Comment by qop | Hacker News Reader

Comment by qop | Hacker News Reader

Do NOT redirect to a .gov website.

CFAA is a tractor beam they can use against anyone they don't like.

I work cyber security (well, mostly application security these days and not so much networking/telecomms) and I've also been involved with a small spat as a contractor a few years back. Basically, I had broken a collection source for the FBI by fixing and securing a resource for a certain department for a certain state, and maybe hypothetically it had to do with a very sunshiney state and maybe hypothetically it was a department that involved wheeled objects.

The firm I worked for was contacted by an investigator, which, lemme tell you, when an FBI agent appears at your work and asks your boss what sort of assignment you're working on, have no illusion that he's not about to cover for you in any way. Not that I did anything wrong. So anyways, the investigator asked me why I made all these WAN changes and about what packet filtering I had added/removed/reconfigured, all this technical domain knowledge and be really had a good idea of what I was actually doing. So I was comfortable. Eventually he left, basically saying we may be contacted further or potentially if the "investigation" became more serious, be made to appear in court.

Well the following week, a different guy comes in, and basically sealed me in our little coffee room and interrogated me. I was cooperative as I could be because I thought he was well informed like the other guy and generally had an understanding with my work, but he was a complete asshole.

It ended up that (thank God) all my paperwork was in order and my contract was pretty intensively detailed about what work I was going to be doing, I hired an attorney and he took good care of me. Never made it to court, but I ended up owing the lawyer a couple grand (funny how THEY always get paid) and yeah. Luckily I didn't go to federal prison, and my gratitude pushed me to greener pastures and better states.

TL;DR, your judgment has gotten you this far, so trust yourself, but I've poked the government before and I almost went to federal prison. Ymmv

Has this occurred more than 5 years ago?

Because if not, you're not out of the woods.

I hired the attorney too. I thought (and he thought) it wasn't ever going to make it to court. I moved on to a different job in a different state. Years later, surprise surprise.

NEVER say anything but the word "lawyer" to a law enforcement official. FBI agents make a policy of not recording interrogations (euphemistically referred to as "interviews") with anything but their own notes. Every word you thought he was trying to put in your mouth, he did, successfully, and when and if it makes it into court, it's your word against his, and nobody will believe you.

Yeah this was in 2002. I never heard anything since then about it.

I realized later how badly I fucked up that second interview because you're right, I shouldnt have said anything. It's embarrassing but I was more or less "good fed, bad fed"'d.

I've not had any major incidents of this nature since then, but rest assured, I know what to do now.

Were you a contractor too, or a state employee? How bad did it end up?

Pretty bad. It hasn't ended yet, and it won't for years to come.

The bad part is that the agent's notes can be used to convict not only you, but other innocent parties as well. That happened with me- I've never talked to an FBI agent in my life, but after being woken up half-naked with 17+ FBI agents storming the house and pointing M4 assault rifles at her head, trapped in a fenced backyard, my wife did talk to them, no Miranda warning (2011).

Naturally, half the things in the notes were literally impossible for her to have said. The agent himself didn't even memorialize them in a 302 until 2 days after the whole-house search and seizure. That was good enough for the judge to call it consensual and admissible.

For more details, mattchannon dot org.

Good God, it's depressing what they're capable of.

Don't talk to police:

https://www.youtube.com/watch?v=d-7o9xYp7eE

What to do:

https://www.youtube.com/watch?v=b8S4isIxo2w

It's simple really:

https://lawcomic.net/guide/?p=2897

> but he was a complete asshole

What did he do?

He would frame my answers in such a way to assign malicious intent, accuse me of trying to siphon data out of the system or maliciously make the system less efficient.

"oh! I see, you want to stop the government from looking up drivers' social security numbers..."

"no, but that data doesn't need to be in the same table that the civilian website queries from, just in case."

"just in case what? Just in case I don't catch you stealing civilian's personal information? Just in case I don't catch your ass performing treason in my goddamn system?!"

"no no no, I'm just saying that information should be divided according to where it is expected to be used from, that way if there was ever to be an incident, the more sensitive information is farther away from where the attack surface is"

" so you've thought this through, tell me: how are you gonna do it? When I'm not looking, you empty out a government database and sell it to someone. Who? How? When?? Are you gonna make me sit here all day before you tell me?"

That type of shit.

Reply on news.ycombinator.com