Bradley Manning and "hacker madness" scare tactic
newscientist.com
newscientist.com
The prosecution claimed that using wget was an unauthorized access under the cfaa because, direct quote I wrote down, Manning was: "only allowed to view one document at a time using a web browser."
To emphasize how scary hackerish wget was, they said that someone: "could not see wget from five feet away. It is a command-line program...it can run in the background."
To talk about how Manning was clearly a hacker, they explained how he:
* "used wget to create functionality that did not exist";
* "had to program wget—wget did not have a GUI, therefore it was not as simple as double-clicking"
* "had to research how to program wget" (by which they meant forensic evidence that he had consulted the wget man page!!)
They also mentioned that there was forensic evidence he had searched google for "computer programming".
That's just wget. In addition, they claimed that writing a VBA macro in Excel to bulk download contact info from Outlook was also a CFAA violation, because Outlook didn't offer a mass export function, so writing a VBA macro (in another part of the Office suite!) was a CFAA violation.
Yeah, scary stuff. Manning was convicted of the CFAA charge by the judge.
But as a military soldier they could almost as easily have charged him with simply downloading information without authorization, wget or not.
Classification requirements have 3 elements:
1. A valid security clearance for the information to be obtained. 2. CO's permission. 3. Need to know.
They wouldn't even have to bother with wget at all thanks to 2. and 3., except perhaps to make it more clear that Manning failed 2 here.
They did charge him with various "mis-use of classified information" violations -- he pled guilty to most of them. The CFAA charge was an additional charge, carrying additional potential jail time, and it's one of the ones he was fighting in court (others he pled guilty to).
That's why they were 'bothering with wget', specifically to try and prove the CFAA charge (which he was convicted of) -- it was specifically about 'authorization' under the CFAA, not about COs permission under any rules or regulations related to classified information.
And regardless of what you think of Manning, it's the CFAA stuff that's scary for the rest of us computer programmers.
I mean, it is probably possible to convincingly make that case, but it seems a bit tricky.
"The government says that Bradley Manning used the automated downloading program Wget to retrieve hundreds of thousands of State Department cables from the Net-Centric Diplomacy database, and that use of Wget alone constitutes exceeding his authorized access to data, a violation of the Computer Fraud and Abuse Act."
...
"The Government has not introduced any evidence to suggest that PFC Manning was not permitted to view the cables in question. The Government has not introduced any evidence to suggest that PFC Manning was not permitted to download the cables in question. The Government simply asserts that PFC Manning was not permitted to download them using a certain program, Wget. (Sec. 6)
The Government is simply incorrect in asserting that the use of an unauthorized program to download information automatically converts what would otherwise be authorized access to that information into “exceeding authorized access.” Whether or not PFC Manning used Wget to download the information he had access to is irrelevant; under the language of Section 1030, as well as this Court’s ruling and all legal authorities, PFC Manning could not have exceeded his authorized access because he was authorized to obtain the information he obtained. That is, “exceeds authorized access” is not concerned with the manner in which information to which one has access is downloaded; it is rather concerned with whether the accused was authorized to obtain or alter the information that was obtained or altered. (Sec. 8)"
[1] http://www.bradleymanning.org/featured/incompetent-overprose...
EDIT: clarified
However in this case I think it would be more equivalent to charging Manning with using a handtruck to move paper files instead of carrying them one-by-one; i.e. a pretty lame excuse for a charge.
Seriously, it's a ridiculous distinction and I'm discouraged that a Court would allow it to stand.
Clearly he has never used Wget. It is dark and nefarious and riddled with confusing options that should have sensible default combinations. There's dozens of rules you must follow when using certain parameters, and no simple "turn on all the sane defaults for downloading a website" option. Example from the man page:
Note that Wget will behave as if -r had been specified, but only
that single page and its requisites will be downloaded. Links from
that page to external documents will not be followed. Actually, to
download a single page and all its requisites (even if they exist
on separate websites), and make sure the lot displays properly
locally, this author likes to use a few options in addition to -p:
wget -E -H -k -K -p http://<site>/<document>
And that doesn't even handle more than one page, recursion, 3rd-party-site recursion limits, timeouts, SSL, cookies, forms, user agents, etc. If it's a choice between using Wget and being waterboarded, i'm not so sure I would choose the former over the latter. --mirror
Turn on options suitable for mirroring. This option turns on recursion and time-stamping, sets infinite recursion depth and keeps FTP directory listings. It is
currently equivalent to -r -N -l inf --no-remove-listing.It started way back when the establishment managed to get society to equate "hacker" with "criminal". Many have argued that we should just accept that as a historical fact, but the propaganda was deliberate and the process that created the propaganda has only gathered strength since.
Witches and heretics, the lot of you.
The spells that witches cast are analogous to the code that hackers develop. They are both writing in esoteric languages that can create things and cause actions. Witches' power is magical, but hackers' power is virtual. Neal Stephenson uses the Sumerian word namshub to describe this idea in his novel Snow Crash.
Which is bonkers - the press routinely have to get handled by the military because they, through ignorance or not caring, will often aid the enemy with information.
From a UK example the BBC during the Falklands exasperated the military because it routinely broadcast information of assistance to the Argentines because they didn't know any better. It isn't the fault of the journalists, it's the fault of the military personnel telling them the information.
The article rightly points out Government's abuse of general ignorance of tech. At the same time it falls into the opposite trap of the "information should be free" brigade.
http://en.wikipedia.org/wiki/List_of_wars_involving_the_Unit...
Eastasia. We've always been at war with Eastasia.
O/T: when I typed "aiding the enemy" into G, the word it suggested next was "pokemon". LOL.
Like inductive reasoning, one example is all the law requires here, and for good reason.
For stuff that was actual whistleblowing of war crimes (i.e. the stuff actually beneficial to that nation of 300 million) there can be no charge of aiding the enemy. But for all the rest, there could have.
Luckily the judge threw in an extra element to the UCMJ (which was written for a pre-Internet age). But that still didn't help with most of the rest.
"I'm not allowed to say how many planes joined the raid, but I counted them all out, and I counted them all back" [1]
[1] - http://www.theguardian.com/commentisfree/2010/dec/20/brian-h...
Manning should've gotten a few years in prison at most, if that. It's quite obvious the government's hand is all over this case to scare future whistleblowers.
Anyway, is there any hope for Manning, now? Can the case still go to the Supreme Court, or is this over?
Without commenting on this particular case I want to note that it is not just the government that engages in this practice but that business and governments have a very rich history of creative redefinition of terms to stretch their meaning well past the breaking point.
Doubleplus ungood.
Manning's case will be appealed to Court of Appeals for the Armed Forces (there might be an Army-specific appeals court before that too, the Navy/Marines have something like that but I'm not sure if Army does).
After the CAAF it can be appealed to the U.S. Supreme Court, but other than that it's final.
As a former DoD employee, the hacker paranoia definitely scares me. I used scripts and wrote command line tools for analysis since the tools given were insufficient or just plain sucked. The arguments listed by jrochkind1 could have been applied to me. I certainly have never leaked any information but from the comments below it seems that programming and command line tools themselves are now considered crimes because they can be more powerful although the bulk of normal people are uninterested in using them. Should he be tried and convicted for what he did? Yes (IMO). Should he be tried and convicted because he was what most would consider a power user? No. That's like tacking on charges for a murderer for being too accurate. It deflates the validity of the governments claims, exposes the legal argument to some risk, and creates ridiculous precedent.
There is a scary amount of anti-tech stuff going on now, though I guess that should be expected. Thinking of pg's What People Can't Say essay here, since the computer illiterate are still in charge of most things, while simultaneously the computer literate are now ascendant. I expect it will get worse before it gets better.
So the court is not releasing public transcripts, but some people organized to crowdfund an independent court recorder.
So here's the prosecution's closing arguments; they are VERY long and repetitive (I was there watching in person, I haven't yet read the transcripts) but burried in here is where you're going to find the prosecution's own presentation of their argument.
MOST of the CFAA stuff is probably in the afternoon session, but there might have been a bit at the end of the morning too.
(AM) https://pressfreedomfoundation.org/sites/default/files/07-25...
(PM) https://pressfreedomfoundation.org/sites/default/files/07-25...
try searching for 'wget' in the PM one. i also recommend searching for "VBA", that part was bonkers too.
There are a variety of offenses under the Uniform Code of Military Justice that aren't crimes in the civilian world. Courts-martial tend to be nasty because of it.
Here's an example: Article 92 of the UCMJ - Failure to obey a lawful order [1]. This is a pretty broad Article, mostly because everyone is ordered to obey the UCMJ and other laws. So you get prosecuted for it in addition to your other crimes.
So, a person who gets arrested for DUI out in town is actually guilty of Article 92 in addition to Article 111 (Drunken or Reckless Driving).
To compound this, you also have Article 134, which specifies,
>>“Though not specifically mentioned in [the UCMJ], all disorders and neglects to the prejudice of good order and discipline in the armed forces, all conduct of a nature to bring discredit upon the armed forces, and crimes and offenses not capital, of which persons subject to this chapter may be guilty, shall be taken cognizance of by a general, special, or summary court-martial, according to the nature and degree of the offense, and shall be punished at the discretion of that court.”
So, this means that anything that can be proven to have a "detrimental effect on good order and discipline" is also punishable by court-martial. And that's a distinct crime from Article 92. So that guy who got a DUI? He's actually charged with three things - Article 111, Article 92, and Article 134. All for the same offense. And yes, he's punished for all three. Even nastier, there's no double jeopardy for 92 and 134 because they have no civilian versions. So, you can be tried under civilian court for DUI and lose your license and then lose your rank and pay under the UCMJ for the exact same crime with two different legal proceedings.
Now look at Bradley Manning's case, and you can pretty easily see that his actions could be punishable under these two Articles alone. And that's what they did. His guilt in these charges isn't even close to being in question.
Just? Personally, I think so, but I'm colored by my own views and experiences. Your opinion might differ. But it's most definitely legal and will beat appeal.
[1]http://usmilitary.about.com/od/punitivearticles/a/mcm92.htm
I'm not sure I agree with you that 'news articles' in general have been generally pro-Manning. In general, I think mainstream media has been pretty incompetent at covering this trial, generally ignoring it, and not doing a very good job of explaining it.
But, if there really are lots of passionate articles pro-Manning, but hardly any passionate anti-Manning articles... what do you think the explanation is?
It could also be that the government's case on the contested charges in particular really was bonkers. It's hard for someone to passionately defend it without seeming like a moron.
I do think it's notable that it's the government that decided not to make transcripts of this theoretically public trial available. The only reason you even have access to the prosecution's closing argument is because pro-Manning folks funded their own freelance court reporter.