Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Privacy Government The Courts Your Rights Online News

Hacking By Subpoena 30

solidox writes "SecurityFocus has an article on how Alwyn Farey-Jones instructed his lawyer to issue a subpoena against ICA to get all their emails. ICA's ISP, NetGate, complied and gave them over 300 emails from ICA employees. When ICA found out about this they sued and the court ruled that this was a violation of the Computer Fraud and Abuse Act. This could be good news for those trying to fight off the RIAA subpoenas to isps to catch file-sharers."
This discussion has been archived. No new comments can be posted.

Hacking By Subpoena

Comments Filter:
  • Damn! (Score:2, Funny)

    by laptop006 ( 37721 )
    Can't sue Microsoft for the Windows source code now!
  • 300 emails? (Score:4, Interesting)

    by aderusha ( 32235 ) on Monday September 01, 2003 @07:50AM (#6843910) Homepage
    the entire company only had 300 emails collectively? i've got more than that in my deleted items folder on any 1 given day...
    • spam doesn't count
    • Re:300 emails? (Score:4, Interesting)

      by bluGill ( 862 ) on Monday September 01, 2003 @08:14AM (#6844010)

      If I understood the artical correctly, the 300 or so obtained was a sample. Presumably the ISP was working on getting them the rest when the court steped in. No mention of how many total emails could have been obtained.

      No details are given on how they were selected, so I don't know if they are emails between 1:00pm and 1:10pm, or all emails for an entire month. Or just a random sample from the backup tapes.

    • No doubt (Score:3, Funny)

      by phorm ( 591458 )
      What would be their closing statement using these emails as evidence:
      "Your honor, as you can see the defendent is of questionable moral integrity and dubious legal practice. Of their 300 emails we *ahem* appropriated, 289 of the messages received were in relation to conduct of dubious sexual nature. Obviously, your honor, they are nothing but a bunch of no-good perverts!"
  • by Dachannien ( 617929 ) on Monday September 01, 2003 @09:03AM (#6844216)
    From the article:

    "To equate an overbroad subpoena to breaking in is outrageous," says Mark Rasch, an attorney and former Justice Department cybercrime prosecutor. "The real crime here is the ISP getting the subpoena didn't contact the customer immediately and say, 'what do you want to do?' Every subpoena is overbroad. It's the responsibility of the party receiving the subpoena to try and narrow it."

    This comment ignores the fact that the oldest form of hacking is social engineering. Doing something to sound official, or to appear to have clout that you don't have, in order to get what you want (generally, to get something you're not supposed to have) is definitely a form of hacking, used in some cases for nefarious purposes. The case mentioned in the article definitely has nefarious outcomes, and so, this sort of social engineering should definitely be prohibited.

    • by MrWa ( 144753 ) on Monday September 01, 2003 @09:38PM (#6847530) Homepage
      This comment ignores the fact that the oldest form of hacking is social engineering. Doing something to sound official, or to appear to have clout that you don't have, in order to get what you want (generally, to get something you're not supposed to have) is definitely a form of hacking, used in some cases for nefarious purposes. The case mentioned in the article definitely has nefarious outcomes, and so, this sort of social engineering should definitely be prohibited.

      This comment ignores the fact that the first comment was about breaking in and not about hacking. To equate breaking in with hacking only serves to further the illusion that all hacking is, by its very nature, something that is at best in the grey area of the law. This is, of course, absurd.

      The aforementioned comment goes even further to suggest that social engineering - and overly broad subpoenas by connection - are something that should be regulated because this particular case had "nefarius outcomes." Not a good idea - more regulation is not the answer, thank you very much.

      A better, and more reasoned approach, would be to not give business to an ISP that doesn't care about the privacy of its customers enough to ask what that company would want to do. Maybe, if an ISP were sued for providing the emails in the first place - industrial espionage? - we could focus on the misapplication of a subpoena. This is, though, something that is not new and unique to cyberspace. The application of anti-hacking laws to something that is, in essence, a purely "real-world" problem creates a scary precedent considering the inept laws regarding computers and the Internet that have been created in the past few years.

      BTW: does an ISP actually own the traffic going over its network and, if so, are they not culpable for stolen MP3s? If not, how can the ISP be asked to provide something that does not belong to them (emails in this case...)

    • Over broad ? (Score:4, Insightful)

      by jefu ( 53450 ) on Monday September 01, 2003 @10:17PM (#6847714) Homepage Journal
      Every subpoena is overbroad. It's the responsibility of the party receiving the subpoena to try and narrow it.

      IANAL (naturally) so I'm confused.

      As I understand it, the DMCA allows someone who thinks they are being ill used (in copyright sorts of ways) to issue a subpoena essentially without a judge being involved and those on the receiving end are then supposed to comply. But this lawyer says that those on the receiving end get to try to negotiate it. If there's no court/judge involved, who do you negotiate with?

  • Subpoenas (Score:2, Insightful)

    by Goo.cc ( 687626 ) *
    From what I read of the article, it sounds like anyone can issue a subpoena without going to court first. Am I understanding this correctly? If so, it seems silly that anyone can subpoena e-mail just on their word.
    • Re:Subpoenas (Score:1, Insightful)

      by Anonymous Coward
      Never underestimate the power of human stupidity. Sure you need to go to court, but not if the other guy is too stupid to check, since that was the point of this story.
    • Welcome to the Wonderful World of the DMCA.
    • Article quote here:

      Under federal civil rules, a litigant can issue such a subpoena without prior approval from the court, but is required to "take reasonable steps to avoid imposing undue burden or expense" on the recipient.

      "A litigant" implies that there is ongoing litigation, and it's normal in the discovery phase for each side to request each other's emails and internal documents that are relevant to the case.

      A DMCA subpoena for copyright doesn't require an ongoing trial and it doesn't require a jud
  • somewhat misleading (Score:5, Informative)

    by danoatvulaw ( 625376 ) on Monday September 01, 2003 @09:58AM (#6844478)
    When ICA found out about this they sued and the court ruled that this was a violation of the Computer Fraud and Abuse Act.

    Well, not quite. The 9th Cir. reversed the trial court's dismissal of certain claims made by the plaintiffs. They did not hold that this conduct of serving overbroad, deceptive and illegal subpoenas per se violates the CFAA. Essentially, what the court did say was that there was enough questions of law and fact to go to trial on the issue. The opinion is on the 9th Circuit's website [uscourts.gov]

    And to answer the poster below, there are certain times when parties to a litigation can issue subpoenas (under the FRCP), and some statutes authorize subpoena power without requiring the person to whom you are going to serve to be a party (ex. DMCA). But no, not just anyone can issue an subpoena, even though today it may look like it!
  • by BitterOak ( 537666 ) on Monday September 01, 2003 @05:43PM (#6846407)
    I am not a lawyer, so I'm asking. Aren't you immune lawsuits if your actions are required by a court order? It sounds to me like you're damned if you do and damned if you don't. If a judge orders you to do something, and another judge orders you to pay up for doing just that thing, it seems impossible to comply with the law. Doesn't the constitution have something to say about that? Otherwise, when a judge gives an order, what's to stop a defendent from saying "I'd like to comply with your order judge, but I'm afraid I might get sued!"

    Any lawyers care to comment?

    • by Fryed ( 205364 ) on Monday September 01, 2003 @08:17PM (#6847182)
      Actually, from my reading of the article, it appears that the ISP is not being sued in this case, merely the person who issued the subpoenas. First off, a judge never ordered the ISP to hand over the emails. Apparently, in certain situations, individuals can issue subpoenas without asking the judge, and that appears to be what happened in this case. When the ISP received that subpoena, they were required by law to provide the emails, and did so. When the company whose emails were subpoenaed found out, that's when someone was sued...but it wasn't the ISP who was sued, but the person who issued the subpoenas in the first place.

      (Of course, I'm not a lawyer either, so it's entirely possible that my reading of the article is completely wrong. I'm sure someone will post to enlighten me if that is the case)
    • by Anonymous Coward
      The recipient of a subpoena has an obligation to act in good faith and not just throw the cupboard open.

      For example, lets say you got some MS Documents via e-mail, and they are under an NDA. You want to give them to your buddy, but can't because of the NDA. So you get your buddy to issue you a DMCA subpoena for ALL your e-mails, and you give them over.... he gets the data you otherwise couldn't give him and you claim as a defense to violating the NDA as the subpoena (which is why mos NDA's have a notice
    • Yes you are required to respond. No, you aren't necessarily required to COMPLY with it.

      Simply put, you can't ignore a subpoena and hope it goes away. But you can respond with a Motion to Quash, asking the judge in the case to wipe out the subpoena or at least modify what you have to do to comply with it.

      By the way, most subpoenas come from lawyers in the case, not directly from judges. Lawyers are given subpoena power to gather evidence to make their cases for their clients, but as officers of the cour

  • by Krellan ( 107440 ) <krellan&krellan,com> on Monday September 01, 2003 @08:45PM (#6847305) Homepage Journal
    There's a reason I'm not a Netgate customer anymore.

    They were a fine ISP when I used them several years ago, having good dialin numbers (these were the days before easy broadband access) and reasonable prices. They didn't have any technical problems to speak of. They even had really good USENET access (I used to post a ton from krellan@netgate.net, Google it).

    However, Netgate's social/legal policies really stank.

    At the time, for example, they had agreed to host godhatesfags.com. So, I left.

    It wouldn't surprise me now to see them overzealously comply with a subpoena, hurting their own customers in the process.

    I still think it's really cheap of hosting companies to not warn their customers when receiving legal action against them (except when the DMCA actually requires that they not warn, yet another reason why it's such a scary law).
  • Isn't this a perfect example of why people shouldn't be able to attack, harass, seize the posessions of, or arrest other people without a court's approval? This is the same thing as the new PATRIOT act no-warrant searches.

"Just the facts, Ma'am" -- Joe Friday

Working...