Hacker News Reader

Comment by indigochill | Hacker News Reader

I have an unrealistic idea (more of a thought experiment) that companies should face equal culpability to criminal hackers in attacks. After all, technically the way the hackers use systems /is/ authorized in a sense, even if the method of obtaining authorization is unconventional. Maybe this would get companies to pay more attention to securing their systems.

From a certain perspective, Twitter is an accomplice to fraud by providing the platform and the access to the fraudsters (although I'm fuzzy on whether knowledge of one's aiding of a crime is necessary for an entity to be legally considered an accomplice - probably is).

And yes, the charge count is insane but the US loves holding a bit of life-ruining theater when they catch hackers threatening commercial interests. e.g. Aaron Swartz's conviction: https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosec...

View on HN

I disagree, no system created by humans is going it be without flaws. I think it should be possible to sue a company if a victim can show that the company was negligent in its actions. Damages should be apportioned between the scammers and the company on the basis of their contributions to the act.

I'm not sure I would call this "authorized in a sense" since social engineering, in order to gain access to an internal tool, was the method.

Social engineering most often involves impersonation, so the person getting access was not really the intended party.

> companies should face equal culpability to criminal hackers in attacks.

That's an interesting idea, and I think I agree with you in spirit. But don't most hacking-related criminal charges boil down to "unauthorized access to a computer"? It would be hard to argue that the company that owns the computers has unauthorized access.

Maybe a better phraseology would be to say that the company is an accomplice to the hacker. For that to really hold up, I think you would need to show that the company was negligent or not keeping up with security best practices.

> It would be hard to argue that the company that owns the computers has unauthorized access.

That's not the way I'd argue. I'd say the company has authorized access and they then gave access to fraudsters who should not have been given access to the system, which is where they were aiding the fraud.

So they aren't the principal offender, but they did aid in the offence which is what I'm suggesting makes them an accomplice (although as another paulpauper points out, an accomplice has to be aware they're aiding a crime - being duped isn't a crime).

accomplice means they knowingly aided in the fraud or profited from it. Being caught off guard is not a crime. The culpability is the reputation damage from being hacked.

>Being caught off guard is not a crime

It can be. Twitter could be found criminally negligent if they knew the risk of this type of attack (or it was obvious) but chose to ignore it.

Should we make homeowners equally criminally liable when burglars break in? Certainly if the homeowner had been less lax or obtained more security, that burglary could have been prevented.

Breaking and entering requires breaking.

Sending packets is peaceful speech.

Sending these particular packets was more akin to fraud. Should fraud be legalized?

Bad analogy: the only victim of a home invasion is the home owner.

In the Twitter case, the victim were the users.

Your comment just sparked an weird thought for me. We're all familiar with the adage that if a product is free, you're not the customer you're the product. In this Twitter breach, Twitter's customers were not harmed. However, the product was harmed.

> Should we make homeowners equally criminally liable when burglars break in?

Aren't they? I've seen a lot of insurance cases being denied due to negligence. This might even happen if you let your bag lie around openly in your locked car.

Also, burglar victims tend not to cause further damage. And, if they do, the victims will be in trouble as well. At least in Germany, a stolen gun will cause you a lot of problems, unless you can prove that you stored it securely according to the national guidelines.

Like most things in life: it depends.

Your home was broken into and your jewelry stolen? No, you're not criminally liable for anything, you were the only victim.

Your home was broken into and they stole the stack of personal records for your small business' employees that you left sitting on the dining room table? Yes, you should be liable for that because you were not the only victim and those others were victimized due to your own negligence. The documents were not properly secured, was your home properly secured as well given the sensitive material you were housing there?

It doesn't have to be a binary thing either, there's nuance to it. A hacker steals unencrypted personal information off a server you didn't even password protect? You're more liable than a company that lost personal information that was strongly encrypted.

> Your home was broken into and they stole the stack of personal records for your small business' employees that you left sitting on the dining room table? Yes, you should be liable for that because you were not the only victim and those others were victimized due to your own negligence. The documents were not properly secured, was your home properly secured as well given the sensitive material you were housing there?

This is one of those ideas that seems to be made in good faith but ultimately harms the competition far more than it harms the industry leaders. Twitter can afford cameras and alarm systems for its data centers; I can’t. Twitter can afford to hire armed guards; I can’t.

The ultimate end result of a policy like this is that people will simply kill anyone trespassing on their property; after all, who knows what documents they may have seen or confidential records they may have exfiltrated. It’s way too heavy handed.

> Twitter can afford cameras and alarm systems for its data centers; I can’t.

Twitter is also a much bigger target, and it makes sense to apply very different standards to what "reasonable" security is.

> The ultimate end result of a policy like this is that people will simply kill anyone trespassing on their property;

That will probably get you more jail time than whatever other liabilities you might have had, which realistically maybe would have just been civil anyway, were some policy like this to become real.

But put another way, in context of business collecting personal user data: if you can't secure it, don't collect it. If your business isn't viable then, well, tough shit.

Reply on news.ycombinator.com