Hacker News Reader

Comment by PhasmaFelis | Hacker News Reader

I kind of got the impression that Weev getting sent up for identity fraud was a lot like Al Capone getting it for tax evasion. Which is to say, he was a sadistic monster of a troll who delighted in ruining people's lives, but he was cunning enough to never quite cross the criminal-harassment line with anyone brave enough to press charges, so they got him on this instead.

It's a rotten precedent, and I can't really blame anyone for opposing it on principle, but let's do remember that Weev himself is not any kind of hero.

View on HN

It's what's called a trumped-up charge, or Kangaroo Court. This kind of thing happens to unsympathetic defendants like Weev first. Then later it can happen to anyone who gets in the way.

I blame anyone for not opposing it on principle. If you're ok with some trumped up bullshit because you don't like the person, fuck you (not aimed at your personally).

I'm okay with it. Weev is the type of guy I wish was behind bars. He's a stain with no redeeming qualities that I can tell. He takes a lot of joy in causing people pain, and many peoples lives are better with him behind bars. So I don't really care if it's for wire fraud or tax evasion.

Unpleasantness is not a crime. Which judging from your post is probably something you should be thankful for.

What weev did crossed many times into criminal territory. He harassed a lot of people in ways that made it either hard or unlikely to press charges.

Seriously, save the reaching argument for people who aren't complete scumbags.

So prosecute him for the shit that deserved prosecution and leave the CFAA out of it.

Well someday we'll get CFAA reform... but even then I'm convinced that weev in particular would still have run afoul of it in this case (though presumably a misdemeanor variant of it).

Security researchers in general wouldn't run afoul of even the current version IMO, though it's certainly prudent for security researches to re-emphasize how key some of those techniques are for them, so that we don't end up in a surreal situation where even altering a URL, cookie, etc. one time would subject one to conviction under CFAA.

What the current version means depends on how it works out in prosecutions. If weev is prosecuted, normal security research is endangered.

That's the whole point of the Mencken quote squeak posted. Another favourite: "Bad cases make bad laws" - if bad principles get enshrined in the precedents made by convictions of bad people, those bad principles will hurt good people or good activity down the line. That's precisely why the EFF, Schneier, Felten, et al., are devoting their precious time to this case.

I think that people who employ your kind of cowboy-film morality on suspension of rights for those they dislike to be complete scumbags.

I'd still want you to have a fair hearing if you ended up in the shit however, as I hold the quaint notion that the criminal justice system should at least attempt to be more than a popularity contest if it wants to retain any kind of legitimacy.

I owe someone else on HN for introducing me to this quote:

"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all." —H. L. Mencken

Prison as punishment to force behavioral changes is really messed up, even if Weev is a scumbag.

What exactly did he do to other people?

If a person is a criminal in general I don't really care if hasn't done the one particular crime he is nailed for if he is clearly guilty of others, but just being an ass should not be criminal.

Also don't forget that Weev was considering selling the info he got, before he decided to be lazy and just tell the world. So not only is he a massive troll, but his motives for the "hack" were also less than saintly.

glad i haven't been jailed for things i've considered. i'd be down for murdering a lot of commentators on hn...

<devil's advocate>If you "consider" stealing thousands of credit card numbers, break into a business and collect all the required data, then get lazy before you get around to incurring fraudulent charges and just boast about it instead, perhaps you _do_ deserve jail time</devil's advocate>

weev fucked up - and he _knew_ he was "fucking up" when he went from "finding a vulnerability" to "automatically exploiting that vulnerability to collect as much data as he could". Felten, Blaze, Schneier, Kaminsky - they would all have tried incrementing the get parameter - when it worked they would all have tried a bunch more times to confirm their assumptions, none of them would expect to get away with subsequent wholesale download of AT&T's customer data. Neither should weev.

IIRC, all he would have been selling is email addresses that are known to belong to iPad owners with AT&T as a provider. I don't recall that he had any credit card info.

Yeah sure. That's what the devil's advocate tags were about. I was arguing reductio-ad-absurdum - for some crimes, half carried through preparations should be punishable even if the intended "end crime" never got carried out.

I'm not suggesting weev was after credit cards or intending to commit fraud. But I stand by me second para - that Kaminsky or Blaze wouldn't have downloaded the entire database after confirming the vulnerability works - and weev should have known he was "doing something wrong" when he chose to. I agree that AT&T (and the prosecutors here) are _seriously_ overreacting, but weev was a fool if he didn't expect _any_ adverse reaction.

The mother that drove her daughters' friend/rival to suicide via fake MySpace profiles should have known that what she was doing was wrong, but a conviction for her on the grounds that using a fake name violated MySpace's Terms of Service, and is therefore 'hacking' under the CFAA is just bad law. Making bad law to punish someone that was doing something 'bad' is a net-loss to society, not a net-win

Agreed.

This stinks to me of AT&T and their legal team trying to make them look like "the victim" - where in truth their subscribers are he aggrieved parties here and AT&T are as much in the wrong from he subscribers point of view as weev is.

Regardless, it seems that they're railroading a guilty person.

Is that supposed to make it OK?

If the man is actually guilty of a crime, convict him of that crime. If not, don't.

What you're saying is that we should convict innocent people of crimes they haven't committed because we don't like them. Do you not see the problem with that?

That's what the term "railroaded" means in this context: that a person is not being subject to due process.

You can, in fact, forget that. We should judge people to be criminals or not based on their actions, not their daydreams.

Also, how is it lazy to create a media shitstorm and get your house raided versus making some free money quickly and quietly? Are you really trying to frame his turning down free money as the MORE disdainful choice?!

It is in fact illegal to "daydream" (i.e. make solid plans) about doing certain crimes: https://en.wikipedia.org/wiki/Conspiracy_(crime)

To try and define the term "daydream" as being equivalent to "make solid plans" so that you can equate daydreaming with criminal conspiracy is some of the most tortuous logic I have seen in a while. Have you ever thought of a job as a government press secretary? You'd fit right in.

Trying to define "talking to your friends about how you're going to sell stolen information" as being equivalent to "daydream" is the tortuous logic I was responding to. Please read the entire thread and not just comments you don't agree with.

I did read the whole thread and I just read the published transcripts.

He does not say that he is going to sell stolen information.

He does remark on irc that the information is valuable and could be sold or used for a phishing operation, but that is an observation of reality, and can not be taken as a statement of intent without some other evidence showing that he was likely to pursue that course of action, and given that he then handed the list to gawker it would seem that this was not his intent, though the possibility had obviously crossed his mind.

To consider the possibility of indulging in criminal behaviour is not the same as planning to do so.

Typically Conspiracy requires more than just "dreaming". It requires an overt or concrete action being taken in the implementation of that daydream.

If that were the case then any number of "spy thriller" type authors would be potentially guilty of conspiracy for publishing their "daydreams".

You're conflating motivations with thoughtcrime.

We don't criminalize daydreams. And I'm not suggesting that we should.

However, we do take motivation into account with a great many crimes. For example, if you kill someone, your intentions, and how long you've had them, affect whether you get charged with manslaughter or murders 1 through 3.

That doesn't tell us the motives for the hack, just that he is possibly being honest about what ran through his head after finding something valuable.

> he was a sadistic monster of a troll who delighted in ruining people's lives

Could you elaborate?

https://en.wikipedia.org/wiki/Weev#Trolling makes it quite clear.

Sure. First, go read this: http://www.gossamer-threads.com/lists/fulldisc/full-disclosu...

djfooroach/Memphis Two is Weev, as per page five of this New York Times article. http://www.nytimes.com/2008/08/03/magazine/03trolls-t.html An excerpt:

Over a candlelit dinner of tuna sashimi, Weev asked if I would attribute his comments to Memphis Two, the handle he used to troll Kathy Sierra, a blogger. Inspired by her touchy response to online commenters, Weev said he “dropped docs” on Sierra, posting a fabricated narrative of her career alongside her real Social Security number and address. This was part of a larger trolling campaign against Sierra, one that culminated in death threats. Weev says he has access to hundreds of thousands of Social Security numbers. About a month later, he sent me mine.

In 2007, Kathy Sierra was the target of an avalanche of death and rape threats that drove her out of tech and public life entirely. http://en.wikipedia.org/wiki/Kathy_Sierra#Harassment Nobody seems to be quite certain why, except that it may have had to do with a blog post defending people's right to delete comments from their own blogs. Sierra said, "I have cancelled all speaking engagements. I am afraid to leave my yard, I will never feel the same. I will never be the same." Weev claims credit for this. He's proud of it.

There's plenty more out there, if you care to trace through Weev's many aliases. He was never shy about how much he loved brutalizing people. “I hack, I ruin, I make piles of money,” he boasted. “I make people afraid for their lives.” --The New York Times again.

Anything else you need to know?

Okay that does it, he needs to be locked up. What an utter little shit.

Reply on news.ycombinator.com