Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

This article makes an important point about the brokenness of CFAA sentencing, but it (or Wired's editors) do the point a disservice by making an absolutely hyperbolic claim.

The "War On Drugs" has imprisoned literally millions of people, and done so in a fashion that is both racist (minorities are far more likely to be imprisoned for a drug offense) and classist (wealthy defendants are unlikely to be imprisoned for casual offenses). Furthermore, persecution of drug users targets actions people take that cause debatable harm to society.

If[f] Keys, who is accused of deliberately enabling Anonymous to vandalize the front page of the front page of one of the largest newspapers in the world, is shown to have done the things spelled out in the warrant, then prosecutors will have shown that he:

* knowingly damaged the computer systems of Tribune Corporation

* actually caused 5 figures worth of damage

* did so by abusing a trusted position at Reuters

Keys, who as we can see has exceptional attorneys working on his case, is far more culpable for his actions than a large fraction of drug offenders.

It is indeed a very serious flaw in the CFAA that sentences can "scale with the iterator in your for loop" as your actions cause seemingly spectacular amounts of damage despite no change in your actual criminal intent.

But it's worth pointing out here that that flaw plays a minimal part in Keys potential sentencing. The base level for CFAA crimes (like most larceny and fraud charges) is 6, which merits a 0-6 month sentence. The damage "accelerator" in Keys charges adds 4 points to that level, bringing him to level 10, which is a 6-12 month sentence where conditional probation is allowed. The damage accelerators aren't what's ramping up Keys' sentence --- it's the combination of damage (at any level), cost to remediate, and abuse of his position of authority.

Here's Popehat with a fantastic post on how the sentencing guidelines actually work (I don't think they disagree with Keys' lawyer, except that Popehat goes into more detail later in the article on how sentences are reduced in practice) ---

http://www.popehat.com/2013/02/05/crime-whale-sushi-sentence...

The article goes off the rails with this sentence: "As a country and a criminal justice system, we’ve been down this road of excessive punishment before: with drugs."

There's no particularly strong connection between computer crimes and drug crimes. As you point out, the comparison is hyperbole, and ignores the deep racial, cultural, and class conflicts at the heart of the drug war. None of those things are really applicable to computer crimes.

Rather, the time Keys is facing is simply a symptom of the broader malaise of the justice system: felony enhancements are too quick to trigger, sentences are too long and the sentencing guidelines offer false precision while reducing necessary judicial discretion.

The article's comparison to California's vandalism law highlights the issue described above: "Under California law, physical vandalism – like spray painting graffiti on a building — can be punished as either a misdemeanor or a felony..." That part is true of the CFAA as well, which is also a misdemeanor unless committed in furtherance of another crime. And the trigger for felony vandalism in California isn't high--above $400 in property damage makes a felony charge available to the prosecutor, as well as a sentence of up to three years in prison. In other words, I don't think it's fair to say that Keys faces more time for his computer crime than if he had physically vandalized a building to the tune of five figures of damage.

Drug crimes are just in a whole different league. Possession with intent to distribute less than 100 grams of heroin can carry a sentence of up to 20 years, or up to 30 years on a second offense. Meanwhile, prison time for computer crimes is still relatively light, unless they are effectively some sort of fraud or theft: http://en.wikipedia.org/wiki/List_of_computer_criminals. Something like this is much more typical: http://www.washingtonpost.com/local/crime/aspiring-medical-s... (three months prison + 7 months of halfway house out of 10 months sought by the prosecution for hacking into AAMC computers with intent to cheat on the MCAT exam).

I've been idly working on an essay for... I don't know, 5 years now? about how computers and the Internet catalyze harm, by shielding people who cause harm from the impact of their action, and by making harmful actions practically indistinguishable from benign ones --- "click this button and 'like' someone on Facebook, click this other button and help DDoS someone whose politics you disagree with".

I have some sympathy for defendants who are blindsided by the impact of simple, trivial-seeming actions; things that just see like pranks or political statements. But I'm also very familiar with the real damage these actions cause. I see the gap. I don't know how to resolve it. And I think it occurs all over the place, not just in computer intrusions but in things like mass file sharing, online trolling, defamation, revenge porn and sexting.

I don't have the right words yet for it, as you can see; I'll probably still be mulling it 5 years from now.

Anyways: the fix I'd want to see for the CFAA is the one that applies approximately the same consequence to pulling 10 accounts from an AT&T endpoint as it does for 100,000, and so keeps Auernheimer from facing a long custodial sentence for abusing an AT&T web service simply because he ran his script too long. From the way these things are prosecuted, constraining sentences also (a) makes it safer to push back on potentially unjust charges --- since you're most likely looking at probation anyways, and (b) might keep them out of court to begin with.

I don't know what you do about the guy who fed his admin credentials to Anonymous to help them deface a newspaper. That seems overtly criminal no matter what rules we come up with.

Would this truly fit "real damage" in your opinion? Based on the outcome I'd project it doesn't - but the real question is do you feel the potential punishment is representative of the crime?

I'm guessing the actual monetary value assessed was some consultative analysis paid out to investigate the "breach", beyond that I find it hard to believe the actual cost to fix was more than three figures.

Of course it does. And if they paid forensic analysts to track down the breach, they got the deal of a lifetime; we don't do that kind of work, but of course work with other firms that do, and $15k is below table stakes for that kind of work. A high-profile forensics investigation can clear 50k easy.

And again, while cost accelerators on sentences are disquieting and a serious problem, they're not the fulcrum for Keys' outcome; it's the combination of cost, overtly damaging acts, and abuse of authority that combine to put Keys in Zone C. Put differently: had Keys not been a Reuters employee, he'd be eligible for probation. (He could still be, depending on what the prosecution does and doesn't manage to prove. Unlike drug defendants, Keys has excellent representation.)

Sideways-related question.

What if Tribune had a sister company in some other country (Australia) that did something completely unrelated. Sell children's toys or something.

An admin for the sister company gives up his credentials in order for Anonymous to deface the children's site. They instead use it to deface the Chicago Tribune.

The admin has no earthly clue that the systems are inter-related. In fact, they've been told that the systems are independent by design; anonymous found a very clever flaw.

Is he as guilty as your hypothetical Tribune admin who gave up his password to deface the Tribune?

As I understand it, he's guilty, but potentially not as guilty.

He's an accomplice if he understood the goals of Anonymous, gave them credentials to further their acts, but didn't map out with them exactly what they were going to do --- accomplice liability is for all intents in purposes liability.

On the other hand, if he casually gave them credentials because what the fuck who cares, and had no understanding that Anonymous might deface a website, he have lesser liability, or might not be liable for the defacement of the website while remaining liable for a reduced or lesser number of CFAA charges.

Got it. So it's sort of like the difference between "willingly and knowingly" giving away the credentials and "willingly" giving away the credentials.

The intent matters.

Just wait until someone tells a robot to go out and gather carbon compounds.

Yes, that also sounds scary.

Like this: http://wiki.lesswrong.com/wiki/Paperclip_maximizer?

Its not in a human beings best interests to create something capable of undergoing an intelligence explosion. Of course, that won't prevent somebody from doing it.

Its better to control the technology you're using. Most robots will be either remotely controlled or designed to handle a specific domain. To create a potential competitor with an ever-evolving ability to compete is very dangerous.

But even drones will be very dangerous even when tightly controlled by someone malicious.

I'd say we have some interesting challenges ahead of us.

"I don't have the right words yet for it, as you can see; I'll probably still be mulling it 5 years from now."

I call it the Turing Chaos; intrinsic to computer science is that a single bit flip can completely and utterly change how a system works... and this is not a trivial observation, it is actually a deep and profound observation about the difference between the "cyber"world and the physical world that has pervasive and radical consequences at every level from the entirely ivory-tower theoretic out to how Grandma uses her computer (as you mention). Usually I've thought of this in the context of programming in general and trying to contain bugs against the overwhelming forces of chaos pressing in on us as we try to build systems of millions, billions, or trillions of bits; as programmers, we are exposed to some fairly raw mathematical chaos, in the "chaos theory" sense of the term, and in particular, the difficulty of fully predicting what a chaotic system will do in response to some stimulus. A great deal of software engineering is a desperate attempt to wall it away from ourselves and confine our intrinsically wild and wooly systems to just the behaviors that fit in our heads... but alas, we fight against a crafty foe that can find even one bit's worth of weakness and bring millions of dollars worth of systems down around our heads.

And that's before we consider human attackers.

One bit flipped can be the difference between an attacker walking off with the entire contents of your billing database, or getting a simple rejected request. One click can start a cascade of trillions of instructions terminating in your amazing computer becoming a spam delivery device that belongs to a guy 15,000 miles away. Every computer program stands balanced precisely on a small, small knife edge, with an n-dimensional abyss waiting on all sides to consume it, and hostile, intelligent forces anxious to give it a small, carefully calculated tip into their bit of it.

That probably doesn't work for the essay you're looking to write; my metaphor comes more from the software engineering side. But I think it's the same thing; the computer world is the math world, and it is a harsh, subtle, uncompromising place compared to the physical world, no matter how complicated the latter can be.

Great comment! I wonder if the younger generation doesn't appreciate this because they have grown up with computers all around? I've been writing software for nearly ~15 years now and computers still amaze me. Like you say how we try to fight against the overwhelming forces of chaos pressing in on us as we try to build systems, I am constantly amazed that the systems we build with increasing complexity work at all.

I don't see that as an internet thing, its about long distance control, or remote control. Its the same thing when people say its easy for politicians to send troops to war, or when a soldier controls a drone. They don't directly witness the outcome. The internet is just a more efficient, wider spread, easier to access example of it. Maybe also, its the same sort of thing as common folk committing minor insurance fraud. They don't see a victim.

Often wondered.... If a website were set up which had just one button one the page, and message saying the following: "After 10 million unique hits, a nuclear missile will be launched at a random capital city" Then lots of genuinely convincing stuff about it being about it being real, such that it was know to be for real. Also probably restrict it to adults, some how. (No, I don't quite know how, but this is a thought experiment after all.) How long would it take to hit the 10M? Would anyone really click?

Anyway, its clear to me that the more remote something is, the more people disassociate from it. The internet is just another example.

Web crawlers? People still figuring it's part of some game? Broken browsers? Nukerolling?

There is only one possible sane answer, and in this hypothetical it is quite pronounced - assume the Internet is full of malicious noise, and fully blame the person who hooked the missile up to a web page. Anything else is an exercise in responsibility laundering.

> assume the Internet is full of malicious noise

Spot on.

The noise doesn't even have to be composed of malicious people to be malicious itself; the potential bartier is very low here. In this case I can easily imagine one drunk /b/tard posting in on 4chan because "hey, it has nukes on it", and then someone else thinking "hey, it's on 4chan so it must be troll, lemme hook it up to my DDoS bot and see what happens".

Boom, gone a city of 30M, vanished in the flash of pure randomness.

> about how computers and the Internet catalyze harm, by shielding people who cause harm from the impact of their action

In general distance from a victim shields people from experiencing the impact of their actions. My late grandfather was an artillerist on the Soviet side in World War 2: he talked about how soldiers would vomit, fall ill, and cry after visibly killing enemy soldiers for the first time with short-range handheld arms (i.e., grenades, rifles, submachine guns, bayonets, or pistols). Yet, himself, when shelling remote positions with full understanding the shells -- in addition to killing much larger groups of enemy soldiers than bullets -- may have also killed civilians (which for most of the war generally meant Soviet or other allied civilians).

This isn't about moral rationalization -- obviously resisting Nazis and winning World War II was a good thing -- but emotional reaction. To get back on topic, what I think happens here isn't someone thinking that somehow committing one crime electronically vs. physically is less severe; it's that one's disgust with what they're doing is less, which makes a various rationalizations (whether correct or incorrect) for one's actions easier to accept.

> I don't know what you do about the guy who fed his admin credentials to Anonymous to help them deface a newspaper.

I am trying to draw a comparison here with someone either letting an unauthorized person enter the printing rooms of a newspaper (and as a result something other than a newspaper was printed and delivered). Yet that isn't quite right: someone with physical access to printing room of a newspaper could have done even greater damage.

Another comparison could be with a newspaper boy agreeing to deliver a sarcastic parody of a paper in place of the actual paper. Yet that too isn't quite right, as it's far easier for the newspaper to recover promptly, and the damage is localized.

All of those things are hard to answer.

You're certainly right about the hyperbole of the title, but I think that the point of the article is to identify these kinds of oppressive judicial and law enforcement patterns while they are in their germination stages, before they begin affecting millions of people and severely threatening civil liberties.

In that sense, it seems like a good idea to be on the lookout for the next incarnation of the war on drugs/war on terror/red scare/etc. so we can do something about it before it gains momentum. Hyperbole may not be the best tactic to accomplish this, but I suppose it beats being ignored by everyone when you have an important point to make.

Yeah I would say once the "War on Hackers" begins to ruin people's lives on the order of 100,000s of people, now we're actually getting CLOSER to being similar to the War on Drugs.

But suggesting otherwise is analogous to stepping on an ant colony and calling that genocide.

Well, the point of the article is that prosecutors who prosecute 'hackers' are 'learning' from the drug war prosecutors and a culture of overpunishment is spreading. In that sense it is a 'new' war on drugs, but I wouldn't call it "the" new war on drugs; the only real problem with the article is the title.

The article does not make a good case for overpunishment for Keys.

point taken.

Reply on news.ycombinator.com