Hacker News Reader

Comment by rayiner | Hacker News Reader

Government documents and web servers are private property. (The information within might be public, but it's illegal to access private property in an unauthorized way to get public information). Ordinary law-abiding people do the things that property owners expect them to do (or what they reasonably infer the property owners intend them to do). If there are signs (literal or figurative) that the property owner doesn't want you doing something, then you don't do it--and you're charged by the law with heeding those signs.

That's not Orwellian or authoritarian--it's a basic part of "social" behavior in a society with private property.

View on HN

Files an a server may be considered "private".

However, when you make those files available through a web server, you make the "public".

You then have the ability to limit the access to those files through any one of a large number of techniques to make them private again. Now if there were evidence that they tried (and failed) to use one of these techniques or that the teenager in question deliberately circumvented these techniques, then you would have a point.

One (not particularly good) way of limiting access to files without verifying identity would be to create a hash (say using the requesters email address and the request ID) and use this in the url to access the document (similar to how google docs implement sharable document links).

If they had done this, then perhaps you could legitimately claim that there was evidence of intent to restrict access.

An incremented ID is the opposite. It is a sign that you wanted people to be able to easily predict the correct url to download the next file from. Using an incremented ID is in fact evidence that this information was intended to be public.

Except this teenager was explicitly authorized to access all those files.

He literally asked the web server "can I have these files" and it responded with "yes, you are authorized, here you go".

If he wasn't authorized, the server should have responded with a 403 Forbidden!

Web servers are built around authentication and access rights! It is not the teen's fault that the government doesn't know how to configure them properly.

Failure to properly secure one's private property does not make it legal for someone else to access it.

Except they’ve been given access. The server should represent its owners in its sharing of data.

Failure to properly secure one's private property does not make it legal for someone else to access it.

It doesn't matter if we're talking about physical property in the real world or virtual property on a server.

It does if that other person has a reasonable expectation that you intended for it to be public.

Leaving your property on the curb is a good example. If someone takes it, you would be hard pressed to get it back from a legal standpoint.

This is very similar. The government left all those documents on the curb.

Sorry- I edited. What I’m saying is that the server represents its owner, so when the server grants someone access in normal operation it’s not intrusion.

Servers don't grant access. People grant access. People can make mistakes and set up servers to mistakenly allow access to things.

Making a mistake doesn't revoke someone's property rights.

> Making a mistake doesn't revoke someone's property rights.

This is a non-sequitur, nobody is saying anything about anyone's property rights being revoked.

The teen asked for access, and the content owners, via the permissions they had configured, granted it. Sure they can later decide that this was a mistake, but that doesn't make it theft for the teen to have asked for access.

Making a mistake doesn't revoke someone's property rights.

They made a mistake when configuring their web server. It's obvious that this was a mistake because some of the documents contained private information from Canadian citizens.

> They made a mistake when configuring their web server. It's obvious that this was a mistake because some of the documents contained private information from Canadian citizens.

Per the tech article, it was an open archive of public documents that the government published periodically. The reasonable assumption is that the files were all public, and there's no reason to suspect the teenager in this case thought otherwise. The fact that ~3% of the files weren't properly redacted (whatever that means) is hardly "obvious".

> Making a mistake doesn't revoke someone's property rights.

Let's keep things constructive please.

Putting it out on the curb with a "FREE INFORMATION" sign, however, does. And this kid is being thrown under the bus for taking it all because it was on a site labeled FREE INFORMATION.

Ummm... You put your furniture on the curb or your trash, then accuse someone for stealing it? If it's private it shouldn't be on the curb. Anything on the curb is considered public. Clicking a picture of anything on your curb is also considered public. If you wanted to keep it a secret, you should have bought a box and kept it in the locker.

Edit: after few days you realize that the trash on your curb shouldn't have been there. Then you raid the trash company because your brother is a cop.

> If there are signs (literal or figurative) that the property owner doesn't want you doing something

But there weren't in this case. The express purpose of the site was to make that information publicly accessible. If you leave stuff out at your curb with a sign that says "Free to all takers", and someone takes something you didn't mean to put there, how are they supposed to know you didn't want them to take it?

What literal or figurative signs were there that he should not have accessed the private information? By all accounts, most of the information he retrieved was clearly intended to be public so there would have been no way for him to know that he wasn't supposed to access the small portion that wasn't intended to be public.

Reply on news.ycombinator.com