The Boy Who Stole Half-Life 2
eurogamer.net
eurogamer.net
I wonder how differently things would have played out if he lived in the US.
The whole experience sounds rather civilized. The police let Gembe get dressed, eat breakfast and smoke a cigarette before bringing him down to the station. And when he confessed, his punishment was 2 years in probation.
I somehow doubt his experience with the FBI would have been similar.
It depends. Gun ownership isn't nearly as common in the US, so they can safely assume that a 17 year old blackhat won't pull a gun on them.
On the other hand, I've seen a ~4.9 feet tall girl getting knocked unconsciously with a Mp5 during the eviction of a squat. In 2003, a schizophrenic in custody was beaten to death by officers in Cologne. They were sentenced from 12 to 18 months in probation. In 2005, Oury Jalloh burned to death in a holding cell in Dessau while being tied with handcuffs to a fire-proof mattress at his hands and feet. In 2008, Josef Hoss was beaten to a bloody pulp by a special unit after his arrest. He is irreparably crippled. He later recieved 30,000€ for compensation.
Yes, if "a LOT larger" means 3.5x larger. Germany has 82 million inhabitants and is the most populous country in Europe.
For example, a beating in California isn't going to be as troubling to a resident in Vermont. They'll simply say "different state, different police force". On the other hand, a beating in Berlin is going to trouble someone in any part of Germany.
It was quite an enlightening read, and I think I take it seriously because my own experience in high pressure situations. First was a time when I was taking a walk with my dad and some kids surrounded us. One tried to spray pepper spray in my face from behind, but my dad saw he was doing something so yelled at him, and my dad got sprayed instead. Then they all ran. I was stunned and couldn't process what was going on; really, I was just so focused on the guy in front of me, my decision-making process was paralyzed.
My second was when I was the venue technology manager for Cypress Mountain at the Vancouver Winter Olympics (freestyle skiing and snowboarding). In terms of operational pressure, that was the most difficult thing I ever experienced, and even more so because Cypress was literally the most difficult and complicated venue of the Olympics. There were situations where my brain literally just shut down and I was going 100 miles an hour trying to fix whatever went wrong; there's a word for that, it's called panic. If it weren't for the training I had and some of my more experienced colleagues, I imagine it would have been an utter disaster.
I can only imagine that if I have some guns, batons, or any other type of weapon, and am meant to quell a situation, it could get ugly easily.
edit: One more anecdote, my friend is an immigration officer. He had an incident once where he and another officer were interrogating a guy because some papers or something needed clarification. The guy suddenly made a move, they misinterpreted, and it became an all-out brawl. My friend distinctly remembers yelling at his colleague and his colleague yelling back at him, but they could not hear each other. Their minds were in a zone where they could no longer communicate, they were just subconsciously focused on survival. Later, it all turned out to be a mistake, but in the heat of the moment, it was hard to discern that.
You say that as if the first does not cause the second. America's 'war on drugs' is the cause of the problems, not an excuse.
I see no reason to believe that he would have been treated differently by the FBI, and besides, he would probably have been extradited right back to Germany.
About considering you part of something:
"..There is a step beyond thinking of yourself as x but tolerating y: not even to consider yourself an x. The more labels you have for yourself, the dumber they make you."
SWAT-style tactics are rarely about any actual belief that the suspect has weapons and is likely to resist arrest, but about violently (sometimes lethally) subduing a suspect who might destroy evidence and impair the prosecution's case.
And, of course, the overtime pay for SWAT work in many US jurisdictions. Don't know how that works in Germany.
http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_st...
The stories that get all the publicity are the bad ones which of course leads you to think that's all there is.
But by far most cases end up exactly like this one.
Judges LOVE honesty, and so do cops. If you are honest and open with them you get a far milder punishment than someone who won't talk. I've seen it in so many case reports.
Judges are trying to figure out what kind of person you are. If you are open and honest they figure you made a mistake, but are basically a good person and thus don't need much punishment.
On the other hand someone who won't talk is assumed to have a more negative mindset.
I don't mean to suggest that not talking is taken as evidence for guilt - guilt is established separately and is not based on your cooperation. But the punishment for that guilt varies depending on your behavior in court and to the cops.
A lot of the advice on the internet about not talking to cops etc is aimed at avoiding guilt. And it may work. But it utterly ignores the second half, which to me seems almost as important, and that is punishment.
Traffic tickets are not even in the same league as the kind of offenses that we're talking about here, but if they are any indication then I have to agree. I've gotten out of my last three traffic stops by simply telling the cop exactly what I did: driving in the HOV lane without a passenger, rolling through a stop sign, and doing 40 in a 25.
These people -- law enforcement and the court -- get jerked around all day by people who insult their intelligence with bullshit stories. It must be refreshing to hear someone clearly admit what they did with no attempt to evade responsibility.
He was careful to end the story by reminding students that things have changed a bit since his youth, and what he did would be multiple felonies now.
In this kid's case, information was copied. The intention was not to take away sacarce resource for self benfit. He got the source simply because the act of looking produced a copy. Not because he was trying to seek self gain. You should not equate the two and pass the same judgement of character simply because we tend to label both acts as "theft." They are completely different. I really think there should be another word to distinct between these different acts.
One of the reasons I believe that is because the ramifications of making copies of someone else's information is not very obvious compared to taking away a physical object from them. When you take something tangible from someone it is immediately clear that the other person will be suffering a loss. However the act of looking at files stored in a remote server (and as a result creating copies) is much less obvious. I think it is very plausible that the kid was just trying to see the state/progress of the game that he has been anticipating so long for (4 years) and simply did not think about the ramification of his actions. This is totally different than the pre-meditation of a crime with the intention to put another party at harm. He has zero motivations to harm Valve. He sees them as his heroes and still is a big fan.
That's a different kind of self gain than the one I was talking about. There is no need to point out/talk about the one you mention - every action anyone does is/can be argued for self satisfaction/gain of some sort - since everyone does it already. Yes I agree with that one. However, the gain I'm talking about is taking away a physical object away from someone else for the sake of gaining possession of it. Again, this is not what motivated the kid to break in and obtain a copy of the source code. However this type of gain is exactly what motivated the guy from Roosevelt's story. My original reply was trying to point out this difference.
>...you cannot recognise the significance of actions beyond their physical consequences.
Yes I can. Not only I can, I am also making a distinction between the actions with obvious physical consequences and the actions with less/no obvious physical consequences. It is you who insist on generalizing the two into the same thing and cannot see the (somewhat subtle) difference.
>The only way he could fail to be aware of the negative repercussions is if he accidentally took the source code and thought it was something else. He clearly did know what the code was, its value and why it was protected...
I beg to differ. That is just one extreme way. It is definitely not the only way he could have failed to be aware of the negative ramification. This is where evaluating his intentions/motivations is helpful. He loves the Valve company. He wants to play this game that he's been waiting for 4 years to ship. But the game keeps on getting delayed. He wants know the progress of the game's development. So then he decides looking at the source code is a good way to achieve this. I think it's very reasonable to argue that, "Had he known that by doing what he did would only further delay the game he wants to play and cause his heroes a lot of trouble, he would not have done it." The ramifications in this case is not as nearly as straight forward compared to breaking into a factory for the sake of gaining possession of the factory's secret plans. I really hope you can see this difference.
>so i don't see how what he did was any different from someone breaking into a factory and stealing secret plans
I think I've already done the best I can to explain to you the differences. If you still cannot see it then you are just going to have to figure this one out on your own/with someone else. http://en.wikipedia.org/wiki/False_Dichotomy That might be a good place to start. I notice coders often tend to engage in this kind of over generalization/all or nothing thinking.
Quite simply, he should have known better. I know what a false dichotomy is - and it's exactly what you are purveying by insisting (so far without justification) that crimes with physical effects are not comparable to those without.
"Hey Gabe, you know what I love Valve and I love all of you guys. You are all my biggest heroes BUT you know your security systems aren't good. I hacked your system and it was quite easy. For two weeks no-one even noticed it. I DIDN'T steal anything but if you give me a job I will do my best to pretend such security issues and make your system as secure as I can. Would consider giving me a job?
I attached some source code of Half-Life 2 to proof my abilities.
I hope you all best and hope to hear from you back.
Thanks"
I really think that this would bring in the job.
I realize that everybody likes to call themselves a "hacker" because they can program a computer, but this is an actual black-hat hacker. There are bad guys in the world and he's one of them. He wrote malware. He stole source code and gave it to the world. And this wasn't some evil corporation he was trying to bring to justice for its crimes. This was Valve. All they do is make cool games for the world. It's incredibly difficult work and they do a fantastic job. What kind of asshole do you have to be to shit all over them like this kid did?
"Gembe's malware crimes, while undeniably exploitative and damaging, were crimes driven by a passion for games rather than profits."
I understand that it is important to explore his motivations, but the way this is phrased (in particular what seems to be an attempt to contrast the boy's "passion" with Valves lust for "profits") is pretty terrible. I don't think his "pure" motivations matter at all-- what matters is that he chose to steal the property of Valve and make it available to others. Whether Gembe meant for it to end up on the internet doesn't matter when it ends up on the internet.
I see a lot of comments on this that are sympathetic to the kid, and while I understand that feeling, I think a more sensible look at the situation demands that you feel sorry for him because he brought this upon himself, not because he was any kind of "victim".
I'm glad to see that he was able to get on with his life, and I probably don't agree with what U.S. authorities would like to have sentenced him to had they gotten ahold of him. But that doesn't make him the persecuted hero that so many people seem to think he is. And that doesn't mean he shouldn't have done some jail time either.
Wow, did you read the same sentence I did? They weren't implying Valve had a lust for profits, they were indicating that Gembe wasn't motivated by profit. I think you're reading way too much into that particular sentence.
> I see a lot of comments on this that are sympathetic to the kid, and while I understand that feeling, I think a more sensible look at the situation demands that you feel sorry for him because he brought this upon himself, not because he was any kind of "victim".
I see the comments here differently--I don't think anyone thinks he's strictly innocent, I think people are sympathetic because he was looking down the barrel of the American Corporate Legal System™ and only narrowly escaped.
I understand Valve's anger at having their stuff ripped off and published around the internet and if I were in their position I might have the same outlook. But, having the gift of 20/20 hindsight, we can see that it didn't actually affect them negatively in any tangible way. Half-life 2 was released and overwhelmingly successful and there are no game engines with stolen Valve code stealing licensing profits from them.
So I am sympathetic to the fact that he escaped any jail time because in the end what he did didn't matter. 2 Years of probation seems perfectly appropriate.
Fair enough. I think its a fairly straightforward example. Reading it again, I still think its fairly obvious that the piece was designed to minimize the clearly stupid, clearly wrong actions of an individual, and in order to do so, they needed to paint Valve as the villain. But I appreciate that this is my own interpretation and certainly one could read it differently. (The example I cited should have been changed regardless, as I don't think its necessary to the story and to me still reads as an attempt to vilify Gembe's victim).
> we can see that it didn't actually affect them negatively in any tangible way
Red herring. This probably helped Valve's sales, but that doesn't mean that it necessarily would have, and has nothing to do with the morality/legality of the matter, and as such, it has very little impact on my view of Gembe's actions.
Are you not familiar with the American justice system at all? I have a hard time wishing American prison on murders and rapists, people who do actual tangible harm to people.
I also think it's deeply immature to divide the world into black and white, good and bad, and put curious kids on the bad side of the line with the rapists and murderers. The world isn't black and white. The perspective on the other side of the line can be quite different; and the people who really are bad are probably more in need of being locked up for medical reasons than some biblical, retributive, medieval eye for an eye logic of punishment
So you're totally okay with me beating your [underspecified relative] so badly they're in chronic pain for the rest of their lives then?
But the law allows for intent as well. From the article, it seems that his acts were committed as a result of maximal fanboyism rather than any real intent to do harm.
So, in this case, it's about whether the sentencing is punishment or deterrent. Sentencing as deterrent is only useful a small part of the time (if it was more effective, then the death penalty would be an excellent deterrent - which it appears not to be). Sentencing as punishment really depends on the person being sentenced and in his case, he actually worked pretty hard to turn his life around.
So, from the article, it appears he got what was coming to him, without having to waste his life in prison, where it does no one any good.
Deterrance is absolutely the point of punishment. What he did was a white-collar crime. There's a perception in society that you can get away with certain extremely harmful things, like hacking or financial crime or environmental pollution, because it's hard to pin down intent and the results are hard to measure.
* Mugging. Damage: $50. Punishment: 3 years in jail. * Hacking Valve. Damage: $250,000,000. Punishment: 2 years probation. * Oil spill. Damage: $10,000,000,000. Punishment: have to sit through Senate hearing. * Financial ponzi scheme. Damage: $18,000,000,000. Punishment: 150 years in jail.
Yeah, it worked out with Bernie Madoff, actually. Still it doesn't seem proportionate to his crimes.
Bullshit.
Edit: I'm agreeing with you haha.
I doubt their competitors will learn awesome secrets from their code-base and I doubt the pirates will compile their own binary instead of just using the standard DVD-Rip.
Yes, they embarrassed themselves. But they have nobody but themselves to blame for not investing in security.
And, as ramidarigaz points out, it was even free PR for them.
Ah, the classic rape defense. It was her fault for walking down that alley.
> There's a perception in society that you can get away with certain
> extremely harmful things, like hacking or financial crime or
> environmental pollution, because it's hard to pin down intent
> and the results are hard to measure.
> * Hacking Valve. Damage: $250,000,000. Punishment: 2 years probation.
The amount of 'damages' that Valve incurred due to this is/was speculative. Of course, once the initial estimate comes out, Valve isn't going to go back and state what the actual damages were, because then people would question why the initial estimate was so high. There are also perverse incentives to inflate those numbers:
- Larger damages get more attention from the FBI.
- Larger damages are more likely to see harsher action by the justice system (aka courts).
- Larger damages garner more sympathy from the public.
- Larger damages can make you look like a hero to investors when the reality turns out to not be so bleak. You can always spin yourself as the hero that saved the company from financial ruin.
- Larger damages make the incident a likely scapegoat should the financial quarter be tough on the company (much like piracy is the scapegoat for the MPAA). E.g. "Yea we did poorly, but it wasn't our fault! It was all that darn hacker!" When in reality the leak had nothing to do with the losses.
> Yeah, it worked out with Bernie Madoff, actually. Still it
> doesn't seem proportionate to his crimes.
Certainly he wasted a lot of expensive people's time and at a critical point in a software development project. You can bet they wanted to wring his little neck badly.
By the time of the trial 8.6 million copies of Half-Life 2 had been sold, its success seemingly unaffected by the leak of 4th October 2003.
But it's unclear how much money he really cost the company. This $250M figure is obviously not credible when they were spending $1M a month on development costs.
I don’t know why he should go to prison for a long time for what he did, though. He was punished harshly (two years probation are no joke) and the judge made abundantly clear that the only reason for not punishing him harsher was his behavior after being caught.
I have no desire to destroy other people’s lives just out of spite and I find this desire to be quite baffling. The only question I care about is whether the punishment is sufficient to prevent future similar crimes from him or other people. I have no doubt that allowing him to keep his stable job and leaving it at a strong slap on the wrist is pretty much the optimal thing to do in this case, in terms of deterrence. (I would think that hackers who lose everything and go to prison for a few years are more likely to become criminals than hackers who get two years of probation but get to keep their job.)
The only quarrel I have is that it took apparently three years to bring this case to court. Swift trials matter a lot more than the harshness of the punishment when it comes to deterrence. (In this particular case it was probably for the best that it played out like this but as a German citizen I would like to see a faster judiciary in general.)
Despite your first sentence, where you try to introduce some nuance to your argument, your other statements suggest that you don't have any room in your schema for people who commit damaging, non-violent crimes but express remorse for them. Essentially remorse is less important (if at all) to you than the fact that someone, somewhere was damaged in some way.
Many people here have expressed the opinion that yes, this kid f-ed up real bad and damaged/destroyed Valve's reputation significantly. But no, there isn't a need to lock him up, because it wouldn't serve a purpose.
If the purpose of the lockup is only to punish him (for punishment's sake), which you seem to be intent upon, then yeah it makes sense to give him 10-20 years despite a marked shift in his personality and outlook on life. To me, it seems like a horrible waste of money and of everyone's time to punish him so severely given that he's already had a change of heart, has the beginning of a successful career doing legitimate work, and he didn't commit any violence.
Also, we have the benefit of hindsight here: Valve went on to be an even bigger success after this, as HL2 + Steam is practically a money printing machine for them.
Go to prison? Prison should be reserved for violent offenders. IMO, putting non-violent offenders in a pen with violent offenders is very clearly "cruel and unusual punishment".
An American example is the "D.C. Snipper" who was charged in Maryland, Virginia, and D.C. to maximize jailtime and possibility of conviction.
Legalistically, its correct but ethically it means that police can try you multiple times so long as they narrow the jurisdiction on the first attempts. For instance, a car chase that crosses multi-jurisdictions can result in multiple trials (and consecutive sentences) even though its really just one offense.
However, since in this case the defendant wasn't tried in the United States but in Germany it would all depend on criminal offense treaties between the two countries, not just US law.
"For some reason they thought there was a connection between me and Sasser, which I denied. Sasser was big news back then and its author, Sven Jaschan, was raided the same day as me in a co-ordinated operation, because they thought I could warn him.
"My bot used the same vulnerability in the LSASS service that his did, except it didn't crash the host system, so I guess they thought I gave him the exploit code. Of course I denied this and told them that I never write such shoddy code."
At the risk of repeating a tired Internet cliche, I think the leak may have helped Half-Life 2.
If the project was already months behind schedule and had a year before a GM build would be ready, having the source code leaked may have given hardcore gamers reassurance that the game was actually coming along and would be finished at some point.
Of course, there's also the newsworthiness and buzz coming from the leak itself.
Though you could be right, we've already been waiting for E3 twice as long as E2.
I flunked (thank god) an interview with a company once that ended up going belly up. The capital came from angel investors (mostly lawyers). When they ran out of money they locked everybody out of the premises (even though all their stuff was still in the building) for the fear somebody would take the source. This was 6 or 7 years ago.. To this date these lawyers still sit on their precious source code.
* I'm not actually sure it is him, but he is plausible enough.
You know in everyone of us is this little devil and if you have something which is important you can earn something with it (money or even credit in the community) there is a good chance that people will go the devil way.
I even would consider saying I even DON'T trust myself on such important and valued things!
Would they really have shot him in the head if he touched the keyboard? My guess is no.
My guess is he'd receive a sharp blow from the butt of the weapon to the back of the head had he shown any attempt to deviate from their instructions.
http://webcache.googleusercontent.com/search?q=cache:T1eI3Z6...
Suppose I cheated on my taxes (which I would of course never do, but I think many people consider that fair game), would the police also wake me with a gun pointed at my head?
As for the taxes, that's entirely dependent on your behavior. There have definitely been stand-offs between tax protesters and armed law enforcement personnel.
If I was in Valve's position, I would blackball him from working there because he couldn't be trusted, and the damage he caused.
Damage caused was at least time spent cleaning up his mess in their network. Conversely it sounds like Valve had a very weak security setup in their network.
Assuming those sorts of cases actually happen, how is this any different?
and if memory serves me correctly, he was eventually caught shuffling credit cards that they captured back out for a tidy profit.
The kid recognized what he did was wrong and regretted it. That was why he came forward and emailed Gabe. If he really just wanted steal and cause harm, he would have never been found or caught. You can tell he truly loved the company and was simply misguided in the way he chose to show it. Yes he made a mistake, but I would have still given the kid a chance rather than beat him down. It's this kind of tragic beat downs that often create villains. (in the worlds of comic books at least. =)
I don't think what this kid did was actual "stealing". Had I been at Valve in a position to hire, I would have definitely considered hiring the kid (after evaluating how contrite he was, and how good he was, and on the condition that he keep his mouth shut, for fear of spawning copycats). But maybe that's because I've done such rebellious things in the past myself, and have a soft spot for true "hackers".
"My bot used the same vulnerability in the LSASS service that his did, except it didn't crash the host system, so I guess they thought I gave him the exploit code. Of course I denied this and told them that I never write such shoddy code."
He doesn't come across like a criminal mind to me.
Don't blame an 18yr old kid for naively crossing lines he shouldn't. Blame the million dollar company for not securing their assets against 18yr old kids.
It would have been more plausible if you didn't claim to know better than the know-it-all in the next sentence ("willfully").
If you really want this discussion then perhaps take into consideration the nature of the crime and try to recall your own youth (you've once been 18, too, right?).
I'm not saying he doesn't deserve a slap on the wrist. It's however beyond ridiculous to try and charge him with virtual 9 figure damages - potentially sending him to jail and ruining the rest of his life.
The more interesting question is who was charged for criminal negligence - or at least fired - at Valve over this?
This is the more interesting question because curious and slightly naive 18yr olds are a natural law. They will always be around, and there's strong evidence that deterrence does not work very well against them.