Hacker News Reader

Comment by mukyu | Hacker News Reader

The title is inaccurate.

It is alleged that he signed up for guest accounts on their network with different laptops, changed his MAC address and re-registered if the IP he was using was blocked (by JSTOR) or cut off of the network (by MIT), and finally connected a laptop in a basement networking closet.

I guess you could say that is 'hacking' in the unauthorized access sense, but not in any meaningful sense. It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection.

View on HN

He found ways to get around the (minor) protections put in place using a computer. That fits the colloquial definition of hacking. We don't own the term anymore - if we ever did.

IANAL, but legally speaking unauthorized access is a crime regardless of how easy it was to gain access.

I think the parent was just disappointed at using "hacking" to refer to something as mundane as getting guest accounts to the network.

This is a very frightening belief.

How long until posting a negative comment to a blog is "unautorized access" to that blog? Gaining access was easy: all you had to do was type a comment and hit submit. But some Powers That Be decided they didn't really want you to post that, so now it's a federal computer crime.

Land of the free.

That's currently unsettled, and yes a lot of computer-crime experts (even typically law-and-order-leaning ones) consider it a huge problem--- it might actually be a federal crime to post a comment on a blog in violation of the blog's Terms of Service.

This case is currently winding its way through the courts, and will hopefully be overturned: http://volokh.com/2011/06/14/petition-for-rehearing-filed-in...

This problem extends way beyond hacking laws—the average person in the US probably commits several felonies a day: http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx

I read this book and think that federal crimes are punished too harshly, but the people profiled seem far from average.

Speaking of "TV drama levels of understanding of criminal justice"... :)

With only a few exceptions, persons accused of crimes are not presumed to have mens rea. Statutory rape, for instance, has "strict liability"; even if you don't know you're committing a crime, you're liable. Most criminal offenses are not like this. The state is required to establish mens rea.

A prosecutor could say that a ToS-infringing blog comment is a criminal violation, but unless that prosecutor can establish that the comment was made in purposeful, knowing, or reckless violation of the ToS, they'd be wasting their time.

So where's the mens rea in this case?

Aaron's? I respectfully decline to lay out a case against Aaron on HN.

You're getting hung up on the "access" part, it's the "authorization" that's important. In your example it would likely be almost impossible for the blog owner to prove that someone intent on posting negative comments was not authorized to do so.

As a side note, I think we all should be more careful with "omg, we're losing our freedoms!" comments. They're usually not as clever as they feel at the time, and have the dangerous property of inuring us to such claims.

This was struck down by the courts by the way. Why? If unauthorized access is a federal offense, and unauthorized access can be determined by (e.g.) a EULA, then it basically allows a business to dictate criminal law. For example:

1. This would allow all of those 'You agree that you are not a law enforcement official' B.S. 'terms of use' on warez servers to actually have teeth.

2. "If you are a {black,hispanic,gay,etc} person, you are not allowed to access my website."

Do any of these sound reasonable? I should hope not.

That's because those restrictions are illegal themselves. "Don't download the whole database" is not an illegal restriction.

* How about "You are not allowed to hyperlink to this page?"

* How about that 'MySpace Hacking' case? From Wikipedia:

  Judge Wu summed up his opinion by stating that allowing a violation of a
  website's Terms of Service to constitute an intentional access of a computer
  without authorization or exceeding authorization would "result in
  transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment
  that would convert a multitude of otherwise innocent Internet users into
  misdemeanant criminals." For these reasons, Judge Wu granted Drew's motion
  for acquittal.  Government eventually decided not to appeal [16].

http://en.wikipedia.org/wiki/United_States_v._Lori_Drew

I don't think hyperlinking is the crime in question for this case.

My post wasn't very clear. I was making two separate points.

There are two separate issues as well, whether or not a restriction is valid and the ease with which it is circumvented. Lots of EULA/TOS terms are unreasonably broad. But let's say the TOS says "use of service without a password is unauthorized". Seems reasonable.

Somebody runs a program to guess passwords until they find one that works. "Ah ha," they say, "I have a password, so my usage is now authorized." I don't think a judge or jury will buy that. Even if the password was easy to guess.

I believe that was SpikeGronim's point. Assuming the definition of unauthorized is legit, there's no such "it was too easy" defense. Or "I could do it, therefore I must have been allowed to do it."

It isn't breaking and entering if someone repeatedly trespasses somewhere (say, banned from a store) even if they change their clothes to avoid detection.

It might not be breaking & entering, but it's still trespassing, which is a crime.

> It might not be breaking & entering, but it's still trespassing, which is a crime.

Jaywalking is murder! Well, it's still a crime...

I'm not sure what you're appealing to. Real-world analogies don't always transfer readily to digital law. Even in the words of the ageing CFAA, "exceeding authorization" to steal commercial information is most certainly a punishable crime. You don't have to pull out nmap and zero days to be convicted of hacking.

The indictment mentions only one laptop, BTW. No indication he signed up with "different laptops".

22. On October 8, 2010, Swartz connected a second computer to MIT’s network and registered as a guest, using similar naming conventions: the computer was registered under the name "Grace Host," the computer client name "ghost macbook," and the throw-away e-mail address “ghost42@mailinator.com."

23. The next day, October 9, 2010, Swartz used both the “ghost laptop” and the “ghost macbook” to systematically and rapidly access and download an extraordinary volume of articles from JSTOR. The pace was so fast that it brought down some of JSTOR’s computer servers.

Huh; my bad.

Also mentioned is that Swartz used the network closet to take 2 IP addresses. Are we to infer he hooked up both laptops with an IP each? Or is the real scenario that he was using one laptop under 2 identities? (Not that impossible.)

How is this not "unauthorized access" "in any meaningful sense"?

They blocked his IP, they blocked his MAC, and he hid a machine in a wiring closet to get on MIT's network. What would he have to do to make it "meaningful"?

Crack a password. Use SQL injections. Steal a credit card. Spoof someone else's MAC and IP. Steal a cookie. Something like that.

He was accused of using a guest network account on MIT, with a fake name, new MAC and IP, and throw-away email address. From there, he used a script to download lots of JSTOR documents.

This isn't the internet equivalent of "checking out too many library books". It's the internet equivalent of "checking out too many library books whilst wearing a false mustache".

So it should only be illegal if a hacker wouldn't think it's lame? Got it.

As a hacker, I think this would solve a lot of problems in the world. ;p

Nah. It should only be illegal if normal people can't do it. Most of what Aaron did is stuff lots of people do.

There's a difference between wearing a dummy badge that says "I am Gary Host", a badge that incorrectly says "I am Bill Gates" (as that would be some kind of identity theft) and forging a passport in "Gary Host"'s name. What aaronsw did was far closer to the first.

Now, you could argue that scripts are power tools, and using them requires a higher standard of behavior. If you are driving a plane, giving dummy credentials over the radio is a lot more serious than a kid with a toy CV radio.

Even then, the dummy credentials didn't really cause any damage. The damage was done by the script itself. Even if he used his real name, the damage would have been done.

I did not say that it was not unauthorized access, just that hacking (in the breaking into computer systems sense) involves actually breaking in.

Changing a MAC address (on a device that you own and control) does not constitute hacking. It is as simple as ifconfig(8) and if you have a consumer router it probably has an option in the web interface to do it.

Reply on news.ycombinator.com