Hacker News Reader

Comment by masayoshis_son | Hacker News Reader

The writing is quite confusing in trying to explain things but the gist of it appears to be that the person in question (1) applied for IP addresses through numerous companies created just for this purpose in order to bypass ARIN's restriction on the number of addresses it was willing to allocate to a single entity, and (2) made the obtained IP address ranges available to serve as VPN endpoints, so that "huge amount of traffic—some of it illicit or criminal—passed through its computer servers but wasn't traceable to the true originators."

He did keep track though of which VPN operator used which range at any given time, so perhaps the "true originators" could be traceable after all, assuming the VPN owners were willing to co-operate. In any case, he is only being prosecuted for (1), and the immediate reason for this is that a couple of US politicians were hacked with attacks originating from these addresses.

View on HN

A prosecution seems a bit over the top for this... Setting up multiple companies to meet some rule isnt against said rule. And anyway, it's a company policy not the law.

It was done to deceive ARIN which is why it is being considered wire fraud.

This seems like a bit of an over reach no?

I've looked up wire fraud in the US and it seems to come with some properly serious penalties:

Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both. If the violation affects a financial institution, such person shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both.[4]

No? The use of deception to obtain something of value that would not otherwise be given to you is the literal, legal definition of fraud?

So, where does that leave advertising? The entire purpose of advertising is to get somebody to spend money on a product they otherwise wouldn't have.

“The use of deception” is key, and it’s true that advertising often crosses the line, and should be prosecuted more often.

You going to work also serves the purpose "to get somebody to [give you] money they otherwise wouldn't have". So that definition is obviously too broad, and different from the definition of fraud mentioned above.

Advertisement tends to deal in opinions, not facts. And where specific factual claims are made against better knowledge it does constitute fraud, and is occasionally prosecuted. See Volkswagen's emissions claims, for example. Or, just this week, some hand sanitiser got hit by the FDA for claiming protection against Ebola and Coronavirus.

Advertising has specific legal limits on what is deceptive. You can say ‘worlds best’ because that’s considered a subjective and meaningless statement, but lying about objective facts gets you into hot water. For example, peanut butter is legally required to have been made from peanuts.

It is called "puffery"[0], for anyone who is interested.

The wikipedia page says a "puff piece" is journalistic puffery. Neat, I hadn't made that connection.

[0] https://en.m.wikipedia.org/wiki/Puffery

To be more precise, the elements of fraud include a false statement, made knowingly, upon which someone else reasonably relies, to their detriment. To prosecute, this pattern must not be merely plausibly true but persuasively true in the face of a motivated, skilled defense. That set of circumstances is only rarely true in advertising. It is clearly true here.

The advertising industry is hated by many people for exactly the parallels you've perceived.

People get sued for false advertising al the time. I feel like people on hacker news are continuously surprised to discover that laws exist and are enforced.

And when they are enforced they seem to think that laws can be hacked with cutesy little games to a judge.

Those are maximums.

I understand insane maximums, offence stacking and plea deals are part of your culture, maybe we should explore that further?

“Not more than”. For most crimes the sentencing guidelines are broad so the context of the case may be taken into account by the judge and/or jury.

if shell companies are fraud, much of the economy is in trouble

Shell companies are not normally used for structuring. That's a different matter entirely. A shell company is usually a holding company, not a company created in order to deceive or to bypass a hard cap on some scarce resource.

Just FYI for others: https://en.wikipedia.org/wiki/Structuring

I didn't know there was a formal term for this. Splitting up money transfers to avoid detection of large sums moving around.

Sounds like packet switching.

No, more like packet fragmentation and reassembly.

Well, there are the fake registrars, such as DropCatch 345, DropCatch 346, DropCatch 347, ... DropCatch 1545. Those are all ICANN-accredited registrars.[1] ICANN parcels out dropped domains among all the registrars who want them at random. Having a thousand dummy registrars improves the odds. That's definitely "structuring" to hog Internet assets.

This is possible only because, while ICANN charges each registry when they acquire a domain, ICANN refunds that if they give the domain back within some time period.

[1] https://www.icann.org/registrar-reports/accreditation-qualif...

ICANN is utterly dysfunctional, see .org debacle.

The .org debacle is evidence that ICANN is corrupt, not dysfunctional. That's an important distinction.

It's both. You could say that the .org debacle more strongly indicates corruption than dysfunction, but it's definitely both with strong ties between them.

How is it both?

They knew exactly what they were doing.

The fact that they knew exactly what they were doing does not contradict that what they were doing is dysfunctional. If anything, it is the dysfunction.

As strange and dysfunctional as that is, DropCatch isn't trying to deceive ICANN into thinking those registrars are unrelated companies, so it's not fraud.

So if I sign up for a service with different email addresses to use the 2-week free trial over and over, I will be guilty of wire fraud?

Yes, and they'd probably throw a CFAA violation in there too.

Wow! I shouldn't be surprised, yet I am, that three felonies a day was right.

Yes. For example, someone signed up for 58,000 accounts and used them to receive micro deposits (those small sums that are deposited into an account to validate that two accounts are linked correctly). They had their time in court: https://www.wired.com/2008/05/man-allegedly-b/

Intent matters. Scale of abuse matters qualitatively.

The legal system does not operate like a computer program.

s/will be guilty of/could be charged with/

These companies often times were bought shelf companies with history so as to have credibility. The goal was selling up blocks to prohibited locations and enabling spamming. This guy spent a lot of time in Tunisia with spam Kong’s and accepted up front money to build infrastructure.

The publicly discussed components here are but a small piece of a complex and sloppily run scam organization.

Look up the judgements under these businesses over the years at various web hosts. These companies would enter long contracts and eventually stop paying.

Reply on news.ycombinator.com