It’s a bad time to be a hacker in the United States
pandodaily.com
pandodaily.com
So to clarify, it's actually still a great time to be the former. It's not now, nor has it really ever been, a good time (or a good idea) to be the latter.
The rest of the article seems to just be an explanation of why that is.
"To law-enforcement and the criminal justice system" the former criterion implies the latter.
But this specific objection actually undermines your entire argument. If justifiable trivial actions can be maliciously portrayed as crimes, so much more can justifiable nontrivial actions. It's a sliding scale anyway: I'm no über-hacker so I know that many things that are trivial to more skilled people would be initially mysterious to me. This is why just law must be based on the consideration of specific acts that either meet or fail to meet concrete widely-understood criteria. Just law does not punish acts that are in a "gray" area, which cannot be said with certainty to be crimes. When uncertainty is a basis for prosecution, the only criteria we have are the potential misunderstandings of the dumbest jury a prosecutor could possibly empanel. At that point, human innovation and happiness will cease.
It seems pretty clear at this point that you did not in fact need any citations.
I was facing criminal charges for a python script that monitored a mail server that I owned. My security clearance was suspended. My professional reputation was tarnished. The charge was that I "hacked" several computers. With no evidence, with little more than a complaint from two people, all of my previously reputable work (never mind my TS clearance) was discarded and I was regarded as a threat. An escort was required if I was near a computer. I could not use any of the Information Systems. I was given a utility closet with a 55 gallon trash can and some cleaning supplies to call my desk. My chair was missing one of the wheels so it rested at an angle. This lasted for four months.
It was impossible to prepare myself. How would my script be 'understood'? I was trying to learn python. The script monitored headers for internal messages being forwarded to external accounts and blocked them. A message was sent to the offending party with the policy that prohibited this act. Pulling from the headers, the message included the intended recipient in the body to the offender. Yet it was more readily believed that I "hacked" the computers of the sender and recipient to accomplish the effect.
Though this is trivially understood, it is not easily accepted by people who are not aware of the fundamental mechanisms of a mail server. I attempted to explain my script using postal mail as an analogy. I explained the auto response as being similar to vacation messages. The charges escalated from "hacking", which was the compromise of a system I did not own, to interfering with the delivery of sensitive information. I was mortified. In trying to explain what I was doing, I dug a deeper hole. Fortunately for me, definitely not for the 'victims', the information that was being sent was now classified and regarded as sensitive. The fact remained that I owned the mail server and it was not authorized for use transmitting sensitive information, which is the responsibility of the 'victims' to know. The charges were promptly dropped and I spent the next several months clearing up the matter with the rumor mill. My clearance took quite a while to be reinstated. I was no longer regarded as a credible subject matter expert to seek for consultation. I was blacklisted, in a sense. I packed up and moved on when I could.
I wanted to better understand Python and mail servers and it nearly crushed me. Once I was labeled as a "hacker", the most diabolical intentions were projected upon my every behavior. Encrypted emails? Suspect. Modified a router to respond to all probe requests? Sinister. Assembled a transparent bridge using commercially available equipment in your garage? Treasonous. I was concerned that my curiosity would held against me. It was a nightmare. That is as mush as I can recount.
Edit to add example: Lamo says
>To put this into some kind of perspective, if Swartz had committed violent battery of a Supreme Court justice or a member of Congress he would have faced, at most, a year locked up in the pen — as long as he didn’t use a deadly weapon.
The maximum prison sentence for aggravated assault in DC is actually 10 years. And if you use a deadly weapon, it adds an additional maximum penalty of life in prison.
He's also the guy who turned in Bradley Manning (after convincing Manning he could communicate with him in confidence since he was a priest).
This isn't something to be proud of.
I don't fully support what he did and I think he was wrong to do it in the manner in which he did and thus he deserves some punishment. I also think he stands as an unfortunate symbol of how the idea of the writ of habeas corpus is completely dead in America, which sucks.
As it relates to Lamo, though, I think it is clear that the way Lamo went about convincing Manning to reveal what he had done while convincing him that he (Lamo) was a journalist and priest and thus Manning would be protected from disclosure was hugely unethical and marks him as one of the great asshats of all time.
As far as Lamo, I agree in general with the description of asshattery. But still, if Manning actually thought Lamo were a priest then I have to wonder about his capacity for critical thinking. And either way, I find it at least a bit ironic that Lamo managed to extract accurate information from Manning, under false pretenses, immediately after Manning extracted accurate information from the U.S. Government, under false pretenses. But only one of those two swore to protect the information in question under penalty of law.
He released evidence of scores of crimes and warcrimes. His actions were a major catalyst for the Arab Spring, yet something for which he has literally been tortured.
Likewise we wouldn't condone getting the GMail password of a child kidnapper by releasing the GMail passwords of all adult males. Whistleblowers report specific crimes, they don't just mysqldump a database and netcat that shit to foreign-entity.co.au and hope they treat the data properly.
But let's talk about his actions catalyzed the Arab Spring. How many Tunisian, Libyan, Egyptian and Syrian lives does Pfc. Manning have on his hands then? We blame the U.S. for all of the fatalities related to Iraq, for example, even though the U.S. didn't directly undertake all of those killings. So why would Manning get a pass for this?
As far as torture, Prevention of Suicide Watch is an actual prisoner status one can be in, especially if one makes jokes about killing themselves (as Manning's own lawyer admitted he did). The military judge presiding over Manning's hearing agrees that he was held under suicide watch without enough justification and has reduced his eventual sentence (it's unclear by how much though).
But either way, I would humbly submit that someone with military training should be intelligent enough to not joke about committing suicide, especially when part of a case with extreme media interest where actually committing suicide would bring the "Eye of Sauron" of negative attention on the detention facility. You don't even have to take my word for that; just look at the reaction to Aaron Swartz's suicide.
He is often compared to famed whistleblower Daniel Ellsberg, who released thousands of documents indiscriminately that had a lower security designation than anything Manning released. Plus even Robert Gates called the negative impact of Manning's leaks "fairly modest."
It wasn't just a SQL dump. Manning found evidence of crimes, and he took what looked suspicious. Read his chatlogs with Lamo if you must.
Pfc. Manning, on the other hand, downloads hundreds of thousands of different documents, and instead of simply releasing the specific ones he looked at which he felt documented war crimes, simply passed it all along. Not to the Inspector General, not to the Office of Special Counsel, not to the NYT, or WaPo, or any U.S. entity. No, he passed it (these hundreds of thousands of documents he never so much as looked at) directly to WikiLeaks, an organization that is not exactly impartial (and either way, is foreign-run).
So I'll reiterate. He took whole CD-R's full of stuff, which he didn't fully review, and offloaded it all to a foreign third-party to filter through and do with as they will. If the impact ended up "fairly modest" it was due only to luck or incompetence on Manning's part (I'll let you pick whichever you like).
If Manning were whistleblowing, he would have taken the "evidence of crimes", and leaked that, just as has been done by other soldiers before him (e.g. Justin Watt, serving in Iraq).
I've read the chat logs as it turns out, but it reminded me of something: Manning himself noted that he had been demoted by the Army for physically assaulting another soldier, that he was dissatisfied with being 'an abused work horse', etc. etc. However he managed to convince himself of his 'ethics', the fact is that he had a ton of ulterior motive.
For all the talk we hear of proportional response for Aaron Swartz, you would think that Manning would have thought more before making the logical leap from "I have to deal with shitty officers" to "I have to exfiltrate as much as I can".
I mean, Manning himself realized that it's not as if all military servicemembers are horrific murderers:
(02:09:58 PM) info@adrianlamo.com: most people in the Army aren’t in specialties
that involve directly servicing targets.
(02:10:14 PM) bradass87: im glad you realize that
(12:12:46 PM) info@adrianlamo.com: Want to go to the press? :)
(12:12:51 PM) bradass87: no
The logs also state:
(12:21:24 PM) bradass87: say… a database of half a million events
during the iraq war… from 2004 to 2009… with reports, date time
groups, lat-lon locations, casualty figures… ? or 260,000 state
department cables from embassies and consulates all over the world,
explaining how the first world exploits the third, in detail,
from an internal perspective?
(1:34:45 PM) bradass87: all while witnessing the world freak out as
its most intimate secrets are revealed
> A law becomes unjust when a person of ordinary — or even extraordinary — intelligence cannot readily predict what charges might arise from a given activity.
...if I were to commit armed robbery, I could easily find out what law I would be breaking and what kind of prison sentence I'd get. With infosec and IP laws, you'll never know how they could be wielded against you!
I wouldn't say that. As an example, many companies in the (very crowded) data-storage or file-sharing space spend a lot of money on legal fees to cover their asses (or do damage control) in case of copyright violation when someone decides to share the latest DVD rip using their service. There are many other examples like this. People in our field are constantly exploring the limits of what we can and can't do with technology in the context of laws that were created without these uses in mind. True, it has never been a better time to be a hacker, but I think when/if we have all these issues sorted out it will be even better.
A totally random person IMs you out of the blue, talking recklessly about crimes he'd committed, and trying to elicit your support and confirmation of understanding and support in furtherance of acts previously and ongoingly committed. Even if you support some of his motives, you'd be wise to either report it (as Adrian did), or, at the very least, make it clear you neither understood nor supported the actions. Otherwise, you're part of a conspiracy, and thus even more fucked.
The guy could either be an informant trying to entrap you, or at least had such recklessness that he'd approach someone and be reported/caught later, so you'd be at risk if you cooperated in any way.
There could be a slight difference if you were a protected party (someone's lawyer, priest, spouse, doctor) and if the crime were not something which carried a duty to report.
(IANAL)
It's fun/scary reading the transcript and figuring out at what point you'd do what. If it were a random person IMing me from Iraq, I'd probably be friendly to start out.
The safest thing is to end the conversation before any criminal acts are discussed. I think it's also probably safer if you immediately switch to "you should report that to law enforcement, it sounds like a crime" vs. just "the fire, please die in it."
As a felon, I would err on the side of reporting criminal contacts.
(I personally also have an obligation to report compromises of classified data, too, so I would have reported this.)
faaaaaaaaaaarrrrttt, pffffffffffttttttttt, pffffffffffttttttt, faaaaaaaaaaaaaarrrrttttt, innuendo, lies, bullshit, faaaaaaaaaaaartttt