Slashdot Mirror
Police Drop Charges Filed Against 19-Year-Old Archivist For Downloading FOIA Releases (techdirt.com)
An anonymous reader quotes a report form Techdirt: Last month, [...] an unnamed 19-year-old was facing criminal charges for downloading publicly-available documents from a government Freedom of Information portal. The teen had written a script to fetch all available documents from the Nova Scotia's government FOI site -- a script that did nothing more than increment digits at the end of the URL to find everything that had been uploaded by the government. The government screwed up. It uploaded documents to the publicly-accessible server that hadn't been redacted yet. It was a very small percentage of the total haul -- 250 of the 7,000 docs obtained -- but the government made a very big deal out of it after discovering they had been accessed.
Fortunately, Nova Scotia law enforcement has decided there's nothing to pursue in this case: "In an email to CBC News, Halifax police Supt. Jim Perrin did not mention what kind of information police were given from the province, but he said it was a 'high-profile case that potentially impacted many Nova Scotians.' 'As the investigation evolved, we have determined that the 19-year-old who was arrested on April 11 did not have intent to commit a criminal offense by accessing the information,' Perrin said in the email."
Fortunately, Nova Scotia law enforcement has decided there's nothing to pursue in this case: "In an email to CBC News, Halifax police Supt. Jim Perrin did not mention what kind of information police were given from the province, but he said it was a 'high-profile case that potentially impacted many Nova Scotians.' 'As the investigation evolved, we have determined that the 19-year-old who was arrested on April 11 did not have intent to commit a criminal offense by accessing the information,' Perrin said in the email."
His hard drives contain sensitive info that may preclude him from ever getting them back.
Hopefully his other family members get their computers back.
Welcome to Oceania, where the citizens are minusfriends.
PROTIP: Every time they redacted something, it is precisely because you would not like what stood there. Which usually means it is harming you.
Who the hell cares about his intent? He downloaded information mistakenly posted to a publicly available system. Unless he's trying to sell state secrets to the Russians, which still doesn't criminalize the act of downloading the stuff, there's absolutely nothing he's done wrong. To say otherwise is to say you can criminalize viewing information that the government posts on billboards by the highway if the government mistakenly puts up the wrong information on the billboards.
Maybe in China.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
It was the prosecutor and not police that brought and dropped charges.
If it's on a public facing server it's "fair game", whether it's supposed to be or not.
:-), but not for a second time. (And can you imagine -- the police arresting you just for accessing a public website?)
..." law?
And "did not have intent to commit a criminal offense" -- maybe this is just in the US, but I thought that "ignorance is no excuse for breaking the law." If he broke a law, let's have him and the law he broke. If not, let him go -- and then let's update all the knowledge of the people who thought he did so this doesn't happen again. (Tech AND Legal.)
I don't necessarily mind misteaks
Sounds like he broke the law: "I don't like what you're doing." Where is that one written down anywhere? Or is this the "Nice place you've got here, shame if something
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
And then that Woman happened to him!
so traffic tickets is a committing a crime and they can use that to get you for just having them? Good thing we have the NRA to stop any BS like with guns. So bad we don't have the same power for tech stuff.
People that can use computers gets punished for the mistakes made by people that can't use computers...
Reality is just like working in IT.
"Good thing" and "NRA" in the same sentence seems a little suspect.
The legal profession adopted a saying which goes all the way back to ancient Greece [circa 4th Century BC]:-
"The wheels of justice turn slowly, but they grind exceedingly fine..."
Meaning that although changes to the law and the framework of justice might take a while to be developed, once done, the result tends to be pretty comprehensive. Of course, this means that there is a dynamic tension between "Justice" (which moves slowly) and anything which is dynamic and develops quickly.
What is perhaps most interesting [and most troubling] about this story is the fact that, once again, we see a failure of the incumbent justice system to acknowledge that it has a weak spot when it comes to potential or actual technology-based crime.
In this specific case, the linked article merely says that the Police Department received information which has prompted them to drop the case. What they don't say is that they will even consider a review of the way that they make determinations concerning this type of computer crime. And there's the rub. It's a little unfair to be too critical of Nova Scotia Police in this instance - all the evidence before them is that this is an isolated incident [although the article cites 11 different IP addresses had come across and exploited the same vulnerability that the un-named 19-year-old was facing potential charges for. So this one case has died a natural death and everyone returns to their default setting, but no corrections have been made to the way that law enforcement interpret this type of event.
Within the legal profession there may be the mistaken view that "technology merely allows us to automate things we used to do by hand, to alleviate the effort required" and thus that whatever laws would have been applied to the manual equivalent of a technology-enabled process can be re-applied to an automated one.
Unfortunately, this simply isn't true. Even before work on "Artifical Intelligence" started, we had plenty of evidence to show us that techniques such as BDA (Big Data Analytics) could achieve things that no human ever could.
It won't be popular with Justice Departments, but in most if not all cases these organisations need to have a complete rethink about the way that the law intersects with technology. This doesn't mean that justice's slow-moving wheels need to turn faster, but it does mean that they need to develop ways of coping with things that do.
Intent is an important part of many laws.
This. Not only intent, but also discretion. As a practical matter, we've known for centuries that democracies overcriminalize because it is in the interests of legislators to never be blamed for letting a bad person out of jail. Thus the justice system depends on the discretion of police officers not to punish every innocent mistake and the discretion of prosecutors not to prosecute when it's too counterproductive or unfair. This doesn't always work, of course, but it's a huge part of criminal justice.
Intent is also critical. Most crimes have a "mens rea" and an "actus rea," basically the criminal intent and the criminal act. So if I take your laptop knowing it's yours, that's theft, but if I mistake your laptop for mine, my mistake of fact (i.e. I thought it was my laptop) negates the criminal intent part of the crime, so I haven't committed theft. (YMMV in practice, since a police officer or a prosecutor or a jury has to believe me.)
Of course, intent in law frequently means intent to do the thing, rather than intent to do the thing with an evil motive. So talking about classified documents may be a crime even if the government accidentally mails them to you or they are published in the Times, but no reasonable prosecutor is likely to go after you for that unless something else pretty bad is going on. That's where discretion comes in.
(And yes, obviously there are first amendment limitations that could come up, which would be balanced by a court against national security interests.)
Real lawyers write in C++
> did not have intent to commit a criminal offense by accessing the information,
When the computer hacking laws were introduced, that was one of the drawbacks: Intent does not matter, for the law. So in this case, it is just the law enforcement being nice in not pursuing the case while they are convinced there was no intent.
But according to the letter of the law, intent does not matter!
Putting an address in the address bar of a browser is not a crime?
Call me shocked.
maybe this is just in the US, but I thought that "ignorance is no excuse for breaking the law."
It depends on precisely what you are ignorant of. "ignorance of the law is no excuse" is usually how it's phrased, IIRC, which strikes closer to the truth because it's about being ignorant of *the law*, not ignorant of *the facts*.
Generally in criminal law (at least in the US), a mistake of law ("I did not think it was illegal to do X") will not excuse a crime, but a mistake of fact ("I did not think I was doing X") can sometimes negate a required element of the crime. So if you take a pen knowing it belongs to someone else you are committing a crime (albeit a small one), but if you take a pen because you confused it with your pen you are generally innocent (unless nobody believes you because you have a habit of stealing pens). It depends on what the specific elements of the crime are, which vary a bit from state to state.
Real lawyers write in C++
Whether you choose to accept it or not, the NRA represents a significant block of grassroots voters. It is entirely funded by its members and represents a large voting block.
Good-bye
The Canadian authorities apparently think they are the Stasi.
Once it was on a public server, without any posted or recognizable warnings, the kid has a pretty solid defense of innocence. If there is some real security breach involved, then they should inform him politely and perhaps firmly, and ask/demand their secret info back (if it still matters).
We all have something to hide from the state, to wit every single activity you perform because it can piss them off arbitrarily.
It is entirely funded by its members
Not according to this article. More than half of its money comes from the gun industry. And then there are all those foreign contributions, including Russian sources.
Second class citizen of the New Gilded Age
There is still a little bit of hope for Canada. I am happy.
lolwut? Amazing. Every word of what you just said... is wrong.
Funding - half of a large number is still a large number (assuming the above statement could be correct).
Gun Manufactures can not constitute a signifigant portion of NRA voting membership, regardless of how much funding they provide.
Well at least yours is.
Why is noone interested in why the non-redacted data was there publicly available in the first place? It seems a far more relevant topic to me than whether or not someone accessing it is in the right or wrond. If anyone should be sanctioned, it should be those people or the agency which publicized the private data to begin with.
The NRA is a grass-roots organization, who draws its power DIRECTLY from the citizens that are its constituents. MILLIONS of citizens support the NRA directly.
Good-bye
Dilbert. http://dilbert.com/strip/2018-05-09
Tags
#hackers, #hacking, #api, #jargon, #obliviousness, #language
View Transcript
Transcript
Narrator: Dogbert The Reporter. Dogbert: How did hackers get access to your customer data? CEO: I'm told they used something called "our A.P.I." to suck out all the data. Dogbert: I'll just say you'er stupid. CEO: Why does everyone always say that?
What rights violations has the NRA ever stopped or prevented? None. Do you think the government is afraid of your guns??
So Activists are the bad guys now, and hackers and running hackatons in big corps...way to flip the meaning of words.
You are the dumbest cop on the force George, the dumbest...
Contrary to OP's post, was not "mistakenly posted to a publicly available system (in the sense OP intends it)," it was instead, insofar as this is relevant, posted to a server with atrociously ineffective "security."
That is a distinction without a difference. To riff on Arthur C Clarke's famous maxim, sufficiently bad security is indistinguishable from no security. The "security" in this case was so bad as to be effectively non-existent. I don't know exactly where you draw the line as a general proposition but it's pretty clear in this case that any claim that this was "secured" data utterly absurd.
Whether you choose to accept it or not, the NRA represents a significant block of grassroots voters.
The NRA represents gun industry interests under the guise of pretending to be a grassroots interest organization. This didn't used to be true but it is unquestionably true today. While it is true that there is a large block of voters who are members and who care strongly about 2nd amendment rights, the NRA is only indirectly represents their voice on the issue at this point. The organization has been co-opted by corporations to advocate primarily for them. Whether you think this is a good or bad thing I leave up to you but don't be mislead into misunderstanding where the money in the NRA comes from or what strings are attached.
It is entirely funded by its members and represents a large voting block.
The NRA is decidedly NOT "entirely funded by its members". Significantly less than half of the NRA's money comes from program fees and membership dues. This is not conjecture - it is a known fact. Most of the NRA revenue comes from corporations with financial interests in selling firearms and related products. The NRA is de-facto the lobbying organization for the gun industry. It hasn't been a grassroots organization for several decades though it pretends to be one as there is political value in maintaining that fig leaf of a lie. Sort of like the NCAA pretending to care about "amateurism" and "student athletes" while they rake in literally billions in revenue for the colleges.
Intent is an important part of many laws. For example, it is entirely legal to carry lock-picking tools,
this assertion is dead wrong. all the state needs is evidence from which they can reasonably infer intent. I cite a US definition below, but I'm certain similar definitions are in place in every jurisdiction. decades ago In my southern Az town, if the cops caught you with a screwdriver and a can of freon, that was presumptive evidence you intended to break somebody's Kryptonite U-lock and steal her bicycle, and was enough to get you charged with theft along side whatever other crime they had already detained you for (in this client's case, failure to yield right of way to a pedestrian).
The NRA is a shill organization for the firearms industry, and its power is in creating a raucous outcry of fear and terror to drive gun sales. Millions of citizens are cozened into supporting the NRA, to the point where they allow a known criminal who acted unlawfully to harm American citizens to be selected as the leader of it.
It's like the grass on a golf course, fed a diet of shit, and crushed by rich guys playing around.
As sufficiently bad sex is ndistinguishable from no sex?
You'll have to speak from your own experience... ;-) (joking)
You can see no difference between mistakenly posting to a deliberately non-secured service and purposely posting to a service with inffective security? You also missed the "insofar as this is relevant" ...
There is no difference because someone can access it without any indication that it is "secured". One could bypass the security without even realizing it was intended to be secure or that any laws were being violated.
You also missed the "insofar as this is relevant" ...
I didn't miss it and I actually thought your post was rather good. I just disagree that there is any basis (legal or technical) to say this data was "secured". They may as well have posted the data on a billboard and then tried to arrest anyone who read it.
Funding - half of a large number is still a large number (assuming the above statement could be correct).
Gun Manufactures can not constitute a signifigant portion of NRA voting membership, regardless of how much funding they provide.
but it is actually less than half from the individual members. And as a voting block, the NRA is nothing compared to the AARP! That said, the NRA can create a message that it provides to its membership but originates in a manufacturer or foreign donor, and drive its voting block towards specific politicians.
As a result of their actions in the past, Pres George H. W. Bush canceled his lifetime membership in rebuke of the NRA stances. https://www.snopes.com/fact-check/bush-nra-resignation/
https://www.google.com/search?q=george+bush+cancels+nra+membership&rlz=1C1GGRV_enUS751US752&oq=George+Buch+cnacels+&aqs=chrome.1.69i57j0l4.9904j0j8&sourceid=chrome&ie=UTF-8
Reality is, their membership is not as big as they would like people to believe.
So first off, yeah, overall this is a good thing. I don't think the kid deserved to be charged at all and it was a case of grossly mishandling private information, what little there was. The FOIA content itself really ought to be public anyway.
But this is a real kick in the pants for the rule of law. It's "high profile", so the cops won't touch it? It means you really need to go to the press and get people angry about issues and get them to mail officials. Bitching and moaning and mob rule is the new rule. Old rule? Have we regressed to criminality being determined by popularity? On the other hand, a lot of tech laws are shit. So in that sense, the undermining of the rule of law is a good thing.
Just another shade in the eternal endless grey that is tech-legal.
The "fraudulently" could also be affected by intent.
Fraud is taking by deceptive, dishonest means. Therefore intent to deceive, intent to be dishonest, comes into play.
The Théroux case touches upon intent to deceive and fraud.
I think the government is terrified of my guns.
The hysteria of left wing hypocrites with their licensed, private, armed security forces trying to prevent the rest of us from being able to defend ourselves shows just how much they are afraid.
Remember when seconds count the police are only minutes away.
I think the 2014 Bundy Standoff showed that the government is very much afraid of its armed citizens. The government has nothing to fear from one armed individual. It's the other ~50 million that hold the government to account and help ensure we maintain a restrained, Constitutional republic. All the people scared of President Trump should be thankful all those armed people (including police officers and members of the US military) will never allow him to become a king, no matter how much he might like that. He's the President and has only the powers provided to the President by the US Constitution until someone else is lawfully elected to the office, he's lawfully removed from office, or he hits the term limits as set by the 22nd Amendment. He would not be allowed to become president for life. It's been that way since the formation of the United States. See also: Federalist 46:
Let a regular army, fully equal to the resources of the country, be formed; and let it be entirely at the devotion of the federal government; still it would not be going too far to say, that the State governments, with the people on their side, would be able to repel the danger. The highest number to which, according to the best computation, a standing army can be carried in any country, does not exceed one hundredth part of the whole number of souls; or one twenty-fifth part of the number able to bear arms. This proportion would not yield, in the United States, an army of more than twenty-five or thirty thousand men. To these would be opposed a militia amounting to near half a million of citizens with arms in their hands, officered by men chosen from among themselves, fighting for their common liberties, and united and conducted by governments possessing their affections and confidence. It may well be doubted, whether a militia thus circumstanced could ever be conquered by such a proportion of regular troops.
You're welcome.
-- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
Fraud is taking by deceptive, dishonest means. Therefore intent to deceive, intent to be dishonest, comes into play.
OK, point taken, it may have been fraudulent intent that the prosecution meant when they announced the case was being dropped for lack of intent. My concern about making out fraud was more basic, where is the deception intended or otherwise, but I don't know, what constitutes fraud in Canada may differ from what constitutes fraud in my jurisdiction.
Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
Again, I'm not sure anyone said it was secured, it was certainly not adequately secured.
If it wasn't secured data then there is no basis for arresting the individual accessing the data. If it was secured data it was so badly secured as to not be secured and we are back to there being no basis for law enforcement to get involved. If this data was supposed to remain private the people who posted it to the internet without any meaningful security are the ones who should be speaking to a judge and retaining counsel.
As I wrote in another post, a deliberate attempt to circumvent a security feature may go to the issue of "fraudlently" obtaining. Apart from that it is difficult to see what relavance the concept of "security" has to this offence.
And my point is that once the "security" reaches are certain level of incompetence (like it did here) it ceases to be security and there is no basis for accusing the accessing party of any fraudulent attempt at access. Just because there wasn't a direct link to it doesn't mean it wasn't publicly accessible information. The failure of the party posting the data to realize this fact is not and should not be anyone else's problem.
Not anyone poked beyond the specific URL they were given to look at other people's information, it was the accused took the effort to do so.
"Effort" is a bit of a stretch description. A minor tweak to the URL hardly something that qualifies as effort. I've done that exact thing myself now and then and I'm hardly a genius hacker.
No, anyone can read everything posted on a billboard, indeed it would take effort to avert one's eyes and read only the notice(s) specifically addressed to you.
It's an analogy meant to illustrate the intent of a point, not the point itself. If something can be accessed by URL it will be. Just because many people cannot be bothered is irrelevant.
I'd prefer simply to work with the facts of the case: it's like he was given a url, realised that by making trivial changes to it he could view other people's information and did so ... a lot like ;)
And there is nothing wrong with that. There has to be some measure of standard of care on the part of the people charged with keeping private data private. If I put private documents in a place where someone can access them with minimal effort I should not be surprised when someone goes ahead and does that.