MIT Legal repudiated Xbox hacker too | Hacker News Reader

MIT Legal repudiated Xbox hacker too

bunniestudios.com

160 pointsirq52 comments

Sorry to be a little cynical here, but I have a couple of questions.

1) Was bunnie's hack of the Xbox keys a MIT-endorsed project? Was it part of his degree work or something he did on his own time?

2) If the work was independent, what's MIT's obligation to shield bunnie in a legal sense? If it wasn't, did MIT step in and say "hey, this might piss off Microsoft if you do this" or was the work just put out there with unknown some degree of oversight?

3) bunnie was an MIT student, Arron was not. The statement "MIT gave up on me too" kind of implies the situations were similar. Were they?

Don't misunderstand me, I have immense respect for bunnie and hackers of his breed, but these things are just bugging me.

I see your legalistic approach to MIT's responsibilities, but this fascination with "endorsement" is missing the point. Universities are not government labs, where you'd expect every participant to clear every activity with their superiors. Research doesn't work that way. And if universities do not stick up for exploration, who will?

Was MIT obligated to defend this fellow? No. Should it have defended him? Most definitely.

In my view, endorsement is key. Let's pretend we're listening in on that first phone call from Microsoft to MIT:

MS: "Hey, um, so we've learned that one of your students just published a way to jeopardize our entire project, one that we've spent multiple millions of dollars developing. He seems to have done it in your labs with your tools. What's your take?"

So MIT's response can go one of two ways:

1) "Yeah, how about that? Cool, huh? We didn't know about it but we fully back him and let's see what the internet does with this."

2) "Um, we had no idea he was doing this and didn't ask him to publish. He did this alone."

Do you see where each direction leads?

3) "That's between you and him."

Contributory liability should be used in far fewer cases than those in which it is attempted. You can't sue me over your auto-accident because my tax dollars built the road.

What's wrong with "This is the first we've heard of this. We'll go talk to him and get back to you once we understand what's going on better; we have no further comment at this time"?

It's unreasonable for MIT's lawyers to be aware of every single research project, but they know that. They should be willing to tell other people "we're not aware yet, but we'll make ourselves aware".

There is a divide in academia between admin and faculty. His supervisors supported the work, but admin and their lawyers did not. Admin typically has no idea about research until it turns into something they actively have to admin. Admin's primary interest is protecting the corporation, whereas the faculty's is protecting their students.

Consider the case where the grad student, acting alone and not as part of an officially sanctioned project, invented something awesome using some resources from MIT like an internet connection and lab space. How eager do you think MIT would be to say "well, we didn't endorse anything you did, so you own the entire IP rights to everything; we want no piece of your new startup" ? Or the student discovers a flaw that gets a lot of press attention; how eager is MIT to feature the work saying they supported it, as opposed to saying "it was all unendorsed." Hint: both of these have happened many times, you can look up the relevant MIT policies, and you can ask people about how it went. MIT benefits immensely from "unendorsed" (i.e. implicitly endorsed after the fact) activities conducted on its campus.

Do you now see why it's ethically questionable for MIT to try to wash its hands off when the same researcher's exploration incurs some legal costs?

Actually, MIT (and similar institutions) do not assert ownership of IP based on use of basic resources like office space and an internet connection.

See: http://web.mit.edu/tlo/www/community/guide2.html#2.1

M.I.T. OWNED (a) Patents, copyrights on software, maskworks, and tangible research property and trademarks developed by faculty, students, staff and others, including visitors participating in M.I.T. programs or using M.I.T. funds or facilities, are owned by M.I.T. when either of the following applies: (1) The intellectual property was developed in the course of or pursuant to a sponsored research agreement with M.I.T.; or (2) The intellectual property was developed with significant use of funds or facilities administered by M.I.T., as defined in Section 2.1.2. (b) All copyrights, including copyrighted software, will be owned by M.I.T. when it is created as a "work for hire" as defined by copyright law, (see Section 2.1.3) or created pursuant to a written agreement with M.I.T. providing for transfer of copyright or ownership to M.I.T.

INVENTOR/AUTHOR OWNED Inventors/Authors will own patents/copyrights/materials when none of the situations defined above for M.I.T.-Ownership of intellectual property applies.

[...]

           M.I.T. does not construe the use of office, library, machine shop or Project Athena personal desktop work stations and communication and storage servers as constituting significant use of M.I.T. space or facilities, nor construe the payment of salary from unrestricted accounts as constituting significant use of M.I.T. funds, except in those situations where the funds were paid specifically to support the development of certain materials.

Hey, remember that one time recently when an MIT student did something cool that MIT didn't know about, where the thing was obviously going to make large amounts of money, and MIT said "sure, we had no idea, and we didn't endorse it, so of course you can own it!" No? Neither do I.

It's ethically suspect to pick and choose, and say "well, when you do cool stuff we didn't know about, that we own, but the stuff that may get you in trouble, you get to deal with all that unless we specifically endorsed it".

Was bunnie's hack of the Xbox keys a MIT-endorsed project?

Since the AI lab published the research as an official memo, it seems like they at least endorsed it. The memo (linked to in the article) is worth reading since it makes clear why the hacking of the keys was done: to test how secure the Xbox's security really was.

When I first arrived at MIT, I was handed a book on "How to Get Around MIT." I was impressed with the section on hacking, which included the following story about the Harvard-Yale hack:

"DKE has tried to hack the game before, most memorably in the late 1940s when they buried explosive cord in a pattern that would spell out "MIT''. Unfortunately, Harvard discovered the hack and set up a trap. They arrested several students wearing coats lined with batteries. A dean, who had been informed about the hack after the arrest, went down to bail the students out. He pointed out to the detective that the battery-lined coats were only circumstantial evidence. At this point the dean opened his own battery-lined coat and declared "all Tech men carry batteries.''"

My point is that MIT presents itself as a place that defends hacking, and it has at least been lenient in the past.

Do you know anywhere that has a collection of MIT-related hacking stories? I also enjoy them when I see them posted here.

MIT itself hosts this site:

http://hacks.mit.edu/

Unfortunately it only goes back to 1989, so it's missing some good ones, like the DKE Harvard-Yale game hack.

Favorite quote: "It saddens me that America’s so-called government for the people, by the people, and of the people has less compassion and enlightenment toward their fellow man than a corporation."

I found that quote interesting too, as it was telling that the author felt it expressed something noteworthy. I don't see why it should be at all surprising. Corporations are made of living, breathing people. They each have their own organizational culture and set of external pressures that guides their decisions and behavior. The same is true of governments, and government agencies, and offices within government agencies, and cliques of people within offices of government agencies, and ... you get my point.

You get an even greater sense of this when you talk to people who have ever created a corporation or tried to make it more powerful. Gee, I wonder if there are any such people who hang around here...

"I started rebuilding my life overseas, and I find a quantum of solace in the thought that my residence abroad makes it a little more difficult to be served."

Does this mean things are better outside the US these days?

Barring the likes of China, things were always better outside the US.

Absolutely! Cheers from Vienna Austria, the birthplace of libertarianism!

To bad that libertarianism is not held in high regard here any more. I am happy to live in Vienna as it is a great city, but governmental overreach was recently demonstrated by a trial against some animal rights activist based on trumped up "terrorism" charges. And while they were acquitted with the judge stating her disgust with the police and prosecution their livelihoods were mostly ruined. I do not agree with their opinions, but they should be able to express them. (Apparently the police investigation was done after the owner of a clothing chain got annoyed by the incessant protests in front of his stores for selling fur products)

Unless you're interested in e.g. free speech, and your's gets labeled hate speech somewhere like the UK or France. Or you know, any of the wide range of other areas where European laws are more restrictive.

The U.S. has 5% of the world's population and 25% of the world's jail population. Numbers would seem to indicate that the laws AND the application of the law make the U.S. much more restrictive than most, if not all, 1st world countries.

By itself this statistic doesn't tell the complete story. For example, according to Wikipedia, the incarceration rate in India is 30 per 100000. By itself, the incarceration rate does not describe the level of justice in a country though it is suggestive. You would need to know the reported and unreported crime rates and the categories of crimes to understand the difference. A large factor in the US rate is the failed war on drugs.

I agree with you. I guess I might have been a tad overreacting at the "we-are-the-best-and-only-truly-free-people" attitude I see too often coming from some people from the U.S.

The U.S. incarceration rate (~750) is indeed much higher than that of say the U.K. (~150), but is highly disuniform. In states like Mass. or Minn. it's only ~200.

Comparing the U.S. and other countries on the basis of prison population is a bit misleading. This chart is relevant: http://en.wikipedia.org/wiki/File:Lifetime_prevalence_of_inc.... The U.K. is more than 90% white. It doesn't have to deal with a huge black population that still carries the legacy of slavery and segregation. It doesn't have to deal with a huge hispanic population that has to deal with the challenges of immigration (and often illegal immigration). The U.K. doesn't have to deal with the gang and poverty-related crimes that arises from segregation and ghettoization on a massive scale.

In London, more than 60% of the population of the metro area lives in the city proper. In Chicago or L.A., that figure is under 30%, and in cities like Boston or D.C. it's under 15%. This statistic isn't just a matter of people in the U.K. enjoying city living. The 30% that live in Chicago in the city proper and the 70% that don't have dramatically different economic and demographic profiles. The U.K. hasn't had to deal with the total collapse of social order that accompanied the outflux of all the middle class residents from the American cities to the outlying suburbs in the 1970's-1990's.

To give a very specific example: New York City is heavily policed, and in places like the Bronx poor minorities can be harassed by the police just for looking the wrong way. And an entire city full of liberal middle and upper middle class people have absolutely no problem with that status quo. How can that be? You can't understand that state of affairs without knowing what New York looked like in the 1970's, 1980's, and 1990's--how it was hollowed out by crime.

The harsh sentencing in the U.S. when it comes to crime is a reaction. It's a reaction to social problems that Western Europe has by and large been spared from, though with the massive influx of Middle Easterners into Europe now I think they're going to get a taste of that in the next few decades.

200/150. only 33% higher in those states you mention than the UK. That's some disparity especially if it's the lower end of the incarceration rate for the US. Rather than racial issues, I think drug laws - specifically decriminalization and subsequent recriminalization of marijuana in the UK[0] would be the differentiator. I think states that decriminalised marijuana in the U.S. will see a reduction in incarceration rate.

[0] https://en.wikipedia.org/wiki/Cannabis_reclassification_in_t...

It's the low end of the U.S. spectrum, but it's a much better comparison to the U.K. than the U.S. as a whole in terms of demographic profile.

Yes, much of the disparity is from drug laws. I think if you decriminalized common drugs, places like Mass. and Minn. would fall below the U.K. About 50% of our federal prisoners are drug offenders, and less than 20% of state prisoners are drug offenders (20% overall). So decriminalizing would cut our incarceration rate, but not by enough to make up the gap (~750 per 100k versus 150 per 100k in the U.K.)

Europeans really have a hard time, I think, appreciating America's unique challenges. Look at the states with the highest incarceration rates in the U.S.: http://en.wikipedia.org/wiki/List_of_U.S._states_by_incarcer...

The top 6 are, in order of decreasing incarceration rate: Louisiana, Mississippi, Oklahoma, Texas, Alabama, Arizona. Three former slave states and three states at the epicenter of mexican immigration.

Note that I'm not trying to make a racist argument here. It's just that class, social standing, and race are deeply intertwined in America in a way people in homogenous European countries really have trouble appreciating. The U.S. has more income inequality than nearly any Western European country, and that income inequality manifests heavily along racial lines. But the racial divide compounds that inequality. It takes the inherent problems with income inequality and adds a vicious "us versus them" dimension to the problem.

On pen and paper, the US allows for more freedoms than other European countries.

I was once arrested for "Disturbing Schools" after I was drawn out of my class for violating my school's dress code because I was cold and chose to wear a sweater that wasn't "school approved", as in it wasn't purchased from the school store an one of their approved retailers. The vice-principal tried sending me to detention for this "offense", but when I refused and returned to my class, I was arrested by the school's embedded police officer and taken to the county jail where I spent the day in lockup with myriad actual criminals (I was 17 at the time, thus qualified as an adult) until the judge released me on my own recognizance. I eventually got off with having to pay some ridiculous fine, perform community service, and undergo criminal counseling. Of course in the lovely state in which I reside, "criminal counseling" actually turned out to be a driver's education course.

It seems in this country, it doesn't matter if you violated the law. They will find one that vaguely fits the bill and contort your actions to have violated the law. Perhaps it is a "grass is always greener" mentality, but I have to hope that other modern nations are not as distorted.

The U.S. has strains of puritanism and liberalism. In different areas, each side has won. When it comes to sex and drugs, the puritans have won. When it comes to free speech, the liberals have one. Which is free-er depends on who you are. If you're not a drug user, not poor, not black or hispanic, and not a minor, you're probably free-er in the U.S. You're less likely to get in trouble for starting a company selling violent video games, less likely to get nailed by a libel lawsuit for criticizing prominent celebrities, less likely to get in trouble for carrying a gun, etc.

If you're in one of the aforementioned categories, I agree that other countries are probably more free.

"Or you know, any of the wide range of other areas where European laws are more restrictive."

No, I don't know. Seems to me that the US has plenty of restrictive laws. Unless you mean laws regarding corporations, but those are pretty messed up too from what I've heard.

It depends where outside the US, one imagines --- but there are certainly places that are generally worse. Law enforcement agencies in, say, China, are not known for their respect for the rights of the accused or their scrupulous attitude towards due process.

True. However, I have this unfounded assumption that prosecuting reverse engineers is not high on their list of priorities.

On the other hand, messing with the state seems like a bad idea.

In fact reverse engineering is probably a strategic mission for them so I wouldn't expect China to criminalize it or anything close.

The Soviets were famous for cloning a WWII bomber (B-29) based on just 3 samples that had emergency landed in Soviet territory during WWII.

Bunnie is based in Singapore.

EDIT: Corrected. I thought he was in Schenzhen but I was confusing him with Zach Smith.

no, he lives in Singapore.

see e.g.: http://blog.makezine.com/2012/04/30/makes-exclusive-intervie...

Hmmm. The place where you get caned for graffiti? Let's institute caning as the punishment for illegal hacking. Problem solved.

If the other option were years of prosecution, loss of millions of dollars and the potential to be sentenced for 35 years in prison and paying millions more... I'd take the caning in a heart beat. Who wouldn't?

Just goes to show that our belief that the US justice system is more civilized than most of the rest of the world is a superficial load of horseshit.

I'm not sure whether things are better generally, but most other developed countries use imprisonment much more sparsely than the U.S. does. Fewer crimes carry prison sentences (and especially fewer nonviolent or first-time-offense crimes), what prison sentences do exist are typically shorter, and prosecutions happen more rarely.

The USA has an incredible economy, and the tech scene is amazing in the SF region. it doing business requires incredible hoops due to multi layered complexity, there are homeless on the streets and other signs of a society that fails to look after the less lucky, it has an amazingly poor political system in practise and lousy food, unless you live in the Bay or have lots of money. But foreigners are most scared and worried about being pulled into the quagmires of the US justice system or the US health care systems.

In the US, prosecution has become a punishment that overwhelms any eventual sentence.

Bunnie here says he feels safer from government abuses in Singapore, which has no trial by jury, a single-party government, and the highest execution rate in the world, where all public gatherings of five or more people require a police permit, than in the US.

Does that mean the US has failed?

Cruel and unusual punishment via prosecution. Prison threats for non-violent crimes. I agree, things have gotten carried far away.

What's wrong with prison for non-violent crime? For instance, if someone steals my car from a parking lot, I'm OK with them getting prison time, even if they didn't use violence to get my car.

Well in your case a fine and paying for damages. Repeat offenses maybe could constitute jail time. But wouldn't non violent crimes be better served by keeping the person out of the prison system with hardened criminals, further preventing a life of crime. In the end, is that better for taxes and society in general? I don't have all the answers, but in many cases prison for non-violent crimes (i.e. this JSTOR case or drug cases) are misguided and perpetuate the problem. Would you be happy if that person that stole your car was a first time offender and later found out he got caught up in a gang in prison and entered a life of crime? Or would you just collect your insurance, buy another car, and hope that there is some non-violent offender programs that could stop that, or that over time he could repay that to insurance? We have to change that I believe, or we can expect many more situations like the recent events. I hate even talking about the private prison system we have here that profits off of incarceration of non-violent crimes.

In Swartz's case, putting someone in prison that is contributing to society in exchange for locking them up for 30+k per year seems completely backwards, cruel and ancient thinking. A system that can create larger criminals easily from imprisonment of minor or non-violent actions. We should at least differentiate them better.

Putting someone in jail is just as likely to turn them in a violent repeat offender as it is to 'cure' them.

Not all prisons are the same. Martha Stewart seems to have survived her felony conviction and her jail time.

It's different for white collar crime. People stealing cars likely don't have much going on in their lives, and joining a gang might look to them like a viable way forward.

Martha Stewart was jailed for insider trading. Before, during, and after, she has a much more comfortable option for her life than to join a gang.

Because they only committed economic damage against you. It doesn't make sense to send someone to jail who only committed an economic or property crime because:

They stole from you and harmed you economically. If they go to prison your tax dollars and the tax dollars of others must house them, pay for their care, etc so they are further harming you economically.

It would make more sense to have them provide restitution to you in some form. They should have to pay for:

Damage to the car (if the car still exists) + cost of you not having your car and any sort of issues arising from that (i.e. you were on your way to an interview, you came out of 7-Eleven and your car was gone, you missed your interview and now have no job, or some such) + interest on the previous two things they should have to pay for

If they destroyed the car in some manner then replace the first part of the equation with the cost of a replacement car of equal value.

Prison should be used when someone can cause harm that is permanent such as murder, rape, etc to prevent them from doing it again to someone else. If they harm is just economic in nature then that can be rectified and there is no sense in making everyone pay to house someone who did no permanent damage.

Further more as pointed out below, going to prison tends to make people come out worse criminals.

"Cruel" is a stretch, and "unusual" is clearly false.

At least in the USA, prison rape statistics were not pleasant last time I checked. Nor is the rate of encountering or being around violence and/or intimidation. Not all prisons are as bad as others but non-violent offenders do always get options on where to go.

Most individuals put around constant violence or threat of such are permanently changed, an unpleasant/undesired change. So for may non-violent crimes many would consider prison a cruel punishment. At least with how US prisons are set up.

My understanding is that historically the "unusual" in "cruel and unusual" indicates unusual from everyday reasonable life. Constantly being around violence to an extent it changes the average individual permanently is unusual for every day reasonable life in the USA at least.

  cruel: 
    (1) willfully causing pain or suffering to others, or 
        feeling no concern about it;
    (2) causing pain or suffering

Intentionally causing bankruptcy for someone (or freezing of their assets) while also threatening them with jail times wildly disproportional to the crime and damages caused by the crime in order to extort a guilty plea before you prove them guilty in a court of law is cruel. Doing so is the willful causing of mental pain or suffering of another human being. If you've ever known another person in the U.S. that has been wrongly convicted of a crime, you'd think it was a cruel system as well. It is especially cruel to those least capable of handling emotional pain.

Are there other universities known for being better at this than MIT?

The impression many people have is that MIT has or is getting worse on these types of issues hence why it is a big deal to them.

Reply on news.ycombinator.com