Hacker News Reader

Comment by notahacker | Hacker News Reader

I don't see why the CIA's apparently lax security means a crime isn't a crime. Just because the security guards should be fired for falling asleep and leaving the door unlocked doesn't mean that the burglar isn't guilty.

Sure, I don't think a kid trying to show off should face the same punishment as an adult doing something purely malicious, but "it was actually a surprisingly easy crime to carry out" should never be a reason not to prosecute.

View on HN

It should be a criminal offence to have such lax security if what you are protecting is so important.

It is hard to find obvious real world comparison for this kind of thing. Perhaps it should be thought of like food hygiene.

If you sell dangerous food you should take responsibility for that and not just blame the bacteria. But if someone intentionally infects food they should also take responsibility. Those two perspectives are not incompatible.

But the lesson is that bacteria and hackers will always exist!

I'd go for the classic bank analogy. Who's responsible, the bank that left the front and vault doors wide open all night while not bothering to hire any guards, or the guy that walks in, goes "bloody joke", and takes some lollipops from the counter?

99% of all houses are secured worse than any online account would be my counterargument, while holding items of much higher value, relatively.

Give me 15s with a crowbar and I will be able to enter almost any house. Crowbars are like 10 dollars at your local hardware store.

Physical security is almost always based on expected risk of detection and subsequent penalties, not prevention of ability to intrude, yet we somehow don't accept the same reasoning for digital security?

There is literally trillions of dollars worth of assets sitting around the world protected by nothing more than the idea of a closed door and some sort of expectation that a sheet of glass represents a barrier. Our society relies on a system where people respect the laws and have penalties enacted on them if they dont.

Both are. Common sense dictates that if you're moving millions around, you MUST have enough money to buy yourself some security at physical or digital level. I'm not saying CERN-level security, but at least SOME security standards should be fulfilled. If the bank doesn't care, then it should be punished IMHO.

Same goes for the criminal.No matter how lax the security precautions of the bank are, an individual is judged for his crime.

The problem with cybercrimes and digital-rights related material (piracy, etc.) is that punishments are usually disproportionately severe. I believe that the fault lies to lawyers who over-sensationalize these crimes and judges who are totally unable to understand the real vs possible damage. For example, a 15 year old hacker who found a 5-years old XSS and hacked (as in copied 15 MySQL databases) from a CIA/NSA/FBI website and post his IRC nick on the page to brag about on his friends vs a 35-year old spy who sold these info to some other country for huge profits. These are different situations but are most of the time treated equally by judges.

Automatically indicting parents of abducted children follows as one consequence.

Not quite. Lapses in security in governmental organisations can put millions of people at risk. This case was pure carelessness by multiple parties.

We pay a lot of money -via taxes- for the governament to protect private documents. Of course they are liable for this incompetence.

As is the person that actually stole them.

And yes, I also think that the weight of criminal penalties should generally place more emphasis on deterring people from trying to steal stuff rather than deterring people from working in infosec or security cleared professions. Not that I don't think there are potentially people who should no longer be working for the CIA as a result of this.

Reply on news.ycombinator.com