Should The FBI Have Arrested 'The Hacker Who Hacked No One'? (thedailybeast.com)

Last week The Daily Beast ran an article about the FBI's arrest of "the hacker who hacked no one." In December they'd arrested 26-year-old Taylor Huddleston, "the author of a remote administration tool, or RAT, called NanoCore that happens to be popular with hackers." It's been "linked to intrusions in at least 10 countries," reported Kevin Poulsen, but "as Huddleston sees it, he's a victim himself -- hackers have been pirating his program for years and using it to commit crimes."

The article quotes Huddleston's lawyer, as well as a Cornell law professor who warns of the "chilling effect" of its implications on programmers. But it also says security experts who examined the software are "inherently skeptical" of Huddleston's claim that the software was intended for legal use, since that's "a common claim amongst RAT authors." Security researcher Brian Krebs also sees "a more complex and nuanced picture" after "a closer look at the government's side of the story -- as well as public postings left behind by the accused and his alleged accomplices."

Click through for the rest of the story.
Mark Rumold, senior staff attorney at the EFF, tells Krebs "I don't read the government's complaint as making the case that selling some type of RAT is illegal, and if that were the case I think we would be very interested in this." Also skeptical is Allison Nixon, director of security research for New York City-based security firm Flashpoint. "Huddleston can claim the DRM is to prevent cybercrime, but realistically speaking the DRM is part of the payment system -- to prevent people from pirating the software or initiating a Paypal chargeback." Krebs writes:

Nixon, a researcher who has spent countless hours profiling hackers and activities on Hackforums, said selling the NanoCore RAT on Hackforums and simultaneously scolding people for using it to illegally spy on people "could at best be seen as the actions of the most naive software developer on the Earth. In the greater context of his role as the money man for Limitless Keylogger, it does raise questions about how sincere his anti-cybercrime stance really is."

And of course, the FBI's complaint also notes that the software was promoted on HackForums.net. The Daily Beast says Huddleston eventually realized "it was a terrible place to launch a legitimate remote administration tool. There aren't a lot of corporate procurement officers on HackForums," adding that at first Huddleston handed off the business, "while continuing to develop the code as an 'advisor' in exchange for 60 percent of every sale."

Slashdot reader Highdude702 believes Huddleston's arrest "is an outrage, and is a push too far, also in the wrong direction," calling it "the story of a script kiddie gone big time...arrested for being an accomplice to a crime committed by people he had never met, let alone knew well enough to commit crimes with."

What do Slashdot's readers think?

Comments

commonly used claim?

[Anonymous Coward]

"I didn't murder someone" is a very commonly used claim among those who don't murder people. Would that "raise skepticism" and make one a target for a murder investigation? I don't think so. This is a chilling-effect arrest. They know this guy didn't hack someone, they're just trying to make the tool-makers lives harder because the tools can be used for no good.

Re: commonly used claim?

[ewanm89]

Do you arrest Glock cause someone was murdered with one of the pistols they made? What about Louisville Slugger cause someone was beaten with one of their baseball bats? How about Ford cause one of their cars was used to run someone down? Arresting the creator of a tool because of how it is being misused by others is highly questionable in any circumstance. I think most of the civilised world would agree that the responsibility for the use of such a tool in all the listed cases is on the person who used it to commit a crime, not one the person who created the tool, why should a software tool be considered any different?

Re:commonly used claim?

[phantomfive]

The difference here is that the government doesn't even claim he hacked anyone. Usually when someone is arrested for murder says, "I didn't murder someone" the government is asserting that they did.

Re: commonly used claim?

[Anonymous Coward]

Do you arrest Glock cause someone was murdered with one of the pistols they made?

Yes, if Glock ran commercial ads stating their products were most and solely useful for murder and no other uses, they would likely be arrested or at least charged with crimes.

What about Louisville Slugger cause someone was beaten with one of their baseball bats?

Yes, again if Louisville Slugger specifically advertised their bats were most useful for assault and battery and less useful for baseball, they too would likely be in legal trouble for doing that.

How about Ford cause one of their cars was used to run someone down?

Once more, yes, if Ford advertized their cars as primarily useful in running over humans and were less useful as a form of transportation, they too would be in trouble.

Arresting the creator of a tool because of how it is being misused by others is highly questionable in any circumstance.

I agree, but what does that have to do with this guy or story? No one was arrested for creating a tool being misused by others.

I think most of the civilised world would agree that the responsibility for the use of such a tool in all the listed cases is on the person who used it to commit a crime, not one the person who created the tool, why should a software tool be considered any different?

I agree, it shouldn't be different, and thankfully still isn't different.

But do you not understand why a manufacturer of a "tool" might be in a little trouble if even that manufacturer explicitly says they sell no "tools" but only "weapons" specifically desired to be used for illegal purposes, while attempting to dissuade anyone from using them for legal purposes?

The manufacturer should also probably not admit out loud that there isn't enough money to be made from legal uses of their "tool" and admit to selling to others that state their intent to break the law with it, because those self-admitted criminals pay better.

Re: commonly used claim?

[geoskd]

Do you arrest Glock cause someone was murdered with one of the pistols they made?

Yes, if Glock ran commercial ads stating their products were most and solely useful for murder and no other uses, they would likely be arrested or at least charged with crimes.

It would be difficult to make the claim that Glocks handgun products have any other purpose than injuring or killing people. Handguns are mostly worthless as a means of hunting either for food or sport. The simple fact is that handguns are made to kill. I think it is a perfect analogy to the tools this person made. Whether Glock advertises it that way or not, they are what they are.

Given that, I have to agree with the original sentiment. The maker of a tool, no matter how evil the perceived usages of the tool are, should not be accountable for how and when the tools are used. Even the most evil of tools can be put to good uses too. For example, if and when the "Armageddon/Deep Impact" scenario actually comes around, we will be very hard put to save ourselves without nuclear weapons, and the development of those tools lead directly to the development of nuclear power production, and it is entirely possible that this will be the only thing that prevents us from cooking our planet to death by way of AGW

Re: commonly used claim?

[Zak3056]

Handguns are mostly worthless as a means of hunting either for food or sport. The simple fact is that handguns are made to kill.

Some thoughts on the above:

1. Apparently "hunting" is not "killing" in your lexicon?

2. Some handguns (though none I can think of made by Glock) are indeed used for hunting. This is what cartridges like .500S&W and .454Casull are for. I have friends who take deer or boar with them.

3. There are other shooting sports beside hunting. Glocks appear quite frequently in some of them.

4. Some handguns are made specifically for the purpose of punching holes in paper or knocking over steel plates, rather than for killing things. While they're capable of the latter, it would be akin to using a screwdriver as a hammer.

Just saying.

Re: commonly used claim?

[Anonymous Coward]

I'll bite your strawman argument...

Once more, yes, if Ford advertized their cars as primarily useful in running over humans
and were less useful as a form of transportation, they too would be in trouble.

Since your statement is so subjective, how about when Ford provides vehicles for movie studios
(for the free publicity), and in some cases those vehicles are user to "simulate" bad things. So, if fact,
they are advertising those things as something their vehicle is capable. Do that make your case tighter?

There has to be an mens rea "evil mind" at play. You can't just make you own rules up. How about
all of the people who work in the manufacturing of ordinance? There is only 1 purpose for the fruit
of their labour, amiright?

The absolute best the feds _Should_ be able to do is assert that he conspired to do evil, but there isn't
any credible evidence for even that. They have taken a huge leap and risk to make this guy a
multimillionaire through damages that will be award to him in any sane court of law.

CAP === 'miseries'

Re: commonly used claim?

[PoopJuggler]

Explain how cigarettes are legal. They serve no benefit to anyone and murder millions of people every year.

Re: commonly used claim?

[blindseer]

2. Some handguns (though none I can think of made by Glock) are indeed used for hunting. This is what cartridges like .500S&W and .454Casull are for. I have friends who take deer or boar with them.

I thought I'd get into deer hunting after talking to some of my friends that hunt. Along with their exciting tales of deer hunting I heard horror stories of hunting during what we call "shotgun season". You see around here it is legal to hunt with a shotgun that fires "slugs", which is a shotgun shell loaded with a single projectile. In this case the "shotgun" is really just a rifle with a big slow bullet, or what I call a "slug gun". Anyway, since just about anyone can hit a deer with a $300 "slug gun" all the good hunting spots fill up real quick with inexperienced hunters on the few days when "slug gun" hunting is allowed. This can lead to a dangerous and unpleasant hunting experience. Fortunately there is a handgun and bow season that opens before the "slug gun" crazies come out.

To avoid this I thought I'd get a handgun to hunt deer. So I go to a local gun shop and look at guns suitable for hunting deer. I ask the guy behind the counter what would be a good gun to use. During that conversation I ask about using a semi-automatic handgun. He replies that while it is legal he said, "you'd look funny shooting deer with a Glock" and then brought me to the display case with the revolvers.

There is nothing "wrong" with hunting with a Glock, mechanically or legally speaking. They are light handguns which make them suitable for carrying often and shooting little, but being light can mean a loss in accuracy. When hunting one wants something durable and accurate. Things where a Glock shines over a revolver, such as ammunition capacity, mean little while hunting.

I also have not seen anyone use a Glock for hunting but that does not mean that no one does. A Glock chambered in .45ACP or .40S&W would be quite suited for hunting. The quite powerful 10mm is rare in Glocks, as I understand, but it is something used for bears, either hunting or protection from them. The .357SIG and .45GAP are good too, but not many cartridges in those calibers are suited for hunting.

The point is that handgun hunting is quite popular, and I suspect that is true even for those that own Glocks.

Re: commonly used claim?

[drinkypoo]

Sport and practice are the primary use of guns. I have many guns, and not one of the thousands of bullets I've shot have killed anything.

And yet some guns in common sport use today were definitely designed for killing humans (including most pistols) and many if not most popular non-shotgun calibers were also intended for this purpose, including .45 ACP, 9mm, .30-06 and .30 carbine, obviously NATO rounds...

Re: commonly used claim?

[Applehu Akbar]

Making gun manufacturers liable for crime is exactly what admin carts spent the last eight years trying to do. Now that Repubkicans are in control, the jackboot is on the other foot.

Re: commonly used claim?

[Applehu Akbar]

EDIT: ...exactly what the Democrats spent...

Re: commonly used claim?

[Applehu Akbar]

Arizonan reporting in: Hikers carry handguns in bear country because hunting rifles are too heavy in the pack.

Re: commonly used claim?

[hairyfeet]

They are also good for fisherman as there are several very poisonous snakes here in the USA and the last thing you want is to get bitten out in the middle of nowhere. At certain times of the year snakes are VERY aggressive and fishing on a creek bank without a handgun to deal with the snakes? Not a really good idea.

Re: commonly used claim?

[SuricouRaven]

The standard freedom argument: If people want to do something incredibly stupid and hazardous to their own health, that's their decision.

It doesn't work very well for cigarettes though, as the rest of society eventually ends up footing the bill for their lung cancer, either through taxes or higher insurance premiums.

Re: commonly used claim?

[drinkypoo]

I didn't buy a commander-style 1911 because it was pretty (it isn't particularly) or because it puts holes in paper nicely (which it does) but because .45 ACP is just a whisker better than 9mm in the force delivery department, and California will only let me have ten rounds anyway.

Re:commonly used claim?

[lsatenstein]

"I didn't murder someone" is a very commonly used claim among those who don't murder people. Would that "raise skepticism" and make one a target for a murder investigation? I don't think so. This is a chilling-effect arrest. They know this guy didn't hack someone, they're just trying to make the tool-makers lives harder because the tools can be used for no good.

If I was a gun manufacturer and someone used a gun I manufactured and sold to commit murder, am I an accomplice or guilty in the use of the gun?

The guy made a hacking tool. It became available and hackers used it. Should the guy be found guilty of being an accomplice or even being charged as a hacker?

Re: commonly used claim?

[kenh]

to fund poor children's healthcare

Re: commonly used claim?

[rtb61]

How about as a recruitment tool ie either work for us for free or spend the next ten years in jail. That is closer to the reality of what is going on.

Re: commonly used claim?

[Obfiscator]

"Anyway, since just about anyone can hit a deer with a $300 "slug gun" all the good hunting spots fill up real quick with inexperienced hunters on the few days when "slug gun" hunting is allowed."

You can say the same thing about any rifle (well, .270 and higher...not sure I'd use a .22 for deer). A 12-gauge slug is what, three quarters of an inch wide? If you're a good marksman, you can group your shots at minute-of-angle, or 1 inch at 100 yards. Going from a one quarter inch wide bullet (.30) to 3/4 inch isn't going to make that much of a difference. The slug drops a lot faster, too. If you zero your slug gun at 50 yards, it'll drop 5 inches by 150 yards. Rifles have a much flatter trajectory.

In parts of the midwest (where there is a higher population density), rifles are outlawed and you can only hunt with slug guns, because the slug drops so much faster (less likely to stray into a population zone). When I was growing up, you couldn't use rifles in a lot of places. That seems to be changing. Now Iowa and Illinois are the last two states that are slug-only.

Or were you saying that it's easier to hit a deer with a slug gun than with a handgun or bow? When I think deer hunting, I think rifle, so I automatically compare against that.

I would argue that using a handgun for protection against a large bear is silly. It takes a grizzly, what, a little over 3 seconds to cover 100 yards? A 12-gauge slug delivers about 1600 foot pounds of energy at 100 yards. The 10mm stats that I find list a maximum of 1000 foot pounds, and that's at the muzzle, where the 12-gauge slug has almost 3000 foot pounds of energy. Some .50 AE rounds get 2000 foot pounds at the muzzle, so maybe that's what you were thinking of. In addition, a good pistol marksman will be able to hit accurately at 50 yards, while 100 yards is easy with a slug gun. So, easier to aim, longer range, and more energy. If the bear is standing still and not charging, then anything would probably work, since you just have to fire up in the air and not at the bear.

To be honest, I'd have a hard time concentrating if there was a grizzly charging me, so I can't say my aim would be the best. Better chance with a slug gun than a handgun!

Re: commonly used claim?

[Pseudonym]

Historical reasons. If Walter Raleigh had visited Central Asia instead of the Americas, cannabis would be a legal health problem and tobacco would be a banned substance.

Trafficking in circumvention measures is illegal

[Anonymous Coward]

Well.. as outrageous as the OP makes it sounds, you actually don't need to "hack" someone to break the law.

There are lots of laws out there. For starters, trafficking in software or devices which circumvent security measures is often illegal. "Using" said device isn't necessary to run afoul of the law.

The DMCA has strong anti-circumvention language for example. Other countries have similar laws.

Bullshit logic.

[Anonymous Coward]

Time to arrest the manufacturers of trucks that are used to plow into civilians, hey?

Almost every "hacking tool" has a beneficial use.

Re:Bullshit logic.

[epyT-R]

Exactly. It exposes known vulnerabilities (at least to the author). Shutting these people down is just another form of security through obscurity.

Re:Bullshit logic.

[Hognoxious]

Bullshit logic? Here's some budget logic.

The FBI arrest three people.
The FBI arrest 79 million people.

In which case do they get the most money?

Re: Bullshit logic.

[Jesus H Rolle]

I take it your gun isn't Swiss military issue.

Re: Bullshit logic.

[jaymemaurice]

"It also functions as a laser pointer for presentations and universal off switch"

Like tax preparation software.

[BitPit1]

RAT is just like TurboTax. Each has an intended purpose (Remote Administration / Tax Filing). Each can be used by criminals (unauthorized system administration for ransom / filing another person's taxes for refund). Poor business decisions about where to promote your product for maximum intended purpose sales is not a crime. Improper use of the product is a crime.

Re:Like tax preparation software.

[phantomfive]

Why did people pay for RAT instead of just using VNC?

Hacking tools do not hack, it is people that hack.

[Anonymous Coward]

I would be happy if he went to jail ONLY IF executives of arms manufacturing also went to jail for killing people. Otherwise hacking tools do not hack, it is people that hack.

It's an outrage...

[Anonymous Coward]

...everytime the media kneejerkingly supports the bad guys!

.On or about November 21,2013, HUDDLESTON caused an activation email to be sent to a customer who had purchased the Limitless key logger, knowing that individual intended to use the Limitless key logger for the purpose of committing unlawful and unauthorized computer intrusions. 'The email contained the license serial code and instructions for how to download and activate the keylogger.

Guy is toast and rightly so.

Re:It's an outrage...

[Orgasmatron]

Good post - insightful and informative.

Note that this is a different scenario than the hypothetical question asked in the article/summary. The key is "knowing that individual intended to use the Limitless key logger for the purpose of committing unlawful and unauthorized computer intrusions". This is the standard FBI quasi-entrapment operation.

In my opinion, no tool should be illegal to make or sell as long as some legal use is possible, however improbable. Selling it to someone after you know that they intend to use it illegally, however, I'm willing to let law enforcement do their thing. (But I'd like to see some more public scrutiny of their methods, which smell like bullshit a bit more often than I'd like.)

Re:It's an outrage...

[Orgasmatron]

When you get done shaking, go read up on how the FBI busts "terrorists". The legal mechanism is exactly the same, and it often smells like entrapment. The details, of course, are different, which probably comes as a big surprise to people who aren't aware that the people and situations are totally different.

Re:Trafficking in circumvention measures is illega

[epyT-R]

That doesn't make it immoral. This is a case of opportunists making use of bad laws they likely lobbied for.

Re:Should the FBI have arrested 'The Hacker Who...

[epyT-R]

People like you are the reason big government inevitably becomes tyrannical.

Re:So what did he think would happen?

[epyT-R]

This 'blame chain game' inevitably leads to unchecked witch hunting. Do we blame Toyota for bank robberies when one of their cars are used? No. Do we blame Intel when one of their cpus is used in a 'hacking' crime? No. This is no different.

It's a sad day when this kind of thing has to be explained to someone who reads a site like slashdot.

simple answer

[jmccue]

Are gun manufacturers held responsible for deaths caused by their products ? I guess you know the answer now

Re:simple answer

[whoever57]

Gun manufacturers are not guilty of the same crime as this person: the crime of not being wealthy.

Re:simple answer

[Richard_at_work]

Do gun manufacturers hang out on "home invaders" forums touting their wares...?

Re:simple answer

[jopsen]

Do gun manufacturers hang out on "home invaders" forums touting their wares...?

Are the major of people killed by handguns killed in justifiable self-defense?

Re:simple answer

[wisnoskij]

If you advertise your gun as being particularly good at stickups, if you sell the gun to someone you know will use it unlawfully, yes. Yes they are
If this guy can be proven to have knowingly sold tools to an individual stated his illicit intent. If he ever made any claims to its potential use illegally, he will likely be convicted. I me likely will not be if it was just some pirates who used his software to hack.

Re:simple answer

[drinkypoo]

Those forums have a significant non-criminal audience.

[citation needed]

It's not having "hack" in the name, necessarily. It could be obd hacking, or something like. But I don't think we're talking about a forum like that here.

Re:simple answer

[jon3k]

You mean other than following the hundreds of byzantine laws on the manufacture and sale of guns?

Re:simple answer

[gravewax]

If they advertise and sell it to criminals as ideal for committing crimes then yes they would be held responsible.

Re:simple answer

[Anubis IV]

Are gun manufacturers held responsible for deaths caused by their products ?

No, but they're also not advertising their wares on sites dedicated to exchanging tips for committing murder, nor are they providing customer support to people who are apparently engaged in murdering others.

From the sounds of things, this guy was advertising on forums commonly used by hackers to sell their wares to each other, and was offering support to people who made it abundantly clear that they intended to use his software for illegal purposes.

Re:simple answer

[Aqualung812]

Are the major of people killed by handguns killed in justifiable self-defense?

Are most defensive gun uses reported, or even result in a gun being fired?

That's honestly the hardest part with this debate. We simply have no idea when the mere brandishing of a gun caused a potential victim to move on unharmed while the attacker left.

I'd love to actually see some method of reporting an tracking DGU, just do know the answer, whatever it is.

Overreaction...

[Freischutz]

My first instinct was to say 'no' before I had even read the summary based on the argument that if this guy should be arrested for making a legal admin tool that's been misused by hackers then the CEO of Beechcraft should be arrested because his planes are used to run drugs as well as passengers and legal cargo. However, it then occurred to me that even the evil trinity of Donald Trump, Steve Bannon and Mitch McConnell could not have turned the FBI into the holy inquisition this quickly. There must be more to the story so I read the summary. If it is really true that this guy launched the marketing campaign for his 'admin tool' on black-hat hacker forums, I'd say they should at the very least drag him into an FBI field office for some serious questioning. There is a difference between your aircraft that you market for civilian purposes being used by criminals and you actively catering to the needs of criminals, concentrating your marketing on them and advertising in places that criminals frequent.

Re: Overreaction...

[Zero__Kelvin]

So in your mind there is such a thing as Black Hat only forums and white hats never go there to be able to keep up with them? You really believe that? How, EXACTLY, do they ever that? It's there a "Black Hat Certificate" of which I am unaware?

Re:So what did he think would happen?

[Anonymous Coward]

It's a hacking tool right?

Wrong, it's a tool to remotely administer your own computers.

Re:This reminds me of erectile dysfunction ads

[dyfet]

And if your keylog session lasts for more than four hours seek immediate help from a legal professional?

Re:Should the FBI have arrested 'The Hacker Who...

[fustakrakich]

I will put it upon you to read this before reacting so hastily.

Re:So what did he think would happen?

[epyT-R]

Stop embarrassing yourself and read the comment I replied to. RAT is not a bomb.

Re:Should the FBI have arrested 'The Hacker Who...

[epyT-R]

I'm not sure it matters. Such arguments are made quite a bit these days and deserve critical responses, if not for the benefit of the troll who likely knows better, then for those who read his comments.

Question of intent for the Jury

[techesq]

Since we're operating under U.S. Federal law, our innocent until proven guilty developer will be able to force the prosecutors to prove their case and have a jury decide his fate. The government's case is this: if you're a developer of a legitimate remote admin tool and DRM tools, why are you marketing and supporting the product in a known criminally linked forum? What was your relationship with the convicted felon who distributed the Limitless keylogger tool? From the Krebs piece it appears he assisted (a prosecutor might say "conspired with") the developer of key logger crimeware to receive payments. This is a case of what did he know and when did he know it? This is not an easy case to prove, but there is probable cause to suspect something criminal was going on based on the totality of circumstances. The government will have its work cut out for it, but I think the "chilling" effect defense is weak. You're free to develop, market, and sell any type of RAT or DRM software you want. You cannot knowingly assist criminals commit cybercrime. Pretty simple in my book. If you think otherwise, hire a lobbying firm and buy your own legal exceptions to established laws like the gun lobby did ;)

Re:Question of intent for the Jury

[wisnoskij]

Its also more of a tricky case than what you might imagine at first glance.
All these people know what their customers are doing with their products. I am sure their are gun sellers who know with 100% certainly that when a certain type of person comes into his store that one of his guns is going to end up at a crime scene sooner rather than latter. And yet you cannot discriminate even if you know the guy is part of a gang. There are gun sellers who know 90% of their sales go on to commit crimes. What is the real difference when one of your customers lets slip verbally that the gun will be used for illegal means instead of just signalling with the very essence of his being? At what point has someone gone from joking around to admitting to future crimes? Is it a surprise that Huddleston was not outraged when he learned that a potential customer was a criminal, when we all know full well that Huddleston knows what his software is used for, he knows that most of his customers do with it.

Re:Should the FBI have arrested 'The Hacker Who...

[jenningsthecat]

I'm not sure it matters. Such arguments are made quite a bit these days and deserve critical responses, if not for the benefit of the troll who likely knows better, then for those who read his comments.

Be honest now - did you really think AC was trolling, rather than simply using sarcasm to make his point? Or did you just type so fast that your comment outpaced that whooshing sound?

Re:Should the FBI have arrested 'The Hacker Who...

[epyT-R]

Around here? I give it 50/50.

Why is his RAT necessary?

[knorthern knight]

ssh/putty and RDP handle linux/unix/bsd and Windows remote administration perfectly well. The major difference is that you can't set up an sshd/putty/RDP server on your machine by clicking on an email attachment. Question... what legitimate use-cases are there which ssh/putty/RDP don't handle?

Re: Why is his RAT necessary?

[pbhj]

Pen testing is a legitimate use. If it's possible to create such a tool then it's necessary for security operatives to use such tools to treat the effects they would have when penetrating a particular network's security.

Re: Trafficking in circumvention measures is illeg

[phantomfive]

So if we prove gun makers true intentions they get to go to prison for murder?

Probably as an 'accessory to a crime' or 'aiding and abetting.' The legal system has been able to deal with this problem for a long time. If the bullet manufacturers intentions can be proven, they will likely go to jail, too.

Of course that's an unlikely scenario.

Ramp up the Volume

[shubus]

How long have we got before creating security software is deemed to be a crime. Think VPN's and PGP. Should Zimmerman be worried?

Re: Ramp up the Volume

[techesq]

It depends on your intent. Are you trying to cover up a criminal act using VPN software? Are you knowingly writing VPN or encryption software to help commit a crime? Then yes, you have something to worry about. There are tons of examples of this in criminal prosecutions. Just because we use different technology these days doesn't change the way the law works. If I'm a security guard and I sincerely forget to lock a door, and the place I'm guarding gets robbed, I didn't commit a criminal act (though I might be negligent, and if I was really negligent -- like drunk or sleeping -- it may rise to criminally negligent act). But if I leave a door open as part of a scheme to rob the place, then my action (or inaction) is criminal because of my intent. Law enforcement and prosecutors can use all the facts and circumstances surrounding the acts to infer intent -- then a jury gets to decide if they proved it or not. In today's context of VPN and encryption software, the prosecutor can argue that the use of those tools is evidence of intent. A defense lawyer would argue otherwise. But ultimately, it's the jury's job to decide. That's why we have them.

Re:So what did he think would happen?

[phantomfive]

He apparently added DRM to the software, and if anyone bragged about using it for hacking, he disabled their license. So.......

Re:So what did he think would happen?

[epyT-R]

So? Was he caught spearfishing with it? Someone still has to decide to and then use his tool unlawfully. Arrest those people. I'd rather these easy-to-use tools are made and distributed because they highlight the vulnerabilities (software and policy) required to get them installed. Software vendors and governments don't want them highlighted, the former because of image and the latter because they hoard them as munitions. Neither attitude is beneficial.

The last thing society should do is depend on law and law enforcement for system security. I bet they use RAT (or something like it) too. If it's ok for them, then it's ok for everyone else.

Re:What are they charging him with?

[tomhath]

FTFA:

“During the course of the conspiracy, Huddleston received over 25,000 payments via PayPal from Net Seal customers. As part of the conspiracy, Huddleston provided Shames with access to his Net Seal licensing software in order to assist Shames in the distribution of his Limitless keylogger. In exchange, Shames made at least one thousand payments via PayPal to Huddleston.”

Conspiring to commit a crime is not free speech..

Ikaruga?

[Opportunist]

That game looks a bit like a retextured Ikaruga.

If that's true: May $deity have mercy on your files!

Re: So what did he think would happen?

[Zero__Kelvin]

You evidently have never heard of the perfectly legal "Anarchists Cookbook".

Re: What are they charging him with?

[Zero__Kelvin]

I agree with you; All Microsoft executives SHOULD be arrested post haste. Great point!

Re:So what did he think would happen?

[Anonymous Coward]

He added DRM to allow the malware developers to disable their malware if the person using it wasn't a customer didn't have a license. He aided and abetted criminals to enforce the licenses on their malware. He even marketed his sofware to them directly, knowing for what purpose they intended to use it. That makes him a criminal.

Re:So what did he think would happen?

[phantomfive]

He even marketed his sofware to them directly, knowing for what purpose they intended to use it.

That's the central question, right? If the government can prove he knew, then he'll go to jail. If they can't, he'll probably go free.

Re: Trafficking in circumvention measures is ille

[phantomfive]

Sadly, as the song goes, "first they came for the murders, but I didn't say anything because I wasn't a murderer...",

Um, no actually, I actively cheer them on for catching murderers because I strongly believe murderers shouldn't be allowed free in society. I don't know what weird ideology you have that believes otherwise.

BS - This is thoughtcrime

[s.petry]

If this person is guilty of developing a remote admin tool, then so are the developers of SSH, Citrix Desktop developers, Microsoft Remote Desktop developers, VMware developers, VNC developers, Oracle SGD developers, Apple remote control services, and any other remote admin tool or tool that could be used for remote admin. All of those tools are developed to avoid people seeing what you are doing, all are configurable ports to avoid detection, etc.. Ask any developer or security expert if those tools can be used for hacking, and the answer is "YES" across the board.

The EFF should have stopped when they said it would have a chilling effect. It does, because this would make "not hacking" but developing a certain type of tool a crime.

Now had the guy actually used the tools to commit a crime, he should be charged with a crime.

This is no different than charging a gun manufacturer with murder because a gang member killed someone with a gun made by the manufacturer. This is tyrannical authoritarianism, plain and simple.

Re:BS - This is thoughtcrime

[retchdog]

not that i necessarily agree with the following reasoning either, but i feel it's important to represent the case accurately.

his offense was not developing a remote admin tool. i'm pretty sure that, were he to have just developed it and put it on github or a personal page or even offered it for sale with neutral language, that he would be fine. i believe this in part because a lot of people have released RATs and not been prosecuted.

his offense, more specifically, was selling and promoting the tool as, basically, "something you can use to haxx0r people", rather than as a security tool per se. it's not thought-crime, so much as enticement-crime. maybe that's bullshit too (though i am personally not completely sure), but the distinction is there and has plenty of precedent backing it up.

Re:BS - This is thoughtcrime

[s.petry]

The crime in the case you describe is being an accessory to burglary, not selling tools.

Re:BS - This is thoughtcrime

[Anonymous Coward]

No there is a distinct difference here. He wrote the tool explicitly to perform illegal activity and then sold it to those who intended to commit a crime. Just like a gun shop selling a gun isn't a crime, but if you sell a gun to a guy you know intends to go out and shoot people you are going to be fucked over majorly by the authorities and you will deserve it.

Re:BS - This is thoughtcrime

[gravewax]

This is Slashdot, reality distortion is strong on here, especially if it is some poor innocent criminal that was just trying to make a living screwing over peoples security.

Re:BS - This is thoughtcrime

[s.petry]

Most of those I mentioned have built in key logging. The same is true with other common tools like sudo and Tripwire. Before posting again, fix your ignorance.

Re:BS - This is thoughtcrime

[whit3]

How can you seriously, with a straight face, compare a RAT sold on hack forums ...

There was no 'hack forum', it was a site or sites in an online community which allowed sales of software. Functionally, it was free advertising and pretty-normal ecommerce.

One can CALL IT a 'hack forum', but that has no significance. Name-calling!

Don't talk about 'serious' if your main point is name-calling. You post on Slashdot, after all, and under an assumed identity.

Glass houses, stones... you know.

Re:Real vs. Imaginary Threats...

[__aaclcg7560]

Cool story, troll. Keep trolling, you're hilarious.

I'm not a troll. I'm just someone who loves to troll the trolls on Slashdot. Being doing that for years.

VLC

[hackwrench]

VLC, they're coming after you next!

Re:Real vs. Imaginary Threats...

[__aaclcg7560]

I'm not a troll. I'm just someone who loves to troll

On your permanent record now, troll.

Not yet. I'm working on a Python script to scrape my ~8,000 comments from Slashdot. When I publicly release the script on GitHub, everyone can have access my comments — or their own.

Re:Real vs. Imaginary Threats...

[__aaclcg7560]

Flaming narcissist downloads his posting history onto a pen drive and masturbates with it. So appropriate.

Reference materials for my Silicon Valley memoir.

Re:How about the creators of Tor

[craigminah]

Cars kill people so imprison auto manufacturers, OSes are used to sometimes do nefarious things so imprison OS vendors and those who contribute to them, and the list goes on. This world has gone nuts and the governments of this world have gone crazy with their power and ability to spy on their citizens.

Re: Trafficking in circumvention measures is ille

[ArsenneLupin]

Um, no actually, I actively cheer them on for catching murderers because I strongly believe murderers shouldn't be allowed free in society. I don't know what weird ideology you have that believes otherwise.

Actually, Niemöller's poem never talked about murderers, but merely about Socialists, Trade Unionists and Jews. Well, some variants listed communists, incurable patients, Jehova's witnesses, civilians of occupied countries, but none listed murderers.

Re:Real vs. Imaginary Threats...

[Hognoxious]

got kicked out of the university in my first year for playing too much Magic: The Gathering [...] Everyone in college behaved like adults.

Everyone?

Re:Real vs. Imaginary Threats...

[__aaclcg7560]

Published in three volumes!

#1 I am Not a Troll
l #2 I am a Troll
#3 My Life as a Liar

Not quite. One essay will be about my software testing internship in 1997 at Fujitsu's WorldsAway virtual world. Several essays on being a video game tester and lead video game tester at Acclode/Infogrames/Atari (same, different owner, multiple personality disorders). A longer essay on testing the Sony Reader in 2005. Of course, an essay on the Great Recession when I was out of work for two years (2009-10), unemployed for six months (working 20 hours per month), and filing for Chapter Seven bankruptcy. And, for shakes and giggles, an essay on how I love to troll the trolls on Slashdot. ;)

What do Slashdot's readers think?

[psykocrime]

> What do Slashdot's readers think?

I think the FBI should fuck the hell off, along with the rest of the federal government. Their purpose isn't law enforcement, it's to violate our civil rights, instil fear, and keep the populace under the thumb of the elitists who run the government (for their own benefit).

Seriously, we need to disband the FBI, the DHS (as Ron Paul said, "we fought World War II without a DHS"), ATF, TSA (a bunch of dumb-fucks who couldn't hack it at McDonalds), DEA, NSA, and pretty much the rest of the federal agencies. We don't need some massive, sprawling, byzantine, corrupt bureaucracy... we just need self-government.

Re:What do Slashdot's readers think?

[bombastinator]

> What do Slashdot's readers think?

I think the FBI should fuck the hell off, along with the rest of the federal government. Their purpose isn't law enforcement, it's to violate our civil rights, instil fear, and keep the populace under the thumb of the elitists who run the government (for their own benefit).

Seriously, we need to disband the FBI, the DHS (as Ron Paul said, "we fought World War II without a DHS"), ATF, TSA (a bunch of dumb-fucks who couldn't hack it at McDonalds), DEA, NSA, and pretty much the rest of the federal agencies. We don't need some massive, sprawling, byzantine, corrupt bureaucracy... we just need self-government.

I think you're a trumper, and like most trumpers your understanding of how the government works and what the various agencies actually do is both limited and damaged by extremist propaganda.

see my post about historical precedent for further opinion.

Re:What do Slashdot's readers think?

[Actually, I do RTFA]

DHS (as Ron Paul said, "we fought World War II without a DHS")

During WWII, the US government (a) interred Japanese-Americans (b) rationed all manner of goods (c) had official propaganda departments aimed at US citizens and an official Office of Censorship (d) Diverted 40%+ of the economy to the military, etc. etc. etc. Whether an agency called the DHS existed, certainly far more reaching government intervention occurred. (Plus the military did homeland security; you know, at war and all).

Re:Real vs. Imaginary Threats...

[__aaclcg7560]

Everyone?

If you're making a reference to playing card games in the wee hours, I got off work at midnight from a restaurant job and it took several hours to unwind. My college roommates and I didn't have classes until noon. These days I can't stay up late because I get up at 4:30AM to start work at 7:00AM in government IT.

Re:So what did he think would happen?

[phantomfive]

Nice reading the indictment document. I'm impressed.

Re: Real vs. Imaginary Threats...

[__aaclcg7560]

You forgot to include the chapters on
350#, 1500 calories a day
Laid off two years
Gov't it job

No plans to write about my weight in the near future. Being laid off for two years will in the essay about the Great Recession. My current job is off limits until such time I'm no longer working there and a few years have passed.

They are all self published books by the way.

Self-published ebooks that make me money. Surprisingly, my original essays sell better than my previously published short stories in anthologies and magazines.

Re: Should the FBI have arrested 'The Hacker Who..

[jon3k]

I'd be willing to bet more shoes are used in crimes than weapons :)

Re:So what did he think would happen?

[jon3k]

How do so many people not understand the concept of intent.

I don't see that as conspiring

[rsilvergun]

Net Seal is just software. It's not even a little illegal. It's license management software, like uPlay, Steam & Origin. He sold software to somebody who then committed a crime. We're right back where we started. It's the same as trying to sue a Gun manufacturer for selling handguns. Probably less so. With the gun manufacturer you could argue they weren't following all the laws/rules about selling guns (there are lots, and some folks tow the line pretty close on them). With software there's nothing to say I can't sell to whoever's buying. They'd have to prove not that I was selling to the keylogger guy but that I was trying to aid him in keylogging.

This all smacks of Law enforcement cracking down on a powerless guy because they can. It's infuriating because it gives good cops a bad name and puts the public at odds with law enforcement.

A slightly too secure tool?

[b4_the_looking_glass]

Could it be that the tool is too secure? Is it better to attack on the face of the tools negative attributes, rather than say they are trying to discourage the, possibly powerful, positive attribute(s)? Someone asked, "Why aren't the legal users of the tool using some other VPN tool?". I think the question was asked to support the idea that those users were only using the software with negative intentions. Just a silly way to look at the whole thing and I apologize for it. But I can't deny the simple logic, that individual security is a governing insecurity. When we speak of security, in a political way, it means that the government isn't prevented from governing. So eventually, providing a tool that prevents awareness of activity is very similar to hacking. You are hacking the governments security.

Re:A slightly too secure tool?

[b4_the_looking_glass]

Additionally, I've noticed this being compared to the firearms debate. The idea of "only useful to kill" has come up. In that comparison I would say that the government no longer considers the firearm, you and I can get, as a threat to its capacity to govern. But at some point in history it had been established that we should have guns to protect us from our own government. I think it is pretty obvious that you and I having weapons that can protect us from our own government is a thing of the past. If you did manage to get your hands on something, you would legally be a criminal. If not immediately, as soon as the possession became a known governing insecurity. It wasn't that long ago that the "red scare" had persons persecuted as a result of their voiced personal opinions. Opinions are not firearms or remote network tools. But it could be we are looking at something very similar anyway.

This is the Swartz case all over again

[Applehu Akbar]

“It’s a dual-use technology case,” says Grimmelman. “And you typically don’t get criminal liability in dual-use technology cases unless there’s a pretty clear intent to promote the criminal use instead of the legitimate ones.”

The gummint is fully aware that it can't prove criminal intent, but it has the deep bench of lawyers while Huddleston has whatever late-night TV lawyer he can afford. .

Kettle vs pot

[easyTree]

But it also says security experts who examined the software are "inherently skeptical" of Huddleston's claim that the software was intended for legal use, since that's "a common claim amongst RAT authors."

Welcome to the rest of the world's view of the justification for the existence of your internal arms industry.

Holy fuck, the indictment is bullshit

[bongey]

The entire indictment centers around one of his users that licensed his software put it into a keylogger. Can Microsoft be charged if I uses msvc with msvc runtime dll?

It is outright insane.

Re:Holy fuck, the indictment is bullshit

[bongey]

Correction. Can Microsoft be charged if msvc is used to make malicious?That is basically what they are doing. Nope that is right, the kid doesn't have billions for a lawyer fees.

There is historical precedent here

[bombastinator]

this situation reminds me very much of that man who published a book on how to cook methamphetamine at home. the book sold so well he became a multi millionaire though he made no meth. Of course using his book, hundreds of thousands died from addiction and explosions.

was his an action of unmitigated evil for personal gain which ruined countless lives? YES

Was it technically illegal when he did it? NO

Is it reasonable to assume that anything not deemed actually specifically illegal should be accepted by society no matter how damaging it is? That appears to be the question. IMHO the answer is a resounding NO, but i am one man.

Re:What are they charging him with?

[gravewax]

since when did free speech cover knowingly aiding and abetting a crime?

Re:How about the creators of Tor

[bombastinator]

we already that. IF a car model has a design feature that kills the passengers such as defective seatbelts or whatnot, that is what happens. Your implication is that the use of this system as a hacking tool was accidental, and also not a case of criminal negligence.

What is more important? Intent or effect? How much if any care was taken to prevent misuse of the application in the way it was misused?

In the 80's Regan and thatcher closed the national mental health hospitals nation wide in their countries in what was called in Brittan "throw the nutter in the gutter" program. In the US of the 300,000 some patients over 150000 were dead within the year. Additionally there was a giant rash of "arsons" resulting from said patients attempting to move into unfinished building sites and starting fires to stay warm. The net economic cost was in the billions.

Was this murder? Was it criminal negligence? Was it merely "a timely cost savings" as the administration called it?

Intent and effect. Your argument is quite similar to the NRA slogan " guns dont kill people, people kill people" My favorite response to this comes from Australian comedian Jim Jefferies. feel free to google " jim jefferies gun control" for the video He's pretty funny.

Bullshit

[s.petry]

The reason is that Law can not be arbitrary. Baseball bat manufacturers _KNOW_ that what they produce is used for crime. Hammer manufacturers _KNOW_ that tools they produce are used for crime. Knife manufacturers _KNOW_ that the instruments they produced are used for crime.

Singling out one of those manufacturers because criminals think they are cooler than the other manufacturers is an arbitrary act and has no basis in law.

Try really really hard to use logic and reason instead of the run of the mill bullshit appeal to emotion.

Re:Bullshit

[gravewax]

It isn't arbitrary. If you make baseball bats, advertise them as being perfect to rob convenience stores and then market and sell them to criminals who you know intend to use them for that purpose you will find yourself in the exact some situation as this arsehole.

nirsoft_net

[Trax3001BBS]

www.nirsoft.net have produced and given out a lot of useful software and many have found their way into hacking tools. I'd hate to see it stopped.

Re:Trafficking in circumvention measures is illega

[jabuzz]

How come the two Steve's (aka Jobs and Woz) where never arrested then? They sold devices with the express intention of breaking the law. Or does the fact they used the money to start Apple give them a free pass?

Re:This reminds me of erectile dysfunction ads

[david_thornley]

I've been told that, during Prohibition, some folks sold sets of pipes and other apparatus. The sets came with warnings: Do not do these things (described in detail), for then you would have created an alcoholic beverage and broken the law.

Re:Trafficking in circumvention measures is illega

[Pseudonym]

I don't know, but lots of likely reasons:

The laws around phreaking tools may have been inadequate at the time.

They were not caught before the statute of limitations expired.

There may never have been evidence of a specific crime.

Other countries do have police statistics

[jopsen]

I would assume gun uses are recorded. But I guess maybe not in the "wild west".

Note. In other countries where guns aren't pervasive the mere act of drawing your gun, signaling that you have one, or flashing it, is consider use for force and must be reported (like any other act of violence).
As an interesting statistics from Danish police 2015:
Use of gun: 148 instances (a police officer drawing or signaling that he has a gun)
Number of shots: 11 (of which 8 were warning shots)

That's from ~10k police officers protecting a population of 5m people.

Granted that's stats from police; but it's hard to argue that civilians are likely to need a gun more often than the police.
Note: Yes, US murder rate is 10x, police killing rate is 100x (at least), so US has more violence, but if guns aren't pervasive you rarely need them.