Ok so wait, in response to getting scammed you hacked into this guys accounts to gather information? And then admit to it publicly? And then dox the guy? Unprofessional doesn't even begin...
If you want to base your moral code on laws made by old white guys, go for it. I'm going to live my life based on what I believe to be just. That's really how change comes about, challenging legal authority. Think about the historical figures you respect - rosa parks, mlk, snowden (maybe?). The world would be a worst place if they didn't break the law. To me that is contributing to the good of the world.
Exactly this is the problem. There is nothing fundamentally wrong with frontier justice, the only problem is that people don't act rationally in general. What if it is not some lost money but if someone got badly hurt, raped or killed? Can you hold back your emotions? Make sure that you are not targeting the wrong person? And even in the case of this story, what if those two guys are themselves just victims of the real scammer hiding behind their identities? You just publicly stigmatized two innocent people as scammers.
I get what you're saying, but I still do not agree that I should never disobey the law when I feel it is morally justified.
Yes, that's why in the non-internet world, when someone breaks into my house, I now have the right to commit identity fraud, make false statements, and commit arson of their neighbor's property.
Unprofessional? - if "professional" means keeping quiet, reporting it authorities (who don't care and can't do anything about it) and riding quietly into the sunset call me unprofessional any day.
[1] http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
If this was an article about the US Government convicting or charging people for "hacking" we'd most likely see numerous comments and complaints here about the improper use of the word.
I would never under any circumstances ever share personal information with a company that behaved as you have documented.
You believe this guy has scammed you so you went through his personal artifacts and shared communications to get vigilante justice. Fair enough as a person I dont blame you and find it funny, as a business you just cannot be trusted with personal information.
In the grand scheme of things, all you really illustrated is that for 25K empireflippers is willing to 'hack' someone who as you say yourself hasnt been established guilty beyond a reasonable doubt, but who you have 'good enough' info on.
'Professional' means operating by a business driven code of behavior. You let this issue become 'Personal', and as such took steps to get 'revenge'. You literally committed crimes during the course of getting revenge, and you 'transparently' confessed to these crimes in writing on a public forum that is tied to your 'professional' endeavor. You should have consulted a lawyer both before you took these steps, and before you confessed to taking this steps.
I will say that we did consult our lawyer before writing this post, actually.
Additionally - business is done on trust. Some will read this and (like you) not trust us and won't do business with us. Others will appreciate it and do business with us. No worries either way.
In reading it back, I wouldn't say he was enthusiastically pushing it or anything:
"I think you guys have your minds made up. The reality is the risk is probably low. Truth is an absolute defense to defamation. It's unlikely a couple Russians would try to sue you, but you never know. My boring attorney answer is try not to go too far to minimize any risk. Stick to the verifiable facts."
Considering it's international in nature, did they have any other option or recourse?
Someone else mentioned we should go after them in Russia but, even if we won, I doubt it would be worth the hassle or distraction.
Not really hacking when they gave you the passwords already. That's like me accusing you of breaking into my house after I gave you a key to the lock.
>>>> And then admit to it publicly?
I agree this probably isn't the best thing, but considering the targets are in eastern Europe, and they are criminals, I doubt they're going to press charges.
>>>> And then dox the guy?
This is their own fault for having poor opsec. The fact he got busted and now his information is public is not the responsibility of those he scammed. IF they didn't want their shit exposed and on the internet, they should have done a better job of covering their tracks.
If you lend me keys to your house for a specific purpose, am I also legally entitled to rifle through your drawers until I've found your car keys and then have a drive around in that? They used the word "password hacking" in the email, and using a password somebody has stupidly shared with you for a specific purpose to also access their email accounts and eBay, Namecheap is undisputably hacking of the illegal variety, even if the targets in this instance are particularly obnoxious criminals themselves as well as incredibly slack when it comes to security.
I can understand why someone might feel entitled to abuse the password they'd been given in order to see whether it helps them to recover their property, but to then boast about the felony they've committed on a corporate blog?
You must have missed the part in my original post where I said bragging about it probably isn't the best thing they did. It also means as a hacker, if you fuck with someone's business, be advised, you might end up getting the horns.
I think to a degree, it helps put people on notice these guys don't take this stuff lying down and if you commit fraud on their watch, they're not just going to write it off. It probably also helps potential clients feel safer, knowing they don't just write off their losses, they actually do something about it - regardless of how the general public interpret it.
Also, by your standards, then do you believe what Andrew "weev" Auernheimer did was illegal as well?
Just curious. . .
I haven't payed particularly close attention to weev's trial but IIRC, the main points in his defence were that the "hacked" data was actually accessible via the public internet with no real subterfuge or misuse of private information required, and they'd tried to disclose it through appropriate channels. Neither seem to apply here, even if Russian hackers don't particularly deserve the Feds rushing to their aid.