Andrew Auernheimer case uncomfortably similar to Aaron Swartz case

This is such a sanitized version. I'm open to being corrected here, but afaik the 'crawling' in question was done by a script written and refined for the expressed purpose of harvesting data, with intent to cause material economic harm to AT&T, which they did. They sat on the vulnerability for days while discussing at length how to perform the 'report' in such a way as to cause the most negative effect.

They knew full well what they were doing was illegal and were afraid of being caught and discussed it.

Let's state it again in a less-sanitized fashion: They found a vulnerability, did not report it, exploited the vulnerability and stole data with the stated intent to cause material harm and/or sell said data, and actually brought about said economic harm.

People defending weev are making it sound like some guy tweaked a value in his browser url bar, ran to AT&T and said 'look what I found', and had his home promptly raided. Hence the ridiculous top comment on slashdot, "America has lost its fucking mind."

Let us not, as the hacker community, lose ours over this. What weev did was malicious and illegal and harmful and if we appear to defend him I'm afraid we undermine the cause of Aaron's case and the possibility of curtailing real prosecutorial aggresion. I really don't think it was the case at all with weev.

The idea that security researchers are or even should be free to poke at random websites for vulnerabilities so they can "inform the public" is a myth. It's a meme that's seen most of its spread over the last few years. A couple years ago, most professional researchers would warn you not to test public web applications for flaws. People have gotten into serious legal trouble for doing that.

The C.W. on this has obviously changed. But I don't think the law has!

The best web application shops post pages, like 37signals, or Github, or Google, inviting researchers and instructing them how to report their findings. If you're concerned that you might be using an application that would sue or press charges for someone conducting unauthorized security tests, just stick to the ones that have security pages.

The web applications that don't post pages like this? Don't poke them. It's illegal and (you'd know better than me, Rayiner) probably a tort, which means you can get sued for it right through your corporate liability protection.

There is no door though. The digital equivalent of your scenario is Tron.

An intentionally publicly accessible computer doesn't have well-defined boundaries. The line between authorized and unauthorized is very fuzzy, which is not a good feature in criminal law. Especially where defendants are characteristically individuals without the resources to defend their interpretation of the law in court.

>We do so to discourage people from poking around where they shouldn't, because such poking around is highly correlated with actual crime.

That seems like a self-fulfilling prophecy. If you criminalize poking around then only criminals will poke around. There are also much better reasons for prohibiting it in physical space than on the internet. Industrial equipment can be dangerous and cause massive property damage or personal injury if you mess with it. Invading someone's home impacts their physical security. These are rarely if ever the case with computers. Servers are (or should be) backed up, so even where there is highly valuable data, the extent of destruction someone can accidentally cause is limited to the cost of restoring backups, and reckless or intentional damage would continue to be illegal.

Harmless poking around also has the benefit of revealing vulnerabilities before they get revealed through malicious poking around. A kid who sneaks through your literal open window and starts nosing around in your house is not pointing out a critical security vulnerability; you know that your window is open. There is no benefit to the homeowner, the kid is just a pest. But computers have higher security requirements: The equivalent of an open window is a major failing in need of immediate attention, because if a kid can get in then so can foreign criminal syndicates, and if they get in they'll be doing more than poking around.

>Allowing people to poke around freely makes enforcement hard. Everyone who actually did something wrong is going to claim "oh I was just poking around."

Won't the fact that they actually did something wrong give lie to that claim? The ones who are actually doing something wrong will be found making charges to purloined credit card numbers or modifying shipping information in databases or the like. I suppose you may catch someone in the act before they have an opportunity to do any such thing, but if you have someone who is really trying to do wrong, isn't it better to extend the investigation so as to be able to charge them with the serious crime they actually intended than to roll them up right away on a minor offense?

>Why can't security researchers get consent from their subjects to do experiments on them, like every other kind of researcher?

Discovering vulnerabilities in production servers is not really research, it's more like being a plumber or a firefighter. There may be professionals who are paid to do it, but if you see water leaking or smell smoke, taking a moment to do some cursory looking around to see if there is a serious underlying problem should be just part of being a good citizen.

As for asking permission, the trouble is that the transaction cost consumes the transaction. If someone goes to a website and notices that the URL has a 'userid=1157' appended to it, the natural thing to do is to try putting in 'userid=1158' and see what happens, because the two most overwhelmingly likely things are either for it to produce an access denied error and be harmless, or to log you in as a different user and be harmless as long as you don't further abuse that fact. And 99 times out of 100 it will be the first one. Which is why requiring permission breaks the propensity for good people to help out: If the expectation is for people to ask permission before doing something like that, the website operator is going to have anyone who notices that asking about it, and if it isn't broken then it gets annoying, which annoyance is conveyed to the people asking about it so that in the future they stop asking and stop helping. Which is I think what we see: Security people mostly don't poke websites because the law prohibits it, so security flaws don't get identified until the bad guys identify them.

I would also distinguish this from doing something like SQL injection or exploiting a buffer overflow, which can reasonably be expected to cause a denial of service or data corruption. In those cases there could be a charge for something like reckless disregard for damaging a computer system as opposed to purely for unauthorized access.

You're oversimplifying the situation. See: http://en.wikipedia.org/wiki/Model_Penal_Code.

As I said, crime = intent + action. If you kill someone, and you had no bad intent (it was neither your purpose to kill them nor were you acting negligently), then there is no crime. At the same time, if you fully intend to kill someone, but don't take any action consistent with that intent, there is no crime. The two factors must also exist simultaneously. If you intend to kill someone, and buy a gun, you can be charged with attempted murder. If you fully intend to kill someone today, but then change your mind, and tomorrow buy a gun because of a rash of burglaries tomorrow, then there is no crime.

Now, obviously we can't get inside someone's head. So we infer intent from action. But we must always remember that the focus is not the action, but what the action says as evidence of the person's intent. And no matter what intent is inferred, there must still be independent action towards committing the crime.

So no, it's not illegal to say "I might do this." But, saying "I might do this" can amount to evidence that you intend, in fact, to do this, and if you independently take some other action consistent with this intent, you can be charged with an attempted crime.

Not having good intentions then taking action consistent with that is the definition of a crime.

I'm not saying what weev did is as bad as attempted murder. I'm using the example to illustrate the concept.

> Is what weev did the same thing as walking into your house through your unlocked front door and then rifling through your personal papers? I don't think so. It would be better to say it is the same thing as his walking past your house after you plastered it with old credit card statements and then remarking to a fellow passer-by that he would do well to make some expensive purchases using that now-public information.

It's not like that at all. You're completely ignoring intent, and thereby taking the human element out of it and reducing it to the mechanical. If you plaster your house with credit card statements, a passer-by can reasonably infer that you intend to make the information public. Otherwise, why else would anyone do that? But AT&T clearly didn't intend to make the information public, and Weev's actions clearly suggest he knew that. AT&T made a mistake, but Weev took advantage of that mistake to access private information AT&T didn't intend to make public. The fact that I forgot to lock my door does not give you the right to go rifling through my shit! The fact that it's easy or even trivial to do so does not make it okay.

> The problem with the charges filed against weev and the charges filed against aaronsw is that they were based on a law that so lacks specificity and grounding in actual computer practice

I disagree with the contention that snooping around where you're not wanted for private information is grounded in "actual computer practice." It's grounded in a certain adolescent "hacker culture" that glorifies pushing peoples' buttons and getting around boundaries, but that is not coextensive with computer practice.

> that even computer professionals need to use analogies to justify the illegality of the acts. If the law were legitimate such analogies would not be required.

All law is based on analogical reasoning. Analogies allow us to illustrate operative principles to help translate from familiar situations to unfamiliar ones. Analogies in this case help illustrate the basic principle: just because it's easy to violate someone's property rights does not mean that such actions are not a violation.

> The fact is that the action he undertook can only be described as criminal insofar as accessing a public URL that is not otherwise publisized qualifies as "exceeding access", which is what the CFAA makes a crime.

What's unclear about the application of the CFAA here? He had a certain level of access to AT&T's information. He, through some means (it is utterly irrelevant the simplicity or difficulty of those means), exceeded his authorized access to get access to private information. He knew that he was getting access to information AT&T didn't intend him to access, and that AT&T had taken measures to conceal (it is utterly irrelevant how feeble those measures were). He then took the action of actually downloading that information. That's bad intent + accompanying action.

> Whatever ill will may have existed in weev's mind (I'm sure there is plenty there to go arround), for his action iteself to be criminal

This is a non-obvious feature of criminal law, but it needs to be understood. Under the law, "actions" are not criminal. Actions taken in a given frame of mind are criminal. The same action could be criminal or not depending on the intent. Take the simple act of entering someone's unlocked car. It can either be illegal trespass or not, depending entirely on whether you knew the car wasn't yours and you entered anyway.

> weev had to know what was in the mind of AT&T. And how could he? Because "authorization" is not a concept in the http protocol (or maybe there is, if you count http authentication, which wasn't used here) there are no methods besides clairvoyancy or pure gussing to determine whether a public URL is intended for open access or not. We have to assume that a public URL automatically grants authorization.

No, weev did not have to know what AT&T was thinking. The law does not hold him to that standard. The standard is objective: what would a reasonable person infer about AT&T's intentions? We do not have to use some bullshit mechanical assumption that ignores the simple fact that humans can do a pretty good job of guessing what other humans intend. You cannot tell me with a straight face that just because AT&T's security was trivial to get around that a reasonable person would conclude that AT&T had intended to grant open access to their member's e-mail addresses. That's the point of the "unlocked door analogy." Any normally functioning human being realizes that leaving a door unlocked does not create an inference that people are entitled to enter.