"So why can't you sell this information to the FBI like you intended? Because we're going to give it to them for free."
As ill advised as messing with the FBI may be, this is a masterstroke. Hats off.
As ill advised as messing with the FBI may be, this is a masterstroke. Hats off.
Besides deals at that level are all political and given to their buddies. The person who gave the deal to HBGary is going to still fork over the money since what is a few $M between friends esp when they are not your $M.
But on Feb 13, I leave the keys in the ignition when the car's in my driveway and you take it and give it to Susie as a present from you to her. You get the love, I get screwed.
Is it really stolen if you just give the car to her and it just so happens to be the same car that I was going to give?
http://www.google.com/imgres?imgurl=http://www.thevrabec.com...
Say you're a guy in a pub and you overhear some private company contractors talking about just learning that a group of terrorists is plotting to blow up the Empire State Building, and mentioning some things in detail. You decide to tell the FBI about the terrorists, while they might refuse to give up their information if the price isn't right.
The better example is, you found out where her long-lost cousin lived, some guy eavesdropped, and HE told her where said cousin lived, and she jumped into HIS arms and drove off into the sunset. You are not now without an object that you formerly owned; you just planned to exploit a scarcity of information that no longer exists, and you're mad about it.
You also feel cheated because you were the one that did all the work to find her cousin, and he got all the benefit. That doesn't make it the same as stealing a car.
But in this case, the information was actually of little value, but because there was a scarcity of information in the first place, the FBI would have been none the wiser.
The ethics of spreading information are complicated. Oversimplifying them by comparing them to the ethics of stealing physical objects is wrong and bad.
You also feel cheated because you were the one that did all the work to find her cousin, and he got all the benefit. That doesn't make it the same as stealing a car."
There's Something About Mary
After all, you wouldn't download happiness.
Why do you assume that it isn't "born copyrighted" like almost everything else? (The big exception is pure data, such as the phone book.) The expression of observations is clearly copyrightable.
And then there's trade secret protection. The fact that they got hacked doesn't necessary void that.
Come on, we are talking about the rootkit.com guys. Not taking side is one thing, taking the opposite side is a completely different one.
Pretty much everything I learned for fun about rootkits, I learned it thanks to these guys.
I am speechless.
If you can't even get GET/POST/cookie escaping correct in PHP after years, you should probably not be building web apps.
It's a shame that their site is so bad when their book is so awesome.
I am speechless because they (started?) monetize going after the 'bad guys', while they have been publishing grey/black hat stuff on Rootkit.com for many years.
The trust is gone.
p.s. - if anybody can crack my password, I'll be impressed.
100% of my work is government contracting, thats not how this works. The only question is whether the FBI will ever use this company again, if the FBI thinks they are incompetent then HBGary is out of work. But if the FBI still believes they are competent then they will get another contract to find more information even if some of that information is already in the public domain. The FBI won't punish them for a criminal action. At my job, just because something leaked through Wikileaks doesn't mean its unclassified. We still abide by all the rules and you can get in a lot of hot water for talking about something off of Wikileaks that you do not have need-to-know on. It's as if leaks don't exist to the government.
You or I, and many companies would take advantage of the situation and just use the publically available information and not pay the PI firm. But this is the government. They operate in a whole different ballgame with a different set of rules. Anyone pointing their finger and laughing hasn't been through the requisition process, the government has thrown good money after bad in much fouler situations than this.
...as long as you're clear that this is merely company policy and is not actually a point of law.
Actual prosecutions for people without clearance revealing classified information are generally rare because it's usually done as a form of journalism, which brings first ammendment issues into play. That's probably why wikileaks has made such an effort lately to re-cast themselves as a journalistic organization instead of just a clearinghouse for "whistle blowers."
The scenario you describe simply doesn't exist, it has nothing to do with journalism, and the onus is on those advocating for the validity of these kinds of prosecutions to distinguish acts from those which AIPAC members had charges dropped in the Franklin case just a few years ago.
I'd be interested in hearing about any successful prosecutions, so consider me eager to be proven wrong.
I also didn't describe any scenario for prosecution, so I'm not sure what you're referring to when you say that the scenario I describe simply doesn't exist. The only scenario I described was the kind where prosecution doesn't happen.
My overall point was that your statement regarding the illegality was wrong: the illegality of distributing classified materials is not based on covenant, it is based on statute. The covenant part gives prosecutors a few extra charges to pile on for people who have clearances, but it's not the main piece. Whether or not such laws are enforceable in a practical sense does not change the fact that distributing classified material is, under current law, illegal regardless of who you are.
If the hypothetical piece of paper on the street were a single page marked with a classification level, but without the cover sheet and its explanation, you might be able to argue that you didn't think that you were legally prohibited from distributing that information. Then again, "I didn't know that was illegal, your honor," generally doesn't play well in the courts. IANAL, so I can't tell you what would happen in this situation, but I can tell you that even if you were to avoid conviction the overall experience would probably be time consuming, expensive, and generally unpleasant.
For that matter, I honestly couldn't tell you which statutes provide for prosecution of non-cleared persons who distribute classified materials. All I can tell you is that every classified document has a cover sheet, and that at least some of those cover sheets specifically state that you can be prosecuted for distributing the contents to unauthorized people, even if you haven't agreed to protect it. It's been a long time since I've seen one, so I don't remember the exact wording but the warnings were stern enough that I remember them being there. Maybe the cover sheets cite a statute, maybe they don't specify. Maybe the whole bit about prosecution is a bluff, but I somehow doubt that an anal-retentive government bureaucracy would print official documents with a bluff that audacious.
Virtual Case File anybody? - http://en.wikipedia.org/wiki/Virtual_Case_File
Excuse me?
The FBI can't be that dense, can it?
If the FBI believes that the company can still fulfill its contract terms, and in a lot of situations that comes down to providing the requisite documentation showing sufficient protocols in place, then the FBI will continue to work with HBGary.
Much greater incompetence has been rewarded by the government bureaucracy than poorly picked passwords.
Isn't that a little bit kafkaesque?
I beg to differ.
National news about a security firm being hacked for its confidential IP can't be good for future business.
If necessary, they will change their name.
1) The Federal Government (hereby, "Fed") wanted the data. Fed puts out a request for proposal to qualified federal contractors to solicit work bids. Qualified federal contractors respond with work proposals, detailing the level of effort, the likely strategy to obtain the information, and establishing a cost and payment terms. Cost structure is either Time & Materials (T&M) or firm fixed. If it's T&M, they'll be paid for the time, effort and overhead required to have performed the task. If it's firm fixed, they'll be paid a set cost as established in the proposal.
2) HBGary had an existing contract for work with Fed. This contract may cover intelligence gathering, cyber intel, whatever. Fed creates a new task order for HBGary on the existing contract. Contract is either amended (if firm fixed, after the effort is quoted) or falls under existing task orders. HBGary is paid according to the terms of the existing contract.
To cut to the chase, there are other likely scenarios, but they all look similar to the above, and all involve HBGary being paid under the terms of the contract. Whether they're paid a flat fee or based on the effort involved depends on the terms of the contract. When they get paid depends on the terms of the contract. How much they get paid depends on the terms of the contract.
It sometimes happens that the government opts out of paying for things like this, and someone decides to buck the red-tape-brigade, but those matters usually end up in court as a contract dispute. Generally speaking, I think it's fairly safe to assume that HBGary is getting paid.
What I suspect a lot of people are overlooking here is that generally, if the government has contracted to buy something, EVEN IF somebody completely different comes up with the same good (tangible or intangible) for zero or significantly reduced cost, the government is not allowed to purchase unless there are provisions in their existing contract that allow for this.
The rules governing this process are the "Federal Acquisition Regulations", are set in stone, and are established so that both sides 'play fair'. The terms of the contract are always upheld unless there are exceedingly dramatic reasons not to, or failures of performance. If I contract to buy 10 servers for the government for $1,000 each, and somebody else then offers 10 identical servers to the government for $0 each, I will still be paid.
Since the cost of technology generally goes down over time, this prevents Fed from buying cheaper after the original contract was penned, and is allotted to protect contractors from the Fed, as well as the other way 'round.
It's complicated as sin, and yeah, there are loopholes out the wazoo (most of which relate to winning work,) but it's also defined, repeatable and ends up in HBGary getting paid.
After you've gotten the contract, it's difficult to work with the government's red tape and still live up to the terms of the contract. If you've ever worked on a project with a prolonged or contracted management life-cycle, you have _some_ idea of what it's like, in a very small sense.
Changes requested are shot down by government lifers on little basis. "I vote no, until we've thoroughly thought about the security implications," was a valid rejection on a project I was running that involved, at least partly, replacing plain-text passwords stored in configuration files with Kerberos Keytab certificates. Infuriating, at best.
Meanwhile, slips to the project schedule don't affect your project's contractually obligated deadline. The government is generally happy to trod along at a tortoise pace while contractors run sprints in spurts -- weeks waiting on an approval for a change, then sprinting until it's done.
Add to that the required overhead of having somebody able to meet incessantly about every single line item in every single invoice.
Add to that the fact that in most government agencies, their IT staff is comprised by a heterogenous mix of slow government employees and other contractors that would love to see you fail (as they likely also bid on the work you won, and would love the opportunity to see it rebid in the event that you fail).
Add to that having to get approval on every single change in any product, no matter how trivial, by a committee of stakeholders -- the size of which shrinks and grows as the project moves on, and knowing that no change, however firmly approved, is ever REALLY approved until ship date (aside, months after development on a renovation had begun on a portal's backend infrastructure, senior government personnel were still arguing over the look and feel of a mockup that had been approved and finalized prior to the beginning of development.)
Again, red tape, red tape, red tape.
Believe me, there will be a lot of boxes that will need ticking, meetings, powerpoint shows, and sentences written in the passive voice.