https://web.archive.org/web/20151115154842/http://krebsonsec...
Thanks for giving a link to this post!
http://webcache.googleusercontent.com/search?q=cache:kaymYsb...
(it's the "strip=1" parameter in the URL)
Plus, threatening to kill Krebs' wife.
But since we're talking about ethics here: Sure, now that the hacker faces 30 years in prison, he's not short of probably sincere apologies. I could really believe that he now has changed his view and accepted his guilt. It makes me ponder the thought of if I were Krebs' to not only feel sorry for the guy but (if it were legally possible) to dismiss the charges against him.
Consider the much more likely outcome of the hackers' plan: That it worked. Would the hacker had the same sense of guilt then? Or the same sense of forgiveness as Krebs or me seems to have? Maybe. We'd never know unless he did. It's more likely, he would have enjoyed Krebs' ruined live. Maybe even continued to threaten his wife and family. Just for the fun of it.
Because doing that in the anonymity of the web makes it easy to misbehave in ways no one ever would in front of the public eye and even less in the eye of his family and friends.
If you forgive them, they might just do it again.
I don't think he deserves 30 years either, but he should still go to prison.
I think thirty years is extreme, but I think the hope is that this will serve as an effective deterrent against this kind of crap.
"Fair game" excuses collective punishment, then? I'm not so sure.
Also, a "wife" is a person. How do you justify retaliating against someone by harming someone else? You steal my car, I beat up your wife- hey, "fair game"?
I don't think Krebs was right to dox the hackers wife.
She's her own person. If being married to an asshat is a punishable crime then many people are even worse off than they realise.
But Krebs retaliated in kind.
I do however think that's a punch he should have pulled.
So, should Krebs have flown over to Russia and beat the shit out of her? That would have definitely "scared her into leaving" the guy.
Again: how is it "fair game" to punish one person for the actions of another?
Yeah, but the question is about right and wrong, not accepted USA norms.
The main point here is: this anti-social behaviour of the Hacker was made possible because of his anonymity.
Anonymous towards the legal system but anonymous towards his private life as well.
It is fair to assume he kept his cyberbullying activities to himself because she wouldn't support that.
The hacker's wife was probably more endangered by continuing to be living next to a criminal.
What someone does while they're being watched isn't a good judgement of their character. What matters more is how they behave when they're not being watched.
Unfortunately when you deal with criminals, you can't really justify any behavior on either side since they are both operating outside the bounds of the legal system. Outcomes are mooted in the context of the world they are operating in when it's devoid of rules, honor and morality among the participants.
It's not difficult to open a bank account in your spouse's name without his/her knowledge, and use that account to do things he/she wouldn't do.
When I was in middle school and the internet was still fairly new (we had just gotten it) a classmate of mine hatched a terrible plan to get rid of a teacher he hated. He waited until the teacher was out sick one day then during the substitute's typical teaching pattern of having us "read these 3 chapters, answer questions then keep your head down until class is over" he jumped on the teacher's computer. After reassuring the substitute that he was allowed to he tried desperately to find child porn. His plan was to save it into semi hidden folders onto the computer then later on turn the teacher in for having child porn.
Fortunately this classmate wasn't able to find any and eventually gave up. But I've always remembered his plan. It's terrifyingly believable that if someone managed to get into your computer and download child porn, there is likely little recourse or way to prove you did not do it.
But file creation dates are easily changed by a skilled hacker.
And what if the teacher was not on leave or sick, but just in the school's cafeteria, or briefly in another class, etc?
Good luck proving anything with the dates, especially after several months, where nobody remembers who was where at that random day in the past.
Are there any cameras in the school that might have captured his visit to the cafeteria? Review the footage.
How did he pay for his food? Did that create a record that can establish a time and location?
Are there any witnesses who saw the kid sit down at the computer? Like the substitute teacher, for instance?
None of this is unique to child porn cases. Establishing or disputing time and location is basic trial strategy. All a defendant has to do is create reasonable doubt, not conclusively prove innocence.
And they'd remember they saw him after 6 months, and even more so that they saw him leave in 15:20 instead of 15:10, because?
>None of this is unique to child porn cases.
No, but all this make "I didn't change them because filestamps in file are in an hour I wasn't there" difficult.
Heck, the teacher himself will probably not remember where he was at the time the timestamps show...
Once an accusation of child pornography (creation or possession) is put out there if any of it gets exposed to the public by the way of the media (and it will) that person's life is seriously ruined even without prison time.
The problem seems to get worse, too and I certainly don't have any good ideas regarding it. Except maybe re-tooling a new search engine that somehow can take context / validity into account but that's exceptionally difficult to do. And even then if someone gets their news or information from any other source you're still screwed.
Because think of the children.
Possession and distribution of child pornography is perfectly legal if you're the FBI though.
Fortunately I know you can integrate with that hashing project (I forget what it's called) where they generate a hash for known images of child porn so those can at least be removed automatically but I don't know how much of a percentage that catches.
Each video frame is a separate charge...
Yes. In such a case, a presumption of innocence would be true in theory but of no value at all in practice. Such an attack could even be carried out remotely -- an attacker could compromise a machine remotely, then plant incriminating evidence on the compromised machine (i.e. child porn, terrorist literature, drug-dealing evidence, etc.), then alert the authorities.
This plausible scenario is another reason to vigorously protect one's computer against external attacks.
A few years ago when I worked in computer forensics there was this big myth that if you went on porn websites and one of the images was underage you'd get done for it. However intent is a big part of law and so there would always have to be something along with "just an image" showing some intent to have obtained and viewed it.
What kind of court routinely convicts people who didn't actually do the crime?
Possession of narcotics is a crime, isn't it?
Surely you don't think you should be the one going to prison if someone broke into your house and planted 10 kilograms of cocaine under your mattress?
> Surely you don't think you should be the one going to prison
I don't think you "should" go to prison, but I'm saying that's likely how it would go down. So it's analogous to the files on a computer situation.
In contrast, German law defines possession as "having effective control" (with some more nuance obviously). Possession is also entirely different from ownership in German law. I can not control an object I have no knowledge of. If you place an object in my house, I only gain possession of it once I discover it.
I think this is one of the cases where the civil law approach of rigorous definitions is clearly superior to the common law approach of establishing precedent.
The word "routinely" might be contentious, because we have almost no numbers on it and the law has a way of making things "true" despite reality, but the kind of court you're referring to is just called a court.
You might google the Innocence Project, if you're interested in this sort of thing.
This topic always drives hyperbole here on HN and I'm not sure why. Investigators and prosecutors don't waste time trying to entrap innocent web developers. They are kept plenty busy by people who are actually making or distributing child porn. Source for that: I know someone who prosecutes child porn cases. He is kept incredibly busy with obvious scumbag criminals.
Law enforcement's ultimate goal is always to walk the chain of possession back to find the folks who are actually making the imagery--who are actually abusing kids. That is why there is strict liability for possession. It gives investigators a lever to flip distributors to help find the sources.
Dropbox (and all other "cloud storage" providers) actively scan for CP material and will turn you in to the police automatically.
We have sleepwalked into being a police state and barely anyone seems to care.
Police have also started trawling Reddit to look for thought crimes. [1]
[0] http://m.theregister.co.uk/2014/08/05/whatsapp_smut_convicti...
[1] https://m.reddit.com/r/unitedkingdom/comments/53y1wi/a_reddi...
"<...> police stopped them for unrelated matters and discovered the shock images upon inspecting their mobile phones"
What?? So police in UK can now ask to inspect inside your phone without any warrant or even reason?
I know you can be jailed here for refusing to hand over an encryption key. I don't know whether your passcode / fingerprint counts as an encryption key in they eyes of the law.
1. They weren't convicted of any crime.
2. The person was charged because he racially slandered someone. Not because of a thought crime.
"Oh it's not a crime to think, just to let other people know what you're thinking". Do you seriously think that makes any sense?
2. Why should this be illegal? Yes, it's offensive. But I don't think offending someone should be a crime.
Perhaps they weren't entitled to legal aid? I was under the impression that anyone charged with a criminal offence was entitled but perhaps I'm wrong.
Maybe they just wanted to get the whole thing over with quickly and not face further embarrassment? It's a good example of how these types of charges could easily be used by the authorities to intimidate people. The damage is done whether they are convicted or not.
To answer your question, it seems you can appeal regardless of how you pleaded [0]. But you have to do it within 28 days.
[0] https://www.gov.uk/appeal-against-sentence-conviction/crown-...
And that's exactly the problem: we have layer upon layer of vague and badly-written legislation, which ends up creating terrifying loopholes like the one described above.
My tinfoil hat paranoia is not quite at the level of thinking they're doing it on purpose (although I wonder sometimes).
But it's easy to see that indiscriminate surveillance combined with these vague laws create a situation where anyone could be victimised by the authorities. It's a totalitarian dictator's dream.
The thing about this stuff that's really alarming is that any random script kiddie could also do this by coaxing your machine into downloading something. That greatly increases the surface area of people who can screw you. Given the abysmally awful security profile of a lot of consumer software and devices this is very plausible.
You're likely familiar with this concept in the context of speeding tickets. All that needs to be proven is that you were, in fact, speeding. It doesn't matter if you could not have been aware of your violation due to, say, a speed-limit sign that was blown away by a storm. If you were provably doing 55 in a 45 zone, you have no recourse.
The argument for absolute liability with speeding violations is purely practical, I believe. The reasoning is that it's not a crime, per se, so the trade-off of individual protection vs expediency of trials is deemed worthwhile. Clearly, the same is not true of child pornography convictions.
Actually, that's "strict liability".
> All that needs to be proven is that you were, in fact, speeding. It doesn't matter if you could not have been aware of your violation due to, say, a speed-limit sign that was blown away by a storm.
That probably does matter, since exceeding the speed limit properly posted is usually the actus reus of speeding, so even to the extent it is a strict liability offense, the absence of proper signage for any reason (except when the speed limit is either the states maximum highway speed limit or a default limit for some other condition which does not require signage, in which case notice is provided by the law setting the default for the conditions, and the sign is a reminder) makes it so that no offense occurred. [0]
[0] Also, given that states do generally have default speed limits that apply in the absence of signage, one could easily argue that the absence of signage is itself a positive indication that the default speed limit applies, making available a U.S. v. Kantor-style "good faith" defense even under strict-liability principles. [1]
[1] https://en.wikipedia.org/wiki/Strict_liability_(criminal)#Un...
Not a lot, AFAICT; the main differences seem to be:
(1) "strict liability" is the term used in US (and, AFAIK, UK) law (though the latter seems to refer to a criminal offense to which strict liability applies as an "absolute offense"), both criminal and tort, and
(2) "strict liability" can be either an attribute of an offense as a whole or an attribute of an element of (the actus reus of) an offense (that is, there can be a required mens rea for some element of an offense, but if there is an element which does not require any mens rea, the element can be said to have strict liability.) From what I've seen, "absolute liability" is universally a trait of offenses-as-a-whole (though that may be because I've seen less about it, and am less familiar with the systems in which the term applies.)
http://www.legislation.gov.uk/ukpga/1978/37
> 1 Indecent photographs of children.
> (1)[F1Subject to sections 1A and 1B,] it is an offence for a person—
> (a)to take, or permit to be taken [F2or to make], any indecent photograph [F2or pseudo-photograph] of a child F3. . .; or
> (b)to distribute or show such indecent photographs [F4or pseudo-photographs]; or
> (c)to have in his possession such indecent photographs [F4or pseudo-photographs], with a view to their being distributed or shown by himself or others; or
> (d)to publish or cause to be published any advertisement likely to be understood as conveying that the advertiser distributes or shows such indecent photographs [F4or pseudo-photographs], or intends to do so.
[...]
> 4)Where a person is charged with an offence under subsection (1)(b) or (c), it shall be a defence for him to prove—
> (a)that he had a legitimate reason for distributing or showing the photographs [F6or pseudo-photographs] or (as the case may be) having them in his possession; or
> (b)that he had not himself seen the photographs [F6or pseudo-photographs] and did not know, nor had any cause to suspect, them to be indecent.
There are some amendments in the Sexual Offences Act 2003, but I don't think they turn it into a strict liability offence.
Real-life sexual offences, as in actually attacking a child, is strict liability.
here is him talking about it: https://www.youtube.com/watch?v=CzdFOpRTvyU
Even if declared innocent, being charged on suspicion of possession of such porn is a life-long stigma that never wears off. For example, it will be impossible for a foreign citizen to obtain a US 'ESTA' visa waiver after such suspicions.