Hacker News Reader

Comment by zachrose | Hacker News Reader

Is the constitutional issue here that exploiting a security hole (SQL injection, remote execution to dump the $_SERVER variable, what have you) constitutes an illegal search?

If so, is their any guidance from case law about the difference between some sort of legal poking and prodding vs illegal hacking?

View on HN

I wonder if this could be considered a case of exigent circumstances? [0] The exigent circumstances exception can be invoked "to forestall the imminent escape of a suspect, or destruction of evidence". Arguably, that's what this was -- Silk Road had a security flaw that could be fixed at any moment, and the FBI may have felt they needed to act quickly to obtain evidence before the security flaw was fixed.

[0] https://en.wikipedia.org/wiki/Exigent_circumstance_in_United...

Well, they were also committing criminal activity in "plain view" so to speak.

In general in order to break the law you must have a warrant. For example, a cop entering private property without a warrant or probable cause is nothing more than a trespasser. These agents likely violated the CFAA by doing what they did. Because they didn't have a warrant, IMO it probably constitutes an illegal search, but the courts may well have a very different opinion. Regardless of which side loses this argument, this will likely find its way to the appellate courts and possibly the Supreme court, as it seems to be an unanswered question of great importance.

From the CFAA:

(f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States.

I'm not sure what "lawfully authorized" means there, but my current belief is that one form of it is permission from the Attorney General.

But I wonder if computer hacking (which this likely would fall under) can be "lawfully authorized" outside the confines of a search warrant. The Attorney General could order the FBI to break into the computers of a hedge fund suspected of insider trading, but that clearly wouldn't be lawful unless authorized via search warrant. This is very similar.

Well, I don't think they broke into the computer. But I guess my point was more that the CFAA doesn't have any answers, you have to figure out the scope of the authority possessed by the Department of Justice.

+1. I wasn't aware this clause existed in the CFAA.

If they're simply tweaking the request vars to access unauthorised information, how does this compare with Aaron Swartz's crime?

But if it's a server not in the US? Does it get the same legal protections?

In the past simply typing in random URLs has been deemed illegally circumventing a site's security. Like most things it's fine when the government does it but you'll get jailtime if you do it to one of their friends.

it can probably set a precedent that will free all scapegoat script kiddies currently in outsourced prisons.

Reply on news.ycombinator.com