“The AT&T Hacker” Sentenced To 41 Months In Prison
techcrunch.com
techcrunch.com
Normally you pick the most compassionate defendant (like they did in Heller in DC) for a test case. Weev is probably the least sympathetic defendant. But I guess you go to war with the weev you have, not the aaronsw you wanted.
2. Generally, if you are smart, you don't bring wildly unsympathetic defendants to SCOTUS at all (IE you don't go to war over them). There are cases it doesn't matter, but one of the reason we ended up with so many 4th amendment exceptions is, IMHO, because of the habit of bringing really unsympathetic people/facts to SCOTUS back when we had justices like O'Connor.
While weev himself is highly unsympathetic, his actual "crime" in this case is quite sympathetic -- it was technically trivial and the results were given to the press, vs. used for financial gain (even though they talked about it). So maybe it's not the worst possible test case.
His biggest mistake was not being in the 9th circuit, though.
(IANAL though, of course)
IAAL :)
But who knows, maybe scotus would get bored enough to find it interesting.
I'm betting "no" in part because legislative fixes are being considered right now. If one passes, it would reduce the odds SCOTUS would ever take the case.
Improper search and seizure leading to a trial is going to have found drugs/guns/whatever, by definition. That doesn't mean the rest of us should have our 4th amendment rights weakened.
For the courts charged with maintaining these protections, it can be hard to keep a hard-line stance in favor of 4th/5th amendment protections in face of a docket that is chock full of actual criminals who actually deserve their sentences.
It's an explanation, not a justification.
If he'd gotten 3-6 month suspended sentence, even if you thought that was a bit much for essentially incrementing numbers, you'd probably not care much.
If he were facing life in prison, you'd probably leave the US if you were doing anything in security research, change how you vote, etc.
If you pay US taxes you're paying to keep him in jail. I think he's a vile idiot. I don't think he should be in prison.
There's a bunch of stuff that I think he did wrong, but I'll have to read the court documents to see if I agree with them.
For example: He could have written a proof of concept script, and only downloaded a sample 10 pages, rather than grabbing as many as possible.
I might think that would have prevented him going to jail, but would the court agree?
Had he only downloaded a few records, chances are he might get some community service and probation. Also, his stupidity in taking to Reddit to proclaim next time he won't be so nice didn't help either.
Malicious? Sure. Criminal. Not a chance.
He loves manipulating press and media for his own entertainment. The bigger the number, the bigger of an asshole he makes ATT look like by their not protecting it, and the more anguish he causes their management by damage to their brand and stock price.
A valid effort, I think, as manipulating some shitty corporation's reputation with FACTUAL DATA is one of the least underhanded ways of achieving the goal of "fuck with ATT".
So why do those behaviours escape punishment, while this thing gets a prison sentence?
This is why the ACLU defended the Klan.
This is different than a Klansman being on trial for his car crashing into a bus stop full of black kids, and then publicly announcing before sentencing that "I'm only sorry I didn't kill any of darkies."
The Klansman's own words are used to show intent. Without them, he might legitimately argue that it was a honest accident. Maybe believably, depending on other evidence.
Using someone's own words against them in court is not a violation of freedom of speech. Intent matters, and that doesn't mean we have thought-crime.
The only person he's trolling, is himself.
And to be fair, if he didn't do things like the AMA, he probably would have gotten the 3-6 month sentence.
They didn't sentence him for previous trolling, name calling, or tom foolery.
(Seriously, they read his AMA responses in court this morning. Weev's a shithead, but still: 't'was glorious. )
..But I've stopped laughing. It's time that technologists step up efforts to change things in the favor of communication and free speech.
I must've missed you at the sentencing this morning. I was the hungover one in the mirrorshades.
If you're still on this side of the pond, we should grab a drink.
The way the CFAA works is that it's a misdemeanor unless the illegal access is pursuant to some other crime, which bumps it up to a felony. Had weev simply stumbled upon AT&T's security flaw and reported it AT&T, the worst they could have gone after him for is a misdemeanor.
People are acting like the fact that he downloaded tens of thousands of pieces of personal information is totally irrelevant, but it's not. It's highly relevant. It's why he's been convicted of a felony rather than a misdemeanor. And it should make intuitive sense and it's mind-boggling to me that somehow people on here intellectualize the situation to the point where they write out this part of the facts.
In meat space, the crime of trespassing can range in severity from a nothing to a serious felony depending on what the surrounding circumstances says to a jury about the trespasser's intent. Here, it was totally reasonable for a dispassionate observer to conclude that weev's intent in downloading tens of thousands of pieces of personal information (not to mention the IRC conversations) was seriously malevolent.
It should finally be noted that the "fraud in connection with personal information" conviction would have been by itself sufficient to support the sentence.
Identity fraud for a list of emails? Really?
It's insane even if you assume they were pristine and never received any spam before weev came along and "stole" them. Furthermore, the list was never sold, distributed, or published.
An excerpt was sent to the media.
They kicked around the idea of spearphishing, of spamming, of pastebinning it, of selling it. In full knowledge of the value and leverage that this data allowed, they contacted the media and deleted their own copies. It profited them nothing.
The idea that this is akin to trespassing is simultaneously both obtuse and dangerous. There were _no_ access controls; ATT themselves said in court that the information was published (by them) on the web.
Given that history, it's really easy to claim that he was intending to do harm with that list of emails, and it's also pretty easy to think of ways for him to do harm. Idendity fraud might be a bit of a reach, but computer abuse with malevolent intent? Not too hard to get there from his public statements.
They could have been really bad guys. That didn't happen.
Anybody COULD have done harm with those emails. He didn't. He used them as a fodder for public discussion about internet security.
AT&T should owe him a "thank you".
AT&T customers owe AT&T a boycott for being irresponsible with their information.
I think the question of AT&T having responsibility for inadequate controls is very interesting. I would like to see AT&T face some repercussions for it. Not _instead of_ weev receiving punishment, but _in addition to_.
Collecting lists of e-mail addresses from private databases without authorization should be.
> Identity fraud for a list of emails? Really?
Weev said in IRC conversations that he was going to sell the e-mail lists. Maybe you don't believe him, but it's hard to argue that no reasonable person could have believed that he was going to do what he said he might do.
> Furthermore, the list was never sold, distributed, or published.
If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.
> There were _no_ access controls;
I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.
Society charges you with being a normal functioning human being and respecting obvious boundaries. Obviously this is too high of a bar for people like Weev.
Unauthorized I can see, but "private"? What was "private" about this database he accessed? It was a public API on a public server with no authentication required.
> Weev said in IRC conversations that he was going to sell the e-mail lists.
Yes, but he didn't. Is he being prosecuted for doing something he said he would do, but did not do? That seems dangerous.
> If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.
This is death by bad analogy. He wasn't breaking into a house, no safe-cracking tools were required (nor, probably, on his person).
Why not argue to the actual point? The list was not sold, distributed, or published -- why is it necessary to fall back to analogy there?
> I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.
Death by bad analogy, again. Surely you don't think that downloading publicly available data is analogous to B&E? And if the email addresses are so precious as to warrant a 41-month prison sentence merely for accessing them, shouldn't the idiots at AT&T be held at least partially responsible for making the data publicly accessible?
> Obviously this is too high of a bar for people like Weev.
Ah: guilty people are lesser people?
I'm not even sure what Weev's crime was here, in layman's terms. Was it accessing the public API in the first place? Was it sending the list of email addresses to Gawker? Was it talking about doing nefarious things with the list of email addresses? Was it not contacting AT&T first?
If I had to describe this case to someone who knew nothing of computer systems and explain why the 41-month prison sentence was justified, how would I do that?
While I think the responsible disclosure could've happened in a better way, I don't think this is akin to walking into an unlocked house. This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.
What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time. It just doesn't sit well with me and I don't think the boundaries are obvious.
I'm not a hacker if I increment a URL by 1. I wouldn't even call you a hacker if you used DNS reflection attacks. To identify cheap parlor tricks as hacking is offensive to the professional breakers and ludicrous in the larger scheme of things.
That's a separate issue.
> This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.
The protection was the fact that the information therein was obviously sensitive and not intended for public disclosure. In a civilized society, that's all that should be necessary.
> What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time
He's not being sent to jail for "exposing this lack of attention." He's being sent to jail for exploiting this lack of attention tens of thousands of times more than was necessary to prove his point and for talking smack on IRC that led people to believe that he might sell those e-mail addresses for profit.
Hackers move easily between different levels of abstraction and believe that things in general can and should be understood. They try to never stop asking 'why?' and this leads them to find places where the system is incongruent. Many of these realizations are benign or even progress the system, and the advantage gained just helps the hacker succeed within it (eg. pg's main use of the word hacker). But some realizations contradict a foundation of the system (like insecurities of its central nervous system!).
The system is built on abstractions, takes them for granted, and reacts extremely harshly when they are broken (for this is an existential threat). The system can only understand a broken abstraction in terms of the abstraction itself, rather than in terms of underlying reality. Hence we end up with phony blame-shifting terms like "identity theft" instead of reality-based "fraud". Meanwhile, hackers see the failure of the abstraction in terms of the underlying reality and have a hard time seeing what the big deal is - just reprogram the abstraction!
Most people's thoughts are contained mostly within the system, having been indoctrinated into it from birth (constant rote memorization in primary school, blind repetition of contradictory facts, scolded by adults with tenuous justifications every time they don't follow the pack, etc). So they take what they're told at face value and follow along, all the while never seeing the whole picture and hence remaining afraid of mysterious agents that can take advantage of them for what they don't understand. If they're told that a collection of email addresses is a threat to their way of life, they'll actually believe this because they lack the broad framework to analyze the truth of this statement. They'll instead trust the system and assume it's correct, feeling that if it were indeed wrong they would no longer be able to take anything for granted.
I theorize that all religions begin with understandings of fundamental truths that are summarized to pass along. They then ossify into mechanical words and take on an oppressive life of their own :/.
Bruce looks at his, then checks that he can look at some others - he collects 100 examples and angered by this he takes those examples and posts them on his blog as proof of a major security failing so bad it's embarrassing
Now weev it seems is an Unpleasent person who has been looking for ways to attack AT&T. - but is the strawman argument above an accurate analogy to the facts of the case?
If so I really don't see what his motives or personality have to do with anything other than his sentencing. It's the prosecution and conviction that seem wrong afaik
The world is full of sensitive information that's basically protected on the honor system, for the same reason the world is full of unlocked doors: because we assume some assholes won't come around and abuse the situation.
AT&T had a duty of care to protect their Data which they signally failed to do. Then some asshole finds out and makes that situation public. He did not do so in a responsible manner but four years is a long time to get for being an asshole.
If that is commonplace HN is going to be a smaller forum
Weev was convicted, by a jury, of fraud in connection with personal information. The jury believed he intended to sell the e-mail addresses he collected to people who would use them for various nefarious purposes. Given that he claimed he was going to do so in IRC conversations, it's really hard for you to sit there and argue that the jury was unreasonable in reaching this conclusion, and that all they are really punishing him for is blowing the lid on AT&T.
What you're doing is trying to create a particular narrative about Weev's intentions, but ignoring that the jury in this case heard and rejected this narrative.
Whilst I see that there are times and crimes it is viable, it's just a vicious circle.
He intended to commit a crime, but did not? And so he got jail?
I admit I am taking this too far on too little reading of the case (any links to original docs would be useful) but intention is real flimsy.
It's amazing how much point of view can change perspective.
Rather than disclosing to AT&T, he leaked it directly to Gawker, and discussed how to potentially abuse the data he had (by shorting the stock, selling the e-mail addresses he had collected to spammers, etc).
The sentence is absolutely disproportionate. But there are so many ways in which the guy could have handled himself better. I think a lot of people in the infosec industry are simultaneously angry at the sentence but not massively empathetic with the defendant.
What I'm trying to say is that as a test case or campaign to change the law it's far from ideal.
Ironic that you should say that, considering that Weev's defense is essentially "her parameters were all hanging out and it was just so easy."
Secondly, if a company posts something publicly, people in the public are going to see it. My mind is incapable of comprehending the logic of anyone who would say "Just because we posted it on our website doesn't mean we wanted anyone to see it."
And oddly, if one of those is a crime, so is the other.
I'm going to go ahead and suggest that the answer is "No, but we as a society make a distinction." Same princple here. I believe the general principle is that you have freedom of speech, but you do not have indemnity from the harmful consequences of your speech.
So it's not even appropriate for me to say that it's a slippery slope, because it started at the bottom.
It's going to cost approx $40,000 per year to keep this non-violent criminal off the streets. (From Wikipedia, California state prison, 2008)
The US should probably consider not putting people into prison unless they are violent offenders, or unless they are repeat offenders. (But even for repeat offenders it's probably cheaper to work out why they're offending and put something in place to stop that.)
(https://en.wikipedia.org/wiki/Incarceration_in_the_United_St...)
If the two guys from Steubenville had been over 18, the sentences would have been considerably higher.
But, 18 shouldn't be the dividing line for responsibility.
What those guys did was reprehensible and they should be in jail. No questions asked.
But we have two separate penal systems in this country: one for juveniles and one for adults. The adult penal system uses harsher punishments than the juvenile one.
You simply cannot compare the sentence handed down in both of these cases, because they are happening under two effectively different penal systems.
For ANOTHER thing, the actual sentences handed down by the judge in the Steubenville rape trial where that they are remanded to the state juvenile detention facility for at least one year (for the one who only participated in the rape) and for at least two years (for the one who also sent around the pictures). At most, they will stay in such a facility until they are 21. In addition, these two must also register as sex offenders for the rest of their lives, effectively giving them life-long parole.
So, when we are talking about Aaron Swartz, everyone quotes the maximum penalty he could have faced, even though it was almost impossible he ever would have received such a sentence. But in the case of these two rapists, everyone is saying they only got one or two years. The fact is, when you want to say punishment is potentially harsh, you quote the maximum, but when you want to say it is weak, you quote the minimum. Make up your mind.
Again, I'm not trying to defend those two guys. I'm making the point that you cannot compare juvenile and adult sentences. Perhaps question whether or not these two should have been tried as adults, sure, but then there are many who would argue that that is overly aggressive prosecutorial action[1].
We have marched, protested, voted and won. Human rights, gay rights, pollution and justice. But it took effort and now the injustices are less obvious, are not next door but a long way away, and so it seems we can stop and rest. But injustice is like entropy - it never rests and so we let the torture be done in our name, we don't mind that the youth of the country are given sentences for looting longer than murderers, we don't shout that companies who leave their virtual doors unlocked should not be upset i they find people inside the building
It's right we should be upset, should write our MP should protest the wrongs - but it just seems lacking
I used to think that the USA had a written condition and so would always defend these things - but it seems that if we stop caring then we stop fighting for the spirit of the law and disappear up out own bottoms arguing over the letter of the amendment.
This is not true by any stretch. Human rights have been and are continually violated, esp. for minority groups, mainstream gay rights has become assimilationist and has abandoned the LBTQ of LGBTQ, and pollution abuses continue and many of those abuses moved overseas as perpetrating corps. went for cheaper labor.
> But it took effort and now the injustices are less obvious, are not next door but a long way away, and so it seems we can stop and rest.
The injustices are next door, they happen every day. The root causes of issues have not been addressed and classism, racism, sexism, and capitalist patriarchy are as much of a part of western society as ever.
> But injustice is like entropy - it never rests and so we let the torture be done in our name, we don't mind that the youth of the country are given sentences for looting longer than murderers, we don't shout that companies who leave their virtual doors unlocked should not be upset i they find people inside the building
It should be noted that people have tolerated and/or endorsed this kind of structural dysfunction for a long time and continue to do so. But you are right in that injustice is systemic and will continue even if people feel hopeless or tired of fighting that injustice.
If they didn't want the maximum to be the maximum, they shouldn't have put it in the range?
For the most part, the actual calculation is mechanical. Unless the judge performed an upward departure (which i can't find any evidence of), he was just following the guidelines.
If I was dealing with such dickheads as the AT&T and the US prosecutors, my "last" wish would be to harm them more, too.
Edit: typo, changed "with" into "wish" in the last paragraph.
>>>> If I was dealing with such dickheads as the AT&T and the US prosecutors, my "last" wish would be to harm them more, too.
Then you'd be no smarter than Auernheimer, and I sincerely hope you don't behave as stupidly as he did, or you inevitably would land in jail too. It usually doesn't go well for people that try to harm others and publicly admit it. At least Auernheimer didn't publicly proclaim his desire to harm prosecutors too, that'd be an nice cherry on top of this cake of self-destruction.
If you're a federal persecutor, it usually goes very well.
Prosecuted and convicted at all? Whilst I recognise there is a lot of backstory here and a lot of anti weev feeling if the case is as simple as AT&T kept private records behind the worst security imaginable - the equivalent of putting a unlocked filing cabinet on the street and moaning people rifled through it - then his criminality should be IMO the equivalent of someone who we t through that filing cabinet and took the files to a journo to show how crap their security was
If there is something else to it (as opposed to him or he is repeatedly trying to get AT&T) then I would of course like to knwo
Conflating what weev did to someone walking around inside your house brings in too many emotional triggers about private property. He wasn't in someone's house, he was trying to demonstrate that the company you hired to keep your private property was doing a crappy job at it.
EDIT: Okay, yes, he was probably just trying to be an ass but fortunately that's not a crime.
The headline would be the same: "X Company exposes N Number of user accounts in discovered security hole". So do you see where that doesn't make any sense?
edit: agree with you @drhayes9, just responding to the OP's assertion that the number mattered.
I think the numbers helped sensationalize it, sure.
But if you are a bank, commercially offering "secure" services for profit, and the deadbolt is on the outside, then any public outing is to be expected.
Really this is abou a lack of understanding of software and architecture by the entire public - imagine a bank had actually put a million Dollar safe up and had forgotten to put a lock on it - the competitors CEO would expect to be fired if he did not take the press and cameras around to have a good laugh
It just does not work.
Yes I would download a car if I could....
http://www.blogto.com/upload/2008/02/20080215_rats.jpg
The restauranteurs were not informed about it; it went straight to the media and to the city health department. The restaurant was shut down later that day for health violations.
Has a crime been committed? Did the photographer have a moral, ethical, or legal duty to attempt to quietly inform the restaurant that they have a rat problem? Should the photographer have been prosecuted for interfering in the business operations of the restaurant? Suppose we know the photographer is an asshole. Does that change the calculus?
Part of the problem, and I think you'll agree with me on this, is that these metaphors breakdown because, when talking about information and systems, the notions of property are much more complicated. What if, for example, the photographer photographed a sheet of paper with 100 usernames and passwords to gmail accounts, or bank account records and then mailed it out for everyone to see?
He should probably have gone to the authorities first, not the media.
It's quite easy to casually condone three years in a cage for someone you don't like when that's your only involvement.
You don't actually believe those words you just said.
But the public also understands that things visible through the front window of a business on a street are not private or secret. (And I know someone is itching to type that AT&T is just a window and they just served up exactly what Weev wanted, but I'm too tired to respond to such nonsense.)
"Bringing a serious problem to the public's attention" are not magic words that make someone's actions legal.
I'd say that a list of email addresses isn't actually private information worthy of legal protection. We've just got these ridiculous laws calling widely-available datums "sensitive" because banks (et al) are trying to pretend that your "identity" is somehow being "stolen" rather than that they're simply being defrauded. So a simple trespass with questionable intent has been turned into a several year felony based on these toxic bits that aren't actually important enough to necessitate serious audits or redundant controls.
Frankly the highly fucked up part of these laws are the amount of time involved, both what defendants are pressured to plea bargain with, and the actual amounts that get sentenced. It's very easy to say that three years in a cage is reasonable from the comfort of your chair. We can debate what should be ultimately illegal etc, but with these kind of sentences we're basically talking about destroying someone's existing life for a non-violent action with minor damages that a different company wouldn't even press charges for.
Justiceporn (people getting their come uppance) and cringe (originally things that made you cringe in sympathy, but latterly videos of socially awkward youth that Reddit could bully and mock) are two examples, but there are others.
First-hand experience in my case. He and his GNAA attacked my volunteer-run open source project and did many things, including calling Child Protective Services (CPS) and making false complaints -- leading one of my volunteers and his children to have to undergo interviews with CPS to suss everything out.
They emailed one person's professors at university and made false, damaging claims. Bosses were tracked down and jobs were contacted. Parents were found and harassed. Our web site was attacked and taken offline. Our business associates were contacted and they concocted a fictitious business persona to file spurious complaints with our payment processors, leading to us being dropped from two providers.
weev was not just "being mean", he transcended that to stalking, bullying, and harassment. He caused emotional harm to my volunteers and staff and fiscal harm to my business. All in the name of "trolling".
And yes: we pursued the legal route. The FBI is just not super interested in tracking down some random dude on the Internet for harassing a small business. They were happy to talk to us and very compassionate and gave us some advice, but that was the extent of it.
Basically, the prosecution wanted a harsh sentence to set precedent and weev gave them the ammo to do it.
Additionally, when he gave the data to Gawker he told them he had already disclosed the issue to AT&T, which is later turned out wasn't the case.
Juries are not supposed to be rubber-stamps for the government and I'd urge anybody who is going to serve on a jury to learn about their rights and responsibilities before going.
If you think a non-violent person being charged in a marijuana possession case or other non-crime doesn't merit locking up, throw a wrench into the corrupt system and vote not guilty.
One act can certainly have multiple consequences, driving a stolen car through a mall mowing down people and kiosks would entail a lot of charges, even though it would be a "single cohesive act".
That said, I'm not sure about the hacking rule, and I don't know the full details of the 1986 law they are prosecuting under, and whether it has been amended or what amending it needs.
You are also conflating the issue of sentencing with the issue of charging.
The charging/conviction part is actually relatively sane. You can be charged of things you cannot be simultaneously convicted of. You can be convicted of anything that is not a lesser included offense of something else.
IE you could be charged with manslaughter and murder of the same person, but not convicted of both, because manslaughter is a lesser included offense of murder.
As for the federal sentencing guidelines, they were created to standardize what was previously a complete crapshoot. Rightly or wrongly, they were at least based on real data.
They give guideline ranges based on an offense level and criminal history.
The offense level is determined based on the crime plus any enhancements. So yes, you may start out at offense level 23 for murder, and then add 4 more levels because you used an illegally acquire weapon to do it.
However, this is still the sentence for murder, not for the illegally acquired weapon (and note that if the illegally acquired weapon is used as a sentence enhancement, the facts must be proven to the jury)
He remained unrepentant, he said next time he'd go the harsher route, rather than detecting the flaw and reporting it they'd made sure to collate a lot of information from the leak and according to weev reported it before approaching Gawker.
I think the sentence is out of line with his crime, but he was never going to get a slap on the wrist and told to go his merry way. They've probably done their homework and found he's been up to merry hijinks with computers for longer than most people have known how to email.
Maybe slightly cynically of me I wonder if this his act of ultimate trolling, to force the courts to go for a harsh sentencing and to get a wave of sympathy that leads to people DDoSing .gov pages.
If a company accidentally puts a link on their homepage to private info (say, with a typo) and users click on the link and read the page contents, are the then violating the CFAA because they should have known that the company didn't intend for them to view that information?
If you get naked in front of a window visible from the street, you can't get mad that someone saw you.
That being said, this guy is obviously not a saint. I don't want to sound like I'm defending his affiliation with GNAA or the fact that he went to Gawker with it.
If it had been someone who gives to community, is polite, and respectful, and instead had gone to the NYT or another publication, they still could lose 3+ years of their life. To a mistake.
Imagine, though, what the costs of getting a startup off the ground would be like if we did face civil liability for bugs and security flaws.
[0]:http://www.washingtonpost.com/business/technology/man-convic...
If I told a client that I had 'secured' their website, but access was available by incrementing an integer, they could sue me and they would win.
What would have happened if they jailed Woz + Jobs back in the blue box days?
If people on hacker news are seriously this confused, it's no wonder there is no hope for a legitimate jury in CFAA cases.
Should I go ahead and tell the company? And possibly get sued anyway? Do I have a right to show it to my friends or journalists?
Or should I just shut up and pretend that I have never seen this security problem?
And really, who did Weev harm with this?