The FBI could be wrong and that'd suck. I'm just assuming that the FBI and their resources have enough evidence to reasonably believe he's the creator.

And again, your last comment doesn't fit this article. They aren't overextending and arresting a security researcher (although he is one), they're arresting someone whom they believe is a malware creator and distributor.

So you generally believe people are guilty until proven innocent, and I always believe people are innocent until they are proven guilty. I never take the government word for anything, and generally assume the government is lying at all times. History supports my position.

I find it extremely alarming how quickly people just believe the FBI's assertions as fact with almost no actual evidence being presented

“Innocent until proven guilty” is a legal standard applied where “guilty” means having one’s liberty taken away. And in that context it’s a perfectly appropriate standard. But as mere spectators, where the harm caused by mistakenly believing he’s guilty is minimal, I think we should feel free to simply believe in the most likely possibility (aka preponderance of the evidence). You may disagree on that point, and that’s your right. However, if we agree to apply that standard, I don’t think it’s reasonable to believe that the FBI’s allegations being false is actually more likely than the alternative.

> I never take the government word for anything, and generally assume the government is lying at all times. History supports my position.

[citation needed]

You have a peculiar interpretation of justice, one that makes you pretty much like those that liked to burn people on fire pyres on the basis of allegations made by socially relevant people.

Why is it the appropriate standard? Because as a society, we believe that taking away an innocent person's liberty is far worse than letting a guilty person go free. For the expected value (in the statistical sense) of the legal system's benefit to society to be positive, the prevalence of the former should be a tiny fraction of the prevalence of the latter. (How tiny that fraction actually is, in the US or anywhere else, is debatable - you could look at the number of convicts who were proved innocent upon the advent of DNA testing - but that's not the point.) Thus we should only convict if the apparent probability of guilt is extremely high.

But if I as a bystander believe an innocent person is guilty, it's not as big a deal. True, if a lot of people believe that, it causes some reputational damage, which can be bad. If someone with a connection to the person makes decisions disfavorable to them based on that belief, that's quite bad. But this risk is mitigated by the fact that soon enough the police will be required to present their evidence in court, which should help drive our assessments with more certainty to one possibility or the other. And in any case, these harms are far lesser than the harm of subjecting the person to prison, or worse punishments.

Perhaps I misstated the ideal standard for bystanders. Perhaps it should not be literally whichever possibility is more likely; perhaps we should give people some "benefit of the doubt", due to the above harms. But there's no need for the extreme standard demanded by the actual justice system. A reasonably high probability of guilt is enough, at least to treat guilt as a working hypothesis.

In a legal system such as the United States', "if the police took him" (specifically, indicted him), I'd say there's a high probability - at least 75% or so, probably higher - that there's a "good reason for that to happen". (At least in the sense of "he did what they say he did"; whether that thing ought to be illegal or not is typically more subjective.) It's not certain; there could be some sort of corruption or unethical behavior by the police, or they could simply be mistaken. But it's enough to form a working hypothesis, to use until we gain more information.

Innocent people have their lives for ever ruined with nothing more than false accusations, and not being found not guilty at trial does not change that.

Further I would like to see where you get your belief that police are correct 75% or more of the time.

It seems to me you have a very favorable opinion of the American legal System, this tells me you have very very limited first hand experience with it and like view of from rose colored world view never having known anyone personally that has been ground down to nothing by this system that is IMO largely unethical

it was the FBI that pointed the Media to him as a suspect.

Do you habitually eat food that has been left out for longer than government guidelines allow because you generally assume the government is lying at all times?

Do you increase your speed when you see a sign that says REDUCE SPEED, SHARP TURNS AHEAD because you generally assume the government is lying at all times?

Those are completely Voluntary and used for Stock Control not food safety

As to speed limits and sharp turns I drive for the road conditions for the most part, so no I do not always slow down around sharp turns unless there is a posted speed limit for the turn for which I would be subject to arrest or fine for violating.

Is indicting people for crimes they are alleged to have committed consistent with your position? Because that's all that's happened so far.

The FBI asserts that he created malware. He denies it. An indictment and a trial will figure out which of them is lying.

Another is that he might plead guilty and we'll never know whether he was guilty or innocent (but threatened with consequences he didn't feel he could risk).

Yes, that might happen. Taking that position to its logical conclusion, nobody should be indicted for anything.

There are serious problems with the US justice system. As far as I can tell, there is nothing at face value that's unreasonable about this indictment.

1. True malware creator and seller is sent to prison.

2. True malware creator and seller is not sent to prison.

Whether he pleads guilty or not has nothing to do with him being a security researcher. I'd much rather have more false positives than false negatives. You, and the rest of Europe, would too.

"it is better 100 guilty Persons should escape than that one innocent Person should suffer"

Also, you've got this wonderful dichotomy laid out, but there are other options too: for instance, that this guy is sent to prison but was not the creator of the malware, thus ending any chance of the true creator ever being caught.

Unless of course you're so mediocre that you'll never ever risk doing anything even remotely significant; in which case, whatever.

At least you admit that believing the FBI is crazy, maybe there is hope for you.

Randal Schwartz https://en.wikipedia.org/wiki/Randal_L._Schwartz

Rather ill-advisedly, the Perl-programming guru (who's written several books on the subject) tried to prove his worth by running a password cracking package after he'd left in order to produce evidence that security practices had deteriorated since his departure. Instead of re-hiring Schwartz, as he hoped, Intel called in the police and he was charged with hacking offences.

http://www.theregister.co.uk/2007/03/05/intel_hacker_charges...

It's not the crime of the century, but it's not a case of someone doing benevolent security research getting caught. Nobody practicing today would backdoor a client computer, use the backdoor after their engagement had ended, and expect anyone to find that action defensible.

Seems to be clear example to me

- Weev’s harvesting and publication of iPad owners’ email addresses was far from benevolent, but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter. As you know, it’s not that far from what white hats sometimes do, in terms of probing public websites - with the obvious exception that they’d usually responsibly disclose the vulnerability to the site owner, rather than publishing people’s data!

- Barrett Brown was charged with (among other things) republishing a link to data someone else had leaked. That falls more into the category of journalism than research, and ultimately the charge was dropped, but it still fits a theme of overzealous use of <s>the CFAA</s>.

edit: that wasn’t the CFAA, but same idea.

What ever you think of the actual prosecutions here, neither of those are cases of security research being mistaken for something else. The most you can say, for instance, about Brown is that he is not as closely connected to an extraordinarily serious crime as the DOJ believed he was.

1. Someone physically breaks into factory, steals a list of customers for the purpose of (selling to competitors/personal interest)

2. Someone drives around the country and records locations of $company infrastructure, in an industry where optimal placement provides a major competitive advantage, for the purpose of (selling to competitors/personal interest)

In both cases, the person now has information that the target would rather keep private, and in both I would assume that their plans for the data would be irrelevant to the legality of gathering that data. (I'd assume case 1 would be illegal either way, and 2 legal either way) So if Weev's actions are akin to breaking into/hacking a system, then case 1 would apply - but if it was closer to looking at publicly exposed information, then the situation would be like case 2. But either way, I don't think his reasons for taking the actions (or after the fact plans on what to do with the data) would affect the legality of what he did.

Of course, IANAL and US computer law seems to be completely screwed up so maybe it would matter. I just don't see how.

Your first case has both prohibited conduct and intent (actually, with or without the intent to sell the data, I think deliberately breaking into a factory is itself criminal).

Your second case does not.

Murder is also rather easy, and we execute people for it.

It's certainly part of what he said:

>but it also wasn’t exactly hardcore hacking; IIRC he just changed a URL parameter.

The difficulty of carrying out an action is completely irrelevant to its legality.

This pressure I believe will lead them to over reach on CFAA like they have in the past in other "hacking" cases

https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-...

So while I can not point to an example right now, that is simply because there is a general lack of case law in the field to begin with, nor does that support a position that the FBI is correct in this case, or would never go after a innocent security research, their history defies that completely.

While I tend to agree that this is possible, the parent's point was how unrelated this was to WC and to any research occurring in the field. It's strictly a case of "this guy wrote malware and sold it".

> you seem to believe fully this narrative of the FBI with no room for the FBI to view completely innocent actions as something else. No room for the FBI to be in error, no room for the FBI to be wrong.

I'm confused. The parent simply stated he was arrested for that. How does that translate into "Parent believes 100% what the FBI states with no room for the FBI to be wrong"?