Hacker News Reader

Comment by throwaway5752 | Hacker News Reader

Seems pretty close to textbook SLAPP in a jurisdiction - Virginia - that has strong anti-SLAPP laws [correction: https://news.ycombinator.com/item?id=30867948 notes this is federal, and it has not been established if VA SLAPP laws apply] and and precedent for their use. I am a fan of Ubiquiti gear but I hope they lose, pay Krebs' costs, and pay a multiple of the costs as damages.

https://twitter.com/QuinnyPig/status/1509374736903507974 is just an example of how well this is going over.

View on HN

Krebs was pretty unethical in this case. He published articles based on quotes from a Ubiquiti insider who it later turned out was actually the hacker who was extorting them at the time. Krebs has never (as far as I know) addressed this or even acknowledged it.

If Krebs had just been a rube who was used by the hacker, I'd agree with you. But by not updating the record, he's continuing to further lies that he knows aren't true and are/will hurt Ubiquiti's reputation. Given that, I don't think it's as simple as "this gets dismissed as a SLAPP".

More to the point - he has doubled down on his reporting being correct, but failed to acknowledge that he - himself - was the weapon that the attacker used to inflict damage on Ubiquiti - their employees, users and shareholders.

Krebs got taken. Pure and simple. I can see why he might not want to acknowledge that, or do any soul searching on it, but when you were part of the problem, you have a responsibility to fix your part in it, even if it was a unwitting accomplice.

(From a questioning perspective) If a source happens not to be who they claimed to be, hiding for whatever reason, but the information in the story is newsworthy, credible, verifiable, and authenticated, does that mean the story should not go forward then?

The story already went forward.

It means that a correction should have been issued.

This is why journalists try to get multiple sources to corroborate what the other is saying.

That's hardly very likely with whistleblower stories, all you can do is be careful with wording like "<name> claims" "<name> alleges" to qualify the reporting. I read Krebs I find it hard that he wouldn't retract something if Ubiquiti (or someone else) came to him with evidence showing the "whistleblower" was a fake that he wouldn't retract the article based on new information. He seems like a good journo to me and has nothing to lose by doing such. He reports on a lot of stuff and now one is going to be constantly fact checking every story they ever put out there. It's impossible. I suspect Ubiquiti filed this before they ever contacted him about the whistleblower being a fake.

What's the counterfactual here? If Krebs was wrong to report on this, what's the world where he didn't look like? Is anyone better off?

It doesn't seem like it. Either way, Ubiquiti had a major security issue on its hands. Krebs didn't make that true by reporting it, it was true already and he wasn't wrong to say that they did, regardless of some niggling over whether he knew two people were actually the same person lying to him about who they were.

Journalists aren't supposed to take what a "whistleblower" says at face value. If Krebs were a journalist at the NYTimes, for example, they would've done a lot of background research to corroborate the insider's story before publishing the quote. And then either would not have run it or at least have been clear about how little he knows about the "whistleblower".

And the bigger issue is, once the truth came out, he should've done a retraction and discussed what he knows about "Adam" and how he was likely the hacker who did the extortion.

Ignoring that I didn't ask anything like "what should Krebs have done later?":

> he should've done a retraction and discussed what he knows about "Adam" and how he was likely the hacker who did the extortion.

That's not a retraction. That's an update based on new information. Those aren't the same thing. This is just begging the question of his knowledge. It doesn't really seem like Krebs, even if he is a shitty journalist overall (I know very little about him, so I'm not going to assume one way or another), said anything actually false at the time he said it.

Is a journalist, once they report on a story once, required to continue reporting on that story forever?

If a journalist is complicit in helping an extortion attempt with one of their stories, then, yes, any ethical journalist has a responsibility to update it. This will (hopefully) be a pretty rare occurrence.

Which is it, was he duped or was he complicit? These are very different accusations, and exactly what I mean by begging the question of his knowledge. You (and it seems ubiquiti) are assuming he knew this at some point where he claims he didn't, which makes him not just a victim of misinformation but an active perpetrator.

Proving that in court seems like it's going to be very hard. Never mind proving that he did it intentionally and with malice. It's not like he gains anything really by not expanding on the story as we know it, and as I've mentioned, it's not even clear what ubiquiti gains from expecting him to talk about new facts that make them look bad.

Not a lawyer, but I suspect that the sentence "Ubiquiti has not responded to repeated requests for comment." in Exhibit A of Ubiquiti's own evidence is going to carry a lot of Kreb's case.

Ubiquiti is interesting. The CEO is the technical founder and bootstrapper, overwhelming controlling shareholder, and has been the subject of what I'd consider unethical (stock) short campaigns in the past. So you have a CEO without many checks and balances who is justifiably defensive of his company. I am a fan of him and his company. That said, I think he is in the wrong here, and I just hope he realizes it and can amicably resolve this in a way that is more productive for everyone.

Krebs did address it in a tweet. Says the facts as he reported them were true.

See exhibit E.

https://storage.courtlistener.com/recap/gov.uscourts.vaed.52...

Virginia doesn't have a strong anti-SLAPP law. It's weak at best, only carving out some immunity for statements made about "matters of public concern": https://law.lis.virginia.gov/vacode/title8.01/chapter3/secti... And unlike other states, if the plaintiff loses on a motion to dismiss under the statute, the defendant isn't entitled to attorney fees and court costs.

Virginia has an anti-SLAPP statue but this is a federal suit, and the Fourth Circuit hasn’t ruled on whether state anti-SLAPP statutes apply to federal cases.

What do you mean by “apply to”? It sounds like a run of the mill compulsory counterclaim.

I'm not a lawyer and I don't know how a counterclaim would work in this case, but the way I understand anti-SLAPP statutes to work is that they let the defendant file a motion to dismiss. If the suit were in state court, then the state law would clearly apply and Krebs could try to have the suit dismissed. But it's in federal court, not a Virginia state court. Whether state anti-SLAPP statutes can be used in federal cases is not clear; there's a circuit split and the Fourth Circuit has not ruled on question: https://www.jdsupra.com/legalnews/second-circuit-slaps-down-...

State court claims can and regularly are brought in federal court because federal courts have authority to hear state law cases. It’s Civil Procedure 101. Counter-claims which arise from the same operative facts must be brought or else they’re generally waived.

Also, defamation is a creature of common law and therefore state law governs it; there is no Federal defamation law. Ubiquiti filed in federal court under diversity jurisdiction, and likely because they think they'll get a better outcome than they would in state court. But the court still has to adjudicate the substantive claims under VA state law. Procedurally, though, the Federal Rules of Civil Procedure apply in Federal court, not state procedural rules.

The cited article suggests that some Federal circuits treat anti-SLAPP statutes as procedural rather than substantive law, and so federal judges might decline to apply them in the cases brought to them.

That makes sense, though it’s hard for me to imagine a reasonable finding they don’t apply given the state public policy justification.

My understanding of the linked article is that the question is whether the federal rules of civil procedure supersede the state anti-SLAPP statue, because, since it’s in federal court, the suit is governed by the FRCP even if it’s over state or common law claims.

Reply on news.ycombinator.com