Lapsus$: GTA 6 hacker handed indefinite hospital order | Hacker News Reader

Lapsus$: GTA 6 hacker handed indefinite hospital order

bbc.co.uk

178 pointsode325 comments

> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

That's quite a feat.

> Rockstar Games alone told the court that the hack cost it $5m to recover from plus thousands of hours of staff time.

Either the kid is a genius or Rockstar really don't value their security much. Or maybe a bit of both?

From TFA, and given prior hacks, he's very skilled.

Someone should hire him as a white hat. Maybe they have some kind of custodial guardianship where the employer can monitor him staying clean.

It's tough though, how do you know that they won't use those skills against you? The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can.

Would be great to have them on the "good" side, but would probably take a lot of energy and resources as well.

Hopefully this story will have a somewhat happy ending, because it seems to not end yet.

He'd need a dedicated handler, and even then judging from the article's portrayal he seems like a hopelessly unmanageable type. He'd fit in with a modern-day A-team, come to think of it.

Could set him to work on hacking official state enemies, but you'd have to expect that he'd still engage in side-projects against whoever pissed him off or he had contempt for.

It’s not going to happen. He’s going to be closely supervised in a hospital indefinitely.

> The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can.

Admitting you will continue to fight evil is not evil.

That would be interested, but is impossible as long as they refuse to avoid crime and state that they plan to commit more at the first opportunity

That wouldn't work, you could never trust him at all, as he's expressed zero remorse and actually intent to continue to do crime, and is apparently very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable as a white hat hacker

> very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable

This is a popular framing of autistic people but this assumes the problem is complex nuances. Most of the time it's not very nuanced at all. The problem is that autistic people are less likely to follow rules they don't agree with or see as arbitrary - in the positive this is sometimes described as a "strong sense of justice" but that phrase ignores that the perception of what is or isn't just or unjust can vary.

Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.

>>> The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.

This is exactly what I was referring to. We agree.

> Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.

Very true.

Having seen that play out in real life before, I don't think he'd be as much of an asset as a liability. The problem with white hats is they need to have an interest in following some set of rules. With this guy it sounds more like his rule set is defined by whatever he finds interesting with little concern for legality or what others might find acceptable.

It's similar to the problem with the asshole genius programmer. You can keep him around because he's a genius but being an asshole in a position of authority over others (by virtue of being a genius) will result in people not wanting to work for you and this can easily mean you're missing out in individuals or teams that would vastly outmatch the asshole genius.

I’ve seen the opposite, the worthless manager, way more than the asshole genius.

To be fair, there are very few actual geniuses and a lot more unremarkable assholes.

How about the British intelligence apparatus? Seems like a person they would be very interested in acquiring.

Also seems like the sort of person who would leak everything, and not just for some principled whistleblower reasons, but "for teh lulz" or whatever.

Trust is more important than ability.

Maybe the only thing more dangerous than holding someone in a "hospital" as a sentence is to allow an employer to decide if they should be allowed out or sent back to serve their life sentence. It's just as bad as H-1 visas, or allowing illegal aliens into the USA with babies who are not given US citizenship. (I am not taking sides on whether we should give US citizenship to those people, deport them, or what. I am pointing out that making someone the slave of their employer is bad for society.)

No company will do this because you can hire competent, non violent white hat hackers that don't need monitoring.

And has no empathy, which makes him a lot more dangerous.

autism doesn't mean he doesn't have emotions

A valid diagnosis of one condition doesn’t preclude a litany of seriously dangerous other ones, either, correct?

You might as well say "He has psoriasis, he might also be an axe murderer." No, one fact doesn't preclude the existence of other facts, very good. That doesn't mean that making stigmatising connections is reasonable.

There was no connection made, GP merely pointed out their observation based on what he has done so far

He's a kid that "found" some pictures of an upcoming game, using dodgy means. But these pictures were publicly accessible, he didn't deceive an actual human to get them. Making them hidden, but public was a mistake by the company.

The real reason this happens is that the police doesn't understand, wants to punish the kid ... and youth services has lobbied so that locking up minors DOES NOT REQUIRE PROOF at trial, does not even require an actual accusation of a crime, in fact the kid gets none of the normal legal protections (because this is a 6 month prison sentence, in that the kid gets locked up, and could be an 18 month prison sentence)

During this time, the kid will be denied school, denied access to internet, books, friends, most of his family, he will be physically locked up (sometimes in solitary, although they get regularly accused of locking up autistic individuals for weeks/months). Oh and there is CONSTANT violence in these places.

But fundamentally this happens because there's no fair trial for minors. Why not? Youth "protection" keeps complaining that with the actual legal rights they can't do their job (or arguably even human rights, schooling, not being locked up unless convicted with full legal rights (not the case here), not locking up long times in solitary unless absolutely unavoidable (ie. NOT because of lack of funds and therefore no personnel for supervision), ...)

A fair trial against this kid would have failed since he was caught by illegal means (the police committed a crime to lure him into a trap, which is NOT legal, and frankly totally immoral).

I hope if you do security related work, remember this case. If you expose a security vulnerability, and get offered a job, there's now many examples of that job being an excuse to get you thrown into prison for years. Oh, and DESPITE this being totally illegal for the police to do.

Youth services can't do their job with normal legal rights for minors, because minors talk, and are aware with youth services offers (getting locked up without school, without friends/family, with constant punishment, and then at the end of it getting kicked into the street without any help). Although Youth Services lies about this to kids, it tends to be well known in the cities and "results in a lack of cooperation" (translation: kids, correctly, reason that they're better off abused than helped by Youth services). Oh and it doesn't help. Especially because the "kicked to the street" part, especially kids that don't have parental support for some reason, immediately turn to crime. And, of course, after a place like this, they don't want to be helped by anyone and hate the police.

The overall treatment of children, especially teenagers, in society is absolutely shocking. Literally they are like slaves. As a child, the family can be the single most tyrannical thing we will ever experience in our lifetimes. It can be a mini totalitarian dictatorship if you are unlucky to have bad parents.

In 100-200 years time from now people will be talking about this, just as we look back to barbaric times in the past now.

Empathy, not emotions.

Empathy: the ability to understand and share the feelings of another.

I don't know about you, but if I said someone doesn't have empathy I would think that I'm the one lacking it, since I can't possibly imagine understanding that person or their feelings.

I feel empathetic to you.

Autism doesn't preclude empathy at all. In fact, I would say it augments it once the other person's feelings are understood. What's generally lacking is realising the other is feeling in a certain way until it's explained to them or they have otherwise rationalised that feeling. Which, relatively ironically, will never be enough to make a neurotypical person feel empathy.

I don’t understand why you explain this to me. I just answered empty vs emotion. I am not discussing anything.

He may have emotions but certainly he doesn't care about those of others and the damage he can provoke. He actually wants to continue to be a criminal.

FTA: A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."

The guy needs help because he's autistic, and watched closely because he's also a sociopath.

Plenty of people want to commit crimes that aren't sociopaths.

"empathy impairment" is a fundamental feature of autism. It's not stigma. It'a not universal, but it is a major part of why it's a disorder in the first place.

As someone with autism, I lack empathy for (most) fake situations. Once I realized therapists and their ilk were lying about sad stories, I stopped having empathy for those sad situations.

Ditto for fake news stories.

Only mentally unfit people can pass a therapist's tests and be empathetic for people they know do not exist.

I'm not saying what you're saying is invalid, but I do have empathy for people that don't exist. It's called fiction and I find it quite enjoyable.

Oof, hopethis makes parent think.

Let's flip this around: think about what you just said.

you seem to be implying that feeling empathy for characters in work of fiction is clearly "normal" if somebody doesn't think that way it should give them pause. What you said may be construed as "hey you freak, if you only think for a moment you'll obviously notice that it's perfectly normal to feel empathy for fictional people, after all story telling is such a fundamental human feature that if you're not feeling that way there must be something wrong with you or at the very least it's you're fault because you're not thinking hard enough about that".

Of course, I'm not saying you actually believe that or accuse GP of that, but words and tone matters and can hurt. Think about that

Ummm feeling empathy for fictional characters is something that should be considered normal. If you find yourself not able to do that, you should understand that you may not be neurotypical and should get a diagnosis to understand what other blindspots you have in life that you should be aware of.

And that's fine. Does it make anyone less empathetic if they don't though? At least where it matters - where someone else's feelings are involved vs. literally no one else's (since they don't actually exist).

True.

I should have added: I also dislike being manipulated. I fail silly tests at work because I find them demeaning. If you want to know what I do on the job, drop by and watch.

This is relevant to psychological evaluations because the tests are so silly and contrived, and go on for so long, that I lose patience with them.

TL;DR: that's an outdated idea with an ever-growing body of research refuting it

Autistic and neurotypical people can empathize with others like them, but have trouble between the groups [1]. This is called the "double-empathy problem" by the paper which proposed the idea [2]. More recent papers explore subjects such as information transfer accuracy [3] with the same results: autistic participants understand each other perfectly well when allowed to use their preferred means of communication, as do neurotypicals. However, the two groups have trouble understanding each other. Further work extends this to a generalized model with extremely unsurprising results: people tend to be closer with people who think like them [4].

[1] https://link.springer.com/article/10.1007/s10803-015-2662-8

[2] https://kar.kent.ac.uk/62639/

[3] https://journals.sagepub.com/doi/10.1177/1362361320919286

[4] https://academic.oup.com/scan/article/16/1-2/222/5940490

No, but empathy is something autistic people famously struggle with

is it the same for male and female autists?

Each hack was going into a company Slack server and saying "hell o i am the admin gibe me password". I'm not impressed.

Personally, I think that a skilled exploiter is the one who finds such an easy loophole and exploits it efficiently and first; not the one who writes the most impressive code or finds the deepest algorithmic backdoor. I respect social engineering as much as anything when it comes to this domain.

shouldn't they at least try to use this kid for good instead of locking him up ? but then who know maybe a 3 letter gov agency will take him to a bunker somewhere

He's violent and uncooperative:

> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.

The TLA aren't hurting for talent these days either.

"Use" implies control / coercion, given that this guy doesn't seem to respect authority, that's not going to work. You can't make anyone work for you or "do good".

Conversely, it seems pretty easy to pay people to do bad things.

They have lions in zoos and circus for decades, just saying

> That's quite a feat.

Is it? I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?

The fact this is even mentioned really smells like they're trying to make this guy sound more skilled and evil than he really is, potentially also to cover up for the fact that the police made an oversight in letting him be around internet-connected devices even though their instructions was to not provide him internet/computer access.

I'm not downplaying the GTA hack (although I would still bet good money it was typical phishing/social engineering rather than anything more advanced), but I'm disagreeing that him doing so from a rooted TV stick or phone makes him any more of a monster than doing so from a typical computer.

To be fair: it is hard to not be around internet connected devices now

This is a really great angle and perspective to add in - I agree a noted habit / trend / short-hand in “severity” sometimes with technical subjects. I read through and also have heard some similar routine prep stories. Unusual? Absolutely!

Then again, it’s also unusual for a Dodge dealership in North Texas to have 7 Hellcat vehicles stolen in one night, but here we are.

So, I pick up that maybe the tech stack isn’t the most priority point - it’s the determination. The desire to continue through any avenue. Add that in with, reportedly a physical violence time in life, the persistent threat maybe can heal out of it?

> Add that in with, reportedly a physical violence time in life

Throwing an autistic person into prison will do that. The child abuse that autistic people often receive in their childhood will do that

> the persistent threat maybe can heal out of it?

Or maybe just give them a job instead of throwing them in a padded cell for life?

I hope they worked out a deal at least

> That's quite a feat.

> makes him any more of a monster

You're attacking a straw man.

Saying something is "a feat" is a long way from saying they're a monster.

The statement in the article would sound to a non-technical audience like this guy is some sort of hacking magician, and I'm sure nobody minds this perception for the reason I mentioned above.

I'm just providing a counterpoint as well as a reason why there's an incentive to make this guy sound more skilled & evil than he really is.

> I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?

Installing it is nothing: 2 touches away. But using this crappy Android experience (where the on screen keyboard obscures half of your terminal) shows talent and dedication.

I imagine this is where the Firestick and TV came in - screencast termux or ConnectBot to the TV so you can use the phone in horizontal mode as a larger keyboard.

> I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device

Installing a Linux environment or SSH client on a Fire Stick in a hotel without access to a laptop?

Not familiar with Firesticks- is there an app in their App Store for SSH?

Fire devices just run a flavor of Android, without Google Play Services. Getting SSH on there is trivial, especially when rooted.

I would like to install SSH and root a Fire Stick with my phone. Where should I start?

Second result on Kagi: https://www.firesticktricks.com/install-apk-on-firestick-fro... ?

This would at least give you the ability to install an SSH or RDP client since those don't even require root.

An genius would not only pull of the heist but get away with it.

There is no physical evidence: DNA, fingerprints.

If he didn't have a keyboard and typed on his phone like I do, they could also say that he "hacked them using only his thumbs".

Absolutely monumental waste of talent. Reminds me of how I got expelled from high school for "hacking" into their terrible infrastructure (without causing any damage whatsoever, other than to their pride). They threw the book at me. Threatened felonies. Were going on and on about how I will never vote, never be able to work as a postal worker etc.

Get this kid into the right environment and he would probably be able to do great things.

Note the violence. This is a person that can't control themselves when things don't go their way.

> dozens of reports of injury or property damage.

Eh, this is not outside the realm of expectations for an autistic teenager. Anyone locked in a cage will lash out, especially if they have neurological issues.

There is a way to harness this energy regardless.

> There is a way to harness this energy regardless.

Yeah, it is called prison. I don't care if someone is "autistic" or "shit-head asshole". If you are a violent son of a bitch, I have a concrete cage with bars to house you in.

You do realize that this is the "correctional system" right? With the goal to fix/correct/reintegrate people into society? What if you can do that before locking them up and throwing away the key? You have zero empathy, friend.

Also - this individual is clearly a brilliant hacker and if that energy could be directed towards the white hat space, defensive posture, that would be invaluable.

Guaranteed Mi6 will be trying to snag this kid for offensive hacking. He'd have been hired already by NSA if he was in the US.

> not outside the realm of expectations for an autistic teenager

That's very dismissive of people with ASD.

There are plenty of people with ASD all over the spectrum, but most of them aren't violent.

That in itself is enough of a reason for Kurtaj to be in medical holding, especially given his track record for stalking and harassing women.

This is an 18 year old kid.

The idea that we should, to some extent, excuse physical violence for 18-year-olds is disturbing.

I don't believe I advocated for excusing their behavior, but I don't think it's fair to label a kid as "a violent person who can't control themselves"

I disagree in most cases of 18-year-olds specifically, but even if I didn't, I think you should amend your original post to make your point more specific. It's hard to read it as not excusing his violence to some degree based on the comment you were replying to, even with a generous reading.

The idea that we should, to some extent, organize society around neurotics to the detriment of young boys is disturbing.

This is an 18 year old adult.

No one is adult at 18. Your brain is not mature fully until 25. Anyone who has experienced the age and has normal intelligence knows this.

Ackshully, executive function (what we really care about) hits max and stabilizes at around 18: https://pbs.twimg.com/media/F92-L1sXUAAXjkf?format=jpg&name=...

Source: https://www.nature.com/articles/s41467-023-42540-8

We were all 18 year olds, but we (hopefully) never stalked and harassed women, as is noted in TFA.

And don't use autism as an excuse - my mother teaches autistic teenagers and none of them have committed amoral stuff such as violence and harassment.

Also, an 18 year old is an adult.

Only just an adult. A few years, the hormones might calm down and, well, if we gave up on all 18 year old adults there wouldn't be too many of us left.

Don't judge the future, create the future.

> A few years, the hormones might calm down and, well, if we gave up on all 18 year old adults there wouldn't be too many of us left

Boys will be boys /s

I cannot believe I saw someone give this kind of a statement on HN.

I'm more surprised by your comment, to be honest.

Autism is a spectrum.

Plenty of 18 year olds do amazingly responsible things with positive impacts on society.

I recall being quite cognizant of adult thoughts & adult responsibility at age 14.

At age 20 I created something with friends that has led to multiple tens of millions of research funding for college students.

Many highly intelligent high school students compete in science & engineering competitions beyond levels of college & graduate level students.

People age and mature differently.

How many people have made mistakes and learned/grew from them.

He's a child give him time.

This, indeed, rather than label an 18 year old - whether he's legally an adult or not - as violent and unable to learn, and throw them in a cage for the rest of their lives.

He has (from what it sounds like) moderate autism. He's not just a misguided curious little fella that needs to be set on the right path. He needs a lot of help and to be kept far away from bad influences and temptation.

> a misguided curious little fella

everyone, everywhere, is a misguided curious little fella.

Now imagine you found leverage with your hack and you demanded $4M or else.

“this kid” calls the company and spins webs of lies until someone gives him access to internal systems; a.k.a social engineering. Nothing of value has been lost.

Getting in is getting in. Social engineering is like 90% of hacking.

That’s correct, but it’s not a “monumental waste of talent”

Can you break into Rockstar while in police custody using a fire stick? Didn’t think so.

I mean, he had a phone too. The firestick is a red herring the BBC are using to sensationalise the situation.

If you have a phone, you can break into Rockstar. All you need is persistence and a disregard for your own future. I cannot over-stress how unimpressive, social engineering hacks are.

what are your thoughts on Kevin Mitnick?

Mitnick had skills other than phreaking.

Life in prison for up to $10m in damages? At first I thought the number must be off by a factor of 10. I couldn’t help but see Dr Evil for a moment.

These are at best property crimes, and while the sums are non trivial, sentencing children to indefinite imprisonment for a nonviolent crime against a megacorp is unconscionable.

> against a megacorp

That's the only reason he's punished. A lot more than 10M gets stolen regularly across various online scams but nothing gets done about those since they primarily target the common man and not a large, culturally-relevant company (I'd argue his targeting of BT/EE has a lot of influence in the outcome).

Seem to me like the prosecution is irrationally scared of something they don't understand. When personal data is leaked, no one gives a shit. I got downvoted to smithereens for commenting on HN that I thought the post about Steve Wozniac being in the hospital was perverted. But if you leak something from a business, then life in prison?

People value their life at about $10m. There's a video I found interesting on a YT channel called practical engineering. https://www.youtube.com/watch?v=xQbaVdge7kU.

No, not life in prison. Detention in a psychiatric hospital for an autistic person who is violently attacking other people.

> dozens of reports of injury or property damage

"indefinite detention" as well, meaning the duration is not defined, but it's "infinite detention".

However, the article was definitely updated at some point, as others in the thread have pointed out. I read it earlier today and it did state life in detention.

That is certainly not helping the discussion out, unfortunately.

The detention is of indefinite length, but has clear conditions for his release, which is what a lot of people seem to be missing.

Though we don't consider it such, because we accept that police are needed to maintain some level of order and it's not good when people resist arrest, the violence was more or less in self-defense.

I think there's a huge difference between someone (especially someone with "severe autism") lashing out when getting more or less abducted and removed from a familiar environment by force (even if we'd prefer they stay calm) and someone attacking someone else out of the blue.

What do you want to bet they didn't follow best practices for arresting an autistic person?

Source for these claims?

Which claim? My comment was almost entirely opinion.

At least state side resisting arrest can be stopping an officers fist with your head, or putting your hands up to block being hit. The bar is so low and the penalties can be absurdly high, including felony charges in many states. It’s basically a way of enhancing charges or creating charges where there’s not enough evidence to produce other charges, and almost always used as a plea bargain cudgel.

"Reports", not evidence.

From the article:

> judge described as "unpleasant and frightening pattern of stalking and harassment" of two young women

That was committed by his accomplice, who seems to have gotten a mild punishment.

It's really interesting that if a company causes $10M in damages to people, they get a fine and no one is actually punished.

If a person causes $10M in damages to a company, they go to jail for life.

It's almost as if the justice system is less focused on being "just" and more focused on serving a class of people.

BBC's actual headline: "Lapsus$: GTA 6 hacker handed indefinite hospital order"

The editorialized reframing of the headline is a bit subtle but still incredibly dishonest. An indefinite psychiatric order is simply not the same as a life sentence.

The BBC regularly updates headlines after publication (A/B testing for clicks) so it's possible it was the BBC, not the poster.

Wow - I checked the Internet Archive and you are correct, the "sentenced to life in hospital prison" headline was used when the article was originally published. I stopped reading BBC a while ago because of their sloppy standards but this is unusually bad.

FWIW in this case I would suppose the BBC online editor was careless and fixed their mistake, versus "A/B testing for clicks" generally. If it was A/B testing, the "A" headline went too far: there's a fine line between clickbait and outright lying.

The British way of saying this is "being economical with the truth".

https://en.wikipedia.org/wiki/Economical_with_the_truth

Indeed I didn’t mean to imply they don’t also fix and tweak for legitimate editorial reasons

Updated now. Thanks for catching this.

No worries. It’s so common that the UK sub on reddit has a bot or something to tag the submission as an altered headline…!

It is still pretty bad. When you look up old famous crimes, they're usually in there basically for life. Leaving aside cases like the 'I don't like Mondays' girl (44 years and still in there; temporal lobe lesion, possible sociopathy) or the pre-Columbine shooting you probably don't remember recently profiled in NYer (paranoid schizophrenia; https://www.newyorker.com/magazine/2023/12/04/what-happens-t... ) where they had regular guilty pleas, even someone like Reagan's shooter only just got out a few years ago after his family lobbied & paid a fortune for decades. As my old professor liked to say, you had to be crazy to do an insanity defense, because usually you'd be worse off if you won that defense than if you lost another defense.

Even the BBC headline is sensational. It implies that the indefinite detention is for a GTA 6 hack, and many people in these comments jumped to that conclusion. "GTA 6 hacker" is used in the headline to identify the person, not to explain the detention.

>Doctors deemed Kurtaj unfit to stand trial due to his acute autism

The kid was able to join an international cybergang and hack into a multi-billion dollar corporation. That doesn't sound like somebody who's incapable of standing trial. The article also said that he was violent in custody, but it doesn't mention any form of violence when he was out on the streets. I'm not a lawyer (much less a British one), but an indefinite hospital order is way too severe for a non-violent crime. Hopefully he gets a retrial.

I wonder how much of the nebulous “violent in custody” is true. This sounds like he’s being railroaded (like only the Brits can do) because some wealthy Americans are breathing down their necks.

> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack.

>Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

This sounds too fantastical to be true.

This guy is obviously brilliant, disappointing that he squandered his opportunities.

> This sounds too fantastical to be true.

Use Firestick as RDP/VNC client, use mobile phone for internet, obtain keyboard from Amazon Shopping, remote into a VM, proceed as usual?

Yeah unfortunately rather obvious considering Fire Sticks run android and allow you to enable remote ADB.

Like sure, it is technically possible he runs termux, has all of his hacking tools available, and is amazingly good with an onscreen keyboard.

That being said, if this were an episode of CSI, I would be rolling my eyes.

> has all of his hacking tools available

So there's this wonderful program called wget.

It really doesn’t sound that crazy. Like, almost everyone on this forum is capable of doing this from a technical perspective, right? Almost none of us would have the desire to do this, but we could figure it out if we did…

Use phone, ring overworked admin.

Yea, too bad Aaron Schwarz squandered his.

It's fucked up what they did to him publicly.

I suspect this is being brought up in an attempt to demonize and pump up this guy's hacking skills to reduce the embarrassment of targeted companies but also of police. He presumably was in police custody at the time and they were meant to deny him internet access, but weren't competent enough to understand that these devices can be rooted & turned into a general-purpose computer. Therefore, rather than admitting this (obvious) mistake, they're trying to make it sound like installing a chrooted Linux environment or RDP/SSH client on such a device is some advanced hacking skill.

It concluded that Lapsus$ "made clear just how easy it was for its members (juveniles, in some instances) to infiltrate well-defended organisations".

To me, that sounds more like they were not well-defended ...

This is typical writing from people who aren't familiar with technology. Could this kid be a genius? Maybe. It's more likely he found exploits like the ones we're seeing on the front page today[0]. It's not super impressive or surprising, to me at least.

[0]: https://news.ycombinator.com/item?id=38720544

A lot of "exploits" are simply a certain level of trust that normal people have in each other

I'd rather have him out than live in an absolute zero trust environment

I would say he's not in trouble for gaining access to systems, it's for extortion:

> He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four million dollar ransom, which was not paid.

This is exactly the issue (plus the stalking and the paying employees for inside access)

He's not a "grey hat", he was actively extorting those orgs

I'd really like to hear more about the type of exploits here. Like, what level- Are we saying this kid is so brilliant he is writing zero-days for getting into corporate networks or if this a case of a guy in a good script-kiddie type group running phishing deals where they fire off 100000 emails a day and wait for someone to give up their logic credentials.

Because if it is the former it's really hard for me to understand how that is still even possible in this day and age. Autism, brilliance, or whatever... a 17 year old breaking into systems like they are as exploitable as early 90's systems sounds just insane to me.

It says does it not, social engineering. Getting access to there discord, etc..

A skill in itself but not 0day or anything.

It says "He broke into the company's internal Slack messaging system ".

It does seem likely their approach is something along the lines of phishing or, given some of the other notes in the article, a combination of social engineering or stalking and blackmail...

I have a feeling a lot of these hacker groups that are heard about do very little code exploitation. I think a lot of it is: find info on employees of a company, maybe find their old social media accounts, maybe find some stuff they might not want their coworkers to ever know about or their spouses etc. And then harass and blackmail the employees for a way in.

If the news agencies were better at reporting, I think a lot of people would see these type of 'hackers' as less 'ooooh brilliant genius child like in the movies' and more 'straight up criminal harasser with no more skill than any normal software developer'.

> If the news agencies were better at reporting

The problem is that reporting the truth - "socially-awkward teens hacked their way into large companies by manipulating their idiot employees and exploiting lax security policies" would force many powerful people into answering uncomfortable questions and expose incompetence at many levels.

Keep in mind that at least one of the hacked companies (BT - British Telecom) is culturally relevant in the UK and sadly it is mostly considered as trusted and competent by the general non-technical population. Hell, they've even got a cybersecurity arm: https://www.globalservices.bt.com/en/solutions/security

It would be really inconvenient if it became common knowledge that all this perceived trust & competence was nothing more than smoke & mirrors and that some kids can blow right through it.

Therefore, there's a vested interest all the way up from the government to make the hack more sophisticated than it really is and the hacker a meaner monster than he is. That's also the reason behind the disproportionate sentence, despite similar phishing/social engineering/stalking crimes against the layman not being prosecuted at all.

I don't remember where I read this, but I remember hearing that they offer to buy credentials from rogue employees.

This says you can buy stolen Slack login cookies for $10: https://www.vice.com/en/article/7kvkqb/how-ea-games-was-hack...

He is a danger to crappy security and those that fear free thinkers like him.

There ought to be laws against locking people like him up.

Rockstar said it cost them thousands of hours to recover...they could have asked him, and it might have cost them orders of magnitude less.

Rockstar has hired the wrong people, lol.

"The court heard that Kurtaj had been violent while in custody, with dozens of reports of injury or property damage."

Not exactly "did nothing wrong".

not exactly an unbiased or referenced report, either.

I wouldn't take that at face value - like accusations of resisting arrest - and to the degree it's true, what kinds of injury and property damage, a scratch and a broken glass?

If the violence was so horrible, has he been charged or convicted for it?

"Reports" is all they have. No evidence, only reports from a biased source (the prosecutors).

By that standard what evidence would you ever accept? They almost certainly have video - prisons have cameras everywhere

I would argue they certainly do not, otherwise they would use a more appropriate word than "reports". I certainly argee that there is no reason for them to not have video evidence. I am arguing that the apparant lack of video evidence in this case makes is especially apparant that the reports are fabricated.

> they could have asked him, and it might have cost them orders of magnitude less.

from the article: > He broke into the company's internal Slack messaging system to declare "if Rockstar does not contact me on Telegram within 24 hours I will start releasing the source code".

he was extorting them.

"they could have asked him" A bit like how you can ask a ransomware group after they've done the hack to fix your computer :D

>>As well as hacking offences the boy was sentenced for what the judge described as "unpleasant and frightening pattern of stalking and harassment" of two young women.

Bunch of people on here are defending him, please justify this for me.

he's an 18 year old autistic kid - you've never made mistakes in your younger years? why are we so quick to dismiss an entire human life as worthless? people only learn when others are strong enough to teach them.

No one's dismissing his life as worthless, they're just being clear-eyed about his behavior. It's one thing to be young and creep someone out because you're maladjusted and sexually frustrated. It's another to actually stalk and harass people and announce your intention to commit crimes. Your theory of learning is also opposite my experience; people only learn things when they decide to. Can you find any examples of someone really internalizing a lesson they didn't want to learn?

From what I've read about this kid and his activities, this isn't some youthful prank that got blown out of proportion, the group he was part of was gleefully mocking and extorting their victims.

All of this can be rationalized. We all do dumb shit, and can learn to see things in a new light. What you say about learning has some truths but you need an externality to show you what you’re missing, to shift your viewpoint. You don’t go from rock bottom to sudden realization all on your own. A switch doesn’t flip in your mind. It comes from the outside world, not within.

And a lot of folks are dismissing this persons life in the thread.

I agree that people, including criminals, should be nurtured and given the opportunity to learn and grow. But all society can do is provide the conditions for growth while protecting itself from people who can't, won't, or haven't yet.

Edit: Actually, FTA that's a different (17-year-old) boy.

Ok that's dramatically worse. Still not sure "indefinite detention" is the right call, but that's absolutely a more significant crime.

I went back and re-read it. You are correct and I am mistaken. The article does briefly discuss another 17-year old member of the group who was the one doing the stalking.

The amount of stereotyping of Autism here is horrible.

Perpetrating the trope of the "Idiot Savant" or "Helpless Amorality" undercuts the millions of neurodiverse people who haven't harassed, assaulted, or threatened people.

Relevant sections 23 (discharge of patients) and 41 (restriction of discharge from hospital) of the Mental Health Act of 1983

https://www.legislation.gov.uk/ukpga/1983/20/section/41

https://www.legislation.gov.uk/ukpga/1983/20/section/23

I'm curious about the success (discharge) rate in these cases. With only yearly clinician reports to Secretary of State, and all the hands involved, things appear grim. Hope I'm wrong.

Arion needs help, including care for his autism. What a painful, horrible way to live every day (effectively untreated autism). He's in this situation because he did not have proper help. What a nightmare for him.

Clearly he has some drive that he satisfies by hacking. Good care will help him identify that drive and direct it toward something healthy.

Where are his family? Has he been walking around with this illness, as a child, alone in the world? How heartbreaking. We've embraced contempt for humanity and human rights, and this is a result.

I'm going to say this as kindly as I can, though truthfully, I'm seething. I understand you're trying to be kind and empathetic. I feel for this dude too. But the way you're expressing your thoughts is hurtful, and I ask you to try to learn why. Here's a pretty good article from a mainstream website that talks about ableism and how expressing feelings of pity can be an expression of ableism. https://www.healthline.com/health/what-is-ableism There is no such thing as "untreated autism" because Autism is not a disease. We do need assistance, but much more of what we need--according to modern science--is acceptance and inclusion. Please try to educate yourself on the dangers of ableism, and how it can and does harm us.

I half agree with you. However, your argument that this is ableism is ridiculous. And you almost proved that yourself by stating that autism is not a disease. I would go a step further and say that it is not a disability, just a something that makes you think differently from the "normal" (which I would argue requires all free thought to be hammered out of you at a young age).

I think it's pretty hasty to say it's ridiculous. It's pretty common to use the word "ableism" in Autistic self-advocacy circles and to say that Autism is a disability without being a disease. (This is all standard "social model of disability" stuff that way predates the Autism self-advocacy movement.)

I don't really want to go out of my way to flesh this out further because just googling around and reading Wikipedia articles will be way better than whatever else I say in a few sentences, but suffice it to say, if people can discriminate against Autistic people for being who they are, what should we call that? I'm partial to "neurotypicalism" but that's not the common term. Ableism is much more common.

Anyway, please Google the social model of disability.

The article doesn't seem to match anything in my comment; however, you say,

> expressing feelings of pity can be an expression of ableism

Empathy and compassion, which I think I expressed, are not pity. How do you draw the lines between them?

> We do need assistance, but much more of what we need--according to modern science--is acceptance and inclusion.

Absolutely, but how did I not accept or exclude Arion?

We should stop glamorizing criminal activities.

Even if someone's door is wide open, any self respecting individual wouldn't step in and steal. The urge is always there and is natural. But everything natural isn't the right thing to do.

Besides that, article has no technical hints as to why that happened. Rockstar level of IT environment is not that misconfigured I suppose or there are some inherent design flawa Internet protocol suite that can be exploited with a Firestick?

This dude ran doxbin for a bit. He actually ended up being doxed there himself (white) nearly a year ago. He's definitely a piece of work.

This would be a much better TV series script than that "The Good Doctor" crap. No offense to all the "The Good Doctor" fans. (We all have our own "crappy" stuff we like)

Society would improve if we could turn these high skilled individuals into productive law abiding citizens without having to go through A Clockwork Orange kind of "reeducation".

Sounds like his court hearing was "I AM A HACKER! I AM A HACKER!!"

> He will remain at a secure hospital for life unless doctors deem him no longer a danger, Southwark crown court heard on Thursday.

For life, haha. Probably a few months at most.

> Many young people wish to explore how technology works and what vulnerabilities exist. This can include learning to code, interacting with like-minded individuals online and experimenting with tools.

Learning to code and experimenting is wayyyy beyond what topic OP is doing.

Personally I don't really care. Rockstar has a grip on it. I'm proud of this fellow for finding and exploiting holes. Yes, he should have gone through proper channels. But he is also just a kid and likely don't understand responsible disclosure.

The target person in this article should be educated and administered. They clearly have a lot of potential. Limiting them is not the way to go.

There’s often no mechanism for responsible disclosure, and you put yourself at just as much risk doing so with good intentions.

Best outcome is generally do nothing at all. Never any upside.

[According to the article] He has acute autism, is violent in custody and expressed intent to continue comitting crimes. This isn't just "some kid with potential" – he will end up in prison sooner of later, which will be an especially hellish place for someone like that to be.

I hope he gets the help he needs. Maybe courtesy of certain British spooky agencies.

> He has acute autism, is violent in custody...

Are the two related? Or is his case autism and something is making him violent?

You don't understand. Britain respects some basic rights for those considered dangerously bad, but not the "dangerously mad".

I worked as a paper pusher in the UK's mental health appeal system. If they think the patient continues to present a risk of harm to others, there is no escape. It's extremely hard for a patient to convince others they're safe. Many stay in for many more decades than they would have done in prison.

If they think his condition was so severe that it made the criminal decision for him, they might not ever be convinced he's stopped being a danger until his condition is cured. Given autism is not a curable mental disorder, this outcome is a bit of a scandal.

I mean, stills seems way ahead of the US where someone like him would just be thrown in genpop with no special protections at all.

Don’t know about the UK specifically, but familiar with an analogue process in a EU country and it’s almost always a life sentence.

Doctors will almost never sign off, in part because of fear they were wrong (there were a handful of cases where the person ended up becoming violent in public, lots of public outrage despite it being statistically insignificant across all the released). Result is also that 60% is deemed “untreatable” within the first few months and thus will never even be considered for release.

Issue is also that it’s kind of a feedback loop, no perspective on a possible relief doesn’t help mental issues.

Also doesn’t help that it’s not considered a punishment or substitute thereof so people first have to serve their time in prison (which often fucks them up even more) before they get transferred to a custody mental hospital to fulfill that part of their sentence.

It’s so bad that defense lawyers try to avoid it all cost because then at least they can be treated after prison by someone who’s main priority is to treat or manage the mental issue.

What bothers me about this isn't that he was committed to a "hospital" (read: jail for mentally ill people).

What bothers me is that the sentence is indefinite. The judge can give him a life sentence for what wouldn't normally justify a life sentence because he's calling it "medicine". The hospital commitment shouldn't be able to last longer than the sentence he would receive if he was neurotypical.

Hackcoperation @ g mail com is great to work with! He’s super responsive and very fast and efficient. Any issue I have requested of him to help with he has always been very prompt and professional. I have used him for several website hacking issues and event platform updates and will continue to use him from now on. Thanks

Indefinite hospital stay order for hacking?

I had to read the article 3 or 4 times before I was able to understand that this was in the UK, not in a 3rd world dictatorship.

For anyone who skips the article and comes straight to the comments, this is not because of the hacking. This is because of (alleged) violence and expressed eagerness to return to cybercrime.

> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.

> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cybercrime as soon as possible. He is highly motivated."

...

The details are absolutely wild too. I mean...

> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack. Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

Holy shit, dude. This is the sort of thing they make movies about. I wonder how much of it is true.

What a cool kid honestly.

For life?! This is ridiculous. It's like Kevin Mitnick in solitary confinement all over again. Because of a video game?

i think it’s because he was running an extortion group: https://www.tenable.com/blog/brazen-unsophisticated-and-illo...

Stuff like this is why I’m glad Ken Kessey’s “one flew over the cuckoos nest” become popular and helped remove government mental hospitals from being a serious consideration in the USA.

This kid needs to be cultivated, not institutionalized.

(Edit: never mind, seems he IS a menace to society)

The headline glosses over "The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage."

Custody is violence.

Most people respond with patience, because they understand deescalation is their best move. This person has Autism. I think it's not a leap to conclude that he simply doesn't understand that deescalation is the right move. He may not even realize or totally comprehend that deescalation is an option!

If you want to convince me this person is a menace to society, then talk about his behavior before being arrested. What did he do then? Oh, that's right, he shared video of an unreleased game... Why should I, or any other person feel threatened?

I agree he doesn't understand--that's why he's in a mental hospital. He can't understand how to behave in society.

Can society understand how to behave around him? Has society even tried?

I'm not working to give up that easily. This is a person with the rest of his life ahead of him; and that life has been locked in a room, and declared his responsibility.

All you're doing, in this interaction, is questioning endlessly. You don't have any proposals.

How do you propose, exactly, that society handle a person that openly admits that they'll do whatever they see fit and decide for themselves what rules they'll follow? And we're not talking about minor rules and infractions, we're talking about major ones like 'don't be violent' and 'don't stalk and terrorize women' and 'don't run a doxxing website' and 'don't extort and steal'

Answer me this: _why_ does society need to 'understand how to behave around him' ?

What's the benefit to society?

The guy stands up in court and basically says 'yeah I don't have any remorse and I'm gonna keep doing it because I don't think it's wrong' - why do we need to try and understand that more?

> 'don't be violent'

The only evidence for this is heresay by the prosecutors.

> 'don't stalk and terrorize women'

As has been pointed out by others in this thread, that was a different person. Go read the article again.

> 'don't run a doxxing website'

You've got me there. But I don't think that comes even close to justifying an indefinite sentance.

> 'don't extort and steal'

Yeah, he shouldn't have done that. But as I said before, it does not at all justify an indefinite sentance.

> The guy stands up in court and basically says 'yeah I don't have any remorse and I'm gonna keep doing it because I don't think it's wrong' - why do we need to try and understand that more?

That is completely false. He is never quoted as saying anything to that effect. Rather, this is the closest thing we get:

> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."

Perhaps the question should be what about cyber-crime he is motivated by. There is no indication that the motivation is anything malicious. It may be thrill that he is motivated by. If that's the case, it should be treated as an struggle with addiction, not evil.

I just sense we're never going to reach an agreement here.

My opinion, in short, is that people exist who simply thrive on chaos and drama. If you've met a person like that or have one of them as a member of your family, you understand. You understand that the power to destroy and create drama gives them a thrill that literally nothing else will ever come close to. You can't treat it, it's very hard to redirect (literally the _exact same activities_ will bore them if the outcome is positive rather than negative) and you can't reliably use them as part of a 'red team' because the first thing they'll destroy is the team cohesion.

If you have any teachers in your family ask them 'do you think that some kids are just born wrong' and they'll tell you all about it. They've seen it.

> How do you propose, exactly, that society handle a person that openly admits that they'll do whatever they see fit and decide for themselves what rules they'll follow?

Here's one method: We simply remove that person from the society, because society is made of rules, not people. In a word: fascism.

Here's an alternative method: We better involve that person in the rule-structuring process. We do our best - through education, therapy, and socialization - to expand our common ground into shared goals; because society is made of people, not rules. If the person is unwilling to participate, then we give them judicious punishment. As a last resort, if the person is a threat to the safety of other people, we remove them from society. In a word: democracy.

The benefit to society is the recognition that both rules and people are living and changing. We can recognize that society is a system, and empower people to be in control of that system, rather than allow the system be in control of us.

> If you want to convince me this person is a menace to society, then talk about his behavior before being arrested. What did he do then?

He's part of a hacker group who steals data and extorts companies for money. And he talks about how he can't wait to do more crime when he gets out of lockup. It's all there in the article.

I know, crime against big companies isn't "real crime" as far as many are concerned, but these companies employ real people, and when they take a big financial hit due to cyber crime like this, it can affect peoples' jobs and livelihood. Because the companies will choose to keep paying the CEO a ridiculous sum while laying off lower-level employees to even out the cost of the ransom (if it's paid) or the financial loss caused from the data leakage (difficult to estimate, but a material loss nonetheless that the bean counters will have to account for).

The article also mentioned how they stole from individuals' crypto wallets.

He extorts companies, not people. I see no problem here.

Did you miss the part about assaulting staff and property destruction.

What about the part where he continued hacking after being busted the first time and released on bail.

Its pretty clear that the kid poses a danger and doesn't understand that he needs to stop.

This isn't a youthful prank/indiscretion that went too far. This kid was on trial for causing millions in damages, and then did it again while on trial.

Yeah, institutionalizing people has a horrendous history, but this kid is incredibly destructive, and has proven that cannot control himself or will go out of his way to do the wrong thing. The only viable alternative to a supervised medical setting is jail for him.

being sentenced to life for hacking is out of proportion

He wasn’t sentenced to life.

He was ordered to remain under supervised medical care until a doctor determines that he is mentally fit to stop causing harm. This is as a result of both his hacking, his assaults on caretakers and destruction of physical property.

He also told the court that if he was released he would go right back to doing crimes.

> He was ordered to remain under supervised medical care until a doctor determines that he is mentally fit to stop causing harm.

What if his moral code is correct, and the court's moral code is wrong? (maybe it should be called the cult's moral code?)

Just because a company chooses to spend millions of dollars to "repair" damage does not mean that the damage itself should be valued the same. We are talking about companies with tens or hundreds of billions of dollars at their disposal. An executive could choose to spend $5 million on anything: that doesn't make the thing that valuable.

Ok. Ignore the dollar amount.

His actions have physically injured people, destroyed property, and caused hundreds or thousands of people to spend otherwise productive time on fixing things.

This wasn’t some hacker poking around because he could. He was stealing assets and then trying to ransom them back. He also just straight up stole crypto.

> This wasn’t some hacker poking around because he could. He was stealing assets and then trying to ransom them back.

If he managed to do that using nothing more than a TV and an Android device, I have absolutely zero sympathy with his victims. In the end, I'd even classify that as a public service, getting these companies to up their security game at least to some standard.

> He also just straight up stole crypto.

And here I have even less sympathy. I have grown to hate anything crypto-currency with a passion, simply because it's even more enticing to criminals than a locked safe room full of diamonds.

Don't get me wrong: It's still not correct what he did. Lock him up in prison like every other random criminal. But it's not "lock him up for life"-worthy, not by any means.

Saying that you have no sympathy for their assets being stolen just because they chose to use a form of store of value you disapprove of, shows a great lack of empathy.

What does it matter what form your wealth takes? Whether it's in a bank, in cash, in gold, or in cryptocurrency is an unimportant detail. What matters is that you have every right to keep possession of it.

OK, then prosecute him for those things. Theft and blackmail are already crimes.

Don't give him a life sentence for sharing secrets. Don't ask me to pretend that isn't what this is about.

Kurtaj has been charged with three counts of blackmail, two counts of fraud, and six breaches of the Computer Misuse Act.

You keep saying that he was given a life sentence. He has not. He has been ordered to live in a hospital until he is deemed by a professional to no longer be a danger to himself.

> this kid is incredibly destructive

Incredibly? There are many kids that age who murder and commit other serious felonies.

Hundreds of thousands of man hours have been spent at the companies he hacked and in the justice system on his behalf. If you were the one whose crypto account he cleared out, or one of the people responsible for cleaning up after him, or even one of the lawyers trying to defend some idiot who tells the court he plans on committing more crimes as soon as he is released you might feel different.

Do you think any of these people wanted to spend their time on this, that otherwise important things weren't delayed and sidelined? Do you think that the people he stole crypto enjoy having to work extra hours to make up for what he stole?

His crimes weren't victimless, and plenty of real people were impacted in serious ways. This wasn't some kid who pushed his computer skills a little too far and went somewhere he shouldn't. He engaged in an international conspiracy to extort millions using stolen data.

There are kids that age who commit murder and other serious crimes, and they should face consequences just like he is. But the grand majority of kids that age get through life without committing any serious crime at all.

First,

> some idiot

He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults.

On the scale of things, what you describe is not "incredibly destructive". Many, many people have done worse (many legally). It's a crime (I never said otherwise) but not a big deal relative to very many other crimes - Rockstar didn't face any material danger; the justice system has lots and lots of cases going through it. I'd be more concerned if he was committing serious violent felonies.

> you might feel different

I'm pretty confident I'd feel exactly the same.

> Hundreds of thousands of man hours

What is that based on?

> international conspiracy

All the hyperbole undermines your point, imho.

> He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults.

Granted. I was speaking more to the general frustration of defense lawyers who have clients that say things when they should have said nothing.

> Hundreds of thousands of man hours - What is that based on?

A guess from years of working for large tech corporations. A company level crisis of this magnitude sucks in a lot of people from a lot of departments. Add in all the other time spent by investigators and the courts, and I don't think I'm overestimating at all. Now multiply that times the 11 major breaches he was part of.

> international conspiracy - All the hyperbole undermines your point, imho.

Arrests were made in Brazil and the UK. Organizations from at least six countries were attacked. They attempted to extort millions from multiple companies. Personal data from 300k people in Argentina was released. They took down the site for COVID vaccination records in Brazil. Rockstar was the 11th attack and one of the less harmful ones, I'm not sure why people are so focused on that one. What about the leaked personal info, what about the impacts to Brazilian health ministry and Brazilian citizens? These weren't explorers just getting in to see if they could. They got in, pillaged data, and followed up with more crimes. They certainly conspired, and it was certainly international.

I'm not saying that this is the most heinous crime an 18 year old can commit, and I never did. I am simply saying that this was more harmful than a lot of people think, and if it was mental illness that caused him to do it, then it is pretty reasonable for the court to say that he wont be criminally liable, but that he is required to get help before he is trusted to be out in the world again.

From an IT security perspective this sounds detached from reality to me. If one kid can do this to your organization, someone isnt doing their job. Given economic competitors, hostile nation state actors and the possible stock market impacts, this isnt a matter of people having had better things to do. They had this to do and they didnt. The resulting extra cost is how you get your company to fix these things. Yes its hard, no it doesnt mean you get to ignore it because police will handle it.

Not a moral argument but a very practical one. If somebody like that manages to find a hole in your process big enough to exploit yet dumb enough to get caught you should feel really lucky that nothing worse happened (that you know of) with the hole you just got notified you had all along.

It wasn’t one kid. It was an international group of at least three people (known so far), and likely more.

Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.

>It was an international group of at least three people (known so far), and likely more.

I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers.

>But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.

I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable.

While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that.

Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.

You see all those homeless people? The tent cities? That's because they have nowhere to go anymore. A ton of those people are mentally ill.

Yes, those mental hospitals were terribly run. But we need to create a safe place for these people. We can't just give up because of mistakes made in the past.

https://www.civilbeat.org/2018/06/health-beat-bring-back-the...

all those homeless is incredibly generalizing, there's many reasons to be homeless. but the top ones are drugs and mental illness.

many are drug addicted, they would have somewhere to go but they opted out of society (well, they aren't in the forest so not full opt-out)

but yes a combination of state run rehab / mental hospitals seems to be the only solution, but is it done by force?

if it's not forced you'll have a hell of a time getting people to go. if it is, you are now rounding up potentially unwilling people and shipping them to a facility.

> but is it done by force?

Yes, of course. Do you really think most of these people even in the care of their own family would have complete agency over their lives? No, they'd be declared unfit and their Power of Attorney would be delegated to someone else.

> all those homeless is incredibly generalizing, there's many reasons to be homeless. but the top ones are drugs and mental illness.

Do you know that? In the US, I read (several years ago) that the top reason was losing your home to medical bills.

The mental hospitals were closed. Now the mentally ill are largely homeless or in prison.

They closed something bad and brought no alternative because it’s easy for a politician to score points by appearing to solve problems in the short term but providing no long term solutions.

The sentence doesn't seem just.

Why not just restrict him from electronic devices like what happened to ZeroCool? Surely there are better solutions that putting him in a psych ward for life or until he is 'cured'.

RTFA. They tried restricting him, and he used a fire stick and a a phone to commit another major breach while out on bail. Then he told the court that he planned to keep hacking if he was released again.

He wasn’t sentenced as such. He was determined to be mentally unfit, and put under confined treatment until he no longer poses a threat.

> RTFA. They tried restricting him, and he used a fire stick and a a phone to commit another major breach while out on bail. Then he told the court that he planned to keep hacking if he was released again.

I did RTFA. I'm saying he could have been denied access to any electronic devices without supervision, which I think would be a better alternative.

define "electronic devices."

What about credit cards? aTMs? Self-service checkouts? PIN pads (the things Europeans have to use in stores to pay by card)? Ticket machines and turnstiles? cars? radios? TVS?

All of these sound pretty harmless and are necessary to have a life these days, but he did demonstrate that he can use a TV for hacking.

> define "electronic devices."

Smartphones and computers, anything with a keyboard and internet connection, and sufficient freedom to go anywhere eon the internet from the device.

> (the things Europeans have to use in stores to pay by card

I mean those are in every country. PINs are not always needed for credit card purchases but they are for debit card purchases.

> but he did demonstrate that he can use a TV for hacking.

A smart TV in conjunction with a phone and a firestick.

No reason he couldn't have a dumb TV.

How can you possibly restrict someone from using electronic devices? This sounds entirely unenforceable without imprisonment.

There has been such enforcement while people are on probation, I don't see why it couldn't be longterm.

That requires voluntary compliance from the offender. He was already released on bail with that condition, and that's when he hacked Rockstar. He has also told the court that he would continue hacking if released.

> That requires voluntary compliance from the offender.

Not it doesn't, it just requires more supervision from his probation officer or whatever. Put him on house arrest with an ankle bracelet, it's still better than being in a psych ward.

"A riot is the language of the unheard." -MLK Jr.

> indefinite hospital order

does this actually mean life?

You can try reading the article:

"He will remain at a secure hospital for life unless doctors deem him no longer a danger."

They've got a long life ahead of them. Surely with actual care they would be released at some point right?

His life is in someone else's hands now, and will be for as long as the government wants. He might be fully reabilitated and regret his actions and they can still write him off as completely nuts with a simple signature in a document - and no one will put the doctor's statement through scrutiny.

We aspies have no respect for lies, so we can not be allowed into court rooms (cult rooms?)

The sentence sound very... Soviet.

Call me skeptical but I’m reminded of Murdoch from the A team.

Sounds like a great hire for the CIA or MI6

Literally weaponized autism.

Hacking Rockstar using FireTV stick, lol.

NSA should pick him up, or maybe GCHQ.

Ideally an organisation that isn't as morally bankrupt as these ones, perhaps something in the private sector.

Technical brilliance doesn't mean they're worth the risk and danger. Someone who's documented as physically violent is simply a liability to all other employees they're around. Even without the physical danger he presents intelligence orgs don't want people with broken moral compasses, they want people with unwavering moral compasses that align with their missions. If someone's just in it for fame or money some adversary is always going to be able to offer more of both.

This guy is probably the best thing that happened to Nvidia. Opened our eyes on extremely poor security policies and processes.

> Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.

Damn! Approaching https://xkcd.com/378/ ...

If you have a phone with an SSH client, and access to a server, for many that's equivalent to having a full functioning PC for hacking purposes?

If this is an Android phone with a rooted system (or even just a locked phone with Termux), you can even skip the SSH server.

Not saying this is unimpressive though.

Did he used to post here on hackernews?

Did anyone here read TFA?

He was apparently shown to be a member of a cyber "gang", and expressed zero remorse. In this case, a judge basically has to do something.

> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cybercrime as soon as possible. He is highly motivated."

The guy was already on bail for another hack:

> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack.

> He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four million dollar ransom, which was not paid.

> They also stole directly from individuals through their cryptocurrency wallets.

So:

> He will remain at a secure hospital for life unless doctors deem him no longer a danger.

Hospital b/c of his severe autism. Ostensibly, what has to be done is rehabilitation. If he can even lie convincingly, he'll be out tomorrow.

>> If he can even lie convincingly, he'll be out tomorrow.

Give the mental health pros a little credit. Getting out of a psych ward isn't as simple as saying you aren't going to do it again.

The title of this post is manifestly wrong. Being locked up for an indefinite period is not the same as being locked up for life since he can be released at any time.

But having said that, being locked up "at His Majesty's pleasure" as this is called is s scary sentence, since you can indeed end up in prison for you whole life if you do not have the support of the relevant doctors.

The conspiracy theorists here should remember he was convicted by a jury and can appeal his sentence like anyone else. If that's insufficient come up with a better system.

Yes, I read the article. It's full of expectations.

There is the expectation that someone should be punished severely for hacking a multi-billion dollar corporation.

There is the expectation that that punishment will result in them just never hacking again.

There is the expectation that a person who is arrested and threatened will respond with patience, and not with their own violence.

There is the expectation that the well-known symptoms of Autism will just magically disappear whenever they conflict with the above expectations. If not, it's the fault of the person with Autism, not whoever set impossible expectations.

---

All of these expectations have a common theme: they are leveled at this one person. He's a teenager with Autism! It doesn't matter: we have expectations, and they have to be met.

Fuck that. I have expectations of my own.

I expect that a justice system will actually try to meet people at their own level.

I expect that a justice system will attempt to resolve mental health with treatment instead of violence.

I expect that a multi-billion dollar company will respond to hacks with the only effective method there is: strengthening their own security. Anything else is just a waste of breath.

My expectations are not being met. There's not a damn thing I can do about it, either: I'm not the one with billions of dollars at my disposal.

He is being met with treatment instead of punishment.

He stole and extorted, assaulted people, and destroyed property and was convicted of actual crimes. They did try to meet him at his level. They released him pending bail and he committed more crimes. He told the court that if they released him he would continue committing crimes. They aren’t sending him to prison though, because he isn’t mentally fit. They are sending him for medical treatment, at no cost to him, until he is determined to no longer be a threat to himself or others.

This seems far more humane than sending a mentally unwell teenager to prison where he certainly wouldn’t get the level of care that he will now.

The primary crimes we are talking about are not the violent ones. They are hacking.

You are welcome to disagree with me, but I don't believe hacking Rockstar to get a peek under the curtain should be a crime. So what if we took that part out of the story? What would change? Everything. The whole story would be completely different.

---

Call it treatment all you want. The goal has already been laid out, and it's not rehabilitation.

Have you ever been in a mental hospital? They do important work, but that doesn't change the reality of what they are. It's a prison with carpets. Trained guards are prepared, not only to detain you, but even to sedate you.

Yes, they exist for treatment, but that doesn't make them a good fit for everyone. We can, and should try other avenues first. I'm not content to throw up my hands and give up on this person. I'm not content to accept this system as the best our society can provide.

> He is being met with treatment instead of punishment.

Treatment? From the article:

> He will remain at a secure hospital for life unless doctors deem him no longer a danger.

That sounds like punishment. For indefinitely long. Without even a trial.

If this were about treatment, we'd have details about how he'll be treated and for how long and the chances of success. Instead, we hear only about his punishment and vague scare-mongering about why it's necessary.

Not sure if I'd call that severe autism. That's psychopathic behavior, when you don't feel any remorse for your crimes.

I don't feel remorse for his crimes. Am I a psychopath?

Hacking a game company just so you can show people what is being worked on should not be a crime.

The Rockstar breach was just one instance of criminal behavior. This individual is clearly dangerous and should not be allowed back into society. There is a pattern of blatant disregard of the law, it's not like he's a grey-hat or even black-hat security researcher.

Is it a disregard for the law, or a disagreement?

The law is unjust to begin with. I don't blame anyone for breaking it twice. Would I recommend it? No. That doesn't mean I have to judge them for it.

The scary behavior here is his violence; but that violence was clearly a reaction to the violence he was confronted with: being arrested and threatened. I'm not convinced that he is a threat to society.

Sure, I can agree that it was wrong for him to react with violence. But what else could I reasonably expect from someone with Autism being punished for technically-illegal behavior?

Have you ever spent more than 10 minutes with someone who has severe Autism? If you have, then you know not to expect them to be great at following arbitrary rules. That doesn't mean they have to be institutionalized!

The solution to this problem is well-known: treatment. It's clear that that is not the goal in this case.

> They also stole directly from individuals through their cryptocurrency wallets.

Plus other hacks in the article.

OK, so prosecute him for fraud. I would totally support that.

My criticism is that we aren't talking about fraud: we are talking about hacking. We are talking about legally-enforced secrets.

We are talking about a violent reaction to being prosecuted for hacking. What if was about the fraud instead? Would his reaction be the violent then? We can never know.

I'm supposed to be afraid to live in a society where this person participates. Afraid enough to sacrifice the rest of his life. I'm not convinced.

He hacked a game company and threatened to release confidential information unless they paid a ransom.

I agree that the ransom was immoral, and probably should be criminal.

Beyond that, I don't agree with any of this. If a company wants to keep secrets, then they are welcome to try. Let that be their responsibility.

Not even the theft or blackmail?

Sure, but not a life sentence.

It's my computer, or rockstar's computer, or whatever. You have no right to access any of it. Whether it's a stupid game or something serious doesn't matter; that's for me to decide, not you.

The only exception here is good-faith intrusion testing and the like, but fundamentally: my property, none of your business, misusing my property is a crime.

This is a view shared by literally zero people. It is so lacking in basic reasoning and logic that it's almost frightening to see it on a normally more rational site like Hacker News.

Let's change the wording around a bit. What makes hacking a "game company" exempt from normal ethics into breaking and entering?

What if the "game company" consists of only a single employee who uses their personal laptop? Totally fine to break into their computer and steal their data right?

Why stop at "game companies"? How about all companies? How about you? Why just computers? Remember that one time when you accidentally left your apartment window open, and then a "hacker" waltzed in and took pictures of all your personnel effects?

> This is a view shared by literally zero people

So you make a claim, and to try and pass that claim off as believable you change literally every parameter you can possibly change.

GP said:

> Hacking a game company just so you can show people what is being worked on should not be a crime.

They didn’t say anything about hacking someone’s personal laptop to steal someone’s personal data. They didn’t say anything about hacking all companies, they didn’t say anything about themselves being hacked, they didn’t say anything about someone entering their home and stealing their shit.

They said:

> Hacking a game company just so you can show people what is being worked on should not be a crime.

And just to prove you wrong, you can add me to the tally.

Now it’s a view shared by at least two people.

I would be inclined to agree, but I'm reminded of passages from Edwin Black's book [1] depicting the capriciousness of medical providers. E.g. a board of doctors was typically responsible for sterilization decisions in America when eugenics was mainstream during the early 1900s. It seems reasonable that doctors should be final arbiters of medical decisions, as in releasing this aforementioned hacker from a mental hospital. But the book revealed how these doctors would often inconsistently apply their sterilization standards to favor prominent local families whilst punishing the usual victims, i.e. minorities and poor whites.

In this regard, I find this case deeply disturbing, and would prefer if he simply got a definite sentence.

[1] - https://en.wikipedia.org/wiki/War_Against_the_Weak

Given the magnitude of his continuous hacks, and his verbally expressed desire to do it again and complete lack of remorse, the alternative is prison, either now, or on repeat offenses.

The chance of a more rehabilitation-oriented stay is probably worth it.

WIZARD WEB RECOVERY is a valuable resource for individuals who have misplaced their crypto holdings. This top recovery company specializes in getting lost or unreachable cryptocurrency back. Their team of professionals uses their knowledge of the intricacies of the cryptocurrency industry to give hope to individuals who have given up on their priceless possessions. WIZARD WEB RECOVERY is an expert in the field of cryptocurrency retrieval, having gained years of expertise and a thorough understanding of blockchain technology. They have a brilliant name in the business after helping several clients successfully retrieve their misplaced cryptocurrency holdings. They are the go-to resource for anyone feeling hopeless about their lost digital fortunes because of their experience as well as the state-of-the-art technologies and strategies they employ. During the first consultation, the WIZARD WEB RECOVERY team analyzes the circumstances and determines the likelihood of a successful retrieval. They collaborate closely with clients to comprehend the circumstances underlying the cryptocurrency loss, and they compile all pertinent facts. Following the evaluation, WIZARD WEB RECOVERY knowledgeable staff begins tracking down and looking into the misplaced cryptocurrency transactions. By carefully examining blockchain data and other accessible sources, they find vital information that gets them one step closer to getting their lost valuables back. To successfully navigate the complicated realm of blockchain technology, WIZARD WEB RECOVERY makes use of cutting-edge technologies and strategies. They have an advantage in the crypto recovery process thanks to their in-depth knowledge, which enables them to use cutting-edge software and exclusive techniques. Following a careful examination and applying their knowledge, WIZARD WEB RECOVERY, puts out great effort to retrieve the misplaced or stolen cryptocurrency assets. With their expertise and tenacity, they accomplish the seemingly unachievable, providing their clients with happiness and comfort as they reclaim their priceless digital assets. Truly WIZARD WEB RECOVERY is an outstanding team. To learn more about them, Go to WIZARDWEBRECOVERY. NET

EMAIL ADD ; WIZARDWEBRECOVERY@)PROGRAMMER. NET

Life in prison for non-violent crime clearly sounds like revenge and sour grapes. The big guys clearly don't appreciate having their insecurity being exposed this way (keep in mind none of these hacks required any significant technical skills), and too many people would lose face. Something had to be done, so here it is.

The disparity of this punishment compared to what is usually given out for similar crimes (in the vast majority nothing as it doesn't even get investigated) suggests there is definitely some "saving face" motivation behind this sentence.

Conditional life sentence, he can be freed if docs clear him

It’s not life in prison.

He’s being confined to a mental institution due to severe autism. It’s unlikely that he can be rehabilitated and would remain a cyber security threat to society if released in the future.

This is hardly revenge.

This guy is as much of a "cyber security threat" as your typical socially-awkward gamer teenager, of which we have plenty of. Every internet-connected server out there constantly gets probed by bots/tools often operated by similar people and nothing is ever done about it.

This guy's crime wasn't that he was hacking/phishing/stalking or the general obnoxious behavior that often comes with this kind of person - this is effectively decriminalized in the UK anyway, as long as the victim isn't a big, culturally-relevant company. Financially-motivated scammers and crime rings take advantage of this.

This guy's crime is that he embarrassed the establishment, so he has to be painted a much scarier monster than he really is and made an example of, since the truth that most technically-inclined, socially-awkward teenagers would be equally capable of such hacking would be hard to accept and put into question the competence of the affected companies.

> This guy is as much of a "cyber security threat" as your typical socially-awkward gamer teenager, of which we have plenty of

The following quote seems to indicate that the skills of this individual is much sharper than "typical socially-awkward gamer teenager":

> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone

It doesn't take any skill to install a chrooted Linux environment or RDP/SSH client on a Fire Stick or Android phone, and said skill is orthogonal to hacking skills that could be deemed dangerous to society at large.

The fact that this is explicitly brought up smells like they're trying to make this guy sound much more dangerous & evil than he really is. After all, had he discovered/used zero-days or developed exploits, that would be a real talking point, but if the only thing they've got is "he managed to get a shell on an android device" this smells of clutching at straws.

All that means is that he used his phone and another android device (the fire stick) + the TV as a monitor, to access whatever remote machine he has via SSH, not exactly rocket science

And that's the point, the propaganda machine is working overtime to paint the kid as some horrifically dangerous criminal because he exposed the clowns in power that easily could've pdevented all this.

I don't see how the grand-scale theft and extortion run by Lapsus$ is remotely comparable to the behavior of a "typical socially awkward gamer teenager", even a particularly unethical one.

It's not just unlikely. It's unexpected.

To me, that presents an issue with the system, not its participants.

I don't think this is fair. Another underage person found guilty of the same hacks got an 18-month rehabilitation order. This basically means severe restrictions on going out and computer use together with involvement and monitoring by social workers. This seems perfectly appropriate. They're not having decades of their life taken away from them, and they're not locked up with hardened criminals who would either victimise them or teach them to be much worse.

The indefinite order is because the kid committed multiple assaults and other violent acts while under observation in a mental hospital. Doctors don't believe he can be released in the foreseeable future.

If you were arrested for unpaid parking tickets and then demonstrated threatening, violent and out-of-control behaviour while in police custody, then in a secure unit, you might get a similar indefinite order.

In what world do you live in where getting too many parking tickets and causing violence gets you life in prison until an unknown paid state employee decides you took all non-necessary meds and drank the kool-aid? If someone was killed they would get out a certain date. The judge should have to suffer the same fate before he can order this.

If someone openly and repeatedly said they plan to kill more as soon as they are released, they would be in a similar situation.

It is pretty rare that the convinced don't at least lie about intentions to commit more crime

> If someone was killed they would get out a certain date.

No, there are lots of people (in the United States) doing life without the possibility of parole. There are many people who will never be released from solitary confinement. Some of these people were incarcerated for fairly trivial crimes and all subsequent punishment was for acts committed while in prison.

What do you think happens to people who repeatedly cause injury to corrections officers, attempt to sexually assault them or infect them with HIV, etc? They are eventually put in solitary for life.

Some people will never be released from prison because of single acts which they have never repeated, but also are not willing to ever show (real or simulated) remorse for.

The system for people with severe mental health problems who commit repeated acts of violence works differently but is similar in its effects. Some of those people never get out, and they knew with decades of life left that they would never get out. In the UK, there are many quite high bars before a criminal convict can be incarcerated forever without chance of release. But it's much easier to block release forever from someone who is insane and considered dangerous.

The system for sex offenders works in a very similar way in some places. Some sex offenders, not the worst offenders, can be in a situation where they will never be allowed out, or being allowed out is so unlikely that it will never be worth it to them to spend years complying in order to attempt to be released.

Most jurisdictions have some method by which a person who a) did something to get them within the system, b) committed repeated assaults or threats while within the system and c) did not show that they had radically changed their attitude, will never get out. The details vary but they always exist.

My suspicion is that in most places, people in this situation vary from almost harmless: suffered bad luck and a lack of comprehension from decision makers to extremely dangerous: very hard to imagine how they could ever not be an extreme threat to innocent people outside of incarceration.

Did you read the article?

> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.

How much would that get someone on the street committing the same crimes? Maybe probation or a couple years of jail at most? That's what I'm comparing it to.

If we were routinely jailing people that had trouble controlling their emotions and had propensity for violent outbursts we'd have a lot more people in jail, so I don't believe this alleged violence was really what got him this sentence.

Similarly, how much would someone get for scamming/hacking/social engineering a small company or individual? Well that one is easy to answer: nothing - this behavior has effectively been decriminalized in the UK.

So neither his crimes add up to such a sentence.

How they define "violent", "injury", and "property damage" is very much important though. It could be as light as knocking a mug off a desk and breaking it or them accidentally tripping someone and causing them to get a minor bruise, or it could be to the extreme of assaulting someone or arson.

Curious to know what their definitions and their examples of this behavior are regarding this person.

I don't see violent crimes as necessarily the worst. Crimes that steal from large numbers of people are arguably worse than many types of violent crime due to the sheer magnitude of lives that got destroyed. If you destroy 10,000 regular lives through fraud you deserve the worst punishment in line with murderers. Although this guy's long sentence isn't only because of what he stole from Rockstar, my commentary is not only about him, it's more of a broader point.

Murdering 10 is okay compared to shutting down a video game company for a few hours?

Straw man argument; the person you replied to did not say this.

Definitely not. But I would say scamming thousands of poor people out of their life savings (e.g. FTX) is worse than violently assaulting someone. Violence isn't a necessary condition for a crime to be among the most damaging to victims.

From 'Free Kevin' to 'Free Kurtaj'

Not even close

Seemingly this individual is highly skilled (in technology) yet managed to fail at opsec. Anyone know how police managed to find/grab him?

It doesn't look like any of these even tried opsec - which isn't surprising because such crimes committed against individuals or small companies effectively became decriminalized in the UK so opsec would just be a waste of time.

Their mistake was to think that embarrassing the establishment by breaching high-profile (Nvidia, etc), culturally-relevant companies (BT/EE) would be met with similar inaction.

Also, with regards to skill, keep in mind that the establishment has a huge interest in making the hacks sound much more advanced than they really were to minimize the embarrassment of the affected companies. It would look really bad if it was widely known that these companies were pwned with nothing more than basic phishing, bribery and social engineering, something anyone can do.

Seems reasonable to me. Glad there aren't any comments yet saying "oh gosh it was just a video game company, those are a scourge anyway on family morals!"

Not to me, it's a slippery slope. Want to give someone a life sentence? Cool, all you need to do is to stamp the autism label on them and put them in a secure hospital and convict them for a crime that would get like 5 years in prison.

The point is not the details (I'm obviously not a laywer or anything remotely related to that), the point is that it seems to be a slippery slope.

Did you read the article?

> Cool, all you need to do is to stamp the autism label on them and put them in a secure hospital and convict them for a crime that would get like 5 years in prison.

Good thing that’s not what happened then I guess.

The article specifically says:

> He will remain at a secure hospital for life unless doctors deem him no longer a danger.

So he's confined for life. Confinement is confinement, whether it's a prison or hospital.

This definitely seems like a case where the government found a "backdoor" to allow them to get away with confining someone for life, even though they probably couldn't do through the normal criminal justice system because the punishment doesn't suit the crime.

> So he's confined for life.

> unless doctors deem him no longer a danger

It's down to him and whether the institution he's in can do anything for him.

> It's down to him

No, it's up to the doctors.

If he changes nothing and docs say "we think he's no threat now," he could be freed.

If he completely reforms and appears harmless and the docs don't give him the thumbs-up, he stays locked up for life.

Yep, this is my issue with it. Also, it’s autism for now. What if it slowly spreads to other diagnoses? It could slowly lead to a more authoritarian punishment environment. Things like this can grow slowly but 50 years down the line and voila: a new repressive state is born.

Obviously, that doesn’t need to happen. The fact that it could scares me

I am not sure the consensus here would ever consider relative moral value of attacking a 'bad guy'. I am personally saddened that a clearly brilliant mind will waste away. I, for one, do not doubt that his skill could be put to good use. Not to search, I remember being a kid and saying all sorts of things that would get me in trouble today.

(posted on other thread)

A no doubt gifted person who was probably put through torture (as they would experience it) in a prison, now locked away for life because they lashed out.

Big clap for all the big brains there who failed this guy.

There should be a length of time attached. Even in the US “life” means a limited amount of time that can be stacked over and over again, and we would totally call that excessive for these crimes or lack of remorse.

This is really foreign and sad what the UK is doing.

There is an expectation here that this person will react to being arrested and imprisoned with patience; yet patience is not expected from literally anyone else involved.

It's abundantly clear that he is not being punished for harming people. He is being punished for not playing along. "Refusing to play along" is one of the most well known symptoms of Autism. This person is being punished for neurodivergence. I'm not even remotely OK with that.

> yet patience is not expected from literally anyone else involved.

Can you explain? The whole process has seemed pretty patient on all sides. This wasn't some overnight decision.

I truly don't understand what you're trying to say, or how "patience" is relevant here at all.

Patience isn't just about time.

Sure they were willing to wait, but what were they waiting for? The result was pretty clear from the beginning.

I still don't know what any of that means. Then what is patience about? Who is "they"? What does it matter if people can guess at an outcome based on prior experience?

I still don't know what you mean by "patience" and I still don't know what relevance it has here.

By "they", I mean everyone in this story except the defendant. I mean the justice system itself. "They" should be held to a high standard of expectations.

> "They" should be held to a high standard of expectations.

OK, and the justice system is. It's full of professionals, processes, training, exams, appeals processes, etc. They are held to very high standards.

Why do you say we don't expect patience from them, and why is that relevant?

Legal professionals like lawyers and judges seem incredibly patient, as the processes they deal with generally take months and even years.

Neurodivergence isn't a free pass to commit all the crimes you want. Lots of shooters are neurodivergent. That doesn't mean that society has to let them kill all they want.

Neurodivergence is definitionally not understanding societal rules. Also known as laws.

Neurodivergence is not a "free pass to commit crimes," but an excuse to be locked up by the authorities.

To be clear, they aren't being locked up for being neurodivergent. They are being locked up for committing crimes and refusing to stop if released.

Sure, not committing crimes is part of "playing the game", but it is a game you must play to go free.

If someone can't avoid sufficiently severe crime, that is a completely valid reason to lock someone up. It doesn't matter if they can help it or not

If course it isn't.

Neurodivergence is a reality. Our justice system can do better than be ignorant of it. Our justice system can do better than to escalate its symptoms. As a participant in democracy, I will accept no lower standard for justice.

This person wasn't killing people. He was looking at secrets. There are people who don't understand that murder is wrong, and those people need to be institutionalized for the safety of everyone else. He isn't one of them.

This person was robbing and blackmailing people.

The justice system serves to prevent these actions, and should do so no matter what the mental state of the criminal is.

Is your honest solution just to let them continue doing that as an accommodation for their disability?

You are reading my comments with the most uncharitable perspective possible.

I don't advocate that we legalize blackmail or theft. I also don't advocate that we punish either with a life sentence.

My point here is that he wasn't even charged for the theft or the blackmail. He was charged for the hacking.

My criticism is directed at the justice system itself. Reading secrets should not carry a life sentence. Ever.

>You are reading my comments with the most uncharitable perspective possible.

Im sorry if thats the case and I am trying. unfortunately, I didnt get that from your prior posts and this response as a complete nonquitter.

Maybe it stems from a different understanding of the underlying facts. The perp was not sentenced to life in any way, just custody until they stop claiming they will commit more crimes upon release.

In general, I agree a life sentence would be unreasonably harsh for hacking or reading secrets in isolation.

Charges and conditions of release can be unrelated. You may be placed into custody for hacking, but not release if you say you will commit a more serious crime immediately after.

Reply on news.ycombinator.com