Forgot your password?
typodupeerror
Facebook Security The Courts United Kingdom

UK Student Jailed For Facebook Hack Despite 'Ethical Hacking' Defense 356

Posted by Soulskill
from the judge-didn't-buy-it dept.
Diamonddavej writes "The BBC reports that software development student Glenn Mangham, a 26-year-old from the UK, was jailed 17 February 2012 for eight months for computer misuse, after he discovered serious Facebook security vulnerabilities. Hacking from his bedroom, Mangham gained access to three of Facebook's servers and was able to download to an external hard drive the social network's 'invaluable' intellectual property (source code). Mangham's defense lawyer, Mr. Ventham, pointed out that Mangham is an 'ethical hacker' and runs a tax registered security company. The court heard Mangham previously breached Yahoo's security, compiled a vulnerability report and passed on to Yahoo. He was paid '$7000 for this achievement,' and claims he was merely trying to repeat the same routine with Facebook. But in passing sentence, Judge Alistair McCreath said despite the fact he did not intend to pass on the information gathered, his actions were not harmless and had 'real consequences and very serious potential consequences' for Facebook. The case's prosecutor, Mr. Patel, said Facebook spent '$200,000 (£126,400) dealing with Mangham's crime.'"
This discussion has been archived. No new comments can be posted.

UK Student Jailed For Facebook Hack Despite 'Ethical Hacking' Defense

Comments Filter:
  • Uhh (Score:5, Insightful)

    by The MAZZTer (911996) <megazzt@g m a il.com> on Saturday February 18, 2012 @04:33PM (#39087495) Homepage
    This guy had no business doing what he did. AFAIK you need a signed agreement with the company in question to perform penetration testing, otherwise it's illegal, no matter what your motivations are.
    • Re:Uhh (Score:5, Insightful)

      by Jah-Wren Ryel (80510) on Saturday February 18, 2012 @04:40PM (#39087557)

      This guy had no business doing what he did. AFAIK you need a signed agreement with the company in question to perform penetration testing, otherwise it's illegal, no matter what your motivations are.

      While that may be true, that doesn't appear to be the judge's rational for convicting the kid.

      It sure sounds like the judge is rationalizing the ostrich strategy when he says that the kid's actions had 'real consequences and very serious potential consequences' for Facebook. Those consequences existed not because of the kid's actions but because of facebook's security failings. Even if the kid had done nothing, those vulnerabilities would still be there and facebook (and more importantly facebook's users) would have faced just as much, if not more, risk than they did if the kid had done nothing.

      • Re: (Score:3, Insightful)

        by Anonymous Coward
        His actions did have consequences. I work for a large company with lots of publicly facing servers. If the guy had hacked into our servers, he may well have tripped an IDS or some other log analysis process, which would have alerted us to someone being somewhere they shouldn't be. Imagine how many man hours would be involved in identifying the intrusion.

        Now that's not to say that I don't disagree with the rest of your post: the holes obviously existed, and if a black hat had got in they'd have to respond
        • Re:Uhh (Score:4, Insightful)

          by AlienIntelligence (1184493) on Sunday February 19, 2012 @01:12PM (#39093237)

          His actions did have consequences. I work for a large company with lots of publicly facing servers. If the guy had hacked into our servers, he may well have tripped an IDS or some other log analysis process, which would have alerted us to someone being somewhere they shouldn't be. Imagine how many man hours would be involved in identifying the intrusion.

          Now that's not to say that I don't disagree with the rest of your post: the holes obviously existed, and if a black hat had got in they'd have to respond in the same manner. The thing is, a black hat would (hopefully) be found and prosecuted too, for the same reasons.

          If someone is able to hack into YOUR SERVERS... it's YOUR problem... not the hackers. YOU left the vuln... he exploited it.

          It's not the, "I left my front door open, you came in uninvited, and now I'm installing an alarm system"

          it is, "I own a company, it's in a building, the public comes to it... someone found I left a door open
          that wasn't marked and now I have to install a lock, sign and alarm system, even though,
          I SHOULD HAVE ALREADY."

          The hacker didn't CREATE the situation that allowed his access. He just FOUND it.

          -AI

      • Re:Uhh (Score:5, Insightful)

        by rgbrenner (317308) on Saturday February 18, 2012 @04:52PM (#39087675)

        The lock on your bedroom window is crap. I broke it last night, and then rifled through all of your stuff. Did the same to 2 of your neighbors also.. ya know, just to show it wasn't a fluke.

        Your welcome.

        I would like my reward now.

        • Re:Uhh (Score:5, Insightful)

          by russotto (537200) on Saturday February 18, 2012 @05:03PM (#39087775) Journal

          The lock on your bedroom window is crap. I broke it last night, and then rifled through all of your stuff. Did the same to 2 of your neighbors also.. ya know, just to show it wasn't a fluke.

          Your welcome.

          I would like my reward now.

          OK, we'll sentence you based on the potential damage you might have done -- to wit, you could have accidentally burned the entire house down while you were there, and the fire could have spread to the entire neighborhood and killed a bunch of people.

          Sentence the man for what he did: breaking into the computers. Not based on crap like "Potentially what you did could have been utterly disastrous to Facebook"

          • by epyT-R (613989)

            fortunately the law is supposed to be based on what was DONE, not what could've been done.. of course, that limits the power of overreaching police forces and the egos of cowardly politicians so maybe not anymore..

          • Re:Uhh (Score:5, Insightful)

            by rohan972 (880586) on Saturday February 18, 2012 @06:27PM (#39088345)

            Sentence the man for what he did: breaking into the computers. Not based on crap like "Potentially what you did could have been utterly disastrous to Facebook"

            Creating a hazard can be illegal, eg: you can be booked for reckless driving even if no other cars are around at the time. Leaving aside the question of whether it was he or Facebook that created the hazard, or what proportion of culpability should be shared, the sentence is based not on what he did, but who he did it to (from the first link in the summary) :

            "You accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance,"

            So to answer rgbrenner's "lock on your bedroom window is crap", argument, the judge's response is "You broke the bedroom lock on a rich man's house, it's not like you broke into the house of normal people".

            You don't have to be sympathetic to this guy to find this court judgement reprehensible.

        • Re:Uhh (Score:4, Insightful)

          by tibit (1762298) on Saturday February 18, 2012 @05:36PM (#39087999)

          That's not even remotely the same: one happens in the physical world, the other is pretty much a bunch of numbers being sent between computers on a network without any other consequences at all -- he didn't log into their servers and issue rm -rf, did he? No data was lost/deleted, there was no material/financial loss, so what the heck? It seems almost like a mind crime: he knows what he's not supposed to know, and nothing else, and he's not blackmailing anyone over it, nor is he intending to. Sure someone's feathers got ruffled, but -- to me -- it seems like Facebook basically says: we have a big ego, and we have lotsa money to show for it. And we won't mind jailing people just to show how big of an ego we have.

          • Re:Uhh (Score:4, Insightful)

            by rgbrenner (317308) on Saturday February 18, 2012 @05:48PM (#39088099)

            Nothing was lost when I broke into your bedroom and went through all of your stuff either.. yet you seem to think that is a crime that should be punishable.

            The only problem with my analogy is that I didn't take anything from your house. This guy took source code worth millions of dollars from the server.

            • And what if we chose a different place to use as an analogy, as it seems obvious that certain locations can have worse repercussions...

              What if you broke into a blood bank?

              You can bet your arse that the mere indication that you had unauthorised and unfettered access to a blood bank would have costly repercussions for that organisation - full audits, physical checks and tests, and that's if they don't simply junk all the blood you had access to...

              Compromised servers are no longer trustworthy - cleaning up aft

          • and he's not blackmailing anyone over it, nor is he intending to

            open to interpretation. After all, he did manage, somehow, to convince Yahoo that it was a good idea to pay him $7000...

            Yes, that's puny as ransoms go, but the smart extortionist makes sure his ransom is not more expensive than other alternatives that the victim may have at its disposal (... such as lawyers...)

        • by Hentes (2461350)

          Comparing hacking to IRL burglary is a false analogy.

      • Re:Uhh (Score:5, Insightful)

        by poity (465672) on Saturday February 18, 2012 @05:03PM (#39087781)

        There is a common sentiment on Slashdot that whatever good intentions a company may have, its gathering of data without permission constitutes both a violation and a risk. That risk being the potential for the data in their hands to be compromised by yet another party. Can this logic not also apply to this Glenn and his company as well?

      • Re:Uhh (Score:5, Insightful)

        by Dahamma (304068) on Saturday February 18, 2012 @05:04PM (#39087793)

        While that may be true, that doesn't appear to be the judge's rational for convicting the kid.

        Why does everyone keep calling him "the kid"? He's 26 years old. Just because he's a student doesn't make him some naive, innocent minor - he clearly knew what he was doing...

        • Why does everyone keep calling him "the kid"? He's 26 years old. Just because he's a student doesn't make him some naive, innocent minor - he clearly knew what he was doing...

          I think it was pretty much the definition of naive for him to think that he could keep doing this vigilante white-hat stuff without some corp with too many lawyers eventually coming down on his ass as hard as possible.

    • He also did not cause any real harm. I guess how far to the left or right one leans determines whether or not the line should be drawn at "causing harm" or "had no business doing it."
      • Re:"Damage" (Score:5, Insightful)

        by spire3661 (1038968) on Saturday February 18, 2012 @05:25PM (#39087919) Journal
        Causing a full security review after a known penetration costs REAL WORLD MONEY. You have to pay people for the expense of figuring out what happened. It is interesting that you disregard this aspect of the problem entirely. He had no business being there, flat out. There is no inherent right to crack other people's property. I find nothing wrong in the law saying 'thou shalt not penetrate others network without explicit permission or authority.' This person had neither.
        • by rohan972 (880586)

          There is no inherent right to crack other people's property. I find nothing wrong in the law saying 'thou shalt not penetrate others network without explicit permission or authority.' This person had neither.

          I don't condone his actions at all, but I question placing full legal responsibility on him for the cost of security reviews. Surely whatever security reviews the professionals at Facebook had been shown to be inadequate. Was the security of Facebook from other attacks decreased because of changes he made to the system? Did he cause damage or reveal it?

        • Re:"Damage" (Score:5, Interesting)

          by rgbrenner (317308) on Saturday February 18, 2012 @07:10PM (#39088617)

          Not just the review..

          He impersonated a Facebook employee who was on vacation, hacked into the servers, tried to cover his tracks by deleting evidence he was there, downloaded facebook source code, then hid.

          Facebook discovered on their own that he hacked in, and they had to work with the FBI to find out who this guy was. They had to do a real investigation.

          THEN when the FBI knocks on his door, he says: I'm an ethical hacker trying to HELP facebook.

          Seriously.. this guy is nothing more than a common criminal.

    • Re: (Score:2, Insightful)

      by AmiMoJo (196126)

      I'd say it was a valuable public service, much like a journalist investigating a company. Rather than being prosecuted the story here should be that apparently some random guy was able to hack into Facebook where hundreds of millions of people's most personal data is kept. The fact that it cost Facebook money to fix is irrelevant as they should have fixed the problems anyway. If someone pushes on your security door and it falls off the hinges that should not be criminal damage.

      By prosecuting the guy all the

      • Re:Uhh (Score:4, Insightful)

        by Dahamma (304068) on Saturday February 18, 2012 @04:59PM (#39087751)

        By prosecuting the guy all they have done is ensure that in the future people who manage to find these holes will either just exploit them for criminal gain

        Or maybe it will make some of those people think twice before they do it in the first place...

        • Re:Uhh (Score:4, Insightful)

          by Dekker3D (989692) on Saturday February 18, 2012 @05:25PM (#39087917)

          There will always be people trying to do this, whether hobbyist or professionals making a quick buck. So any leak -needs- to be fixed. Your argument implies that it's possible to scare people into never ever doing this sort of thing again, and people have been trying to do just that for years already. Newsflash: people still hack into servers, and all the scare tactics have only served to punish those who went public with their findings-... the ones who mean to do right and point out the risks, rather than keep it to themselves and use it for personal gain.

          Scare tactics are not having the intended effect. Perhaps it'd be good if people started thinking of other solutions?

        • by 0111 1110 (518466)

          Or maybe it will make some of those people think twice before they do it in the first place...

          Or maybe it won't. Putting people in jail for victimless crimes doesn't have any positive benefits for society. Only negative ones.

          • by Dahamma (304068)

            Have to generally agree in this case - I don't see how a jail sentence is going to deter the guy from doing it again any more than a fine would have.

        • by AmiMoJo (196126)

          It won't stop black hats looking for them, but it will stop the rest of us finding out about them until we get data-raped.

          Walking up to my bank's doors and checking they are locked should not be a crime. Discovering that they are unlocked, taking a quick peek inside to make sure it isn't just a store cupboard I found my way into and then reporting the fact to the bank should not be a crime. Even asking the bank for a job checking that their doors are locked shouldn't be. This guy maybe overstepped the bound

    • Re:Uhh (Score:4, Insightful)

      by rgbrenner (317308) on Saturday February 18, 2012 @04:48PM (#39087641)

      Not only that, but it almost sounds like bribery. He hacks into Yahoo, downloads confidential data, then "asks" them for a reward?

      Why did he need to download facebook source code after he found the vulnerability? Why did he need to breach the server at all? Much less 3 servers?!

      • by Lennie (16154)

        It isn't bribery, he just helped find more vulnerabilities. :-)

        But really, sometimes it takes evidence to convince these companies to look at something.

        I'm sure sending them part of their source code would get their attention.

      • by Lumpy (12016)

        True, find breach, send info to facebook on how to do it from a fake untraceable account.

        you do a good deed, stay anonymous from litigious bastards, and increase your karma.

        Anyone doing any other way is scamming for something. real white hates do it secretly and for free.

      • by dissy (172727)

        Why did he need to download facebook source code after he found the vulnerability? Why did he need to breach the server at all? Much less 3 servers?!

        This here is the root of the problem of why his actions were so wrong.

        Granted, he shouldn't have been poking around in the first place, but that action (if limited to that) might be able to be forgiven. Everything else he did after the poking around was very much uncalled for and unprofessional behavior.
        It would be one thing if he accidentally stumbled over a possible vulnerability, but that is Not what he did.

        Example:
        "Hello facebook security team.
        I was attempting to reach my server at 123.x.x.x port yyyy,

    • by khasim (1285) <brandioch.conner@gmail.com> on Saturday February 18, 2012 @04:49PM (#39087653)

      So you're walking through the business district of a city and just jiggling door knobs to see if anyone left anything unlocked.

      Why? Because you're a "white hat".

      That's the FIRST issue that you have to get through to the judge.

      Once you find an open door, you go inside and take some important stuff out. So that you can prove to the company that you were inside.

      That's the SECOND issue you have to get through to the judge.

      Then, you call the company and tell them that door X is unlocked and you can prove it because you have property Y.

      The company (being unenlightened and still thinking in physical world terms) calls the cops and you are arrested. Even though you intended to give property Y back to the company.

      It makes sense that way.

      So, do NOT freelance. If you do NOT have a signed contract with the company you CAN be prosecuted. You have to put in the EXTRA EFFORT to distinguish your actions from the actions of the bad guys. A signed contract does that.

      • "If you do not have a signed contract with the company you can and SHOULD be prosecuted." FTFY
      • by tmosley (996283)
        Note he didn't take any property. It's more like he made copies of some files from their filing cabinet, or took a picture of the inside of their building.

        The worst thing he could be charged with is the electronic equivalent of B&E. Of course, this being Slashdot, I didn't read the article, and just glanced at the summary, so I'm not sure if that is what happened or not.
    • by epyT-R (613989)

      good, well I hope the next time zuckerberg has a heart attack, his neighbor gets a signed agreement from him before calling 911. after all, corporations are people, right? (yes I know this is the UK, but it would be no different in the US) the only 'costs' were associated with a byzantine, bought-out legal system and not with mangham himself.

    • by Mitreya (579078)

      you need a signed agreement with the company in question to perform penetration testing, otherwise it's illegal, no matter what your motivations are.

      Indeed, I am not sure what is this "ethical hacking defense" that the summary refers to. That may have prevented him from going to jail for a decade instead (i.e. if he had also sold private information or did some obvious damage he'd be punished further). But it isn't a defense, more of a good topic to bring up at sentencing.

  • $200,000? (Score:3, Insightful)

    by koan (80826) on Saturday February 18, 2012 @04:33PM (#39087497)

    So Zuckerberg had to go to his wallet instead of pulling change from his pants pocket, maybe the hacker should have been less ethical and just sold the code.

    • Re:$200,000? (Score:4, Insightful)

      by Dahamma (304068) on Saturday February 18, 2012 @05:02PM (#39087767)

      What does that matter? $200,000 is $200,000, just because the victim "can afford it" doesn't change the crime itself.

      • by Spykk (823586)
        Unless $200,000 is what it cost to fix the vulnerability that was already there. Would you sue your neighbor for the price of a new radiator if he pointed out yours was leaking?
        • by Dahamma (304068)

          Yeah, I haven't seen any specifics on what it was that cost them $200k or whether that is totally inflated, I just don't think the measure of his guilt should have anything to do with the size of the company hacked.

          On the flip side, I think the judge's comment that "you accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance" is even worse. If it's a crime it shouldn't matter

  • by erroneus (253617) on Saturday February 18, 2012 @04:37PM (#39087527) Homepage

    In the case of companies like Yahoo, you can do this. But in the case of Facebook, it's better to sell any uncovered flaws to interested parties other than Facebook or to simply release the information anonymously to the public.

    These "damages" are the lawyer's fees associated with making claims against the "criminal" and the programmers needed to correct the vulnerability... (which are probably the same programmers whose code was vulnerable in the first place.)

    Facebook, you just set the tone for how security researchers will reveal your vulnerabilities in the future. You just made a very uncomfortable bed for yourself to lie in.

    • by davecb (6526) <davec-b@rogers.com> on Saturday February 18, 2012 @04:50PM (#39087657) Homepage Journal

      A new way to profit: leave the holes in place, and charge anyone who discovers them. If the person is stupid enough, he or she will do more than notify you. If they exceed what a random uninterested person would do with the the hole, they've just self-identified as a criminal. You can therefor recover enough money from them to pay for fixing the holes.

      This creates a whole new meaning for "honeypot" (;-))

      --dave

      • by poity (465672)

        You can therefor recover enough money from them to pay for fixing the holes.

        why would they do that when they can get far more by hyping up their IPO?

    • by poity (465672)

      Even better, audit smaller sites with permission so you build up a portfolio of clients before pursuing business with the big guys. That way you don't have to lie about your income on your tax forms, you don't draw negative attention to yourself or your business, and instead of selling for chump change what few holes you do find, you make a steady income from secure sites as well as insecure sites.

      You know, what smart security pros do?

    • Security Researches get permission before penetration testing and there is a lot of money to be made in legitimate security work. Just breaching a company computer network is a crime. It does not matter if you steal any information or cause any harm.
      How about I come over and break into your house when you are not home and leave a note telling you how I did it? I'll try breaking in again a few days later to see if you took measures to keep me out. If I can still break in then I will be justified in taking o

      • by erroneus (253617)

        The difference is that people are CONSTANTLY trying to break into sites like facebook and often successfully. This guy isn't the first and won't be the last. By not publishing the information, he did them a favor. By asking for a reward, he may have entered a grey area. But by prosecuting this guy, they have sent out a rippling message that facebook is not to be dealt with openly or honestly.

        I get that they should be contacted "beforehand" and permission should be acquired, but the fact is, real crimina

      • by evilviper (135110)

        How about I come over and break into your house when you are not home and leave a note telling you how I did it?

        My house doesn't contain billions of dollars worth of information. Now, if you are able to break-in to my bank, without really trying, where I keep lots of uninsured assets, I'd consider that a tremendous service. In a high-crime neigborhood, I'd also consider a note that, eg. a side window doesn't lock, to be a positive public service.

        I'll try breaking in again a few days later to see if you

    • No. The lesson is, if you break in in April, and don't actually do anything voluntarily to disclose the vulnerability and let Facebook know about it and fix it, and actually go back in to erase your fingerprints, and the FBI comes and knocks on the door of your home two months later, that you are too late with the Good Samaritan defense. Having read the article, I'm not particularly as sympathetic to the kid as I was based on the /. summary. He got caught and he hadn't done anything to redeem himself.

  • by MindPrison (864299) on Saturday February 18, 2012 @04:43PM (#39087585) Journal

    ...but a breach into any company is a break-in-and-entering if you haven't been assigned to do so for testing the security vulnerabilities by the company itself.

    It's kind of like catching a thief without any goods, but inside of your home. Uhm...I'm just testing your security system, now you know you have a weak system, thank you - I'll mail you the bill.

  • I call bullshit. He "runs a tax registered security company," which means his motivation was largely if not entirely monetary. Hardly ethical.

  • Poor Yahoo (Score:5, Funny)

    by Dr. Evil (3501) on Saturday February 18, 2012 @04:45PM (#39087615)

    "You accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance," he said.

    ooo, that's got to hurt.

  • The case's prosecutor, Mr. Patel, said Facebook spent '$200,000 (£126,400) dealing with Mangham's crime.

    That is, doing a security audit, implementing tests and fixing bugs? If you have poorly tested code, and you notice it because someone is trying to get in through the back door, you should not try to charge them for your own faults.

    Hopefully, you would have spent that money anyway.

    If you hadn't, then good thing someone came in before you had also to face more serious consequences (as in a public exp

    • by Ziekheid (1427027)

      Beside that, if it wasn't a student from the UK but some cliché bad guy from a country where Facebook can't do shit we could see all the info ending up right on the web. I don't know why but for some reason I want this to happen..

  • Claiming he caused $200,000 in damages is absurd, what is the actual damage? Fixing vulnerabilities that were there in the first place?
    I always think it's funny that when hackers get busted and the company has to spend a ton of cash on securing their servers/software they claim it's somehow the hacker that caused the damages. They had to be secure in the first place.

    • by Lennie (16154)

      It usually boils down to all the time spend (thus money) that was needed to reinstall all the servers in the datacenter with a new known good image ?

      • Re: (Score:2, Informative)

        by Anonymous Coward

        I'm sympathetic to that argument. Post-intrusion followup, investigation, rootkit removal (read -- bare metal installation after hdd imaging), these are all legitimate expenses incurred even in the case of a white hat.

        Fixing the problem they found is not. Conducting an audit to look for similar problems is not.

        Related: How's that related to this? https://www.facebook.com/whitehat/ Did he not follow the procedures?

  • by 93 Escort Wagon (326346) on Saturday February 18, 2012 @04:56PM (#39087727)

    The case's prosecutor, Mr. Patel, said Facebook spent '$200,000 (£126,400) dealing with Mangham's crime.'

    Mr. Patel? Is that Mr. Synthesizer Patel? I guess he discovered music wasn't paying the bills.

  • In the Netherlands, damages are only that what you have to spend to put the original situation back. If that means reinstalling 3 servers from scratch, I doubt you'd be looking at 200K. However, if you need to do forensics to actually establish that it was just the 3 servers and you need an external company to do that because privacy regulations from the government mandate that, 200K sounds plausible.

    If you were never planning on releasing or selling any of the vulnerabilities you found. If you were will
  • Saying "I'm an ethical hacker" when you get caught, doesn't mean you don't do time.

    It means you are an idiot.

    Alex

  • In 2005, Chris Putnam had created a Facebook worm, eventually the worm got traced back to him and Facebook hired him.
    Facebook has also previously hired Geohot, of the iphone/sony hack fame.

  • ... if they discover what they believe might be a vulnerability in somebody else's software, perhaps not deliberately trying to do so, what do they do? I mean, the only thing that would actually qualify as proof of a real vulnerability is if they downloaded something they weren't supposed to, which might require actually trying to do, but at the same time it would be illegal to attempt to do so. What is a person really supposed to do?
  • by Hentes (2461350) on Saturday February 18, 2012 @06:53PM (#39088505)

    Mr McCreath said while he acknowledged that Mangham had never intended to pass on any of the information he had gathered, nor did he intend to make any money from it, his activities were "not just a bit of harmless experimentation".

    "You accessed the very heart of the system of an international business of massive size, so this was not just fiddling about in the business records of some tiny business of no great importance," he said.

    So it's okay to hack a small business but not a large international one? The legality of an offence depends on the amount of capital the plaintiff has? The rich now have more rights than the poor?

  • by detritus. (46421) on Saturday February 18, 2012 @08:24PM (#39089151)

    If only Harvard had prosecuted Zuckerberg when he hacked Kirkland House's online mailing lists to spam users with links to his Facemash service, Facebook might have never existed and this may have never happened at all.

A penny saved is a penny to squander. -- Ambrose Bierce

Working...