News for hackers. Stuff that matters.
Re:Home Computers Connected to the Internet Aren't Private, ... by twoodfin on Friday July 01, 2016 @09:03AM (#12015643)
I'm much less skeptical than the median HN poster about government's use of new technology in its traditional roles of criminal justice and national security, but if this article is a fair summary of the case, I can't see how the ruling makes any Constitutional sense.

Because burglars regularly break into people's homes or cars doesn't make them subject to warrant-free search. If the FBI wants to run code on my CPU in my private home without my permission, they should have a warrant, just as they'd need one to manipulate other objects in my home without my consent.

Re:Home Computers Connected to the Internet Aren't Private, ... by dantillberg on Friday July 01, 2016 @09:13AM (#12015714)
Right? It seems trivial to tweak the judges statement:

"In today's digital world, it appears to be a virtual certainty that computers accessing the Internet can—and eventually will—be hacked."

To apply to houses:

"In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into."

Thus, warrants need not apply for search and seizure in houses. QED.

Re:Home Computers Connected to the Internet Aren't Private, ... by type0 on Friday July 01, 2016 @09:20AM (#12015760)
> "In today's mechanized world, it appears to be a virtual certainty that houses connected to the earth can—and eventually will—be broken into."

Or rather "... houses with doors can —and eventually will—be broken into."

Re:Home Computers Connected to the Internet Aren't Private, ... by type0 on Friday July 01, 2016 @09:21AM (#12015767)
Also: "... houses with WINDOWS can —and eventually will—be broken into."
Re:Home Computers Connected to the Internet Aren't Private, ... by allendoerfer on Friday July 01, 2016 @10:11AM (#12016128)
Even as a programmer I would much rather have to get through "… houses with WALLS …" than through reasonably strong encryption, the task might require strength, but is quite straightforward.
Re:Home Computers Connected to the Internet Aren't Private, ... by spacecowboy_lon on Friday July 01, 2016 @11:29AM (#12016886)
And its easier to break into the average house than the average pc.
Re:Home Computers Connected to the Internet Aren't Private, ... by rqebmm on Friday July 01, 2016 @11:39AM (#12016982)
Maybe, but it's definitely easier to break into a million PC's than a million houses.
Re:Home Computers Connected to the Internet Aren't Private, ... by ComodoHacker on Friday July 01, 2016 @12:51PM (#12017717)
Moreover, many houses also have BACK DOORS!
Re:Home Computers Connected to the Internet Aren't Private, ... by type0 on Sunday July 03, 2016 @08:05AM (#12025753)
Sure, but you can decide if you want keep the key under the rug beside that door.
Re:Home Computers Connected to the Internet Aren't Private, ... by pfortuny on Friday July 01, 2016 @09:25AM (#12015795)
Not just broken into, just peered into. Do not have windows if you expect any privacy.

And of course, do not speak at home (or do not expect any privacy).

Re:Home Computers Connected to the Internet Aren't Private, ... by Juz16 on Friday July 01, 2016 @10:04AM (#12016068)
Having blinds on your windows still doesn't mean you should expect privacy, any window you own can - and probably will - be looked through.
Re:Home Computers Connected to the Internet Aren't Private, ... by PJDK on Friday July 01, 2016 @11:23AM (#12016832)
Genuinely curious, do you need a warrant to look through a window.

I guess the answer is "sometimes, it's complicated"...

Re:Home Computers Connected to the Internet Aren't Private, ... by HillaryBriss on Friday July 01, 2016 @11:40AM (#12017003)
In California, police can peer into car windows without a warrant. That's one reason police always seem to be carrying a mag-light when they pull someone over. (The other being that mag-lights are heavy and useful as clubs.)
Re:Home Computers Connected to the Internet Aren't Private, ... by HillaryBriss on Friday July 01, 2016 @11:44AM (#12017047)
Oh yeah. Another piece of advice I've often heard is that, if police come to your door asking questions, it's prudent to step outside to speak with them, rather than speaking with them through an open door. If they see something suspicious through your opened door, they can reasonably claim probable cause and force entry.

This may be all BS. But it's advice I've heard more than once.

Re:Home Computers Connected to the Internet Aren't Private, ... by anonbanker on Friday July 01, 2016 @02:05PM (#12018332)
If police are doing a "knock and talk", they don't have a warrant. Barry Cooper had the best script for that:

If police are knocking, lock your door and say through a window: "I don't talk to police; have your dispatcher call me. If you have a warrant, here are my hands, go ahead and kick the door down". Then cover your ears, close your eyes, and wait.

Re:Home Computers Connected to the Internet Aren't Private, ... by coldtea on Friday July 01, 2016 @02:21PM (#12018473)
The problem with those kind of scripts is that while they correctly account for not accidentally exposing yourself to the Police (without a lawyer present etc), they fail to account for the consequences of getting in the police's nerves and looking like a suspect in their eyes (which can get down to them downright making stuff up or planting stuff on you).
Re:Home Computers Connected to the Internet Aren't Private, ... by anonbanker on Saturday July 02, 2016 @08:37PM (#12024339)
if police are targeting you, they're likely to make stuff up or plant evidence anyway.

If you feel you can't handle your affairs, make sure to lawyer up as soon as the police leave your house. You'll need to. let the lawyer know what you did, so he can take appropriate action.

Just remember that a lawyer, should (s)he put your needs above the needs of The People or The Court, (s)he would be disbarred. So don't expect magic to happen.

Re:Home Computers Connected to the Internet Aren't Private, ... by wang_li on Friday July 01, 2016 @03:50PM (#12019160)
> Genuinely curious, do you need a warrant to look through a window.

Home windows? If it is visible from a place where a normal person going about their normal activities can see, then no warrant.

For example, if someone walks up your walk to your stoop and there are windows that can been seen through from there, then no warrant. If they have to step off your walkway, walk around the side of your house, scramble through your bushes and pull themselves up to peer through, then a warrant would be required.

Re:Home Computers Connected to the Internet Aren't Private, ... by tinco on Friday July 01, 2016 @10:20AM (#12016198)
I think you can be charged with public indecency if you stand in front of your window naked. So there is some sort of gray area when talking about the privacy of your home.
Re:Home Computers Connected to the Internet Aren't Private, ... by camhenlin on Friday July 01, 2016 @11:34AM (#12016934)
Depends on your location. In my state (Oregon) that's totally fine as long as your intent is not to offend anyone
Re:Home Computers Connected to the Internet Aren't Private, ... by lswainemoore on Friday July 01, 2016 @04:31PM (#12019412)
Hmm. I don't agree with the ruling either. But I don't think this analogy does the original argument justice.

The point of mentioning "accessing the internet" is it's a lot easier for the hacker to scale up their wrongdoing with ease. It's much simpler to put a virus of some sort (say, a fake download button on a media sharing site) and reach a large audience, than it is to break into the homes of a similarly large group of people.

Where I primarily disagree with the judgment is that this notion makes it a "virtual certainty" that hacking occurs for any given person. Smart browsing habits, and general computer literacy, can make the odds decrease to near zero.

Re:Home Computers Connected to the Internet Aren't Private, ... by e12e on Saturday July 02, 2016 @03:06AM (#12021702)
Not only that, most places(?) have fire codes that mandates that all houses are easy(ish) to break-in to. Maybe not easy to sneak into, but certainly easy to break-in to. Because the fire department and emergency services need a way in.

I suppose the analogy would be that just because Microsoft has the power to remotely upgrade your windows 10 install (and potentially install any back-door), that should not violate your expectation of privacy.

Re:Home Computers Connected to the Internet Aren't Private, ... by csense on Friday July 01, 2016 @11:21AM (#12016801)
A house not connected to the earth would be pretty awesome, but you'd have to have a way to get food and stuff delivered [1].

[1] http://what-if.xkcd.com/149/

Re:Home Computers Connected to the Internet Aren't Private, ... by Retric on Friday July 01, 2016 @11:32AM (#12016911)
https://en.wikipedia.org/wiki/Houseboat and https://en.wikipedia.org/wiki/Up_(2009_film) are both connected to the earth. I think you need a spaceship for real freedom.
Re:Home Computers Connected to the Internet Aren't Private, ... by c22 on Friday July 01, 2016 @01:11PM (#12017900)
And even a spaceship will experience a gravitational connection to the earth, no matter where it goes.
Re:Home Computers Connected to the Internet Aren't Private, ... by Grishnakh on Friday July 01, 2016 @01:26PM (#12018018)
Not if you can figure out how to teleport the spaceship into a different universe.
Re:Home Computers Connected to the Internet Aren't Private, ... by anonbanker on Friday July 01, 2016 @02:16PM (#12018425)
Hermicity[0] might be what you're looking for.

http://hermicity.org

Re:Home Computers Connected to the Internet Aren't Private, ... by HillaryBriss on Friday July 01, 2016 @11:45AM (#12017057)
drones, man. all about the drones.
Re:Home Computers Connected to the Internet Aren't Private, ... by slowmovintarget on Friday July 01, 2016 @09:41AM (#12015914)
I feel bad for the judge. He's bending over backward to rationalize the end justifying the means... and he's dead wrong.

His argument is essentially that if your house is connected to a road, then there is no expectation of privacy.

I expect the ruling, or at least that absurd part of it, will be overturned or superseded. But the counter argument (for future cases) would be that running through a physical firewall is not a direct connection to the internet (silly as it is to make the argument).

Re:Home Computers Connected to the Internet Aren't Private, ... by ikeboy on Friday July 01, 2016 @10:34AM (#12016318)
Did you read the ruling? Do you have any specific critiques, and do you think the multiple precedents cited are applied incorrectly?

Edit: I've gone through most of the relevant sections. Most of the ruling is reasonable, the section this article and the EFF are complaining about is less supported by precedent.

The actual legal argument says that hacking is common enough that people don't have a reasonable expectation of privacy, then there's this paragraph:

>Although this Court recently noted in dicta that the possibility of hacking "is not enough to defeat an individual's reasonable expectation of privacy" because it is illegal, see United States v. Darby, No. 2:16-cr-36, ECF No. 31 at 10-11 (E.D. Va. June 3, 2016), this Court stresses that child pornography often resembles an international crime. Similarly, much hacking occurs by foreign nations where the governments condone or participate in hacking. Child pornography is not just a national issue; it is an international issue, and at least a portion of the pornography in this case arrived from foreign sources through the World Wide Web

This seems to be the weakest part. It's saying that hacking can't be the basis for a lack of expectation of privacy, but that since some countries allow hacking, it's legal there, and if you're accessing stuff from other countries you no longer have the expectation of privacy.

Re:Home Computers Connected to the Internet Aren't Private, ... by themartorana on Friday July 01, 2016 @02:01PM (#12018301)
No no no!!

The heinousness of the crime does not justify giving up or overriding Constitutional freedoms. Never. Not ever.

And if anyone is in place to protect us from that level of overreach, it's a judge. I cannot believe he's pulling a "won't someone think of the children!" in justifying (and creating some janky circular logic) this ruling.

The scariest precedent here is the level of crime dictating the flexibility of constitutionality.

Re:Home Computers Connected to the Internet Aren't Private, ... by ikeboy on Friday July 01, 2016 @02:21PM (#12018474)
I think you're misreading it. He's not saying that the heinousness of the crime justifies it, he's saying that by accessing child porn from another country, the defendant opened himself to hacking risk and as such has no reasonable expectation of privacy.
Re:Home Computers Connected to the Internet Aren't Private, ... by slowmovintarget on Friday July 01, 2016 @09:22PM (#12020946)
An unlocked car (which is the closest legal analogy, I think) is a bad fit here. If we're really going to search for analogues let's pick one that really matches what's going on in digital communication: physical communication.

  Whoever, without authority, opens, or destroys any mail
  or package of newspapers not directed to him, shall be
  fined under this title or imprisoned not more than one
  year, or both. -- Title 18 § 1703(b)
What if the "computer" on the internet is my pacemaker, and it uploads a data stream to servers in, say, Dublin. Does that mean I should not have a reasonable expectation in the U.S. for privacy of that data? That kind of rationale is bad in principle and bad law.
Re:Home Computers Connected to the Internet Aren't Private, ... by ikeboy on Friday July 01, 2016 @09:39PM (#12020988)
If you're uploading information to a third party, you no longer have privacy rights under the third party doctrine. That's very well established precedent.

As I said in another comment here, the issue is when it goes beyond such information like IP addresses and goes to actually hacking, which involves running code on the victim's computer.

Re:Home Computers Connected to the Internet Aren't Private, ... by deno on Friday July 01, 2016 @11:21AM (#12016805)
Any web page can include content from any country. Country TLDs don’t correspond in any way to where the content is hosted, and for most people even using DNS-resolved URLs is advanced. However, mostly thanks to IPv4 exhaustion, not even IP blocks correspond to geographical location anymore[1].

And all of this doesn’t matter anyway, because of how packet routing works. No one accessing the Internet can be reasonably expected to have any control over how their packets are routed on the network. You only control the next hop[2].

See for example: http://allthingsd.com/20131120/how-somebody-forced-the-world...

So I would agree to the extent that there can be no expectation of privacy for any unencrypted traffic. However, that’s just one type of hacking – snooping.

As for actual hacking – that is someone breaking into your system – this system has to be running on something, some sort of device. This device has to be physically located somewhere.

If an Elbonian comes to US and breaks into your house is it okay because in their country there are no lock on the doors, just a lot of mud, so breaking is not a crime? This is the logic here, as I see it.

What it ultimately comes down to is the US government wants to have it both ways. They want to be able to extradite people that hack into devices located in the US, but they want you to have no expectation of privacy when they are the ones doing the hacking.

[1] https://en.wikipedia.org/wiki/Provider-independent_address_s...

[2] https://en.wikipedia.org/wiki/Hop_(networking)

Re:Home Computers Connected to the Internet Aren't Private, ... by ikeboy on Friday July 01, 2016 @11:36AM (#12016952)
>If an Elbonian comes to US and breaks to your house is it okay because in their country there are no lock on the doors, just a lot of mud, so breaking is not a crime? This is the logic here, as I see it.

If they came to the US they would be subject to US jurisdiction. Hackers from other countries aren't, at least not always.

Edit: I mean prosecution. Jurisdiction applies whenever there are effects in the US, see link below.

Re:Home Computers Connected to the Internet Aren't Private, ... by deno on Friday July 01, 2016 @11:44AM (#12017050)
This is my point though. The US government claims they have jurisdiction when it suits them. Guccifer is still in the news and fresh on everyone’s mind.

Personally it never made sense to me how one can be subject to some random foreign country’s law by just using the Internet. But if that’s the doctrine it should at least be applied consistently.

Re:Home Computers Connected to the Internet Aren't Private, ... by ikeboy on Friday July 01, 2016 @11:56AM (#12017186)
I spoke incorrectly above. They always have jurisdiction if there was damage in the US. The point is that they can't get access to the person if they don't have an extradition treaty with the country they're in, but that's not jurisdiction, my mistake.

See http://www.kktg.net/Notes/hacking-jurisdiction/ which explains this.

Re:Home Computers Connected to the Internet Aren't Private, ... by deno on Friday July 01, 2016 @12:26PM (#12017486)
Thanks for the link. It’s an interesting read.
Re:Home Computers Connected to the Internet Aren't Private, ... by kakarot on Friday July 01, 2016 @10:59AM (#12016544)
Solution: Turn all international embassies into ISPs.
Re:Home Computers Connected to the Internet Aren't Private, ... by deadtofu on Friday July 01, 2016 @09:51AM (#12015983)
Comedy option: 3rd amendment defense.

("No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law.")

Re:Home Computers Connected to the Internet Aren't Private, ... by ctdonath on Friday July 01, 2016 @10:39AM (#12016356)
Not comedy. One reason for "quartering soldiers" was to obtain evidence and to intimidate within a private space. I've long held any form of broadly imposed in-privacy monitoring (including compulsory back door keys) is a 3rd Amendment violation, especially if the individual is practically paying for it.
Re:Home Computers Connected to the Internet Aren't Private, ... by clarkmoody on Friday July 01, 2016 @11:09AM (#12016679)
It would be really interesting to see a legitimate 3rd Amendment challenge come before the courts in our time.
Re:Home Computers Connected to the Internet Aren't Private, ... by mindslight on Friday July 01, 2016 @12:18PM (#12017393)
Mitchell v. City of Henderson.

Now every last amendment from the Bill of Rights has been discarded.

Re:Home Computers Connected to the Internet Aren't Private, ... by whoopdedo on Friday July 01, 2016 @12:51PM (#12017722)
Is there anything in the Constitution applicable to open government? I ask because the case is locked behind PACER.

... Or is it? http://www.leagle.com/decision/In%20FDCO%2020150203D28/MITCH...

Re:Home Computers Connected to the Internet Aren't Private, ... by mindslight on Friday July 01, 2016 @01:05PM (#12017855)
Wikipedia and news articles should give you the details.

I'd say lack of access to law (as well as its unbearable complexity) is an issue of due process and the fundamental rule of law.

But you can't look to the Constitution to dictate everything - its drafters could not anticipate all future developments, and if the government is that citizen-hostile a piece of paper won't stop it. That which the Constitution does specify should be considered more as "behavioral tests", and currently the majority of our test report is failure.

Re:Home Computers Connected to the Internet Aren't Private, ... by rev_bird on Saturday July 02, 2016 @02:56AM (#12021680)
For what it's worth, the Third Amendment claims were thrown out: http://www.reviewjournal.com/news/las-vegas/judge-police-tak...
Re:Home Computers Connected to the Internet Aren't Private, ... by jbattle on Friday July 01, 2016 @12:14PM (#12017357)
The counter-point presumably being that law enforcement are not soldiers? Maybe the 3rd amendment has been interpreted as applicable to all government agents.
Re:Home Computers Connected to the Internet Aren't Private, ... by blakesterz on Friday July 01, 2016 @09:11AM (#12015698)
>> ...but if this article is a fair summary of the case...

Thanks for that. A good reminder that we need to think that every time we read anything like this. Just asking a simple question, "Did they get this right?" and even taking a minute to read through to the actual primary source.

Re:Home Computers Connected to the Internet Aren't Private, ... by mcguire on Friday July 01, 2016 @10:22AM (#12016224)
"For example, hacking is much more prevalent now than it was even nine years ago, and the rise of computer hacking viathe Internet has changed the public's reasonable expectations of privacy. Cf Lee Raine, How Americans balance privacy concerns with sharing personal information: 5 key findings, PewResearchCenter (January 14, 2016), http://www.pewresearch.org/fact-tank/2016/01/14/key-findings... (reporting that members of a focus group "worried about hackers," though "some accept that [privacy tradeoffs are] a part of modern life"). Now, it seems unreasonable to think that a computer connected to the Web is immune from invasion. Indeed, the opposite holds true: in today's digital world, it appears to be a virtual certainty that computers accessing the Internet can - and eventually will - be hacked."

"Thus, hacking resembles the broken blinds in Carter. 525 U.S. at 85. Just as Justice Breyer wrote in concurrence that a police officer who peers through broken blinds does not violate anyone's Fourth Amendment rights, jd. at 103 (Breyer, J., concurring), FBI agents who exploit a vulnerability in an online network do not violate the Fourth Amendment. Just as the area into which the officer in Carter peered - an apartment - usually is afforded Fourth Amendment protection, a computer afforded Fourth Amendment protection in other circumstances is not protected from Government actors who take advantage of an easily broken system to peer into a user's computer. People who traverse the Internet ordinarily understand the risk associated with doing so. Thus, the deployment of the NIT to capture identifying information found on Defendant's computer does not represent a search under the Fourth Amendment, and no warrant was needed."

The section of interest starts on page 47 of the linked Opinion and Order. http://mobile.eweek.com/security/home-computers-connected-to...

Re:Home Computers Connected to the Internet Aren't Private, ... by imbriaco on Friday July 01, 2016 @12:12PM (#12017332)
The judge conveniently disregards the difference between passive observation and active intrusion. Breaking into someone's computer is no different than if the officer had broken the blinds themself, which clearly would not meet the test described by Justice Breyer.
Re:Home Computers Connected to the Internet Aren't Private, ... by tamana on Friday July 01, 2016 @11:30AM (#12016899)
So, that judge just stuck down CFAA for civilians too? Or only for Law Enforcement
Re:Home Computers Connected to the Internet Aren't Private, ... by ikeboy on Friday July 01, 2016 @11:37AM (#12016964)
CFAA is about exceeding authorised access, not violating expectations of privacy.
Re:Home Computers Connected to the Internet Aren't Private, ... by rmc on Friday July 01, 2016 @09:51AM (#12015985)
FBI doesn't need a warrant for non-US computers.
Re:Home Computers Connected to the Internet Aren't Private, ... by clarkmoody on Friday July 01, 2016 @11:08AM (#12016660)

  "But whether the Constitution really be one thing, or another, this much 
  is certain - that it has either authorized such a government as we have 
  had, or has been powerless to prevent it. In either case it is unfit to exist.”

  -- Lysander Spooner, No Treason
Re:Home Computers Connected to the Internet Aren't Private, ... by tamana on Friday July 01, 2016 @11:32AM (#12016910)
That's horrid logic. The question of fitness for existence is whether the Constitution is better than its absence.
Re:Home Computers Connected to the Internet Aren't Private, ... by logfromblammo on Friday July 01, 2016 @12:05PM (#12017270)
That's an unanswerable question, since we cannot compare a control Earth where the U.S. Constitution was adopted in 1783 and an experimental Earth where it was never ratified.

It is axiomatic that the present we now know inevitably followed from the history that preceded it. When you look at the U.S. federal government that now exists, it must have assumed its current form either by design of the Constitution, or contrary to that design. In case of the latter, the Constitution was entirely unable to prevent the government that it established from evolving into a form contrary to its design. Maybe the process was slowed somewhat. We cannot know for certain.

Therefore, if you dislike the current form of US federal government, it is nonsensical to idolize the Constitution, or any other causally-related fact of history. History gave us the present. If you do not like the present, and wish the future to be different, do not repeat the mistakes of the past. Whether history could have given us another present is irrelevant, because it did not.

In the end, whenever a living human fights with a document, the human will emerge victorious, and the document will become confetti. The Constitution is nothing without a living human to be its champion.

Re:Home Computers Connected to the Internet Aren't Private, ... by clarkmoody on Friday July 01, 2016 @11:46AM (#12017084)
Also flawed logic. Our options are not simply Constitution or No Constitution. There are a near-infinite number of unique constitutions we could have adopted, rather than the one we've got.

Spooner was criticizing the actual form of our current Constitution. GP was making an appeal to the Constitution and the judicial system's ignoring of it. I agree with Spooner that a Constitution such as ours is completely powerless to prevent individual judges from rewriting every time it fits their fancy.

We've basically had an ongoing Constitutional Convention in the federal courts since the founding -- without the consent of the people.