41 Months In Prison For Man Who Leaked AT&T iPad Email Addresses 459
In 2010, querying a public AT&T database yielded over 114,000 email address for iPad owners who were subscribed to the carrier. One of the people who found these emails, Andrew 'weev' Auernheimer, sent them to a news site to publicize AT&T's security flaw. He later ended up in court for his actions. Auernheimer was found guilty, and today he was sentenced to 41 months in prison. 'Following his release from prison, Auernheimer will be subject to three years of supervised release. Auernheimer and co-defendant Daniel Spitler were also ordered to pay $73,000 in restitution to AT&T. (Spitler pled guilty in 2011.) The pre-sentencing report prepared by prosecutors recommended four years in federal prison for Auernheimer.' A journalist watching the sentencing said, 'I felt like I was watching a witch trial as prosecutors admitted they didn't understand computers.'
Good (Score:4, Insightful)
Know I'll get modded down for going against Slashdot groupthink. But what is the argument suggesting? "It all happened on a computer, it shouldn't be prosecuted?" Stealing private information and releasing in publicly isn't just obviously illegal, it caused grief for 114,000 people.
Even if AT&T has a shitty security system, that doesn't make it legal to break in. I'd love to see Slashdot do more mundane crimes. Maybe the home had a sign saying "beware of dog," but the dog was actually at the vet, so the robber was just publicizing a security flaw.
Re:Good (Score:5, Insightful)
He didn't "break in". He sent requests to a publicly-accessible web server, and AT&T sent back private information. This wasn't hacking, or even a DOS attack. AT&T is at fault here.
Re:Good (Score:5, Insightful)
That. It's a flaw that AT&T never would have addressed without public pressure. Further, Mr. Auernheimer did not release private info to the public -- the news agency to which he released the then already-public information is responsible for further publicizing it.
Bottom line: it is ludicrous-speed absurd to prosecute somebody for publicizing already public information. If a newspaper accidentally prints the names and addresses of its entire subscriber base in the classifieds, and I call them to report it, can I then be held accountable for "releasing" the information?
Re: (Score:3)
Re:Good (Score:5, Insightful)
We have convicted rapists and murderers that seem to get off with lighter sentences than people that do anything that involves a computer these days, even if the results don't hurt anyone and only embarrass a company or some govt. personnel.
Re: (Score:2)
Yes and no, you can trace a rapist to his/her victim, but you can't really assess the damage done by publishing 1k+ email addresses. What if one of those email addresses is an old lady that gets scammed by a nigerian prince? What if it's 100 of those emails that that happens to? Should the guy who provided the means for that to happen even be liable? Could it have happened anyways?
I will say this though, innocent before found guilty, if that was true, then the damage would be 0 as it can't be directly l
Re:Good (Score:4, Insightful)
Indeed, but I guess it wouldn't make a difference if he just showed how to do it, instead of actively forwarding the addresses.
But what bothers me is not that he's being punished, but the severity of the punishment. 41 months in jail? Please, remind me how many months in jail did the Santander employees responsible for money laundering for terrorists get... oh, wait, I remembered, they didn't even get prosecuted, because rich people can screw everybody freely.
Re:Good (Score:4, Insightful)
"... you can't really assess the damage done by publishing 1k+ email addresses."
He DIDN'T publish the addresses. He sent them to the newspaper as proof that AT&T was screwing up. If the newspaper published them, you can blame the newspaper. It sure as hell wasn't his fault.
Re: (Score:3)
"Think about what you just said for a second... now go make the real posters sandwiches."
You are claiming that Gawker has no responsibility for publishing? According to the official accounts, "Goatse Security" had tried to contact several "more responsible" news outlets to get the story out. They only resorted to including some emails with the story when that failed, in order to verify that it was real.
Never mind their motivations. Yes they acted irresponsibly. But that is as may be. They weren't responsible for first "publishing" emails.
Now go make some cheese sandwiches for Goatse.
Re: (Score:3, Insightful)
What if one of those email addresses is an old lady that gets scammed by a nigerian prince? What if it's 100 of those emails that that happens to?
If it's that serious then we need to find AT&T criminally negligent for letting absolutely anyone get all those private email address. If it's not that serious after all, then there's no point in railroading the guy who reported the problem, but we can't have it both ways.
Re:Good (Score:4, Insightful)
Stupenville rape case. The raped an unconscious girl. Drug her between parties. Tweeted about it.
Serving a minimum of a year. "Could" be in jail until they are 21, but unlikely.
Re:Good (Score:5, Informative)
Two high school kids just got 1 year each for raping a drunk 16 year old at a party (where people actually filmed and took pictures of it happening).. http://www.sheboyganpress.com/viewart/20130318/SHE0101/130317029/Two-Ohio-high-school-football-players-convicted-raping-girl-16 [sheboyganpress.com]
and this guy gets more than 3 times that for mentioning that a web site will give out people's private email address after AT&T did nothing about it?
Re: (Score:3, Interesting)
"Little punishment"? US justice system is draconian when it comes to punishing crime. These guys are going to have a stigma of "sex offender" for their entire lives on them now.
What the hell happened to rehabilitation? You know, getting both the victim and criminals rehabilitated to be able to live good lives without the spectre of rape hanging over them? Now victim gets "vengeance" which solves absolutely nothing for her, and two guys went from low grade passion criminals to having completely destroyed liv
Show me. (Score:3)
We have convicted rapists and murderers that seem to get off with lighter sentences than people that do anything that involves a computer these days, even if the results don't hurt anyone and only embarrass a company or some govt. personnel.
Show me the numbers and then we can talk.
Real stats for the rapist and murderer. Real stats for the geek whose computer-related crimes earned him hard time.
In the American federal system, crimes of violence are almost always prosecuted under state law.
Execution List 2012 [deathpenaltyinfo.org] Each state on this list, for example, has executed between 1200 and 1300 death row inmates since 1976.
Federal Executions 1927-2003: [deathpenaltyinfo.org] 23.
The DOJ's Computer Crime & Intellectual Property Section archives its press releases of charges
Death Penalty (Score:4, Interesting)
Indulge me in a little hyperbole: for a friend of mine, hacking AT&T was a death sentence.
Lance Moore [fbcdn.net] was involved with LulzSec, foolishly no doubt. As an AT&T technician of some sort, he acquired and subsequently distributed [theatlanticwire.com] some internal corporate documents. The Justice department is liable to be a more accurate source of the specific complaints. [justice.gov] He was caught. The FBI seized its opportunity to bring the hammer down. I've seen various figures given for the amount of jail time he was facing; somewhere between five and thirty. He was found dead by his own hand on February 24 of last year. His crime has by now likely been forgotten by all that were involved with it.
Sixteen other people were arrested the same day that he was arrested. I don't know their stories. The reader may judge whether justice was served.
Re:Good (Score:5, Insightful)
But he didn't trespass -- he didn't break any laws or even conventions regarding the distinction between public/private property in requesting and being provided this information. If the pile of gold in your unfenced yard was on a conveyor that could be activated from the street, I think you would be hard-pressed to convince anyone that you intended the gold to remain in your yard. Likewise, spewing out customer details in response to a simple sql query to a public-facing DB server, which requires absolutely no circumvention of existing security measures, is difficult to paint as an earnest attempt to make a public/private delineation, and thereby prevent even accidental leakage.
As has already been pointed out, the key charge here is "access[ing] a computer without authorization." Since the publicly-facing DB server was not in any sort of secured or even posted enclave, it can only be presumed that the court finds the mere act of interfacing with this system a crime for no reason other than that AT&T has established the server as "private" after-the-fact. That opens up a terrifying door in that any service provider could suddenly declare you persona non grata retroactively, and bring similar criminal charges against you. While that's certainly a leap, it's not a big one...
Re: (Score:3, Insightful)
. . . say I left a pile of gold in the street, I can't have any expectation it'll be there tomorrow, the streets not mine, but say I left it in my yard, and it's unfenced, to get it, you have to trespass + it's on my property. That's what this guy did, he trespassed and took it . .
No, he didn't trespass. The owner had a clear understanding with the public that they were allowed in the yard. The man saw a pile of gold in the yard and asked the local robot - which the owner had configured to hand out vari
Re: (Score:3)
Well... it would more like a farm... you'd enter my 100 acre farm, drive around and randomly spot exposed gold that I did not intend to expose to you, but forgot to bury yesterday because aunt laura swung by. No signs differentiate the gold's space from any other, but you clearly know you're on my land and you know that gold is valuable. I never argued the street's case, besides that I have no expectation of security around the gold on the street, at&t's network would be a private residence owned by a
Re:Good (Score:4, Interesting)
I don't see a huge effort by Andrew to contact AT&T and say "uh, guys, you have a huge problem here".
It's very easy to percieve his actions in a malicious way.
Not that AT&T didn't goof, but this was the wrong way to address it.
Re:Good (Score:5, Insightful)
Nearly everything Weev does is malicious, but the question is: is it (or should it be) illegal? He was convicted of identity fraud and "conspiracy to access a computer without authorization". Think about that: requesting unprotected publicly-accessible webpages is "access[ing]" a computer without authorization". By that standard, anyone who uses the internet could be convicted of a crime.
Re: (Score:3, Insightful)
That being said, even if he did run into a bunch of e-mail addresses by being in the wrong place at the wrong time.. e-mailing that list to someone and going "OMG LOOK AT THIS" was proof that he knew the seriousness of the list he found. It cannot be argued that he did not know what he was
Re: (Score:2)
e-mailing that list to someone and going "OMG LOOK AT THIS" was proof that he knew the seriousness of the list he found. It cannot be argued that he did not know what he was doing.
And if a student finds a gun on school grounds and brings it to the attention of a teacher, that is proof that the student knows the seriousness of that situation. But I fail to see how that justifies throwing the book at the student.
Re: (Score:3)
Re:Good (Score:4, Funny)
1. Set up web site with TOS disallowing access for any reason.
2. Trick lawmakers into accessing your site.
3. ???
4. Profit!
Re: (Score:2)
It's not a perfect situation where there's a black-and-white answer. Think about the implications if the court rules PII / contact info about those people is publicly available information. EVERY marketer everywhere would fall all over themselves to get that information and add it to their databases, maybe even package and sell it, because it would have been called "publicly available" by a court of law. Can you imagine how awful that would be? Whereas, now, there is a stigma of 'a guy got hard time for com
Re:Good (Score:5, Informative)
Isn't a key element of the legal case that he also retransmitted the private information? He did not merely receive it.
From the court filing [archive.org], it appears both charges are predicated on the notion that sending GET requests to an unprotected, publicly-accessible web server constitute unauthorized access under Title 18, Section 1030(a)(2)(C) [cornell.edu].
Re: (Score:3)
Actually the GET request required the ICC-ID of the device to get the email address for that device. The ICC-ID could be construed as a the name of the owner of the device asking for the information and therefore he was fraudulently impersonating someone else when making the requests
Re:Good (Score:4, Interesting)
...sending GET requests to an unprotected, publicly-accessible web server constitute unauthorized access...
Am I reading this right? Someone was convicted of a criminal offence because he did something that search engines like Google do millions of times every day?
Re: (Score:3)
Isn't a key element of the legal case that he also retransmitted the private information? He did not merely receive it.
From the court filing [archive.org], it appears both charges are predicated on the notion that sending GET requests to an unprotected, publicly-accessible web server constitute unauthorized access under Title 18, Section 1030(a)(2)(C) [cornell.edu].
Actually, from your own link, the charges were predicated on the notion that spoofing an identity in order to fool someone into giving you confidential information is a crime. These weren't just GET URL requests like your browser is sending to read Slashdot, but requests with spoofed IDs - closer to sending GET requests to Slashdot with spoofed cookie IDs in an attempt to get emails of other Slashdot users.
Or, as an analogy, this would be like calling a phone number and saying "Hi, this is Bill at [Bank of
Re: (Score:2)
Re: (Score:3)
I don't see a huge effort by Andrew to contact AT&T and say "uh, guys, you have a huge problem here".
Then you have never tried to contact them about... well, anything.
Not even being snarky, just relating my own experiences; I have to deal with AT&T every day, and getting them to so much as acknowledge a problem on their end, let alone do anything to fix it, is similar to attempting to snorkle to the bottom of the Marianas Trench.
Re: (Score:3, Insightful)
Meatspace analogy :
If a bank didn't have a door on it's vault, or any forms of security whatsoever, would you walk in and take out all the money? Even if you proceeded directly to the local police department to report the security flaw and deliver the unguarded money, you'd find yourself in quite a bit of trouble.
Re: (Score:3)
Re: (Score:2)
A better analogy:
A bank has a web server that takes person's name and returns that person's SSN. A "hacker" sends your username and gets your SSN. He does that for several people from the phone directory. Hacker goes to prison for the BANK'S FAULT of exposing SSNs.
It's only the bank's fault for breaching a specific law regarding protection of private information by certain security means (strong authentication, encryption, etc) but if the hacker did anything but flip on his computer (such as construct a program, no matter how small or simple, that specifically talks to the open app on the web server) then he too is guilty of misuse of a computer system under current law.
Debate the efficacy of the law, punishment, etc. all you want, but this is how the current law wor
Re: (Score:2)
Even better analogy: Someone looks through the windows of your house with binoculars and copies your handwritten family phone directory off your fridge.
Re:Good (Score:5, Insightful)
Meatspace analogy :
If a bank didn't have a door on it's vault, or any forms of security whatsoever, would you walk in and take out all the money? Even if you proceeded directly to the local police department to report the security flaw and deliver the unguarded money, you'd find yourself in quite a bit of trouble.
Here's a better analogy: you send the bank self-addressed stamped envelopes, and they willingly send private information about their clients back to you in those envelopes.
Re:Good (Score:4, Insightful)
Meatspace analogy :
If a bank didn't have a door on it's vault, or any forms of security whatsoever, would you walk in and take out all the money? Even if you proceeded directly to the local police department to report the security flaw and deliver the unguarded money, you'd find yourself in quite a bit of trouble.
Here's a better analogy: you send the bank self-addressed stamped envelopes, and they willingly send private information about their clients back to you in those envelopes.
If those envelopes were in any way a misrepresentation of your legal desire to communicate with your bank (such as an incorrect identity, overstated request, etc) then you, the sender, are guilty of mail fraud. Do not pass go, do not collect $200. The legal system seems to be pretty mysterious to a large part of slashdot...
Re: (Score:2)
Not a good analogy, as AT&T didn't lose their database, just exclusivity of it (i.e. now everyone else also has it). A better meatspace analogy might be if a store employee left open a door to an office, and someone walking by took pictures of next weeks sale items (which stores typically don't want released early) and sent that info to a newspaper. The store has not lost any items, just the info about them.
Re:Good (Score:5, Interesting)
No, he made explicit requests for information using trial and error and reverse engineering to find a location that would divulge sensitive information to him.
It didn't throw shit at him, he went digging for it.
Re: (Score:3)
However, money is an unneccessary ingredient here - all he got was information. The only people who will give an analogy involving money are those who want to equate what he did with stealing. But that is nothing but misleading sophistry.
He went up to the reception desk and said "can I have the name and address of client 1000000000 please?" which they then gave him. He then said "and for client 1000000001 please?" which then t
Re:Good (Score:5, Insightful)
First off, the whole reason these guys got whacked by the judge is because they did the standard script-kid thing and went onto IRC and boasted about it, and talk about how they were going to take down AT&T, and make a name for their security company ( Goatse Security, obvious play on goat sex troll )
By that rationale, any request on a web server via the HTTP GET or POST that could escalate privilege or divulge private data should go unpunished. You realize the number of vulnerabilities accessible via a well crafted GET URL? XSS, SQL Injection, tons of stuff. Ignore the fact HTTP is even involved here. This is no different than finding a weakness at any other level of the OSI model, the fact people can easily understand HTTP GET's doesn't make them any less serious and dangerous to an attacker.
Honestly, this has been argued over the Ping of Death back in the day. I mean, your simply sending an ICMP packet via a ping command, it's not like your hacking.
In the end it's about context. Exploiting a weakness is by definition hacking. Just because the hack isn't enigmatic, doesn't mean it's not a hack. Look at Jon Draper and a plastic whistle that happened to hit 2600hz easily.
"But it's just a guy blowing a whistle into a phone, it's not hacking".
These guys crafted a specific HTTP GET request that returned private data. The key in this request was generated by them based off a known flaw in ATT's systems (using ICC-ID as a semi private key). Then they shared that data with a news organization.
Sure, those of us in the industry can shake our head at how stupid AT&T was, but at the same time most of us recognize the line these two guys crossed. It's one thing to send an e-mail to AT&T and copy a security mailing list with a simple example, it's another to write a program and automate the extraction of over 120k e-mails and then package the data and send it to Gawker, while boasting about it on IRC channels.
I could make the same argument for randomly trying passwords against accounts. "I'm just checking to see if this key happens to work in this door...."
Re: (Score:3)
Not at all! The site leaking the information should be held responsible, and if it's clear punishment is due, they should take it like a man.
> These guys crafted a specific HTTP GET request that returned private data.
No craft was involved. They were handed that GET request by the server, in order for their browser to later resolve it for their own legal u
Re: (Score:2)
He didn't "break in". He sent requests to a publicly-accessible web server, and AT&T sent back private information. This wasn't hacking, or even a DOS attack. AT&T is at fault here.
He wasn't just looking to get to his att.com home page and happened upon a list of email addresses. Getting at those addresses took some deliberate work on his part (a big part of the law is not so much about perceptions of ease/publicity, but in perceptions of *intent*). If you leave your windowshades open a little at home, and someone comes along outside and peeps inside to watch you doing [insert something from imagination here] it is the "peeper" who is committing a crime, not the "peep-ee". In this c
Re: (Score:2)
Getting at those addresses took some deliberate work on his part
That "deliberate work" amounted to this:
Weev: "Can I have the email address for whoever is associated with this number?"
AT&T: "Sure, it's xxx@yyy.zzz!"
Now that's a criminal mastermind hacker if I ever saw one!
Re: (Score:3)
In this case Mr. Auernheimer did intend to obtain addresses that were *only going to be exposed to someone deliberately looking for them* and therefore he is afoul of the law.
The law prohibits unauthorized access. Not unlikely access. No authorization control means access is authorized.* The deliberate ignorance of the prosecutors and jury notwithstanding.
*Assuming anything else breaks the entire internet irrevocably.
Re: (Score:3)
He didn't "break in". He sent requests to a publicly-accessible web server, and AT&T sent back private information.
Like sending "requests" to a publicly-accessible ATM using cards with other people's information on them, and then taking the money the bank "willingly" gives you.
Yeah, I totally see the difference between that and "breaking in" to an ATM.
No, that would be like to trying to impersonate people by guessing their passwords. In Weev's case, there was no authentication to circumvent.
Re:Good (Score:5, Insightful)
AT&T publishes the addresses on the web, even though they aren't advertised, they are essentially free to anyone who knows where to look.
Guy finds it, attempts to blow the whistle
Guy is criminal, AT&T takes no liability
Justice!
Re:Good (Score:5, Interesting)
Re: (Score:3)
Re:Good (Score:5, Insightful)
As someone else pointed out, all he did was request data from a public server and AT&T sent it to him. Also, he got 41 months for forwarding 114,000 email addresses to news site, which is overkill. Had he physically broke into an AT&T office and took the email addresses from someone's desk, he would have received less prison time.
He should have been given community service at the most, and then got an award for exposing a flaw from AT&T.
Re: (Score:2)
The Principle of "Full Disclosure" -- Meaning, companies often don't fix vulnerabilities in a timely fashion until the risk is exposed by making the vulnerability public. This principle has been important in the history of and current landscape of information security, and many people think its effects have been a net benefit.
Harm -- how were these people exactly harmed by having their email addresses revealed? If someone posted my email and iPad MAC on a web site, woul
Re: (Score:2)
Know I'll get modded down for going against Slashdot groupthink. But what is the argument suggesting? "It all happened on a computer, it shouldn't be prosecuted?" Stealing private information and releasing in publicly isn't just obviously illegal, it caused grief for 114,000 people.
He didn't release it publicly. He released it to a news site (which did the responsible thing).
It didn't cause grief to anyone, but AT&T.
Re: (Score:3)
The crime wasn't breaking in (as this has been repeated over and over again), it was disclosure.
Part of the problem is that the prosecutors are simply ignorant as to what they are prosecuting. So any "evidence" presented was done without understanding of what they were asserting. That's quite disturbing on its own.
The "offense" isn't necessarily hacking, because that is not what happened (though it is 'believed' to have happened). What he did was collect the information and present it to the media to bri
Re:Good (Score:5, Insightful)
Give away emails to demonstrate a security flaw? 41 months in prison.
Rape, molest, and humiliate a sixteen year old girl? 12 months in prison.
Justice.
---
I love you, America.
Re:Good (Score:4, Insightful)
Damn. Guess I better switch hobbies.
Re: (Score:2)
But what is the argument suggesting?
We are suggesting that requesting an URL is not a crime.
Re:Good (Score:4, Interesting)
How about this analogy:
Your doctor tells you your medical records will be posted in the front window of a white house at 123 Main St. You notice that the street is full of white houses. Just out of curiosity, you go to 125 Main St and see someone else's medical records. 121 Main St., the same thing. In fact every house on the block has a different person's medical records. You see a bunch of other people on the street, going to get their medical records from their respective houses. You joke out loud that you could make a lot of money selling everyone's medical records to some guy in the Ukraine. You tell the hospital that this is a lousy way to communicate medical records.
You get 41 months in prison for viewing everyone's medical records (in plain view) and for your "intent" to sell them to some guy in the Ukraine.
Don't understand computers? (Score:2, Insightful)
So what exactly do they need to understand about computers beyond that?
Re:Don't understand computers? (Score:5, Insightful)
Re:Don't understand computers? (Score:5, Insightful)
The right thing to do, of course, would have been to contact AT&T. Had he done that, AT&T would have threatened him to keep quiet and then never fixed the flaw
FTFY
Re: (Score:2)
Re: (Score:2)
So if I take a phone book and list 110,000 numbers should I be prosecuted?
In a civil case, as that would only be a copyright issue. I'm sure phone books are salted with fake listings just like GPS map data to enable proving and prosecuting copyright infringement.
I know that's nothing to do with your argument, but it's worth mentioning.
Hard to feel sympathy (Score:5, Insightful)
The purported target, AT&T, is hardly the nicest organization, but the actually affected people were just regular people. This doesn't seem especially out of line with the USA's normal unhealthy sentencing. We want to punish, not correct, those convicted here.
As long as that attitude remains dominant, miscarriages of justice will occur within every branch of justice(except for the super-rich).
Re: (Score:2)
Yes, people who bough $product that differs from $YourPreferredProduct are "iDiots".
Never mind that this happened during the iPad 1 era, when there was essentially no other player in the tablet market.
On His Release, Weev Plans To Run For Congress (Score:3)
Sentencing reveals country's values (Score:5, Insightful)
Re:Sentencing reveals country's values (Score:5, Insightful)
It's simple. Society is sick.
Their response to one is "Well, boys will be boys!".
Their response to the other is "Oh my god, if they can webscrape publicly accessible information, the next thing these vial social outcasts will be doing is hax0ring into NORAD and launching nuclear warheads and initiating WWIII and I can't have that because I haven't finished watching Real Housewives, yet!"
Re: (Score:2)
these vial social outcasts will be doing is hax0ring into NORAD and launching nuclear warheads and initiating WWIII and I can't have that because I haven't finished watching Real Housewives, yet!"
Would you like to play a game?
Oh and I think you meant vile.. A vial is something you use in your chemistry lab! ;)
Re:Sentencing reveals country's values (Score:5, Insightful)
Re: (Score:2)
I'm not sure here if the damage was based on "AT&T's reputation" -- meaning, it hurts their income for people to know you don't need to hack them.
OR
Over 100,000 people now have their reputation's damaged for being associated by email to AT&T.
You know that only 300,000 of AT&T's closest advertisers, spammers and script kiddies have these email addresses.
Is the going rate 2 pennies an email to buy as an advertiser or am I being too pricey here?
Re: (Score:2)
The rapists are juveniles. Sentencing is different when you commit a crime before the age of majority, and rightly so.
Re: (Score:2)
I wish I understood that when I was a minor, I would have had so much more fun...
Re:Sentencing reveals country's values (Score:5, Informative)
The Steubenville convictees are legally juveniles. Society has decided that we don't throw the book at them. Had they been adults, they would not be getting sent to a juvenile facility, and they would not be getting out in so short a time. It's hardly an apt comparison.
Re: (Score:3)
The Steubenville convictees are legally juveniles.
Where as weev is simply emotionally juvenile.
Re:Sentencing reveals country's values (Score:4, Insightful)
It's all about who the victim and the perpetrator of the crime is: In the Steubenville case, the victim is a powerless teenage girl, and the perps are a couple of somewhat powerful (at least locally, where the high school football team is a privileged class) teenage boys. In this case, the victim is AT&T (the largest campaign donor in the US), and the perp is a relatively powerless computer geek.
This is just a subset of the more extreme differences: Rob $2000 from a bank, and if you're lucky you won't be shot by the police. Rob $2 billion from a bank, and the SEC or OCC will settle with you for $500 M (25% of your take) and no admission of wrongdoing.
And no, that's not the way it's supposed to work, but it's the way it's actually working.
Re: (Score:2)
Two young men in steubenville rape a young women and get 1 - 2 years in jail. A man writes a script to get email address from a website and gets 3.5 years in jail. Something's not right.
You have a point in that "computer crimes" are often subject to penalties that are far overkill because the legal system has few people, both lawyers and judges, who understand technology well. However, the rape case got the verdict it did for a variety of reasons.
1) The young woman wasn't actually "raped" in terms of nobody put his penis inside her, but some idiot young men fingered her and photographed it.
2) She was so drunk that she had no idea what happened. It was the photos that made this even
Re: (Score:2)
Two young men in steubenville rape a young women and get 1 - 2 years in jail.
A man writes a script to get email address from a website and gets 3.5 years in jail.
Something's not right.
Of course ... once you mess with a big company, your deed is so much worse than anything you could do to another person ...
No understanding of computers or the internet (Score:2)
This people do not have any understanding of computers or the internet in general. I doubt it is going to change in the future. Since this type of people are generally not computer literature at all and never have been.
I doubt they know even what an IP address is or an hard drive.
Re: (Score:2)
But they is more English literature than you are, I hope.
Are IP addresses or hard drives relevant here? Sometimes, you don't need to understand every facet of a subject, even the the most common terms, to understand a specific case like this. All they need to understand is how a webserver works, which can be explained satisfactorily in a few minutes. Of course, it seems they neglected to take those few minutes.
Re: (Score:2)
Since this type of people are generally not *computer literature* at all and never have been.
They probably aren't computer literate either.
they don't understand law, either (Score:2)
the ATT servers were not secured. the data was figurately lying out on the street, in the old days there would be a black or brown binder holding a galloping shitload of greenbar paper, and if you flipped the binder open, it would say, "LIST OF iPHONE USERS DATA." that is thus insecure data, hence public. ATT's trash blowing across the street. the guy should not have been prosecuted, he should have been given a code for free wi-fi at McDonalds for two weeks.
take note... data wants to be free. if it isn
Re: (Score:3)
And you don't understand how rational people work.
A naked woman standing in the street doesn't mean you suddenly have the right to sexually assault her, or does that sound like its okay in your mind as well?
And lets be clear. Data doesn't give a fuck, so stop that bullshit.
And to be more clear: He took distinct actions to access data. Applying reverse engineering and some packet sniffing he SEARCHED FOR AND FOUND the data in question. It wasn't linked from any normally accessible location or anything el
Publicly-Accessible Data=Prison?? (Score:2)
In 2010, querying a public AT&T database yielded over 114,000 email address for iPad owners who were subscribed to the carrier.
If the database was publicly-accessible, how is it a criminal act, as a member of said "public", to actually access it? That's like a newspaper that accidentally publishes data it considers private and prosecuting readers.
The criminal act was negligence by AT&T. This is simply a distraction and face-saving prosecution to wash AT&T clean of culpability.
Strat
Re: (Score:2)
If the database was publicly-accessible, how is it a criminal act, as a member of said "public", to actually access it? That's like a newspaper that accidentally publishes data it considers private and prosecuting readers.
It wasn't publicly accessible. The information of _one_ iPad owner was accessible to that _one_ iPad owner. He figured out how to make his computer pretend to be many different iPads.
There was some interesting discussion recently about anti-hacking laws were huge problems were caused by the fact that the law makes "exceeding authorized access" a crime, which can then be used to apply in all kinds of situations that actually don't have to do anything with hacking. This one is the opposite: The guy didn't
How does this not qualify as... (Score:2)
whistle blowing?
if he would have called AT&T and told them he found this, they would have accused him of hacking, he leaks it to a journalist and gets jail? did the journalist turn him in?
Re: (Score:2)
He probably admitted to it himself, completely underestimating the sheer stupidity our justice system is capable of.
A question of disclosure to whom, when. (Score:2)
Many conflicting articles have been released concerning when the flaw was disclosed to whom. IANAL, but I *think* this may have been the crux of the prosecution's case. If the flaw was disclosed to others before AT&T or perhaps the people whose emails were discovered = crime. If not = no crime.
I am not advocating this position as correct. Just trying to present an opinion.
One of the better articles on the subject of disclosure, still leaves many murky grey area problems for any professional security
reminds me of Harvard B-school hack (Score:2)
... and if Google had done this... (Score:5, Insightful)
They would only be fined 1 days worth of profits...
Corporations are people too? Bullshit. Corporations are treated better than people, under the law. I seriously suggest that every individual incorporate themselves and, when accused of any wrongdoing, claim it was via the corporation, and suggest that the law take it up with the board of directors.
No focus on AT&T liability? (Score:3)
The same type of reckless design that went into AT&T's website for registration is symptomatic of the direction the industry has been heading. It represents that YOUR PRIVACY in the hands of a monopoly is not worth two-shits to them. Even if it was "only an email address" it could have easily been your SSN# on a CD, or medical record on an unencrypted laptop, voting record or ballot on a voting machine, whatever. Weev sounds like a jackass, but I would have expected better security from AT&T. If you're going to take the place to be a reactionary "victim" then maybe you should ask yourself who victimized you first -- AT&T perhaps? If AT&T left your car unlocked, would you still blame the thief?
Re: (Score:3)
Strictly hypothetically, what rock is this key under? And what's your street address? Just hypothetically, so we can look up the laws in your jurisdiction, and understand which rock not to touch.
Re: (Score:2)
Those rocks are for you to look at, not to step on my property and start turning over. Of course, once the cost becomes negligible for a robot to do the rock turning for you, then I'm sure we'll have a rash of home break ins committed by key wielding robots.
Re: (Score:2)
I'm sure this is pointless to comment on, but if such robots existed, they could generate their own keys just by taking a picture of the inside of the lock, couldn't they? Fiber optics are great.
Re: (Score:3)
If you find my key under a rock in my backyard, it is still theft if you break into my house with it and steal things.
The analogy is not really applicable. This is more like writing all your secrets into a notebook and putting it into a library (in a section accessible to everyone). Then you sue the person who found the notebook.
Leaving the data open to any web request is the true crime here. I do not know about the US, but in Europe that would have been a violation against the Data Protection Act.
Re: (Score:2)
No. If you owned an automobile dealership, and wrote down the names and addresses of every customer on a poster, and I asked you for a copy of the poster, and you gave it to me, and then had me prosecuted for displaying the poster, that's the analogy you should be considering here.
Re: (Score:2)
Except it was if you were asking for the poster as if you were someone who was supposed to have access to the poster. He was impersonating a person (or machine in this case). He didn't visit att.com and it spewed 100k email addresses at him. He did some traffic sniffing and reverse engineering.
He made an effort to obtain the data. That is what makes it criminal.
Who stole things? (Score:2)
No one is being charged with stealing things. They are being charged with (to extend your analogy) telling the newspaper what an idiot you are for hiding your key under a rock.
Re: (Score:2)
That's not what happened at all. If you must have a key analogy, here's what happened.
You gave your key to a company for safekeeping. He walked up to the company and asked for your key. They gave it to him. He, in turn, gave it to a news company to point out how flawed the "security" was of the company you gave your key to.
Re: (Score:2)
But if i hand you a camera, you go and take pictures of all your credit cards and hand the camera back to me, is that a crime?
Lets be real here. There was no house, there wasn't a door, there was no security at all. There was no theft, no loss of property. Just a company caught with it's pants down giving out it's customer's sensitive information. Sure, you had to know where to go to get
Re: (Score:2)