Hacker News Reader

Comment by speckledjim | Hacker News Reader

> accessing someone else's voice mail is no less a crime if they don't have a PIN set.

So by extension, you're saying if I setup a directory on my website called /admin and don't password protect it, then you could be committing a criminal offense if you decide to access it?

Personally I think there is a difference. If there is NO security, then it could be argued that it was intended to be public. If there is security, but it is bypassed, then obviously that is a violation.

So I'm with you that the difficulty of hacking isn't related to the severity. But in the particular case of having no PIN, no password protection, there is no hacking taking place. So it's a moot point IMHO.

View on HN

Yes. If you browse to /admin and find it non-password-protected, and then deliberately use it to manipulate an application or gain access to information you reasonably know you shouldn't have access to, nobody making a prosecution decision is going to care about your nerdy protestation that there was no password.

You will be afforded the opportunity to argue that /admin was "intended to be public" in court. Depending on what you do with /admin, a judge or jury may even listen to you.

IANAL, but in the UK, according to the computer misuse act - yes that would be a criminal offence as the access is unauthorized, regardless of how access was gained. (guessing URL, phising, guessing password etc)

http://en.wikipedia.org/wiki/Computer_Misuse_Act_1990#The_Co...

Yes, if someone goes to /admin on your site and starts to mess around even if it's not password protected, that's a naughty thing and should be (and will be) punished even if you should have known better and ensured that it's well protected. Just like stealing a car is a crime even if the owner left the key inside the car. Or burglarizing someone's home even if occupier has accidentally left the front door unlocked. Don't you agree?

What if someone stores their wallet in a public trashcan?

Then, like you, that person is trolling.

I'm not trolling, I was merely adding another analogy to the OP's selective list of things-that-are-like-browsing-directories-on-a-website.

Like my profile says: "I'm not trolling; I actually think that."

If you find someones wallet in the street. Take the cash then give it back. If it can be proven you took the money, you can be charged with theft. The famous saying 'possession is 9/10ths of the law' relates to proving who's possession something is, not what your rights are once you have it.

The laws regarding found property greatly vary between countries. In some places, if you find something and you it's not possible to determine who the owner is, the founder can keep the found property. In other places, if you cannot determine the ownership of a found property, you have to hand it over to the police, otherwise you could be charged with theft. It's a complicated matter.

However, generally, if you find, say for instance, a wallet in a public thrash can and you can determine the identity of the owner (because, for example, there is a driving license in it), you cannot keep it.

At some point the analogy breaks down.. what if I typo "admin" trying to get to another page? Or, more realistically, what about spiders? What if it's linked and a human clicks the link?

You cannot be charged for most crimes if you lack any criminal intent.

Ok, sure, I'm just saying that the analogy breaks down. Now the debate is over intent, whereas it's nearly impossible to accidentally break and enter.

I don't think the analogy breaks down. I think most of the people arguing here need to go re-read Wikipedia on mens rea vs. actus rea. Most of the counter-analogies seem to boil down to things like, "but then Google could one day decide nobody's authorized to visit WWW.GOOGLE.COM and half the US would become felons!"

I think we're talking at different points, I was saying that we don't have like literal robots walking the streets who might accidentally wander into your house, and you can't misclick your way into sticking up a liquor store.

Certainly if you have a whole set of willful misconduct associated with the act, like in this case, then it's illegal/wrong even if the page was wide open and prominently linked.

I guess I was just saying that you couldn't just hold someone culpable for a hit in the access log like you could for being in the wrong kitchen. The bar to prove bad intent is higher.

Sure. Who disagrees with that? If you accidentally stumble onto an /admin page, say "shit!", send an email to the site and then log off, who thinks you should be charged with a crime? Nobody does.

No, it doesn't work like that. Leaving your door unlocked doesn't mean your home is suddenly open to the public who can wander in. Leaving your computer without a password doesn't mean it's legal for someone to hack into it and use it for what they will. It also doesn't mean if you forget to password protect your FTP server that anyone and everyone are free to use it as they will.

There is a reasonable expectation of privacy in these cases. The actual severity might be different depending on the circumstances, but it's still fairly obvious if what you are doing is wrong or not. Obviously, their are grey areas. Does a husband have the right to access his wife's voice mail? What about her computer? What if they share a computer or accounts?

A good example I've always heard concerns banking on public computers. If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to then transfer money to their account and keep it? No hacking was involved. No security was breached.

> If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to then transfer money to their account and keep it? No hacking was involved. No security was breached.

That's not hacking, but it is theft. How about this: If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to glance at the screen, see your account balances, and log you out?

It depends. If it can be established that you accessed someone else's bank balance purposefully or knowingly, understanding it was meant to be private, you can be on the hook for a crime. A classic nerd mistake here is to look only at the computer-related act in isolation; a real prosecution looks at the totality of circumstances. What did you do with the information? What prompted you to access it?

I think it's a stretch to call reading something "access". If someone leaves their private banking documents face up on a table, I'd expect it to be legal to read them.

Sure. Like I said: what did you do with the data? What prompted you to access it in the first place?

Please read my comment in the context of the thread. You've agreed with me: It's a crime. The parent post was suggesting this:

> If there is NO security, then it could be argued that it was intended to be public.

You then go on to this:

> If you accessed your bank account on a public computer, and then left without logging out, would it be okay for someone to glance at the screen, see your account balances, and log you out?

You really think things are black and white. Trying to tidy things up into a neat little package.

No, the intent, or motive of the person is to close the sessions. However, if I'd closed the browser window and left, and someone came and opened and then browsed the bank's site, and then made note of some information, and use it in some manner (perhaps, a PI or something), this is more likely criminal in nature.

You cannot simply say: "This is bad" and "This is good." However, it's absurd to think that just because someone forgets to secure something that it's free for public consumption. There is a reasonable expectation of privacy in certain cases. Just because it's easily accessible doesn't mean you have free reign to do what you will with whatever it is.

Reply on news.ycombinator.com