Kevin Mitnick Hacked California Law in 1983
schneier.com
schneier.com
Kevin's parole officer liked him and knew that his superiors in an overworked system wouldn't bat an eye at his wrong interpretation of the law. So he played along, and his superiors didn't ask any questions. One less kid to keep up with (and a nonviolent one at that).
If on the other hand Kevin's parole officer had been a dick, he would have told Kevin he wasn't allowed to do this. And when Kevin did it anyway, he would have brought it to the attention of his supervisors who would use the right interpretation of the law to hold him accountable and keep the warrant out for some longer amount of time.
Since there isn't a series of human-based gates running inside Chromium, this has very little if anything to do with finding exploits in software.
Edit: clarification
The gamble is whether the regular prosecutor could charged him afterwards for something given what he did, and whether they would bother.
Adult courts have jurisdiction over defendants for crimes committed as an adult (generally 18, though as young as 16 for specific crimes).
The arrest warrant was issued when Mitnick was 21 and on parole, or in other words, for a violation committed as an adult. While the arrest warrant was issued by the juvie court, it could have been issued by the adult court, as both courts would have had jurisdiction over the crime for which the arrest warranted was issued.
So the lawyer was right, because the statute of limitations for the adult court was tolled while Mitnick fled the jurisdiction. And the parole officer was also right, because the juvie court which issued the warrant would have lost jurisdiction over Mitnick once he turned 21.
Juvie court is way nicer than adult court. Mitnick "hacked" the system and only got away with it because prosecutors decided to focus their efforts on more serious crimes. But he could easily have ended up in prison for a few years.
Upon reading it years ago, I finally learned the explanation for why Netcom never billed me for years of continuous dial-up CSLIP service. Kevin had hacked Netcom and deleted their accounting records.
I ran that CSLIP connection continuously for many years. I would have paid them if they had ever billed me.
Just like computer programs, mistakes happen with legal languages, and when they do, they are typically have unintended consequences.
(edited for a couple of missing words in the last sentence)
More seriously, this means you also have to accurately encode all the things the laws refer to, even when those things are vague judgement calls. It's easy to say "you can only have a noncompete agreement if it doesn't make it unreasonably difficult to find another job in the same industry", but hard to express "unreasonably difficult" or "same industry" with the kind of precision we expect from code. A sufficiently evil company would just pay a lawyer for a few days to find a loophole in whatever definitions you can think of.
There's a reason the primary use of this is cryptocurrency conversion - it's a lot easier to enumerate all the failure modes in "give me n of A and I will give you m of B".
Don't need to encode it in some sort of machine code. Just need a git repo with the law so we can submit a PR to the CA assembly and get this fixed.
[0] https://www.cs.virginia.edu/~cr4bd/4630/S2021/
[1] https://exercism.org/tracks/x86-64-assembly
Update: Exercism seems to only be an "exercises" platform and doesn't actually have any teaching materials of its own?
While Leibniz is widely known for his mathematics and philosophy, one of his lesser known ideas was the relation between law and computation.
There is a small research community around it today. Look up Computational Law and Computational Contracts if you are interested.
I thought it was the most fascinating talk in the conference.
https://www.youtube.com/watch?v=EshxZVMURt4
https://popl18.sigplan.org/details/POPL-2018-papers/3/Formal...
The city is Los Angeles, though the content doesn't seem to match precisely what was mentioned.
I found this via a Google search for `conference convert legal phrases into code "theorem" bug`, which returned the following paper:
https://hal.inria.fr/hal-03159939v2/document
I then checked the citations of that paper for anything matching.
Oh wait, everyone was a nerdy person!
There are tons of ambiguities and other problems in issued patents!
When I get the time, I intend to rewrite a significant amount of the code in an object-oriented style. (Basically, making a class for a patent claim and having a ton of methods for that.) The code right now is a mostly untested mess that seems to produce decent results but is not pleasant to work with.
I think the biggest difference they face is that the interpreter is another reasoning human, and not just a functional part of the machine.
2600 was the original “hacker news”.
> PUT KEVIN BACK
Registered a throwaway over Tor just for this thread.
Kevin shouldn't be in prison, because prisons should be abolished, but be careful where you put... that. There's a notorious story about him being physically ejected from a fundraiser for refusing to pay the entry. (Redacting some details to stick to the fun parts)
On my end, I was working my way up to maybe flirting with someone I'd had a crush on for years, because I was a widdle baby hacker at my first... con... and off in the corner there's some kind of disturbance. "What was that?!" I sputter, straining to see across the smoky room, and some multicolored cyberpunk dryly drops "Oh, some asshole getting bounced"
If my timelines are correct, "some asshole" was Kevin Freaking Mitnick being physically ejected because when repeatedly asked to pay the door fee kept reiterating "I'm Kevin Mitnick!" and being repeatedly told "We know!" until one of the goons just... picked him up and carried him out into the hall.
And me? I was in the corner being aggressively hit on by John "Cap N Crunch" Draper, who seemed annoyed I kept refusing to drink from his flask. I told him dude, I'm 21 I can just buy booze at the bar and he angrily spat back "Why would I tell you if she's single, then you won't ever let me give you a massage!" and stormed off to find someone dumber and younger than me to ply.
(It was my first hacker convention, and it fully lived up to my expectations even if I didn't end up on the roof that year, lolllll)
I recall being specifically warned about him early in my conference attending.
Dudes creepy as all fuck. At later events he was eventually banned.
Defcon is basically run by a gang that values loyalty and dedication above most things.. which has historically low standards of ethics for their goons and attendees (albeit has improved somewhat over the years)
No, Derby was run by a gang. (The 303 could probably be RICO'd)
I cannot confirm or deny that Defcon is where the event occured, especially since it was technically just an event at a casino, as many things occuring on the same days as Defcon occur.
>a gang that values loyalty and dedication above most things.. which has historically low standards of ethics for their goons and attendees
I actually was told by someone at my last Defcon they were boycotting CCC because they allowed Nazi imagery or something to that effect, which surprisede me given... you know... Germany.
I've never been to CCC.
I can tell you that Defcon is changing though. I volunteered with a village rather than as a goon since I don't want to kiss ass to war criminals.
(A lot of their security is ex Navy Seals. I will hold the goddamn door open when it comes time to batman people to the Hague, I don't like people who volunteered to do war crimes then walk around Las Vegas with a gun on their hip whining about weed.)
Anyways... I never felt welcome at Defcon, it was like being in high school at the pool table -- you can pay like anyone else to play, but... there's a line... for lack of a better analogy.
Maybe I should check out CCC but part of the appeal of Defcon was cost... for an American, it's pretty cheap for a hotel and airfare compared to going to Europe, a place I may never return to since standing up for folks in the Me Too era + standing against white nationalism has resulted in me being blacklisted from infosec.
Context?
>I never felt welcome at Defcon, it was like being in high school at the pool table
They are like any clique but taken to the extreme. To me what's interesting is seeing how people change over time as they get older. What is old is new again, until you get married and have kids. A lot of white knights in the community as well who hide dirty secrets and make big noise about other people to deflect attention from themselves.
I've had someone legit tell me they didn't want to associate with me implying that it was bad for business despite the fact they helped me personally financially. The message between the lines was that somehow, they thought I was going to cause issues with attendance in their classes or association. Meanwhile, they are probably the most prominent member of the community. Absolutely ridiculous grandstanding.
>Context?
Iraq was a war crime and CMU doesn't have any distinction between the FFRDC and the uni. And the security staff at Defcon, a lot are ex CIA or special forces.
>I've had someone legit tell me they didn't want to associate with me implying that it was bad for business despite the fact they helped me personally financially. The message between the lines was that somehow, they thought I was going to cause issues with attendance in their classes or association. Meanwhile, they are probably the most prominent member of the community. Absolutely ridiculous grandstanding.
No one from the so called hacker community has given me so much as a couch to crash on, I don't feel welcome in it.
I used to travel more, the "hostel people" were quite kind, but that's nothing to do with hacking per se and I'm at an age I'd be intruding if I got a bed in a dorm. (People don't use them like they used to, everything is a party now it seems -- the last place I stayed that threw people out for making noise in the sleeping areas and the like went out of business.)
> A lot of white knights in the community as well who hide dirty secrets and make big noise about other people to deflect attention from themselves.
Yeah I knew at least one guy who handed out a lot of unwanted hugs who now rolls with the so called badass army. People are performative.
Yeah, there's no way that is true. I could easily see it happen the other way round, some edgy American kid turning up with a swastika shirt, getting thrown out, and throwing a tantrum because muh free speech, when he should be happy he wasn't arrested by the police.
(The few who donned them at Defcon were not given a warm welcome, to put it mildly.)
I was very jet lagged and had self medicated a lot due to death threats plus being in an abusive living situation (so desparately seeking employment to take me out of precarity) -- I wasn't taking detailed notes.
But it was a prominent person who made the claim, maybe they were inventing a reason to avoid DE, who knows.
There's been some dark things in the community
That isn’t a refutation of my argument but okay.
(I always avoided it for... uh... "opsec" but realizing I might be missing out on some things...)
I simply wish to explore friend :-)
The hacker perspective, that's what it's all about.
Almost lost it at airport security once so I keep it at home now.
You can bring tools under a certain size through the TSA.
"What's this?"
"My lock pick set"
"Why do you have lockpicks in your bag?"
"For work. They're not sharp."
And with that, after a brief eyebrow raise, I was on my way.
(Though I got the sense they thought I was with the men in black or something, but hey, uh -- be the change you wanna see in the world.)
(I was taping his talk, pro bono for the con, and asked him to speak into the mic for a sound check since we'd had issues with the previous speaker.)
There's a lot of argument going on about what side of the line this is on, but in the end it seems like courts can just say "we don't care" and do whatever they want?
Lexis
Westlaw
Juris (DoJ only)
FLITE (Air Force servicing other agencies)
and law review articles were indexed on laserdisc.
It's all in the public relations. Fellate the right reporters and you're set for life.
Exploiting a technicality in the actual, existing, applicable law is very different from basically trying to completely make up your own laws…