Slashdot Mirror
19-Year-Old Archivist Charged For Downloading Freedom-of-Information Releases (www.cbc.ca)
Ichijo writes: According to CBC News, a Canadian teen "has been charged with 'unauthorized use of a computer,' which carries a possible 10-year prison sentence, for downloading approximately 7,000 freedom-of-information releases. The provincial government says about 250 of those contain Nova Scotians' sensitive personal information."
"When he was around eight [...] his Grade 3 class adopted an animal at a shelter, receiving an electronic adoption certificate," reports CBC. "That lead to a discovery on the classroom computer. 'The website had a number at the end, and I was able to change the last digit of the number to a different number and was able to see a certificate for someone else's animal that they adopted,' he said. 'I thought that was interesting.' The teenager's current troubles arose because he used the same trick on Nova Scotia's freedom-of-information portal, downloading about 7,000 freedom-of-information requests." The teen is estimated to have around 30 terabytes of online data on his hard drives, which equates to "millions" of webpages. "He usually copies online forums such as 4chan and Reddit, where posts are either quickly erased or can become difficult to locate."
"When he was around eight [...] his Grade 3 class adopted an animal at a shelter, receiving an electronic adoption certificate," reports CBC. "That lead to a discovery on the classroom computer. 'The website had a number at the end, and I was able to change the last digit of the number to a different number and was able to see a certificate for someone else's animal that they adopted,' he said. 'I thought that was interesting.' The teenager's current troubles arose because he used the same trick on Nova Scotia's freedom-of-information portal, downloading about 7,000 freedom-of-information requests." The teen is estimated to have around 30 terabytes of online data on his hard drives, which equates to "millions" of webpages. "He usually copies online forums such as 4chan and Reddit, where posts are either quickly erased or can become difficult to locate."
...of criminal stupidity.
I'm from Luxembourg and my chamber of representatives used the same 'security system' (people can't possibly guess numbers) and was also breached, obviously, since this 'problem' is known since 1991 or so, when the worldwide web was invented.
Lets be clear, editing the address line is not hacking, not in any way, shape or form. A user name and password request and getting past that is. Editing your address line on your computer and the distant server allowing it, is a fault of that distant server. A request for access was made and it as legally given, the government is screwed and a penalty should be applied for false prosecution. Strictly their fuckup, they made that information publicly accesible without any restriction and they are fucking liars and fraudsters trying to pin their incompetance on someone else. It is not a crime to edit you address bar, it is strictly their fuck up that caused it. No user name, password request and your web site is public facing, that data is free to download, you just gave it away free from all encumbrances. No different to randomly running IP addresses to download what ever you want. No layer of security, no fucking crime, they are cunts blaming someone else for their incompetence and the victim should sue the crap out of them after this is over.
Chaos - everything, everywhere, everywhen
I am trying to understand what he did that was illegal?
He downloaded documents that the government posted on the internet, by simply "guessing" the URL, which incrementally increased from the URL that he was given by the government?
Yup, looks like a case of the government trying to offset blame to me!
Yeah, sure. Blame the kid. Don't talk about how you fucked up your security so bad that even a kid can bypass it. No, focus on how you were done wrong.
Seriously, if a small kid can bypass your security, you deserve to be 'hacked'. No mercy for incompetence!
It doesn't have to be like this. All we need to do is make sure we keep talking.
Items placed on an open server without a login are made available for public download. Whether you meant to offer them for public download isn't relevant - you did.
He went to the server and asked politely, "Can I take one of these?" The server said, "Sure, here it is", and then tossed it to him.
Prediction for end of Universe #42: Fencepost error in Quantum_bogosort.cpp
Except he did not walk in the door.
What he did is the equivalent of walking up to the public documents window (just dream that such a thing exists..) as saying 'could I please have the FOI request number 1' then saying 'could I please have the FOI request number 2'.... until he had 7000 of them.
The fault in that case, and quite obviously in this, would be in the person (or server) that GAVE HIM THE DOCUMENTS WITHOUT ANY ATTEMPT TO VERIFY THAT HE WAS AUTHORISED TO RECEIVE THEM.
Remember, he didnt falsify ANY information, he didnt impersonate anyone, he didnt do anything else but ask the server if it would kindly send him this document, which it did.
So, your position is that asking for a document is breaking the law? Oh dear.
As an Atlantic Canadian this makes me unbelievably sad.
They just traumatized a family because the government was incompetent. Is this truly where we're going?
They fucking interrogated his 13 year old sister?! I mean the documentation was fucking public; THIS IS HOW THEY CHOOSE TO HANDLE THEIR INCOMPENTENCY?
PM is outright saying he stole sensitive information; 15 officers raided the house.
Atlantic Canada is a pretty quiet place, and there's already enough sketchiness about how the general population feels about our police force; they're really not helping their case. I swear if they (Gov. & police force, RCMP I presume) don't get any repercussions for this I'll be legitimately scared of continuing to live in this country. This is beyond fucking ridiculous. I mean 10 fucking years in prison??
Yeah; I'm fucking angry, sorry.
I tend to rant.
...expect that people will find it. This is not hacking, this is shoddy practices by the people running the FOI site and they're blaming the public. Of course, it would require a modicum of technical understanding to not blame someone else.
---- The above post was generated by the Turing Institute. Maybe.
"He usually copies online forums such as 4chan and Reddit, where posts are either quickly erased or can become difficult to locate."
I thought that only porn hoarders existed, but this guy was hoarding 4chan's shitposts.
So I live in Nova Scotia; i.e. this is happening in my backyard. This is absolutely about the provincial government trying to cover its a**. The mistake was discovered internally when a government employee did basically the same thing and accidentally put in a wrong URL... and instead of getting a 404 got documents that shouldn't have been public-facing (including docs with personal info, SINs and the like). Rather than owning up to the mistake and dealing with the consequences, the provincial government kept it quiet for 7 weeks, and are now using this kid as a scapegoat ("EVIL HACKERS, CLUTCH YOUR PEARLS!!!!"). It's absolutely disgusting, and I hope the court of public opinion judges them (the gov) harshly.
Just because there isn't a hyperlink to the page with the document doesn't make the information private. If there wasn't security on the page/s in question they were public information regardless of what the government intended. The boy broke no laws. And no this is not like leaving your door unlocked and someone walking in to your house/car. It's more like I posted all of these documents on a public document pin board in the middle of the square but put a blank page over them so you couldn't read them without lifting the blank page. I would charge whoever designed the site (not the page coder but the person who decided not to invest in any security) with gross negligence.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
I'm confused... Shouldn't the freedom-of-information releases themselves be freely available to the general public?
In Soviet Washington the swamp drains you.
What I want to know is that did he use a script to (or curl feature) download 7,000 documents or did he just edit the URL 6,999 times?
And where is he storing 30TB of data? Yes that is actually affordable (say 4 drives about $250 each) but who spends that kind of pocket money for something so nearly unusable?
Try doing a grep -r for some string on a mounted USB drive holding 1TB of data and see how long it takes. So what good is that?
Maybe he scrolls through all those documents one by one. For what. Anybody know?
Just what could he use all this crap for. What is wrong with his brain that he wasn't just downloading porn like every other kid?
"Archivist"? A 19 year old.... archivist? What kind of bullshit made up term is...
The teen is estimated to have around 30 terabytes of online data on his hard drives
...Well alright then. I'm not even mad. Props to the archivist.