did then we'd be like Somalia. It's why we can function as a society.

Whatever the circumstances that led to this guy accessing, downloading, and keeping the information, he violated the general trust that we all have that others won't mess with our shit, even if we leave it exposed. He also violated the law, which says, in a nutshell, don't fuck with other people's shit.

If you want to use the unlocked door analogy, what did not do was leave a nice note for the owner saying, "hey, I found your door was unlocked". Instead, he went inside and took stuff, then put up posters all around the neighborhood telling people the door was unlocked, which door it was, and what stuff he took.

Re:So we are back to this

[Anonymous Coward]

We also should have sense of "trust" that technical companies will protect our data from people who know basic SQL. Hopefully by shaming ATT with their own incompetance, other companies will follow suit and take better care to guard their publicly facing APIs from SQL injection, I agree with your analogy and that is essentially what he did. But i don't have ATT so i actually DGAF

Re:So we are back to this

[king neckbeard]

The question is who commited the greater violation of trust, weev or AT&T?

Re:So we are back to this

[sycodon]

Each should be held accountable according to the laws that were violated. Which was a more egregious violation of trust is supposed to be reflected in the penalties. That doesn't seem to be the case in many laws these days.

The good news is that laws can be changed.

Re:So we are back to this

[Wookact]

The good news is that laws can be changed.

The bad news is when they do change they are more often then not becoming more draconian.

Re:So we are back to this

[david_thornley]

There's also a level of trust that what is publicly available won't get you in trouble if you just look at it. Weev used the website in the exact way it was designed to be used. If I cab propose an analogy, he walked up to a door in a commercial district, turned the doorknob, and walked in.

Re:So we are back to this

[Anonymous Coward]

No - AT&T violated our trust by leaving our identities lying out in the front yard, and Weev walked by and told the press. Your analogy is bad, and you should feel bad.

Re:So we are back to this

[cheater512]

The hacker didn't do the harm though. In this specific instance AT&T did the harm, the 'hacker' just discovered it.

What harm exactly came from him downloading the info?
As opposed to the harm AT&T caused by handing out personal information to anyone who asked nicely?

Re:So we are back to this

[BasilBrush]

And we have a word for people who go round commercial districts turning handles in the hope that they are unlocked, walking in on those that are, and taking things without permission.

They are called criminals.

(Note Weev didn't just "look at it". When he republished the data, that was a clear act of having actually taken it and reused it for his own malicious purpose. And if the maliciousness of the republishing were in any doubt, the history of Goatse and GNAA makes it clear that weev's motivations are certainly not good citizenship.)

Re:So we are back to this

[david_thornley]

If the legal issue were Weev's publishing of that data, I'd be fine with that. Trying doors in commercial districts is not, to my knowledge, illegal, but taking things not clearly marked something like "Take one" is.

both

[shadowrat]

wtf. i actually didn't hate beta until i tried to post this snide remark. but now i have to enter a subject for my replies? seriously, wtf?

Re:both

[Khyber]

You've ALWAYS had to have a subject for any reply.

Re:both

[shadowrat]

but i didn't have to type it. i can edit it, but the site prefills it for me.

TV Courtroom Drama...

[tekrat]

Defense Lawyer: I'd like to call the prosecutor to the witness stand.

Prosecutor: Objection

Judge: This is completely out of bounds.

Defense Lawyer: Your honor, if you would just allow this for a minute...

Judge: Agreed.

(Prosecutor takes witness stand)

Defense Lawyer: Exactly which law is my client accused of breaking?

Prosecutor: The computer security and fraud act.

Defense Lawyer: And exactly how did my client break this law?

Prosecutor: He hacked into the NY Times and stole email addresses.

Defense Lawyer: You misunderstand me. I'm asking for you to describe exactly what actions were taken by my client to hack into the NY Times and steal email addresses, because I am not convinced that any so called hacking took place.

Prosecutor: Ernmmmm. Uh...

Defense Lawyer: Move for a mistrial your honor!

What he DID and what he was PROSECUTED for

[Anonymous Coward]

What he DID: Moved several thousand credit cards, led GNAA (a small-time hacking gang that DID commit criminal acts).

What he was PROSECUTED for: The whole AT&T spiele.

Why the disconnect: He helped the government.

They cant understand these simple everyday

[Anonymous Coward]

Things. Just think how many people they sent to prison just because it was actually complicated.
Listen to the actually admit they are retarded.
Lacking computer skills in this world is like not being able to read or write 2 decades ago.

Re:Weev = Miserable Internet Troll (New York Times

[Anonymous Coward]

Does being an asshole justify a prison sentence?

Actually, that example IS illegal.

[Ungrounded Lightning]

They made their bathroom walls out of glass and then complained that he was a peeping tom for setting up a webcam from across the street. Scuzzy? yes, but not illegal.

It varies by state. But...

Pointing a webcam at an uncovered bathroom or bedroom window generally IS explicitly illegal. It will get you busted and into the registered sex offender database.

IANAL but if I undersand this correctly the test is whether the peeped-at has a "reasonable expectation of privacy".

In the all-glass bathroom case you might claim that the bathroom user did not have a reasonable expectation. But what if the switch from opaque walls to glass was made by a contractor and the homeowner was blind? That's the kind of situation we have here, and the accused knew it.

Once upon a time, decades ago, the built-in permission systems of computers were also usually considered (by their users and administrators, before the law got involved) to also assumed to be a presumed-valid expression of intent. My preference would be to have this approach recognized in law - if only to avoid slippery-slopes between users and jail, and to put any blame for security flaws like this on the people designingn and deploying the tools. But then things happened (like WiFi access points being shipped with security features off to reduce service calls by new users), and the law has been going a different way.

Not quite

[Anonymous Coward]

The IMEI is used to identify the owner of the phone

No, the IMEI is used to identify the phone, period. It has nothing to do with it's owner. He impersonated the identity of a phone, perhaps, but I don't think that is illegal.

So if you forget that your crazy ex has a key

[Anonymous Coward]

And they have a garage sale with all your stuff while you are out of town, you are perfectly entitled to sue all of the buyers of your stuff?

The answer, in case you are wondering, is no.

You're welcome (but it's NOT about that)

[Anonymous Coward]

It's about giving folks what they want & asked for (not what they didn't ask for).

* It's just like the app I wrote for hosts file manipulation http://start64.com/index.php?o...

It UNQUESTIONABLY gives folks:

1.) More speed (that you PAID FOR monthly that's being ROBBED by adbanners (that have had malicious code in them like MAD over time))

2.) More security (vs. known threats online in malicious script housing sites or those that serve up malware &/or botnets etc.)

3.) More reliability (vs. Kaminsky flaw redirected DNS servers OR rogue ones botnet masters use)

4.) & even more anonymity (vs. DNS request logs or for circumventing DNSBLs you may not agree with too) - which it does!

( & it does it with LESS MOVING PARTS COMPLEXITY/ROOM FOR BREAKDOWN, + with parts you already have (native hosts file, part of the IP stack running in ring 0/rpl 0/kernelmode vs. SLOWER usermode & laying on "more" slowing browsers yet more in excessive messagepassing redundant b.s. like "almost all ads blocked" crippled by default & SOULED-OUT or like Ghostery (same deal))

That's all!

* I consider it doing RIGHT by my fellow human beings, for those that elect to choose to try & use it... I had the means to create it, & out the door she went to the masses in mid 2012 (I had it ready as far back as 2003 in 3 apps, consolidated it into 1 in 2004 but, I held off, only due to webmasters... but, then ads starting showing malicious code? No more... I released it).

APK

P.S.=> By the by: Again - You're welcome (what I do, just works)... apk

Phone company, phone analogy

[phorm]

So what if it worked this way...

You're checking your account via the phone. You're asked to enter an account #, but you enter it in wrong. The phone doesn't ask for confirmation, but then says "Press one for your transaction history, press two for registered credit card numbers, etc"

Is it still a HACK in this case, because it's not much different. Maybe add that the number you're calling was unlisted and somebody got it by mis-dialing, but I still couldn't see somebody getting jailed over this if it were over a phone instead of over the 'net.

Additionally: Those "snarks" I endure?

[Anonymous Coward]

They're 1 of 4 types of people (bank on it):

1.) Advertisers
2.) malware makers
3.) botnet herders
4.) webmasters

* Doesn't 'take a brain' to realize THAT much - after all: THEY'RE THE ONES WHO GET "HURT" by it... problem is, per my other post to you? THEY have been hurting others bandwidth/speed, secuirty, & more for DECADES...

Funniest part is that those 'snaks' are "the best they got" but they certainly CAN'T get the better of me disproving my points on hosts files' mulitiple nigh ubiquitous value to end users...

(I just decided to do something about it... & I don't "force it' like beta on others - I only show a horse water, but I can't make him drink it!)

APK

P.S.=> Think about what I just said - you'll "get it", fast... apk

Downmods, dumbfuck? Ok - get this:

[Anonymous Coward]

I have EVERY RIGHT to control what comes into MY system, not /. (or anyone else) without MY ASKING... get it shitskull?

Good...

APK

P.S.=> & Again: FUCK OFF already, little prick... You & a 1,000 LIKE you, don't have the intellect, wit, skill, or ability to EVER get the better of me on ANY FRONT (so, get THAT thru your limited brain)... apk

Downmods, dumbfuck? "Play it again, sam"

[Anonymous Coward]

I was requesting slashdot.org, numbskull - THAT is what (you dumb shit) & once more/again also: I have EVERY RIGHT to decide WHAT comes into MY COMPUTER SYSTEM asswipe... not /., - OR anyone else.

Got that? Good...

APK

P.S.=> Now, fuck off already... apk

Weev in prison, for a "crime" not defined in law?

[linuxiac]

So, let me get this straight... Weev was convicted of a "crime" that the government prosecutors cannot explain, nor define, under the law? Talk about stupidity in places of power! Talk about massive injustice! DISGUSTING!!! Then, I find out it really might be a HUGE dislike of him, personally, because he is perceived to be un-repentant? Sounds so much like the witch trials of Salem! There, but for the grace of God, go I!

Inaccurate Analogy

[Anonymous Coward]

Your analogy is not accurate. AT&T isn't a private home, it is more like a bank entrusted with other people's valuables.

For a better analogy, imagine your bank storing your money and valuables in garbage bags and putting these numbered bags on a vacant lot (no locks, no walls, no alarms or security guards). One misstep and the random passerby on the public road (a highway?) finds himself kicking up any of these bags.

There, now build up the analogy and try to draw similar conclusions.