Forgot your password?
typodupeerror
The Courts Government Security

US Wants UK Hacker To Pay To Fix Holes He Exposed 403

Posted by kdawson
from the on-second-thought-make-it-a-kryptonite dept.
bossanovalithium writes "Gary McKinnon, whose tribulations we have followed for several years now, is the UK hacker trying to escape extradition to the US. It appears he is expected to foot the bill for the US Government patching holes his breaching uncovered — to the tune of $700,000. It's not really the norm for someone to pay for exploits to be patched — damages fixed, yes, but this is a very different thing." The article paraphrases Eugene Spafford as saying that the victim of a cybercrime should not take the blame. "If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door." Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?
This discussion has been archived. No new comments can be posted.

US Wants UK Hacker To Pay To Fix Holes He Exposed

Comments Filter:
  • If he's a hacker... (Score:5, Interesting)

    by supersloshy (1273442) on Tuesday September 22, 2009 @12:53PM (#29506599)

    ...couldn't he fix them himself? With supervision, I mean.

    • Re: (Score:3, Funny)

      by Anonymous Coward

      dd if=/dev/zero of=/dev/hda

      Fixed! At least the holes aren't there anymore.

    • by Jurily (900488) <jurily@@@gmail...com> on Tuesday September 22, 2009 @01:27PM (#29507069)

      couldn't he fix them himself? With supervision, I mean.

      If I tell everyone that some houses have a big fucking gap where a door should be, am I responsible for not installing one?

      • You are if you made the owner look like a FOOL!! You're gonna fry.

      • by netruner (588721) on Tuesday September 22, 2009 @01:49PM (#29507347)
        Sure, if a sufficiently arrogant and ignorant attorney brings a case against you.....

        Don't underestimate the arrogance of an attorney, or the ability of people to be swayed by theatrics over substance.

        It's not about what's fair, it's about what one can get away with.
      • Re: (Score:3, Insightful)

        by nomadic (141991)
        If I tell everyone that some houses have a big fucking gap where a door should be, am I responsible for not installing one?

        Better analogy would be, that if you trespassed into someone's house, then got caught, should you be responsible for the amount they paid to have someone come in and check the place out and make sure you didn't damage anything? And the answer is...well, maybe.
    • by mcgrew (92797) * on Tuesday September 22, 2009 @01:51PM (#29507359) Homepage Journal

      "If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door." Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?

      More like being forced to buy a lock when he pointed out that there wasn't one to begin with. Whoever left the holes in the software should have to pay that 700k. If the Ubanti Motor Company* sells a car with defective brakes and the brakes fail and cause an accident, the Ubanti Motor Company will pay the damages, not some mechanic that demonstrated the brakes' fault in a different Ubanti Motors vehicle.

      *Fake name to keep fanboys from mismodding

    • Even assuming this was a sane ruling (its not like he modified the existing code to create the holes, just exploited them, why is it his responsibility to fix the software?), and that he actually discovered the holes himself (and didn't just use known exploits or figure out a password), he would have to be given access to the source code, which may not be open or belong to the people he "hacked". Without access to the source, I believe most holes are found by using fuzzing, which would not give the "hacker"

    • Re: (Score:3, Interesting)

      by b4upoo (166390)

      Seems to me that we ought to thank him for exposing the vulnerability and pay him for his discovery as well as any useful work he does to further increase security.

  • by NoYob (1630681) on Tuesday September 22, 2009 @12:54PM (#29506613)
    If I find a hole in my Government's IT security, I'll keep my mouth shut and let the government hear about it from the Chinese or the Iranians or the S. Koreans or ...anyone but me because they'll send me to jail and make me pay.
    • by rwade (131726) on Tuesday September 22, 2009 @12:58PM (#29506685)

      South Korea (the one with Seoul) probably would tell Washington about it, but it's unlikely that China or Iran would. It's more likely that they would exploit the vulnerability in secret.

      • Re: (Score:2, Funny)

        by sopssa (1498795) *

        South Korea (the one with Seoul)

        Americans really dont know the difference between North and South Korea without explaining it further?

        • by rwade (131726) on Tuesday September 22, 2009 @01:20PM (#29506991)

          The original poster tossed South Korea (which Washington considers to be one of its strongest military allies) with Iran ( which Washington considers part of the so-called "Axis of Evil") and China (which Washington considers one of its strongest rivals), it is unlikely that he knows the difference.

          • by ndege (12658)

            Mod parent up because NoYob (great grand parent) has no clue of the world's basic geography.

            North Korea, also known as the DPRK [wikipedia.org], was what Bushie called part of the axis of evil.

        • Re: (Score:3, Insightful)

          by eln (21727)
          I think he was just trying to be punny. If someone is dumb enough to not know the difference between North and South Korea, I doubt they'll know where Seoul is, or even that it exists.
        • Re: (Score:2, Funny)

          by scotsghost (1125495)

          Sadly, the modern American brain contains a short circuit that associates any mention of "Korea" with images of "puppet sex" [imdb.com]. Adding "South" to "Korea" doesn't overcome this effect. It's all Kim Jong Il territory to US. Amuhrrikuh, fuck yeah.

    • Re: (Score:2, Interesting)

      by gx5000 (863863)
      It's not my fault! It's yours ! No responsibility, no accountability... Whoever designed this should be sued and bring in the hacker as a witness... If I build something and you can get around it, I WILL be paying you to show me how you did it and PLEAD with you to help me out.... Trying to cover my ass for my stupidity, well, that requires an act of ignorance.
    • by Hadlock (143607)

      Chinese or the Iranians or the S. Koreans

      I was going to say "I hope you don't vote", but then I realized that you probably don't, so democracy is safe once again! (please don't start voting)

    • by bill_kress (99356) on Tuesday September 22, 2009 @03:07PM (#29508245)

      Very good point except you were probably thinking of N. Korea.

      I get really annoyed that people try to discourage hackers from their own country that might be somewhat loyal. I'd recommend encouraging and paying them.

      The analogy in the summary is flawed... It's more like suppose there are hundreds of people trying to break into your house every minute--Knocking at the door, twisting the knob, slamming against the door trying to gauge it's strength, ...

      Now one kids comes up and notices that you have an open basement window. None of the other attackers have noticed it yet.

      The kid climbs in, doesn't touch anything, looks through your old family pictures maybe, climbs back out--

      At this point he has a choice to make. Does he let you know that you screwed up, does he walk away, or does he try to sell the info to one of the guys hanging around on your front porch?

      What could you do to encourage this kid to make the correct decision?

      Out of all the people in the world, you are unlikely to stop them all by punishing them. You're only likely to influence the decisions of the few that are likely to want to help (and make them less likely). That's the only effect this crap has.

    • Re: (Score:3, Insightful)

      by hesaigo999ca (786966)

      Unfortunately this is exactly why trying to do something ice for someone is ridiculous, and that the last die hard movie, based on true story within the government about how lax the system is, and that when this was brought to the attention of certain individuals, they were sentenced for breach when they showed they broke easily into one organization's file system...I tend to agree that it seems the government is not making any friends, and setting precedent that even people within the US who would want to

  • Potholes (Score:5, Insightful)

    by Whorhay (1319089) on Tuesday September 22, 2009 @12:55PM (#29506637)
    I wouldn't report any kind of crime or safety hazard if this becomes a regular tactic.
    • Re:Potholes (Score:5, Insightful)

      by kylemonger (686302) on Tuesday September 22, 2009 @01:01PM (#29506723)

      The good guys will make you pay them for exposing holes.
      The bad guys will pay you.
      Hmmm, maybe I got the "bad guys" and "good guys" mixed up there.

    • Re: (Score:3, Insightful)

      by DragonWriter (970822)

      I wouldn't report any kind of crime or safety hazard if this becomes a regular tactic.

      McKinnon didn't "report any kind of crime or safety hazard", and there is no reason to expect that, even if the approach the government used to here to assess damages from a violation of the law were to be accepted in that role that it would somehow affect people who "report any kind of crime or safety hazard".

    • Re: (Score:2, Funny)

      I wouldn't report any kind of crime or safety hazard if this becomes a regular tactic.

      Good. Perhaps this will teach people that just because you found some security holes, all is not forgiven for breaking into government computer systems without the authority to do so. The government already pays people to find security holes. They don't pay you. Perhaps this will teach some people that if you don't want to pay the fines for breaking the law, then don't break the law!

      Also, you can say, "But this guy is obviously crazy. He's trying to find stuff about aliens." So, basically, as long

      • Re: (Score:3, Insightful)

        by Chris Burke (6130)

        Perhaps this will teach some people that if you don't want to pay the fines for breaking the law, then don't break the law!

        Well it's teaching me that if you break the law, you'll have to pay fines for things you didn't do.

        That doesn't really encourage respect for the law, you know.

        He didn't create the vulnerabilities, he exploited him. Punish him for the illegal computer trespass, but fix your own damn security holes, because those were your fault.

  • by rwade (131726) on Tuesday September 22, 2009 @12:56PM (#29506639)

    This is exactly like charging for a lock that was never there. Another analogy -- it is like forcing the thief to pay for the security system that the store owner now feels that he has to buy to prevent future actions.

    If he damaged a system by hacking in, that's one thing. He should pay for that. But it's hardly his fault that the holes were there in the first place and he shouldn't be held responsible for funding the software improvements to prevent such actions in the future.

    • by sumdumass (711423) on Tuesday September 22, 2009 @01:31PM (#29507127) Journal

      This is not entirely unheard of.

      I had someone repeatedly break into my garage and take my gas cans for the lawnmowers and root through the cars for money. Eventually, they took an expensive looking but stock car radio. The time that happened, my then girlfriend walked into the garage to go to work and startled the intruder. He knocked her down and ran but wasn't afraid to come back.

      I eventually placed some hidden cameras in the garage and back yard with a dummy camera on the side of the house in plain sight. It took the guy about 5 days to realize the visible camera was a dummy and I got his picture including him rooting through everything and taking crap. I then placed a piece of a set of antique lamps made of sterling silver in the garage but locked them in a cabinet with a window. Anyways, those lamps were valuable enough to make his repeated breaking in worthy of a felony on the crap I could prove he stole alone.

      The prosecutor advocated that the guy pay for the security system and cameras that I had to install because of his actions. The judge agreed and order it as part of his restitution. Of course he couldn't pay while sitting in jail, but as a term of his parole, he had to make payments to an account until the costs were paid off. As I understood it, I could have sued him for the costs but doing it this way made it a condition of his freedom which meant I was more likely to get paid.

      • Re: (Score:3, Insightful)

        by Altus (1034)

        that would be paying for the materials necessary to catch the theif. Costs incurred while investigating someone breaking into your house.

        This situation is more akin to you catching him and then the judge ordering him to pay for a new steel reinforced garage door with a retinal scanner for access.

        If they were trying to get the hacker to pay for the expense of having caught him I might buy that. If, say, they spent a bunch of money on a new server and network setup to act as a honey pot to catch the hacker

      • by Monkeedude1212 (1560403) on Tuesday September 22, 2009 @02:23PM (#29507719) Journal

        It's an interesting story - but the one thing that sets it aside is that the cameras were fundamental in the charging him for his crime, possibly even the capture.

        In the full article, it doesn't say what the 700,000 dollars are for. Its a little sketchy on what can be claimed as the "Damage Caused" and whether or not the money is for the systems (and security checks) to be implemented after his breach.

        Whereas you had to set up a Camera to catch the criminal, the US Government caught their criminal and now want to put up the camera. Two different scenarios, which can appear to be so similar that distinguishing who should pay what gets a little fuzzy.

        Peter Sommer (the expert refered to in the article), is basically saying that the security should have already have been implemented. In your case, you can argue that you shouldn't require cameras to be set up in your garage as a basic security measure. Closing and locking doors and windows should be enough.

        Basically the Government did not have a firewall or any security systems in place at all to stop someone from Remoting in. Thats like leaving your door open, and expecting someone not to enter without permission. Someone walks inside, does that constitute as breaking and entering?

        The "Hacker" used a popular program used for technical support to log into a computer. My ISP can't even do that, and all because I have 60 dollars Linksys router at home (not even a firewall), which BY DEFAULT blocks any incoming traffic on those ports.

        That is like placing a lock on your door, which is pretty standard. Which the government didn't do, and is now trying to claim almost 3 quarters of a million dollars for.

  • Faulty locks (Score:5, Insightful)

    by Adrian Lopez (2615) on Tuesday September 22, 2009 @12:58PM (#29506677) Homepage

    Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?

    Rather like the lock company demanding he reimburse them the cost of redesigning their badly designed locks?

    • Re:Faulty locks (Score:4, Insightful)

      by sonnejw0 (1114901) on Tuesday September 22, 2009 @01:05PM (#29506775)
      This is security through obscurity, and it's frightening that a government entity relies upon it enough to fine someone for publicly declaring a security flaw. Should Microsoft, Apple, or the Linux Foundation pay a fine every time they patch a security bug, thereby describing how to utilize that bug in all unpatched systems?

      I think not, I think that's ridiculous. But that quickly brings us to the argument that all software that we rely on should be open source so that we can modify it to fix it ourselves ... or the corollary, that all software we rely on should be closed source so it's difficult to find bugs (which is kind of an untrue assumption. I'd rather be in control of how I keep private what I'm trying to keep private. If I don't have control over the means of privacy, I have no privacy at all ... I guess I should go delete my FB account).
    • Faulty Lock Users (Score:4, Insightful)

      by eldavojohn (898314) * <eldavojohn AT gmail DOT com> on Tuesday September 22, 2009 @01:21PM (#29506997) Journal

      Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?

      Rather like the lock company demanding he reimburse them the cost of redesigning their badly designed locks?

      From what I can find of his "hacking" abilities on the black vault [theblackvault.com]:

      Somewhat frustrated by the common avenues of UFO research, Gary began some basic computer hacking techniques from his girlfriend's Aunt's house in the mid-late 1990s. Soon he began using a system of scanning for blank administrator passwords on supposedly secure networks ...

      Sounds more like the lock company distributed a working lock to many U.S. government entities and they put the locks on their sensitive possessions but some individuals simply forgot to close the clasp and had no policy for walking around double checking locks. If he did do $700k of damage and bring the system to a halt, he should pay for it. If they are charging him $700k for a script that scans for blank passwords on accounts on their systems and drop it in a chron job, I'll gladly fulfill the work order for half that price!

    • by mpe (36238)
      Rather like the lock company demanding he reimburse them the cost of redesigning their badly designed locks?

      With or without proof that a) they actually changed the lock and b) whatever changes they made were relevent to the defect in question. If they discovered something else wrong in the process or made some unrelated changes isn't that their problem.
  • by spydabyte (1032538) on Tuesday September 22, 2009 @12:58PM (#29506681)
    It's paying for the research, development, and possibly deployment of a new and improved lock.

    Analogies should be correct to be effective. Sadly, the most effective ones are often incorrect.
    • Doesn't matter how good the lock is if they don't use it properly. You might have the best keypad entry system in the world, but if the entry code is 12345 then who's fault is it when someone gets in?
    • If I pick or break a lock I should be responsible not only for replacing the lock but also for all of the research and development that goes into a newer, less breakable lock?
    • Car analogy... (Score:4, Insightful)

      by mangu (126918) on Tuesday September 22, 2009 @01:34PM (#29507151)

      It's paying for the research, development, and possibly deployment of a new and improved lock.

      Similarly, Ralph Nader [wikipedia.org] should pay for the research, development, and deployment of a new and improved Chevrolet Corvair?

  • Analogy, sans car (Score:4, Insightful)

    by Bobfrankly1 (1043848) on Tuesday September 22, 2009 @01:02PM (#29506729)
    I like the lock analogy, but I think it would be more appropriate to say that they are charging him for discovering that the bolts that hold the locked door shut were missing. He simply pointed it out...
  • Isn't it... (Score:2, Interesting)

    "Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?"

    No, it's more like making him pay for new locks because he wrote a lockpicking book. The flaws existed, and he exposed them, but it's not his fault that people might use them to perpetrate crimes. If someone tells me how to crack a safe, I'd generally blame the safe's maker for designing that fault... not the person who realized the problem. Eh?

  • The real crime is exposing sensitive data through the internet. If a hacker shows his concern and makes it clear that the government is exposing sensitive data, the criminal is the government, not the hacker.

    The funny thing is that the real crimes are often not legally the real crimes. In the Netherlands, it is not a crime to have a system full of sensitive data that is hardly secured. But it IS a crime for anyone to expose this insecurity. The Dutch government has created a special "theft of processor time

  • Me thinks (Score:3, Insightful)

    by arizwebfoot (1228544) * on Tuesday September 22, 2009 @01:08PM (#29506821)

    "Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?"

    More like they want him to pay for a lock that wasn't there because he was the first one to tell them that the lock wasn't there.

    Or even more obvious, somebody forgot to put in a front door and now the store wants him to pay for a new door because he was the first one to tell the store that they had no door.

  • Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?

    No, not really; I think it's a little more complex than that. As far as I can tell, to use your analogy, McKinnon basically rattled the locks on the door, and found that they were unlocked. He then entered, rifled through the underwear drawers hoping to find something sexy (UFO data), and took some photos of what he found (copied files). He then left again leaving things mostly undistubed except for

  • He should counter-sue the US gov for putting an insufficiently protected system on the internet in the first place. Normally that wouldnt be sensible as the damage cant be proved, but in this case it can by the governments own reckoning: $700k.

  • by moz25 (262020) on Tuesday September 22, 2009 @01:17PM (#29506939) Homepage

    This is where dogmatic views and analogies really contrast with technological reality. Those security holes would have existed whether or not he abused them in some misguided and naive attempt at finding info about UFOs. This is clearly a very intelligent person whose skills are of immense value. He just wasn't mature enough to realize the consequences and he certainly wasn't paranoid enough to keep his mouth shut.

    It makes no sense whatsoever to lock him up with dumbasses whose greatest accomplishment in life is learning that beating their girlfriends is a bad thing or that guns and drugs don't mix well. What a sad waste of talent.

    No, instead, I say: let him pay that $700000, but let him do it in the form of consulting. And fire the idiots who made those security holes in the first place.

    • by Timmmm (636430) on Tuesday September 22, 2009 @02:34PM (#29507841)

      This is clearly a very intelligent person whose skills are of immense value.

      From Wikipedia: McKinnon claimed that he was able to get into the military's networks simply by using a Perl script that searched for blank passwords; in other words his report suggests that there were computers on these networks with the default passwords active.

      Note that this is never ever reported in news articles. It is always that he 'hacked into' the computers. I think most people would agree that trying blank passwords doesn't really count as hacking, and most people have probably done it at one point in their lives. It is completely ridiculous that he could be extradited over this.

  • by fahrbot-bot (874524) on Tuesday September 22, 2009 @01:17PM (#29506943)

    Isn't the McKinnon case more like charging him to buy the lock that had been missing when he walked in?

    I'm sorry, you must state your question in the form of an Automotive analogy...

  • To answer the question posed in the write-up with a question: aren't the door and the lock one system ? Wouldn't replacing the door usually also mean: replacing the lock ?

  • I remember years ago debating the value of a login banner. Granted, having a message that says "for authorized use only" won't *deter* anyone, it does make this sort of legal weaseling more of a moot point. Instead of proving that he was intentionally out to cause damage, or that he wasn't just mindlessly poking around, they just would have had to prove he wasn't an authorized user.

    By his lawyers defense, having any open port exposed to the internet on any machine absolves the perp of responsibility.

    "Your h

    • Agreed, it is like trespassing if they don't lock the door. Now do you think anyone would ever get charged on multiple offenses be in fear of extradition and have to pay many hundreds of thousands, possibly more than a million dollars for trespassing?

      There is a difference between breaking and entering and trespassing. Opening a gate doesn't constitute trespassing neither does lifting a latch. To charge someone on break and enter you need to have adequately protected the house. This generally means a locked
  • ... but I think I actually agree with the majority of the posters here. Glad I was sitting down!

    He should be held liable for his actions, and for the crimes he committed - that includes breaking into government computer systems and accessing classified information. But it does seem silly charging him with the costs incurred by the government when they worked on improving their security post-breach. Really, they should have done those "security checks" long before - and if the system had been competently adm

  • by bugs2squash (1132591) on Tuesday September 22, 2009 @01:34PM (#29507147)
    He should pay to re-train the entire government technical staff.
  • To have someone set some damn passwords? [guardian.co.uk] (10th Paragraph).
  • Q: If a burglar climbs through an open window that would cost the homeowner $700,000 to close, does he owe the homeowner $700,000?

    A: Of course not.

    How much would the US Government have had to spend to discover the security holes Mr. McKinnon exploited? While he shouldn't be paid that money, that theoretical number should count against any "damages" he caused.

    It's probable that most of the "damages" being pinned on the guy are inflated government-contractor consulting rates, which (in this taxpayer's opinio

  • There's a lot of misinformation in this thread being paraded as fact.

    The scope of available restitution is defined by statute. The only limitations on statutory restitution are imposed by state and federal constitutions.

    Contrary to some of the nonsense spouted here, in California (in re Jeremiah F.), a burglar may be ordered to pay for the cost of a burglar alarm in a (previously unalarmed) house that he burglarized and the Montana Supreme Court has authorized restitution for enhanced security (State v. Th

  • by the eric conspiracy (20178) on Tuesday September 22, 2009 @02:27PM (#29507763)

    From Wikipedia

    "The US authorities claim he deleted critical files from operating systems, which shut down the US Army's Military District of Washington network of 2,000 computers for 24 hours, as well as deleting US Navy Weapons logs, rendering a naval base's network of 300 computers inoperable after the September 11th terrorist attacks. They claim the cost of tracking and correcting the problems he caused was $700,000.[15]"

    So I don't see where the idea that the claim the $700,000 is merely to secure previously unsecured systems originates from.

    If you break into a networkof military computers, it seems reasonable that the owners of the computers would feel that a complete audit of the network to asses damages would be necessary.

    • Re: (Score:3, Insightful)

      by nomadic (141991)
      So I don't see where the idea that the claim the $700,000 is merely to secure previously unsecured systems originates from.

      The imagination of slashdotters, who can never escape that techies-vs-the-rest-of-the-world mentality.
  • by noidentity (188756) on Tuesday September 22, 2009 @07:58PM (#29510683)
    In other news, the emperor is demanding that the child who pointed out that he lacks clothes be the one to pay for them.

Lo! Men have become the tool of their tools. -- Henry David Thoreau

Working...