Hacker News Reader

Comment by treis | Hacker News Reader

In the picture timeline it says:

>Tiffany Filler is accused of logging in with the "Scott Shaw" account from her MacBook Air from Tufts' wireless network to view answers for a small animal medicine bonus quiz, then minutes later on her own account to take the quiz

That's smoking gun evidence. It's theoretically possible that she is the victim of an elaborate scheme to frame her but it seems pretty extraordinarily unlikely.

I don't quite see the evidence for the requirement of "detailed and extensive hacking ability". It seems like on administrator account was compromised and used to create/access other accounts. The initial compromise could be as simple as looking over a shoulder, swiping a post it, or guessing an obvious password. After that, it's just basic computer skills to do what they did.

View on HN

Seems to me like she hired someone to help her pass. They had remote access so they could make it look like she was taking the tests on her own laptop. They'd have to do it during times when she wasn't using it herself.

If she wasn't involved at all, how would she not notice that quizzes were being completed without her taking them? How would she not notice that her grades were improving?

> That's smoking gun evidence.

Even after you consider all the counter evidence, such as the time she hacked the network when working in a lab without computer access (according to many witnesses)?

I don't know what could have happened here, but going off the TechCrunch article, the school's story doesn't add up.

>network when working in a lab without computer access (according to many witnesses)?

Someone else was using her laptop.

So now she had an accomplice too?

That's quite a bit more reasonable than a mysterious disgruntled roommate extracting revenge through a convoluted cheating scheme over the better part of a year.

To me, the even more plausible scenario is that the school’s entire story is just wrong in some fundamental way. Who knows what was actually in their system logs. The school seems very eager to ignore anything that doesn’t support their case.

If she had an accomplice, that should have been the story presented by the school. But it wasn't. If you’re going to accuse someone of wrongdoing of this magnitude, you need to have a coherent version of events.

Or she had it automated to run a script when she wasn’t there.

That's a whole lot of effort for someone who according to the school didn't bother to spoof their MAC address.

And how exactly would you even attempt to do that when you can't even log in to see what you're working with, let alone test anything. Testing web apps with something like Selenium is hard enough as it is, trying to only work on it without access to anything while you're at the computer might as well be impossible.

Remember she had a housemate who had it in for her. And MAC addresses can be spoofed. And when attempts were made to contact that person, the person refused to respond.

The housemate's scheme didn't have to be elaborate in order for the spoofed MAC address to provide a smoking gun. It's dead simple. Beyond that, Tufts' theories are elaborate, or maybe a better word is torturous, but that's on them.

Focusing on cloning a MAC is a red herring, which we've unfortunately been pushed into from having to continually rebut this persistent nonsensical idea that it's some kind of fixed identifier.

The more likely scenario is a straightforward remote-access trojan installed by a housemate. Every other detail then falls out socially.

Ultimately, prosecution of computer tampering continues to reek of "burn the witch!". With emotionally charged terms simultaneously used to focus blame by ascribing superpowers to the defendant, while deflecting any competing theories as too complex for anyone but the witch.

Yep that's also a very likely scenario, I agree.

It works that way defendants too.

I was on a jury for a case where a guy plead manslaughter down to reckless driving because IT supporting various police agencies was inept or working with ancient junk and a expert witness was unable to explain how NTP works.

The defense attorney was able to dazzle and jive his way to dismissing the evidence. This happens because the issues are complex and the practice of IT is so poor.

/might be related

I've seen something similar in regards to a normal DUI case. The defense lawyer talking about 1970's RADAR tech in airplanes, NTFS filesystems, Windows Server, "md5 hashing protocols" and other items "related" to the case.

The judge was all sorts of confused and "phoned a trustworthy friend who worked in a fortune 500 company" for clarity.

That guy got out of a DUI after 5 x 2-3 hour sessions in court. 10+ hours of court to get out of a couple hundred dollar ticket, if that.

I really wonder what the lawyer fees were though. No way was he doing that for free or cheap. It was his first offense and this state is very lenient on DUIs.

Showed me exactly why I never want to be in court, on either side.

/leaving a lot of details out, but man, was it depressing to watch.

DUIs can be a lot more serious than just a few hundred dollar fine. They can result in the loss of your license (and consequently your ability to work), possibly several months in jail, and bar you for life from some countries (Canada won't let you visit if you've gotten a DUI.)

Spending many thousands of dollars on lawyer fees to get yourself out of a DUI can make a lot of sense unless you're in a jurisdiction that doesn't take DUI seriously. Of course it makes a lot more sense to only drive when bone dry sober.

Trust me, I know they can be serious, but

>> jurisdiction that doesn't take DUI seriously

That describes where this was at perfectly. Which is why I had put

>> It was his first offense and this state is very lenient on DUIs.

I probably should have used a different word than lenient, but it is what it is.

I would propose "rational". The level of animosity and punishment directed at checkpoint victims in most of USA is really quite amazing, and totally out of proportion to any reasonable understanding of the risks of automobile travel.

School networks tend to emphasize MAC addresses as an identifier, simply as a historical consequence of when those networks developed. A MAC address used to be more meaningful than it is now. For example, at my boarding school around 2008, the internet shut off at 11pm, unless you set your MAC address to the same as a library computer...

Point is, I can easily imagine a grumpy and misinformed IT person placing an unrealistic amount of confidence in a piece of evidence drawn from a MAC address.

That’s not even close to being smoking gun evidence. Courts treat all computer evidence as circumstantial, and the key for a forensics expert is to create such a preponderance of it that guilt is the only credulous explanation. Here you just have two events linked in time, and nothing establishing she was behind the keyboard.

And who’s to say she didn’t share the Scott Shaw account with others? She’s claiming that some of the times it was used she couldn’t have done it, not all of he times.

I think that’s pretty much the case regardless. Sometimes you just happen to be using your computer when someone hacks your account.

I think the answer is obvious, someone helped her.

I think the answer is obvious, they tried her without a defense. They never explored what actually happened.

Reply on news.ycombinator.com