Blogger Fined €3,000 for 'Publicizing' Files Found Through Google Search 248
mpicpp points out an article detailing the case of French blogger Olivier Laurelli, who had the misfortune to click links from search results. Laurelli stumbled upon a public link leading to documents from the French National Agency for Food Safety, Environment, and Labor. He downloaded them — over 7 Gb worth — and looked through them, eventually publishing a few slides to his website. When one of France's intelligence agencies found out, they took Laurelli into custody and indicted him, referring to him as a 'hacker.' In their own investigation, they said, "we then found that it was sufficient to have the full URL to access to the resource on the extranet in order to bypass the authentication rules on this server." The first court acquitted Laurelli of the charges against him. An appeals court affirmed part of the decision, but convicted him of "theft of documents and fraudulent retention of information." He was fined €3,000 (about $4,000).
Saving face by hurting innocent people (Score:5, Interesting)
I HATE it when governments do this. They can't simply admit to having made a mistake and made those files public (albeit difficult to find). They have to fine this poor person just for coming across something interesting and posting it.
Fuck them. Fuck them hard with a chainsaw, every last one of them who pushed for this.
Re:French government (Score:4, Interesting)
How can you appeal an acquital?
Re:Hacker??!! (Score:4, Interesting)
French law and government is just simply fucked. There really isn't a better word to describe it.
They try to legislate all kinds of stupidity and it nearly always backfires on them. Just take a look at all the laws they've passed to improve employment in their country. Laws that fine employers for layoffs (guess how that turned out? Hint: all sane companies just laid off a bunch of people before the law came into effect and have less desire to hire anyone else), price fixing of books in a futile attempt to save bookstores, taxing the shit out of any company in an effort to fund a spendthrift government, it goes on and on.
http://globaleconomicanalysis.... [blogspot.ca]
The constant meddling has driven so many companies from their country, it just puts them in the hole even further. Speak out against any of the stupidity and rather than attempting to smarten up, they'll try to fine you. What a disaster. It's no surprise they came up with this dreadful verdict.
Re:Hacker??!! (Score:1, Interesting)
What the fuck is it with autistic geeks, seriously?
Technology is not the law. Technology is not social protocol.
Just because you CAN do something, it doesn't mean it's okay to do it. This creates a horrible survival-of-the-fittest arms race techno-bureaucracy where values are absent.
In particular, if the door is unlocked, that doesn't mean you can walk into the building and take photocopies of everything you find there, then publish the documents.
Although, unless I'm misunderstanding, the French appear to allow convictions on appeal, and to have recently reduced the number of jurors by 3 in all jury proceedings "to save costs". These are IMHO serious problems with the French judicial system.
Re:Hacker??!! (Score:5, Interesting)
Just because you CAN do something, it doesn't mean it's okay to do it. This creates a horrible survival-of-the-fittest arms race techno-bureaucracy where values are absent.
In this case, when a PUBLIC agency violates their own security protocol, and turns over all its internal documents to the internet, it means EXACTLY that it is OK to do so.
Your analogy of walking into an unlocked office fails the sniff test. (not to mention the stupid analogy test).
He did not break. He did not illegally enter. There was no door. He didn't deprive them of anything. The documents might as well have been stacked neatly in the public park, with signs and arrows pointing to the juicy bits.
The government agency already published the documents.
Re:Hacker??!! (Score:3, Interesting)
The mistake he made was knowingly publish documents that didn't belong to him and which he knew weren't supposed to be publicly available. If you read the article, the only information the authorities had in the beginning was that someone had documents they should have had and that the IP address used to access them was foreign (Panama, because of his VPN). They then traced that back to him which looked awfully suspicious. They had no idea he simply stumbled upon them through a Google search. So at first they were sure they were hacked, they didn't realize the link was right out in the open. The problem was sorted out but he still did the wrong thing by publishing documents that didn't belong to him. That is why he was fined. To me, its a fit punishment. He meant no harm but he knew he shouldn't have done what he did.
He even admits he did the wrong thing:
Re:Hacker??!! (Score:3, Interesting)
Re:Hacker??!! (Score:5, Interesting)
It's insane to try to prosecute the downloader. My 6 year old loves to watch youtube videos.
Alot of the words she knows how to spell like 'dora' and 'mickey mouse' are copyrighted.
How is she (or her grandma or anyone else) suppose to know that video A is ok to watch
but video B (which youtube is still getting ad revenue from) is copywrited and illegal.
Honestly half the time I can't even tell. I assume that full length movies on youtube
(yes there are quite a few, my kids stumble upon them all the time) are illegal but youtube
does a terrible job of enforcing it on all but the most popular movies and there is tons
of gray area as I'm assuming some of the shows like the disney ones are probably
actually licensed but then again even some of those have poorer quality and might
be bootleg. Prosecuting the downloader especially if the provider is someone like
google or youtube is like prosecuting someone because walmart sold them a bootleg
dvd.
Re:Hacker??!! (Score:5, Interesting)
Yeah this isn't a "door was left open" scenario. That scenario is more comparable to network infrastructure without a password on it like ssh. There is a door, but it's been left unlocked. This wasn't even a house (private network) this was a public place.
In the scenario we're talking about the object was both left in a public place and said public place was referenced in another. I can't think of anything analogous to the real world, but real world analogues only cloud judgement.
The bottom line is this had to be in a directory literally called "public_html" or the equivalent for IIS/Nginx. This folder, and it's contents, are shared with everybody. Not only that, but the URL was advertised in an unspecified public place. This URL was also indexed by google.
Further there were 7GB worth of files..plural..so directory listing was on. This is DIRECT EVIDENCE that the French prosecution/government is simply spinning things.
"In their own investigation, they said, "we then found that it was sufficient to have the full URL to access to the resource on the extranet in order to bypass the authentication rules on this server."
Obviously he didn't need the full URL if he was able to wget 7 gigs worth of text and/or pdf files. If he was able to download the entire directory there was no authentication mechanism to be bypassed, and the only offense by the French government is farcical. This has a double impact, as it also proves this was conclusively NOT an extranet by definition.
So if I was the defense I would say:
1) The "open door" example is intentionally (and obviously) misleading and biased, and that's probably the exact analogy they used. It seems like that analogy gets used in all court cases.
2) There is clear intent by the person who designed the server to make said documents public information. The intent is proven by a very simple fact: the site has been crawled by google. Without a robots.txt google will not crawl your site (at least these days.)
As this file must have been created and configured intent couldn't be any more clear.
3) To further prove the intent of the French administrator the files were (most likely willfully and knowingly) placed in a directory specifically marked for sharing files.
4) Laurelli never bypassed (or even provably encountered) any authentication mechanism whatsoever.
5) The French government's argument is non-unique as these documents were already made "public for advertising or promotional purposes" when indexed by google, and this claim is supported by google's own mission statement:
google's mission is to organize the world’s information and make it universally accessible and useful."
google's mission statement (by it's own admission) is to make the world's (what they choose..via indexing) information universal. This is obviously for promotional purposes of google and would fall neatly into the definition of "publicizing." So by crawling google announced their intent to publicize the documents, and by indexing said documents as step 1, we have both a provable intent and provable action moving towards publicizing the documents at hand. The next step in publicizing after indexing is of course to wait for users to access and share the content. This is exactly what my client did (teehe I couldn't resist).
In summation it is very clear cut that there is indeed only 1 victim here...but there are 2 villains in this story. The first (and lesser at least under French law) was the network engineer/admin who either misrepresented his/her ability, got lazy, or was grossly negligent.
The second, and greater villain, and the true perpetrator of this crime was google. For the intent of gaining profit using the French government's documents (which google indexed to grow their search database) in the pursuit of adding content for their userbase in an effort to grow said userbase and profit via advertising targeted to it's users.
Mr Laurelli is the clear victim of both goo
Re:Hacker??!! (Score:5, Interesting)
Thing is. In the US you can be tried twice for the same crime. It all depends on how far the prosecutor (and you) want to push things. This is what various appeals courts, all the way up to the Supreme Court are.
nopee. the first court is the only court that hears matters of fact, i.e. evidence, witnesses, etc. all the appeals courts only hear matters of law, i.e. whatever. further, if the defendant wins a court case, the prosecutors can't appeal. So, no you can't be tried more than once.
In the US, you can be convicted in absentia as well. Take Andrew Luster [wikipedia.org] as an example.
The supreme court has ruled over and over and over again that people have the right to be present at trial, and if a trial happens without them it is a violation of due process protections. Congress codified this in 1946 to lay out specific protections and enumerate specific exemptions. One exemption "the defendant waives his or her right to be present if he or she voluntarily leaves the trial after it has commenced". Your dude Andrew Luster bolted from the trial and fled the country. He got sentenced anyway.
You sir are my chief pedant of the peasant's pedant brigade. USA is an exceptional nation.