Hacker News Reader

Comment by mabbo | Hacker News Reader

For anyone not following what was done here: they added a tracking pixel. This is a single-pixel image with "src=<myserver>". You send it to someone and get the IP address of everyone who opens the email because they download the image. (This is why your email client asks if you want to open images).

It's not malware, really, and it can't harm a local computer that opens it.

But it is a sign that the prosecutors in this case believed the reporter would forward the email on to their source, giving the prosecutors the IP address of that person. And there is some question of whether that's ethical or not.

View on HN

It was a visible logo apparently, not just a pixel.

> The tracking software appears to be “an unusual logo of an American flag with a bald eagle perched on the scales of justice” included in an email from the lead prosecutor, Navy Commander Christopher Czaplak. Images in email are routinely used for tracking purposes, though the image files are typically transparent. Navy technology, it seems, is less subtle.

http://www.caaflog.com/2019/05/14/navy-prosecutors-accused-o...

It's worth noting that some email services automatically add such tracking pixels (usually marketed as "email open notification"). The user normally has the option to turn it off, but might not be fully aware that they are in effect violating the privacy of the email recipient and any places the email is forwarded.

It is pretty normal in the advertising world to use these features. Some mail clients (for example gmail) load these images without prompt by default (although they do so via an anonymizing proxy).

I'm really surprised that the recipients aren't following basic email security protocols here: don't allow HTML rendering of emails, don't allow linked images to be referenced and used, and don't open attachments that you weren't expecting to receive.

Seems like they were. It was discovered, after all.

Are you really surprised though?

I am, although I know that I shouldn't be. I just would like to think that people in professions that are more likely to attract attackers take more care about these things than the average person.

At the very least, you could chalk it up to human error.

Technically speaking, you don’t add a tracking pixel. You add a link to something the client loads. The server on the other side can send whatever he wants, even different things to different clients. And given that there have been vulnerabilities in image parsers more than I wish to remember, that may quite well be malware.

You just defined a tracking pixel. Ok, technically it is larger than a pixel, but if the server with the image is harvesting information about the client to learn something about the user, then it's tracking the user.

There's no question, really. It's not ethical by any means. If it wasn't a military court the judge would spank them, hard. But the defense could still report the prosecuting attorneys to the state bar.

Right. It's just like how we consider lawyers sending certified mail totally unethical because it allows the sender to know that the receiver received it. Shame on them.

I think it's ethical. Why do you think otherwise? What is your hypothetical basis for reporting it to the state bar? What Model Rule do you have in mind that it could possibly violate?

This is clearly an attempt to gather evidence about the defense and the journalists involved. It is also likely that they are attempting to identify the source for the Navy Time's reporting.

Here's an analogy from the civilian world: An employee reports an OSHA violation. Their employer is fined and forced to spend money on fixing the violation. Angered by this, the employers management tries to find who reported them to OSHA.

They were caught doing something wrong, and now they are trying to identify who caught them doing it. The ethical response is to admit wrong doing and make it right, not intimidate your opponents. If you don't understand that I'm not sure there's much debate to be had.

Okay so what ethics rule are you claiming was violated?

https://www.americanbar.org/groups/professional_responsibili...

I don’t think they meant “ethics rules of just lawyers.”

It’s unethical because the only reason they are trying to unsurface the leaker is so that they can potentially punish them to discourage that behavior which revealed bad behavior in the first place.

The comment discussed reporting them to the state bar. The state bar only enforces ethics rules of the type I'm discussing.

If the original comment far upthread was contemplating reporting someone to the state bar for something that didn't violate state bar ethics rules, then that's even more egregiously inflammatory.

That is true, but I think those were two unrelated points. That is “... is unethical” and also “they should report to the state bar.” I believe that was the original intent of the commenter, since the sentences did not directly follow each other in his paragraph.

Where there's plenty of cases out there but I'd ask you why you think that opposing counsel attempting to violate attorney/client privilege is ethical?

If there are "plenty of cases," then cite one. You're making the accusation. Provide the basis.

Perhaps if this is a courtroom in a trial, but he is under no obligation, legal or otherwise, to do research for you. All information he provides is free and under no warranty to be correct. Think of it as a pro-bono donation of the truth (from his perspective of course).

It is up to you, or the reader, to choose to believe him or not and the information he provided is already more than he is obligated to give to enrich your life with. It is, as you put it, a “good place to start” if you wish to google more yourself.

If you don't like him just say so and move on. Trying to rationalize and then justify non-substantiation in an argument by playing this burden of proof shifting metagame wastes everyone's time. Just because you dressed up your assessment in this snide court language doesn't make it any better.

No. It is up to the proponent of a proposition to offer evidence of its truth.

Perhaps those with no legal training should be the ones Googling, since many here clearly have no idea what they're talking about.

There is no oxygen in space (any area reasonably far from a planet). My lack of citation does not make it any less true. And if I were to try to convince you of that fact it would be simply for your benefit.

Think of any comment by anyone here as someone graciously providing you with free counsel out of the time of their day, with the big disclaimer that they are not your client, and that the information is under no warranty. This disclaimer is implicit on all internet comments. It is up to you to consider their claims, and verify them. If you’re not willing to research their claims yourself then it’s pretty clear that

1) you’re just here to argue for one side to the public (aka propaganda)

2) pursuit of the truth is not actually your goal

Given that your profile states that you are both part of the military and also a government lawyer may indicate that both 1) and 2) are true.

I think you’ll be hard pressed to convince people they are wrong simply by accusing them that they are wrong due to lack of evidence. There is no court here, no jury to decide you win or lose. You can contribute more to this discussion by offering your unique perspective given your background.

I think there is actually oxygen in space. maybe not as much as on Earth, but it's still there

https://pubs.geoscienceworld.org/msa/rimg/article-abstract/6...

I agree with you that many people in this thread are talking out of their asses, but as a thought experiment, would it be unethical for an Prosecutor to plant a tracking device on the car of a Defense attorney? Is there a legal difference between that and attempting to track the behavior of the Defense attorney online?

> It's not malware, really, and it can't harm a local computer that opens it.

Can't harm a local computer? I think you're wrong.

Malware has often hidden inside of specially-crafted images.

Reply on news.ycombinator.com