Hacker News Reader

Comment by antihero | Hacker News Reader

> “Further, Ticketmaster’s employees brazenly held a division-wide ‘summit’ at which the stolen passwords were used to access the victim company’s computers.”

Isn't this a felony? Why aren't these people in jail?

> Live Nation hired a former CrowdSurge employee named Stephen Mead in 2013. Then, now-fired Ticketmaster executive Zeeshan Zaidi and other executives encouraged him to turn over his old employer’s secrets

You know, there are ongoing extradition cases from UK->USA for people who have done far, FAR less malevolent actions than these.

Why are these people not facing 10+ years in jail for hacking?

View on HN

Aaron Swartz did far, far less, but took his own life because of how draconian the CFAA is.

I agree: these people should be prosecuted. I'd also argue that Ticketmaster in this case was acting as a criminal conspiracy.

The statute of limitations on the CFAA is two years.

Yes, but it's from "the date of the act complained of or the date of the discovery of the damage."

Also, the article states that Ticketmaster is under a deferred prosecution agreement for CFAA. So they get to pay a pittance of a fine, and make some internal "policies" and get off scot free.

>Isn't this a felony? Why aren't these people in jail?

Zaidi was prosecuted and he pleaded guilty, although his sentence has yet to be determined.

>Zaidi was terminated from Ticketmaster in 2017 and pleaded guilty in Brooklyn federal court in 2019 to one count of conspiring to access protected computers without authorization and to commit wire fraud, according to the deferred prosecution agreement. Zaidi's sentencing has been delayed, according to court filings. CNN has contacted his attorneys for comment.

https://www.cnn.com/2020/12/30/business/ticketmaster-plea-pa...

https://www.bleepingcomputer.com/news/security/ticketmaster-...

"The company admitted that it is responsible for the actions of its employees under United States law."

That was also my question why those employees are not in jail yet. I was thinking that company gets fine and employees get jail time but that must be some weird/interesting part of US law.

>that must be some weird/interesting part of US law.

Indeed. We see time and time again that corporations can get away with almost anything they want without facing any real consequence compared to individuals. What part of US law is protecting these corporations and the people involved when they flagrantly break the law? It's sickening.

>We see time and time again that corporations can get away with almost anything they want without facing any real consequence compared to individuals.

...except that corporations are literally just groups of people, the person who perpetrated the act (Zaidi) pled guilty to hacking and is awaiting sentencing?

And all the other people who were present and knew what was going on?

IANAL, but in the US at least there isn't any obligation to stop or report any crime you witnessed[1]. As for the other people in the company that used his credentials to access the competitors site, it's possible to prosecute them, but you'll have to prove intent. That might be tricky to prove because the defense can argue that they didn't intend to hack the site, because they thought Zaidi was properly authorized to use the site.

[1] There are some exceptions, eg. if you're a teacher and you learn about child abuse

According to the articles other employees logged in with what they knew were not legitimately obtained and pretty clearly committed CFAA violations that have gotten serious punishment before. Moreover they induced Zaidi to commit the offenses he's been prosecuted for _and_ co-ordinated a set of employees to access the victim's network _and_ showed that off internally. How is that not criminal conspiracy unless it doesn't count against Ticketmaster if they just say the magic words that they didn't know?

Really? Zaidi did all this by himself? Last time I checked "I was just following orders" isn't a valid defense for felonies.

> What part of US law is protecting these corporations and the people involved when they flagrantly break the law?

Er.... this is entirely the point of the law in the US -- to protect corporate interests. Who do you think are writing the laws? It's not some weird edge case or quirk in the system. Protecting and furthering corporate interests is the system. As always, the purpose of the system is what it does.

Cool so I want to hack a company and face no jail: create my own company, employ myself and do the hack.

My company gets fined $X million, which it doesn't have so it folds. I skip off into the sunset

If only. It requires a bit more finesse and money than that. Ticketmaster had the resources to throw at the right people to influence outcomes. If you don’t, then you will not have the same outcome as there is a lot of subjectiveness in the system.

> Cool so I want to hack a company and face no jail: create my own company, employ myself and do the hack.

https://en.wikipedia.org/wiki/Piercing_the_corporate_veil#Fa...

You're going to have to be very careful to avoid that, and even then, you might still be personally liable, see my other comment: https://news.ycombinator.com/item?id=25593629

I think downside of this plan is that you have to have billions of dollars first and a pack of lawyers to pull it off.

The problem we have is that the lawyers for the government want to show victories quickly. They don't care about justice, and they aren't incentivized to prosecute tough cases where rich companies have dozens of lawyers and present roadblock after roadblock through legal defense. We literally need robot lawyers that will prosecute and convict people tirelessly and fairly. There are hackers who did much less that got the book thrown at them and actually spent time in jail. Weev's case (https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-begi...) is disgusting even though he was using AT&T's own APIs and actually didn't hack anything. Yes, Weev appears to be a horrible person but that isn't the point, the point is the law should be fair to everyone. If the Ticketmaster execs and those that hacked CrowdSurge don't see a sentence much harsher than this, it will be an attack against justice. But again, I don't think justice will be served because the prosecutors literally don't care about justice.

Reply on news.ycombinator.com