Hacker News Reader

Comment by robk | Hacker News Reader

That seems like a very reasonable process. Nothing unusual anyways.

The only part I take exception to is the hyperbolic kill portion of, "intent to kill, injure, harass..." of the complaint. Seizures are unpleasant, inconvenient, and you might get injured on the way to the ground but they are rarely fatal, and if the victim was known to be at risk of such, he would be in an ICU somewhere. Did the perpetrator intend to kill? That might be hard to prove.

> “Spammed this at [victim] let’s see if he dies,”

Seizures can kill and this is widely known, so widely that we got instruction in high school on how to deal with a seizure victim to make sure they don't die.

Surely someone sending a seizure inducing picture to someone they know is prone to seizures is well aware of the risk they are taking, they are definitely not doing it to give them a monitor induced suntan. See perps quote above, definitely a slam dunk for intent.

Griefers don't care about the damage they cause, the more the merrier.

That quote sounds like common smack-talk rather than a genuine statement of intent. I think you could hang "intent to do the victim harm" on the combination of that and the actions here. But, actual intent to cause death? I'd want to see much more than mention of dying - "do that and I'll kill you" or "I hope you die", or similar, must have been said a trillion times in situations where actual death was _not_ intended.

12 angry men.

Sorry, I don't understand the implication of your reference?

And I totally missed your reply. Apologies. It's a reference to an old movie that explores that kind of situation leading to an acquittal.

The clauses aren't as strict. The criteria's merely intent to induce fear/distress.

> whoever (2) with the intent to kill, injure, harass, intimidate[...] or intimidate another person[...] in a course of conduct that—

> (A) places that person in reasonable fear of the death of or serious bodily injury to a person described in clause (i), (ii), or (iii) of paragraph (1)(A); or

> (B) causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to a person described in clause (i), (ii), or (iii) of paragraph (1)(A),

> shall be punished as provided... [0]

[0] https://www.law.cornell.edu/uscode/text/18/2261A

Page 7 there are some DMs. "Spammed this at [Victim#1] lets see if he dies".

While his own DMs might be construed to be hyperbolic, he's done himself no favours there at all, and his defense attorney is going to have the fun task of trying to prove that.

That was my first thought too. After reading the document, it's pretty clear he acted with intent. He visited websites to figure out how to make images that trigger seizures, clearly created the gif for maximum impact and chance of a seizure, which he knows could be fatal. It was planned and well thought out.

An 8 minute seizure is really, really bad. That was probably very close to fatal.

See page 7 of the affadavit. The perpetrator sent a series of direct messages to another Twitter user stating:

> I hope this sends him into a seizure

> Spammed this at [Mr. Eichenwald] let's see if he dies

> I know he has epilepsy

So, the intent to harm and/or kill is pretty damn clear.

What the statute says[1] is "the intent to kill, injure, harass, intimidate, OR place under surveillance with intent to kill, injure, harass, or intimidate another person."

The affidavit in the complaint does say "AND" but maybe that's just a calculated legal ploy, where they can still fall back on the "OR" of the actual statute?

1: https://www.law.cornell.edu/uscode/text/18/2261A

Status epileptics can definitely be fatal. Epileptics are at serious risk of death from seizures or seizure-related injury so I would not be so dismissive of the risk.

That's not hyperbole, it's just the wording directly out of the law they're charging him under:

https://www.law.cornell.edu/uscode/text/18/2261A

And in full context it says:

… engages in conduct that—

…

(2) with the intent to kill, injure, harass, intimidate, or place under surveillance with intent to kill, injure, harass, or intimidate another person, uses the mail, any interactive computer service or electronic communication service or electronic communication system of interstate commerce, or any other facility of interstate or foreign commerce to engage in a course of conduct that—

__(A) places that person in reasonable fear of the death of or serious bodily injury to a person described in clause (i), (ii), or (iii) of paragraph (1)(A); or

__(B) causes, attempts to cause, or would be reasonably expected to cause substantial emotional distress to a person described in clause (i), (ii), or (iii) of paragraph (1)(A),

So they're not trying to prove "intent to kill". They only need to prove "intent to intimidate anther person" using an "electronic communication system of interstate commerce" that either for (A) "places that person in reasonable fear of … serious bodily injury", or for (B) "would be reasonably expected to cause substantial emotional distress".

Seems to me they've laid out all the evidence needed to show that - the only thing a court needs to decide is if that evidence is all true and admissible.

I wouldn't want to be the defendant here.

Agreed. This appears to be the ordinary process.

Can anyone point out what might be of interest here.

The only thing I can point to us this is one of the few cases where some piece of atrocious online harassment actually ended up with someone being held accountable in anyway. There have been plenty of cases of death threats and bomb threats and other such things that didn't seem to trigger any kind of real response.

Good point.

Maybe there are many other cases but they go under- / un-reported?

Isn't it way easier now to find harassers on Twitter because Twitter made a telephone number linked to the account mandatory in some (all?) cases?

They typically don't qualify as criminal threats in those cases. The FBI does investigate quite a few of these and I've seen more than a few from FOIAs that don't result in arrests because they fall short of being criminal. I'm still surprised at just how often nothing is done about swatting.

I find this case interesting. While it's far beyond acceptable or fair play even in good fun and trolling to do something like sending someone who suffers from epilepsy a gif known to trigger a seizure, it's being classed as stalking in this case. I'm curious to see the evidence and what precedent this sets, because it seems like a stretch to call it stalking from what I understand of this case, which is admittedly not too much.

A good side effect of this is that hopefully it prompts companies to provide better protections against this, because it's rather unique in terms of medical conditions interacting with technology and has a lot of potential to cause harm.

It was interesting to me because of how ordinary it was. I just assumed the user would be doing this from a regular computer, and that the police tracked down the IP. Not that the suspected troll would be dumb enough to use his own phone number to register for Twitter. And be someone who is "Clever" enough to use a pre-paid account but then dumb enough to sync data to iCloud. But I guess it's easy to erroneously conflate Apple's device security with iCloud security.

These are common mistakes of cyber criminals. Usually people get caught because they miss a point of data leaking. A commom one is people using a VPN and then accidentally opening their browser that's still logged into Google...All of a sudden that IP is now linked to you personally. If you're going to commit crimes online keep everything separated and use a VM or better yet a different device altogether.

>But I guess it's easy to erroneously conflate Apple's device security with iCloud security.

You might be overthinking it. I get the feeling that many people think of "online" as some sort of magical place where they are shielded from the consequences of their own behavior.

I think it serves as a good reminder that it's quite easy for law enforcement to access anything that you have stored in your cloud accounts. We tend to get casual and think of these as our personal backup pods that can't be accessed without our knowledge.

It's good to remember that Google holds the keys and that they are used according to legal procedure (as in this case), and at times, according to Google's fancy (as in PRISM and I'm sure many incidents of unauthorized employee spying).

Pay attention to what you upload, and pay attention to what you're using. It's very easy to cross-contaminate or leak information, and these things can have a very long tail. "The internet never forgets".

Dread Pirate Roberts aka Ross Ulbrecht was eventually tracked down because early on in the Silk Road's lifecycle, he made a post on a btc talk account linked to his personal email account asking if "[anyone had heard about this new marketplace called Silk Road]". Since that was the first mention found online, agents began to investigate Ulbrecht.

It may seem obvious in hindsight, but that was a single long-forgotten post made years before anyone had an inkling of what Silk Road would become. Strict opsec is very important.

It doesn't have to be something unusual or extraordinary to be interesting. Personally I found it pretty interesting simply to see how the wheels of justice turn, just like I used to watch detective shows when I was a kid.

One odd little thing that caught my eye: the way they used archive.org to establish some history of the victim's Wikipedia page. I would have expected that they would have used Wikipedia's own edit history for that. It made me wonder if the FBI agent just didn't know about the Wikipedia edit history, or if they thought archive.org was a more reliable source.

Reply on news.ycombinator.com