Hacker News Reader

Comment by TylerE | Hacker News Reader

Consequences are a real bitch, aren't they? Sucks to be that guy, but maybe you should have thought about that before stealing and release people's personal data.

View on HN

What personal data did he "steal" and "release?"

My memory may be wrong, but I recall Auernheimer downloaded about ~115K email addresses from a non-password protected portion of AT&T's web site and provided them to Gawker. This may be misguided, and certainly the court system found him guilty. But it's not what most people view as "stealing" and "releasing" sensitive personal information.

Kathy Sierra's SSN and address.

This is the first I'm hearing of a connection with Sierra. Was he involved in the abuse that drove her away from blogging? (I guess I'll google that.)

I thought his prison sentence stemmed from visiting publicly available (simple GET) AT&T URL's that exposed their iPad users' email addresses. In which case, he probably did us all a favor in pointing out the sorry state of AT&T's [cough] security and management of customer data.

Yes, this is the same person. While it had nothing to do with his AT&T/ CFAA conviction, do not think for a moment that weev cares about your personal privacy. This is, after all, the person whose weapon of choice against individuals is... doxing. For the lulz. We're programmers here, right? So we of all people should be able to decouple the case from the person. This is the last person we should be calling a hacktivist, or... Hero. He didn't do this for us. He didn't do this for public good. Still doesn't mean he should be in prison, though. I hope he wins on appeal, for all our sakes (CFAA). He destroyed a good chunk of my life and took some innocent family members along for the ride. Please, fight the CFAA, but don't think for a heartbeat that when it comes to protecting our privacy, rights, etc. that THIS is the guy who "has our back."

Thanks for the response and clarification.

I agree with your point about separating the issues.

I also recall (with some vagueness, and with no reference to cite) that Auernheimer may have pondered/vacillated upon what to do with the data, before deciding to take it to a journalist. I don't know whether there is any truth in that.

I'm of torn opinion about Auernheimer. I've had acquaintances and a few friends who deliberately, um... "mess with" "the system", for functional reasons that may be less apparent to many than the "attention" that gets ascribed. OTOH, they tend to draw a pretty sharp (yes, if personally defined) line between the culpable and the innocent (for lack of better terms, and yes in a subjective sense) and to put effort into avoiding harming the latter.

Based upon both your reputation and what you've done for me as well as others (we've emailed briefly once or twice, long ago), I'm inclined to take your point with significance and regard.

At the same time, Auernheimer does seem almost like the perfect... "extreme" counterpoint to the CFAA and its like. On opposite sides, but equal in their obnoxiousness. Almost "made for each other".

I hope he prevails in this case. Putting your customer data at the end of a public URL is the crime, here. And... it fits with my longstanding and poor personal experience with AT&T (à la SBC).

P.S. Given your history, I really hope that my comment and reply are appropriate and not painful.

Best Regards

Thanks for posting this. It's a good perspective to have in these discussions, which can otherwise veer too far in the direction of legal nuance.

Declan, weev took proprietary information from one source and was not authorized to do so. He then gave that data to the "journalists" at Gawker.

How does this not qualify as stealing and releasing -- especially given Gawker's fiasco with the pre-release iPhone. Am I missing key points here?

Because it was published on the internet and available for anyone to see?

That's a very twisted definition of "published". If you forget to lock your house when you leave, does that make your living room a public space?

No because there is expectation of privacy in my home. Anything published on the internet is fair game.

That's exactly my point. It does not appear that the information was "published*, unless your definition of "published" includes "we meant to make this private, but screwed the pooch on security".

That's a bad analogy. It's more like you have a big window in your house. Is it a crime for people to look in? What about take pictures from the street?

If you accidentally upload something and it's accessible with a simple URL, is the burden on you to secure it or on the person accessing it?

I would say the burden is on you; that's just my opinion though.

Reply on news.ycombinator.com