Hacker News Reader

Comment by rbobby | Hacker News Reader

Bank robber calling the cops to report the safe has already been cleaned out...

It's a safe cracker calling the cops in this scenario. "I wanted to see what banks I could break into" is a much more reasonable defense in this situation seeing as he's alerting others to the intrusions when he clearly could have just kept quiet and stayed out of trouble.

Not that it says anything about whether he'll be in legal trouble. Laws are crazy.

You poke into someone's house when you see their front door wide open, see it has been cleaned up and then notify the cops...

That would imply OP had malicious intentions, which he apparently did not.

Malice is in the eye of the beholder. He logged into a server he didn't own and ran commands without authorization. That is malicious from the perspective of the law.

Out of curiosity, wouldn't this also apply to the security researcher at erratasec.com that did an earlier survey? That scan logged into peoples boxes and executed a ping going out. Now obviously there isn't any damage, but what legal theory is protecting these legit security researchers?

Nothing is protecting them legally, and many people mentioned similar things on those threads. However the fact that this guy sent himself reverse shells and actively exploited the servers makes it much more likely that someone will try to prosecute him.

Really this a question that can only be answered by a judge.

The CFAA in the US might apply, section a.2.c bit is pretty broad: information from any protected computer). The wikipedia article is full of interesting bits and bobs: http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Though whether or not a DA would be bothered with investigating and building a case is a different story (probably not, unless there were lots of complaints and/or "serious" complaints).

I strongly doubt anyone, even at the FBI, is tasked with finding hackers independent of any complaints.

The lack of anybody attempting to prosecute them.

Only good to a certain extent, and since hackers are often easy targets and successful computer prosecutions are a good feather in the cap of prosecutors ever more concerned about having something on their resumes related to the "cybersecurity" buzzword, they'll frequently get harsh sentences.

Weev got 3.5 years and also did nothing malicious with the data he found: http://www.wired.com/2013/03/att-hacker-gets-3-years/

If you walk into my house through the backdoor you're trespassing. Your intentions are irrelevant.

Intention is relevant. What if I was mentally ill and mistaken your backdoor for my own? Or it was was the only feasible escape route from a murderer that was in pursuit of me? Of course this doesn't apply directly to the OP, because this house analogy doesn't hold water. BUT, intent is very relevant when it comes to law.

Well, no, intention is not relevant in the sense that these people are still trespassing. Ok though, you have a point; in some extremely rare circumstances it may make a difference. Of course, as you said, none of these apply here, so what's your point?

Reply on news.ycombinator.com