Hacker News Reader

Comment by sillysaurus2 | Hacker News Reader

Is this illegal? Could he somehow go to some authority?

EDIT: Why is it unlikely the FBI will successfully investigate?

Ask a simple question, get a simple answer: it is obviously and unambiguously illegal. You can certainly refer this to the FBI computer crimes folks and your local law enforcement. It is unlikely they will successfully investigate.

Yeah, I'll discuss this with Amazon when they get back to me, but I don't hold much hope for a positive outcome.

What specifically is illegal about that? Someone gave you credentials to an online service. Now you use those credentials. What law did you brake? You probably broke the ToS/EULA/whatever, but that by itself is not illegal.

(I'm not saying otherwise, I'm asking)

For the US, pretty much anything is covered under https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Just because you have the means to do something does not mean you have the permission. If I drop my car key on the ground and you take it, it's still stealing. I gave you the means (accidentally), not the permission. Especially when using the ill-gotten item will cost me (gas, time, money).

Reminds me of the old phrase: What's the difference between hacking and penetration testing? Permission.

Yes, I see that difference. I also know there are laws protecting computer systems and such. But was wondering if it could be applied to an online service.

statutory minimum is 5k. we work with federal law enforcement somewhat frequently at wepay to deter fraud, and it appears that the informal threshold to get their interest is about 100k of damages

Illegal? Yes. Convictable? Yes.

But will any law enforcement department or agency actually look into it? Highly unlikely. There's so much major scale white collar crime/cybercrime going on daily that it's generally too hard to dedicate resources to smaller cases like this.

Now, if they got evidence the perpetrator was doing this with dozens or hundreds of AWS accounts, that would be another story.

Possibly because it would cost the FBI orders of magnitude more than the damages to investigate.

The damages which amazon will likely refund.

The FBI does not target petty thieves.

Amusingly, I went to a meetup with some feds the other day.

Their statutory minimum to investigate is 5k, but they suggested it's worth getting in touch with them either way. If nothing else, it'll give them an excuse to say "cyber" a few more times.

This. I was defrauded to the tune of $3,500 (run of the mill stolen Paypal account bought a top of the line iMac from me on eBay) and after discovering to my horror that both eBay and Paypal sidestep all fraud for protection... I called the FBI, police, etc.

They listened politely until I said how much it was worth -- one of my favorite quotes was "If you added a zero to the end, we'd knock down their door at 6AM tomorrow. For $3,500 it's simply not worth our time."

The decimal point adds two zeros. ;)

He is still a criminal either way.

Dang, that sucks. So neither eBay OR Paypal helped? Did you send the macbook to the "Paypal verified address", because I thought that was one of the protection requirements?

Oh, they certainly do, if powerful enough people complain.

http://en.wikipedia.org/wiki/Aaron_Swartz

The question is whether the poster is such a person.

The FBI wasn't involved in Swartz's prosecution, which was considerably easier for the US Attorney by dint of them actually knowing who was behind the incursions.

I am not sure but FBI can only be involved on financial frauds over 1 million (I vaguely remember this and could be wrong)

Pretty sure you're wrong about that.

Reply on news.ycombinator.com