Hacker News Reader

Comment by sneak | Hacker News Reader

Possessing email addresses should not be a crime.

Identity fraud for a list of emails? Really?

It's insane even if you assume they were pristine and never received any spam before weev came along and "stole" them. Furthermore, the list was never sold, distributed, or published.

An excerpt was sent to the media.

They kicked around the idea of spearphishing, of spamming, of pastebinning it, of selling it. In full knowledge of the value and leverage that this data allowed, they contacted the media and deleted their own copies. It profited them nothing.

The idea that this is akin to trespassing is simultaneously both obtuse and dangerous. There were _no_ access controls; ATT themselves said in court that the information was published (by them) on the web.

View on HN

> Possessing email addresses should not be a crime.

Collecting lists of e-mail addresses from private databases without authorization should be.

> Identity fraud for a list of emails? Really?

Weev said in IRC conversations that he was going to sell the e-mail lists. Maybe you don't believe him, but it's hard to argue that no reasonable person could have believed that he was going to do what he said he might do.

> Furthermore, the list was never sold, distributed, or published.

If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.

> There were _no_ access controls;

I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.

Society charges you with being a normal functioning human being and respecting obvious boundaries. Obviously this is too high of a bar for people like Weev.

> Collecting lists of e-mail addresses from private databases without authorization should be.

Unauthorized I can see, but "private"? What was "private" about this database he accessed? It was a public API on a public server with no authentication required.

> Weev said in IRC conversations that he was going to sell the e-mail lists.

Yes, but he didn't. Is he being prosecuted for doing something he said he would do, but did not do? That seems dangerous.

> If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.

This is death by bad analogy. He wasn't breaking into a house, no safe-cracking tools were required (nor, probably, on his person).

Why not argue to the actual point? The list was not sold, distributed, or published -- why is it necessary to fall back to analogy there?

> I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.

Death by bad analogy, again. Surely you don't think that downloading publicly available data is analogous to B&E? And if the email addresses are so precious as to warrant a 41-month prison sentence merely for accessing them, shouldn't the idiots at AT&T be held at least partially responsible for making the data publicly accessible?

> Obviously this is too high of a bar for people like Weev.

Ah: guilty people are lesser people?

I'm not even sure what Weev's crime was here, in layman's terms. Was it accessing the public API in the first place? Was it sending the list of email addresses to Gawker? Was it talking about doing nefarious things with the list of email addresses? Was it not contacting AT&T first?

If I had to describe this case to someone who knew nothing of computer systems and explain why the 41-month prison sentence was justified, how would I do that?

Is there not some level of basic accountability? I mean, shouldn't AT&T face penalties for hosting consumer data in such an egregiously unsafe fashion?

While I think the responsible disclosure could've happened in a better way, I don't think this is akin to walking into an unlocked house. This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.

What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time. It just doesn't sit well with me and I don't think the boundaries are obvious.

I'm not a hacker if I increment a URL by 1. I wouldn't even call you a hacker if you used DNS reflection attacks. To identify cheap parlor tricks as hacking is offensive to the professional breakers and ludicrous in the larger scheme of things.

> Is there not some level of basic accountability? I mean, shouldn't AT&T face penalties for hosting consumer data in such an egregiously unsafe fashion?

That's a separate issue.

> This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.

The protection was the fact that the information therein was obviously sensitive and not intended for public disclosure. In a civilized society, that's all that should be necessary.

> What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time

He's not being sent to jail for "exposing this lack of attention." He's being sent to jail for exploiting this lack of attention tens of thousands of times more than was necessary to prove his point and for talking smack on IRC that led people to believe that he might sell those e-mail addresses for profit.

It's a public issue, so any client who thinks AT&T sucks can go to one of the other providers. What you want, put people that write bad code to jail? You'd need pretty roomy jails then. May as well jail everybody who ever wrote any code at all - some of it most probably is bad.

I was about to post a similar comment to yours until I clicked through to the linked AMA below and saw some of his GNAA history.

Given that history, it's really easy to claim that he was intending to do harm with that list of emails, and it's also pretty easy to think of ways for him to do harm. Idendity fraud might be a bit of a reach, but computer abuse with malevolent intent? Not too hard to get there from his public statements.

Those emails we're exposed to the public. Weev's security company exposed "gaping holes". AT&T are at fault for exposing their customers information in the first place.

Anybody COULD have done harm with those emails. He didn't. He used them as a fodder for public discussion about internet security.

AT&T should owe him a "thank you".

AT&T customers owe AT&T a boycott for being irresponsible with their information.

Finding a security hole is not a get-out-of-jail-free card.

I think the question of AT&T having responsibility for inadequate controls is very interesting. I would like to see AT&T face some repercussions for it. Not _instead of_ weev receiving punishment, but _in addition to_.

Punishment for what?

Edited to add paragraph beginning "They kicked..." to clarify.

They could have been really bad guys. That didn't happen.

It's actually quite simple, but requires a lot of question asking to figure out.

Hackers move easily between different levels of abstraction and believe that things in general can and should be understood. They try to never stop asking 'why?' and this leads them to find places where the system is incongruent. Many of these realizations are benign or even progress the system, and the advantage gained just helps the hacker succeed within it (eg. pg's main use of the word hacker). But some realizations contradict a foundation of the system (like insecurities of its central nervous system!).

The system is built on abstractions, takes them for granted, and reacts extremely harshly when they are broken (for this is an existential threat). The system can only understand a broken abstraction in terms of the abstraction itself, rather than in terms of underlying reality. Hence we end up with phony blame-shifting terms like "identity theft" instead of reality-based "fraud". Meanwhile, hackers see the failure of the abstraction in terms of the underlying reality and have a hard time seeing what the big deal is - just reprogram the abstraction!

Most people's thoughts are contained mostly within the system, having been indoctrinated into it from birth (constant rote memorization in primary school, blind repetition of contradictory facts, scolded by adults with tenuous justifications every time they don't follow the pack, etc). So they take what they're told at face value and follow along, all the while never seeing the whole picture and hence remaining afraid of mysterious agents that can take advantage of them for what they don't understand. If they're told that a collection of email addresses is a threat to their way of life, they'll actually believe this because they lack the broad framework to analyze the truth of this statement. They'll instead trust the system and assume it's correct, feeling that if it were indeed wrong they would no longer be able to take anything for granted.

You're inventing a religion in which your people are the only holy people, and everybody else is just an infidel.

Anybody can ask 'why?', it just takes constant effort.

I theorize that all religions begin with understandings of fundamental truths that are summarized to pass along. They then ossify into mechanical words and take on an oppressive life of their own :/.

Reply on news.ycombinator.com