Hacker News Reader

Comment by jessaustin | Hacker News Reader

Dude should have used a password manager. Or maybe just a new password.

Also, the Cards staff probably shouldn't have logged in from home.

Also, how on Earth is this a valid use of the FBI's resources? Fix your broken crap yourselves, Astros.

One multi-million dollar business franchise gained illegal access to the computer network and private data of another multi-million dollar business franchise. Sounds right up the FBI's alley to me.

I'm not sure where the legal line gets drawn. There was no hacking. There was an attempt to use a password that worked.

Right now, "unauthorized access" is any after-the-fact declaration that someone didn't want someone else looking at something.

If there had been broken encryption, 0-day exploits, SQL injection attacks, etc... THAT is hacking. Not accessing a public endpoint that lets you in.

This kind of hair-splitting is why the legal definition of "exceeding authorized access" is so general.

There seems to be a very popular misconception that the law criminalizes "hacking", as in "0-day exploits" and "SQL injection". No: thankfully, the law doesn't so much care about how you get access. It cares that you knowingly access things without permission, no matter how you do it.

Accessing a public endpoint has been prosecuted before. http://arstechnica.com/tech-policy/2013/03/auernheimer-aka-w...

True. And many, many people had trouble with that decision - many of them members of HN. Just because it's been prosecuted doesn't make the outcome any less right or wrong.

Of course - I think it was probably wrong too, though this isn't realy the place. But OP was talking about the legal line.

"any after-the-fact declaration that someone didn't want someone else looking at something."

I think putting password protection on something isn't "after-the-fact", it's pretty obvious they didn't want someone else looking.

So by your lights I could make a copy of a key on your key ring, enter your house, take stuff, and that is fine because your locked door is a public endpoint?

Or if the fact that the key is physical gives you pause, let's say you nave a numeric keypad lock, and at work one day you commented that you had it set to the same setting as the lock at work to make it easy for you to remember. Do I get to take your stuff?

It's funny, these arguments weren't top of mind with regards to the hacking charges against weev or Aaron Swartz. In that case, HN was clear fault lay with AT&T or MIT and the abuse of the word "hacking" was a horrible miscarriage of justice.

Since when does the FBI care about corporate wrong-doing?

Another way to phrase "corporate wrong-doing" is "crime."

So that's probably why the FBI would care.

Except when it involves bankers...

RE downvoters: http://www.nytimes.com/2014/05/04/magazine/only-one-top-bank...

Just because it's sports doesn't make it any less illegal.

It does make it much less important. Nobody is going to die because the Cardinals know what the Astros think about some high school pitcher. With this and the FIFA thing, it seems as if the FBI is interested mostly in sports. Meanwhile, murderers are on the loose, there has still been no meaningful investigation of the financial shenanigans for which we've all paid, there has been no examination of the FBI's own adventures in illegal surveillance and parallel construction, etc.

It's clear, too, that the Astros' staff brought this on themselves. When one is hired away to a competing organization, start using new passwords! Sheesh.

No one would die if Google or Facebook or Apple or, well, 99% of other companies were infiltrated for the theft of highly-valuable corporate secrets. That doesn't make it outside the purview of the FBI.

So, the whole idea of patents is that we don't approve of corporate secrets. What's the idea of also giving legal protection to trade secrets?

That's absolutely not the whole idea of patents. You should probably skim the Wikipedia page.

> Primary incentives embodied in the patent system include incentives to invent in the first place; to disclose the invention once made; to invest the sums necessary to experiment, produce and market the invention; and to design around and improve upon earlier patents.

This is two goals, stated as four:

1. There should be more technology developed under a patent system than otherwise.

2. People should stop keeping their technology secret.

> Main article: History of patent law

> Patents were systematically granted in Venice as of 1450, where they issued a decree by which new and inventive devices had to be communicated to the Republic in order to obtain legal protection against potential infringers.

Goal #2 is the origin of the system, and the only goal that the system directly addresses.

So let's take a common example of a trade secret protected by American law: a company's customer list.

I don't see the argument that businesses wouldn't bother developing customers in the absence of trade secret law. Nor do I see why protecting that information is in the interest of anyone outside that particular company. It's definitely contrary to the interests of the customers.

The Uniform Trade Secrets Act explicitly states that it's intended to protect businesses who believe that their information is nonpatentable:

> "In view of the substantial number of patents that the courts invalidate, many businesses now elect to protect commercially valuable information by relying on the state trade secret protection law."

And hey, for secrets like a customer list those businesses are surely correct. But who cares? Trade secrets are by definition something the business felt was worth the effort of developing regardless of patentability concerns. Any hypothetical benefits to society are, at best, extremely precarious -- that's why we have patent law. Trade secret protections are an undisguised, pointless giveaway, and they undermine the goals of the patent system.

re "Astros' staff brought this on themselves": A predictable outcome doesn't make it an acceptable outcome. They should have taken security more seriously, but that doesn't in any way excuse the Cardinals for exploiting them.

See, I disagree. You know how if you're in public you have no reasonable right to privacy?

Well, if your network is open to the public and not properly secured, that's on you. Especially multi-million dollar organizations that can afford to pay security experts.

An unlocked door is not in itself permission to enter a house.

Bad or no security is not in itself permission to enter.

Yes, the Astros do bear some responsibility to make sure things are not easily accessible. That doesn't change the fact that what the Cardinals did was wrong.

Look up lock bumping. I (well, somebody) could be inside your house in 10 seconds if you use a normal lock. I trust you won't be calling the cops when you find your home emptied of all valuables? It's on you, right?

More then 1200 immigrant workers (essentially slaves) have died building the stadiums for the Qatar World Cup, a World Cup that it seems increasingly likely Qatar only got because of illegal bribes. [1]

FIFA's shenanigans also costs Americans money, in the form of the bribes and backdoor deals the various TV networks have had to pay to get the TV rights, which directly or indirectly consumers end up paying.

I don't know if what the Cardinals did rises to the level of organized crime that FIFA seems to be, but MLB teams are publicly funded (via stadium-building subsidies) companies, and deserve scrutinization just like any other business.

[1] http://www.motherjones.com/mixed-media/2015/05/chart-fifa-de...

Wow I thought it was weird when the USA was held responsible for not stopping atrocities in sub-Saharan Africa. TIL we're responsible for Qatari workplace conditions. Maybe I should migrate to Canada; this is just too much pressure.

I think there's another angle here, which is that the individual players may have been harmed - with confidential scouting reports or player performance data, the behavior of the Cardinals may have changed towards those players. They may have missed opportunity to advance their careers, or get a better deal, etc.

It's not just about one team spying on another team, there are ripple effects here of people who might have been negatively impacted by the illegal activity of the Cardinals.

Maybe for Ground Control, but that doesn't explain how they penetrated the Astros' LAN.

So yes, FBI.

Obviously, at least the player DB was open to the internet. [EDIT: TFA talks about "networks", but not specifically enough to be sure the DB was even on a LAN.] These people weren't hackers. They didn't even use a public hotspot, let alone Tor or one of these no-log VPNs.

This perhaps is another indictment of the Astros' security policies. It certainly should be on the FBI checklist for "should we help these clowns figure out how they got hacked?"

If I leave my front door open, it's still illegal for you to come inside and take things.

OMG why do people persist in recycling this inane and ridiculous physical analogy? We've heard it about 600 times already, and it doesn't make any more sense the 601st time. A node on the network is not a place, any more than a telephone is a place. If one node sends a message to another node, the receiving node may respond in any fashion, including no response at all. It may be necessary to police this common interaction, but that necessity does not follow from the common human desire for security in one's home.

Analogies aren't mean to be perfect comparisons. That's why they're analogies.

The analogy works well enough, since we're dealing with private property (home, network) concealed by points of entry (doors, windows, nodes). Types of responses and feelings of security, etc are outside the scope of the analogy.

In what sense does a window or a node "conceal" anything? Perhaps you're thinking of curtains and adequately-implemented authentication? If I call a phone number, and the answering machine comes on and tells me some corporate secrets, would you still compare my nefarious conduct to the physical acts of physically entering someone else's home and depriving them of their physical goods?

By the way, it's disingenuous to introduce a scenario (of dubious relevance) that inspires strong feelings and then to deny you intended to evoke those feelings.

so corporate espionage isn't in the purview of the FBI so long as no one dies because of it?

I'll be sure to use that line at my deposition

If the argument were valid, it'd be more useful to have your counsel use it in a motion to quash the subpoena for your deposition then for you to use it at your deposition.

> Nobody is going to die because the Cardinals know what the Astros think about some high school pitcher.

We have criminal laws for things besides murder, which would be kind of pointless if we didn't allocate criminal law enforcement resources to things besides murder.

I understand you are frustrated in seeing the FBI spent public efforts on sports. However, you say, "it seems as if the FBI is interested mostly in sports" based off 2 stories.

The FBI is a huge organization. They can investigate illegal computer access as well as slavery rings. Their sports investigations are no different than any other corporation.

W/R/T your other objections, regarding financial and surveillance issues, well, it's clear that your opinions differ from those in power. To continue calling for investigation of financial shenanigans is, well, your choice, but it's not something I'm getting upset about. (Not because I don't think it's wrong, but because I don't like getting upset over things I have zero control over.)

Reply on news.ycombinator.com