Hacker News Reader

Hacker News

Comment by swalsh | Hacker News Reader

Full thread

swalsh

Could these "Researchers" be prosecuted under CFAA? Purposely accessing information known to be private?

EDIT: accidently wrote DMCA

View on HN

Yes, of course. This is an illegal hack.

Edit: I should add, it would be under the CFAA.

Edit #2: I could be wrong, it looks like they used Parler's APIs, and didn't bypass any auth. I really shouldn't have even called this a hack, it's more just archiving. But weev went to jail for the same thing, so I'd say there's a chance of prosecution, would come down to a court case. If I was the person who did this, I would never step foot in America, just to be safe.

Is it? The article indicates at least some of this comes from merely incrementing an integer in the video URLs.

> I am now crawling URLs of all videos uploaded to Parler. Sequentially from latest to oldest. VIDXXX.txt files coming up, 50k chunks, there will be 1.1M URLs total...

I believe from a legal standpoint, all that matters is whether the user intended it to be private or not.

It is a felony to open a mail envelope addressed to someone else. It doesn't matter that a butterknife can cut open the envelope, the intent is clear.

This is more a postcard than a letter.

The public posts are probably allowed to be accessed (like a postcard).

The issue comes with the posts that were deleted: they arguably have an expectation of privacy.

EDIT: And direct messages, if they work like Twitter, DEFINITELY have an expectation of privacy. If Parler has a DM-like system, they are probably illegal to access.

At least one person has already been prosecuted for "hacking" for incrementing integers in a URL.

People have been sent to prison before for nothing more than fetching publicly available web pages by incrementing numbers in a URL:

https://en.wikipedia.org/wiki/Weev

We tend to think that's bad and an incorrect definition of cracking that should be overturned around here, right?

> the conviction was vacated by a higher court

> While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.

I don't know how it works "over there", but where I'm from "URL-hacking" is not considered hacking, but data publicly available.

...and you are 100% sure that if this got before a court, the decision would go your way?

No, I am not a lawyer.

I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale_...

But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...

I’m assuming, but the USA then. What country is that?

Denmark.

It is considered on par with an email sent to a wrong recipient. There might be an exception though, but it is untried in the courts, AFAIK.

...and publishing the personal data they got their hands on this way ("In revealing the flaw to the media, the group also exposed personal data from over 100,000 people")

It was a bit more than that. The attack was against AT&T, there was zero public interest in the information from a whistleblower perspective, the victims were customers of AT&T, a telecommunications provider.

Dumping the contents of a far-right website that helped push for Insurrection against the US Government seems pretty tame by comparison.

Also, Weev is open and proudly a Nazi, so the optics of bringing him up while defending the rights of a Fascist website isn't great.

>The attack was against AT&T, there was zero public interest in the information from a whistleblower perspective, the victims were customers of AT&T, a telecommunications provider.

You think there's "zero public interest" in knowing that a large US corporation, with private information about a significant fraction of the American public, has neglected their obligations to protect that private information? And that they've ignored all pleas to treat the vulnerability with the seriousness it deserves?

>Also, Weev is open and proudly a Nazi, so the optics of bringing him up while defending the rights of a Fascist website isn't great.

How are his political leanings relevant to the question of whether accessing this data would constitute a crime?

Weev when to jail for the exact same thing under the CFAA.

Weev's conviction was vacated.

On a technicality because of where he was charged, not because of the law. I don't think he should have ever been convicted under the CFAA, but he was.

From Wiki on his case:

It's a pity it didn't make it to full review on appeal to get a solid ruling on this.

Well if I were to do the same to any social network, I would have to request their permission first on the basis of security research according to their Terms of Service.

In this case it is still an unauthorised hack.

I think the extracting of the data will definitely go to court as a violation of the CFAA. The publishing of the data might also fall under the DMCA but it sounds less plausible to me. I'm not a lawyer so take this with a grain of salt.

DMCA is only for intellectual property, not private information in general.

There are other laws this would likely fall under. Laws against hacking are generally "access in excess of authorization," where "authorization" is legal permission, not system permission.

I think I meant to write CFAA, thanks for pointing that out. Comment updated.

Practically no. Judges, tech community lobbyists, and basically the entire state is on their side.

That's not really how it works, jury nullification notwithstanding.

Trigger warning, but this reminds me of the Steubenville High school rape case (you can google it).

A hacker accessed and leaked video of the situation in question (IIRC after officials refused to take action, and gone as far as too allegedly cover up the incident in order to protect the athletes and school's program).

At least one of the individuals responsible for leaking the video was charged under CFAA. IIRC this individual received a harsher sentence than those involved in the underlying crime.

You'd like to think that a judge and entire state would be understanding, but that's not always the case and not something to depend on.

Doubtful, all the links were publicly accessible. I believe the researcher just crawled the "video.parler.com" domain after finding out they used sequential IDs.

Allegedly Parler didn't scrub exif data from any media, including all of their "verification" materials including Drivers Licenses and Passports.

Possibly. Automatically creating fake user accounts[1] likely falls into that category.

I'm not in favor of vigilante justice. I hope some of these people do sued under the CFAA. If all they wanted to do was archive public posts, there are ways to do that that don't involve programmatically creating fake accounts.

[1] https://archive.is/Dupjk

Reply on news.ycombinator.com