Is releasing this legal? It seems like this person isn't really disguising their identity or concerned about breaking the law. In their profile they even seem to brag about leaking company's code.
This is demonstrably false. While not all of this list are Canadian citizens, some are:
https://en.wikipedia.org/wiki/Category:People_extradited_fro...
At the very least, Intel owns the copyright on this material, so sharing it is a copyright violation in any country that is a signatory to the Berne Convention or the TRIPS Agreement, which is effectively almost the entire planet.
Then you have to add Trade Secret laws on top of that, which will have slightly narrower jurisdiction but still impact a lot of countries. There are very few places on earth where you would not be facing any legal trouble whatsoever for releasing this material.
You probably find quite a bunch of countries where it's illegal but not prosecuted. Through I only know if Russia.
Here's a good list of potential candidate countries which are neither in Berne Convention nor TRIPS Agreement:
https://en.wikipedia.org/wiki/Berne_Convention#List_of_count...
It may take effort and money to be protected, e.g. setting up a legal entity in that country which takes full responsibility and you cannot be legally forcibly unmasked as being a proprietor, and other local laws may need to be fully checked out to explore other risks.
Nothing is a guarantee and perfection doesn't exist but it's fun to explore these legal layers.
>The two essentially wrote a program to send GET requests to [publicly available pages on] the web site.
Basically, I would not be surprised that if the exact same case happened today, the defendants would still get jail time.
Coercion can be the difference between asking for money and theft. In the case of this intel data, it was clearly coerced from a server - it's not like it was linked on Google, they had to specially craft URLs to coerce the data out.
1. Find the server via nmap
2. Guess at some URLs until the server finally responded with some hidden data.
While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.
The key here is that these services were not advertising their presence.
There are often ways to beaches and other spaces unadvertised, but otherwise OK to use.
Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices.
There was no lock on this at all.
That did not happen here. Theft is not part of the discussion.
Infringement could be, and is at least the right language for the discussion.
There is zero theft in this discussion.
One could argue there was infringement, and that argument is very difficult to make without breaking the Internet for everyone just because someone with deep pockets failed.
Coercion involves, at the core, an act of agency performed to the intent of someone else, who is not the agent, actor.
Bad practice does not support coercion at all.
I wonder whether that word even applies to entities lacking agency.
Servers are automatons. They do not make value judgements and or creative acts of agency of any kind.
We need these things as a basis for coersion.
There are lots of things not indexed by Google and it is dangerous to imply people are somehow wrong when data is accessed sans a Google index.
Security by obscurity does not make sense. This mess is part of why.
No civilian will agree with you that just because technically you could slip through several doors that happened to be not locked and got helpful advice from a neighbor, it doesn't mean that whatever you found behind those doors was "public" just because you didn't have to pick locks. Or that the photos you took of private company documents by social engineering your way inside must clearly be unsecured and publicly distributable because "they were given to me when I asked for them".
The analog would be if I posted a flyer on a telephone pole with what I considered confidential information and someone else took a picture of it. There's no way you could argue that I had a reasonable expectation that only people for whom the flyer was intended would be able to view the flyer.
If someone deliberately bypassed computer security measures to acquire this information I'd agree. But you don't get a free pass to be negligent just because you're a big company. I suspect the EFF would support my viewpoint as they supported Weeve's appeal of a much more contentions and ethically gray scenario (the acquisition of personal information from a server that was negligently "secured" and required someone to imitate the calls an iPad would make).
The flyer analogy does not work because the services were not broadcasting or otherwise advertising their presence.
Following the house analogy, the thief tested all the front doors on the street and opened those which were not locked.
What you’re effectively saying is that the flyer is unknowable unless a Street-view car drove past and snapped a picture of it and its owner engaged in SEO to make sure it landed near the top of search results.
There is no “house” in this analogy (which you might call a corporate/private network secured or otherwise). No private network was accessed. This stuff was on the street, in the free pamphlet section of the newspaper stand.
Physical analogies break down.
Truth is, this info was out there for anyone to copy, and who ever did that is definitely guilty of something and or liable.
It will be tough to make passers by into criminals here. They aren't.
Keeping secrets is hard. Should be.
Regardless, under what moral framework are we operating such that obvious guilt is prescribed to anyone who might pick up a wallet in the street, anyway? Of what crime are they guilty?
However, my understanding of the law is that, once secrets are made public, further distributing the secrets is not illegal.
So, republishing it is probably not more illegal than running a torrent of a Hollywood movie and an Ubuntu ISO (which can run afoul of export regulations).
Note: I’m not a lawyer, and if what I said was true in practice, Julian Assange / Wikileaks would have nothing to fear from the law.
EDIT: While it maybe a relatively clear cut case according to US law, other countries (may) have different laws. There are also all kind of potential diplomatic and political obstacles, when this was done by somebody outside of the USA. For instance, good luck if this was a Russian or Chinese citizen.