> Proving who accessed it has become a huge forensic investigation at that point.
If you have some simple logging and a foolish "hacker", it's a pretty trivial investigation.
If you have some simple logging and a foolish "hacker", it's a pretty trivial investigation.
It is also a trivial piece of data to plant. Given the facts, I see no particular motivation for her to have sent the message. However I do see a motivation for the department to try to frame her. And they've already established a willingness to make stuff up.
And I'd also want to know more about the setup. What is the machine used for? What else is on it? How is the logging set up?
Given the general incompetence shown, I wouldn't be surprised if the machine needed to provide ingress is also one that is publicly accessible for downloading data from the public. With lots of stuff in unlogged POST requests. If so, they could indeed have a request from her close in time to when the message was sent. And it might be legitimately hard to figure out whether she was doing something authorized or not.
Our plea bargain system is so lopsided that 97% of criminal charges end with a guilty plea without a trial. Even if she is 90% sure of winning at trial, unless she has a million dollars lying around and a deathwish, it STILL isn't worth it to fight the system.
I first looked into this after Aaron Swartz's suicide. Every time I've looked since it has seemed even more broken.
This is bad news for anyone who cares about justice. And good news for any authorities who are trying to target someone that they don't like.
If we're discussing police charging into houses of people accused of nonviolent crimes armed to the teeth, we're on the same page. But otherwise, I'm not clear what your suggestion is here.
Look at what happened to Aaron Swartz. If he lost at trial, he was facing a lifetime in jail. They were also seeking damages that he had no hope of paying because his finances had already been drained by the legal fight. A legal fight that was projected to cost over a million dollars more than already spent.
Or he could take a plea bargain. Which would have put him in serious debt, in jail for a few years, and made him a life-long felon.
Or he could commit suicide. Which, of course, he did.
In that surprisingly typical example, if his odds of winning were 90%, on average he spends as much time in jail if he chooses to fight. Which he couldn't afford to do. And you still have to accept that chance of losing your whole life in jail.
In that situation, I'd probably have accepted the plea bargain. No matter how much I believed myself to be in the right.
Given those incentives, it is somewhat surprising that 3% of people do choose to fight. But then again, that's down in the range of the portion of the population with serious mental illnesses.
You wrote other things, and I'm sorry I didn't read them carefully, because I'm a nerd and a human and I can't get past "a lifetime in jail". I'll try to revisit later and respond to them, and wouldn't want to suggest my not responding to them is an indication that they aren't good points.
That was before they added nine more felony counts on September 12, 2012. As techdirt said at the time in https://www.techdirt.com/articles/20120917/17393320412/us-go..., the theoretical amount that he could have been put away for was 50+ years with a fine of up to $4 million.
That's the lifetime that I was talking about.
The fact that they were seeking a far lesser conviction, didn't stop them from throwing around those figures. And I'm sure that Aaron Swartz had to think about those numbers.
Incidentally Aaron Swartz wasn't even the first programmer to commit suicide while being prosecuted by a team including Stephen Heymann. That dubious honor goes to Jonathan James in 2008.
All of this notwithstanding, the important point is this. For most of US history, plea bargains were illegal. The way that they now railroad people into pleading guilty en masse demonstrates that they should still be illegal. And the fact that our plea bargaining system is so lopsided means that the right to a fair trial is more theory than practice.
As a double check on that, consider https://innocenceproject.org/bad-drug-test-leads-to-wrongful.... Widely used roadside drug tests that are inadmissable in court have been found in practice to be wrong more than 1/3 of the time. And yet, 90% of people charged wind up accepting the plea bargain.
The state literally has no evidence that they can present in court. And knows that a lot of those people are actually innocent. But they all get railroaded.
Welcome to justice, American style.
https://www.popehat.com/2013/02/05/crime-whale-sushi-sentenc...
35 years is a "whale sushi sentence". You have multiple ways of knowing it's false, if you dig in: again, Swartz's lawyer, the prosecutors own statements, and a straightforward reading of the sentencing guidelines (2B.1).
A particularly important detail of how sentencing works: charges group. The press releases often imply that you might serve time on every count, but in reality, in almost all circumstances, you serve the sentence associated with the most severe count.
The TechDirt article makes the same mistake. TechDirt has gotten better over the last few years; Mike Masnick got tight with the Ken White / Popehat scene, and I assume they get feedback now on legal stuff. But that article is exactly the kind of thing what White is talking about when he says that the media bears some culpability in people's misunderstanding of how sentencing works.
To be clear: all I'm litigating is whether Swartz faced a "lifetime" in prison --- or, for that matter, any double-digit-years sentence whatsoever. I'm not qualified to evaluate the sentencing guidelines, but my layperson read of the guidelines results in Swartz facing 1-2 years if he'd been convicted on everything. You shouldn't take my word for it at all, but do note that my reading lines up with what Swartz's attorney said as well.
Still, the fact that prosecutors seek to create this confusion in the general public makes it likely that they seek to create it in defendant. And stressed out people who should know better often wind up with bad conclusions because stressed out people under pressure don't think well.
That said, Swartz's attorney told Swarts that they would be seeking 7 years. Your lay reading may say that they wouldn't get it. But the gap between what you hear from different sources is extreme. And once you're in front of a judge, I don't trust courts to do the right thing.
Swartz had excellent counsel, federal criminal defense attorneys understand the sentencing guidelines the way we understand singly-linked lists.
I agree, strongly, that there is a massive power disparity between ordinary defendants and prosecutors. But I'm going to gingerly venture that you can't gauge the magnitude of that disparity by the number of cases that plead out. Some component of that is power imbalance, but the greater component of it is that law enforcement generally prosecutes lay-up cases. Many years of reading and listening to Ken White, who is no friend of the DOJ, leads me to believe this is even more true with federal prosecutions.
See https://www.texastribune.org/2017/03/07/report/ for how there is only one county in the country that actually double checks drug tests after someone has plead guilty. The result is that the one county alone manages to exonerate more people each year than the next three states combined.
There is no reason that I know of to believe that Harris County has an abnormal number of people wrongfully convicted. They are only unusual in figuring that out and turning them free later.
This is very likely not true according to his very good attorney. He felt that there would be no custodial sentence, and that losing the case was not likely.
It doesn't take a ton of expertise to set logging, most web services log access by default.
Warrants do not require evidence, just a signature.
The system is Internet-exposed. Even proving the user is in the country that you think they are is nontrivial.
If you run an internet exposed service and you log IP addresses and have the ability to issue a warrant, it is entirely trivial to trace a request back to a specific house.
There are a lot of ways to obfuscate your IP address, but if you don't know how to cover your tracks, it's easy to get caught.
Having an IP address alone is not generally probable cause enough to get a warrant, because they are regularly rotated, and shared, across geographic areas. And that's assuming nothing proxying that connection at all.
It might not be enough to convict her, it is enough to get a warrant. While they do rotate, ISPs do this with law enforcement a fair amount and I'm pretty sure they keep track of who owns which IP at any given moment.
> And that's assuming nothing proxying that connection at all.
A clever knowledgeable person would proxy, most people wouldn't know how. This is why I said it would be a foolish hacker. It's also possible someone else tapped into her wifi and did it. Or maybe there was no IP.
I'm just suggesting what is the most obvious piece of evidence which a judge would accept to grant a warrant here.
That does not negate the fact that an ISP can trivially correlate a time-stamped IP addr with a specific user.
Find out the ISP that owns the address, ask the ISP what customer it was assigned to at the time in question, and while that doesn't tell you who was using it for the particular accesses you are investigating (it could be anyone in the house at the time, or someone outside using that house's WiFi, or someone from anywhere in the world using malware installed on a computer in the house), it does tell you that that house has a decent chance of having relevant evidence, and that will probably be enough to get a warrant to go look for that evidence.