Rather than having knowable, deterministic laws we are all at the mercy of the lawyers and judges we happen to get that "day".
It's still probably the least bad system.
Why? Because you can't formalize away the fact that humans can't think of everything ahead of time. We make laws about your rights regarding messages you write on paper, then telegraphs and telephones and email come along. Either you try to interpret the law to cover them, or you revise your definitions of "messages" to include or exclude them.
In a "specify everything" system, everything that the courts currently interpret would have to be sent back to the legislature. The effect would depend on what you do with gray areas in court.
Option 1 would be "if a case is ambiguous, put it on hold until the legislature clarifies the law." That would clog up the courts and effectively merge the court and the legislature.
Option 2 would be "decide cases based strictly on existing law and let the legislature revise things for the next go round." That would create a lot of absurd outcomes, where a small loophole, with no ability to apply "common sense", means innocent people are convicted or guilty people are freed.
Like a group of elected officials who's only job is to close these loopholes without massive fanfare and a simple vote. A process that is incredibly fast and decisive in order to get double digits done per day.
Because, y'know, having officials crank through tons of difficult decisions per day is such a supremely effective[1] and corruption-free way to create a social process. It's worked so very well for the patent system, why not for law and jursiprudence?
[1] cf. "decision fatigue": https://www.nytimes.com/2011/08/21/magazine/do-you-suffer-fr...
Many things involve context (it is illegal to murder someone, but a killing in the context of self-defense is often not murder). Even where context is not explicitly recognized by the law, we want judgment and discretion to exist (speeding because you are drag racing is very different than speeding to a hospital with a bleeding passenger.)
So, you're saying that's more dystopian than the thought of secret laws for 'national security', on top of a body of laws that already spans over 200,000 pages, whereby even with non-poorly-written laws, you're still likely breaking one every single day?
Because that's what we have now. So if those are my options, then shit yes, I will take mathematical certainty of the legality of my actions any day.
I don't expect laws to be formally defined, I just expect them to be few, sensible, and transparent. Reasonable people shouldn't have a hard time inferring whether a specific activity is illegal.
Right now, our body of law is vast, complex, opaque and uncertain. Because of this, as I said above, most people likely break the law every single day. This gives rise to tyranny by selective enforcement (http://en.wikipedia.org/wiki/Selective_enforcement), burdened economies and reduced investments due to untested and protectionist regulatory regimes, and an overall reduction in freedom and civil liberties.
By contrast, yes, the knowability and certitude afforded by a hypothetical-but-impossible legal system based on mathematics would be preferable. This is really not a complicated idea.
“Corruptissima republica plurimae leges. [The more numerous the laws, the more corrupt the state.]” — Tacitus, the Annals ca. AD 69
So's our society. Roman law was quite a bit simpler, but justice in ancient Rome was extremely unpredictable.
By contrast, yes, the knowability and certitude afforded by a hypothetical-but-impossible legal system based on mathematics would be preferable. This is really not a complicated idea.
As HL Mencken said, 'For every complex problem there is an answer that is clear, simple, and wrong.' Godel's theorem tells us that in any sufficiently expressive formal system (such as mathematics), you can have consistency or completeness, but not both. A hypothetical mathematically-precise legal system would thus yield cases that either couldn't be judged because there was no prescription for such a situation (a div zero problem, if you will), or else would yield contradictory results on the same facts at different times.
People are emotional and subjective by their very nature. It is not possible to be objective - one can only tend towards objectivity by applying constant introspection and reassessing one's world view. Nonetheless, an Ape is not capable of being a Vulcan. It is, frankly, a travesty that people's fates are being decided by other people's stomachs.
I'd argue that you really can't say anything with such certainty. If true friendly AI is ever possible (and that is up in the air), such a system would be a better one. Obviously, this is all speculation.
In other words, by the time we have consistent laws (in the mathematical sense), "Precrime" could already exist.
I guess that one positive impact of your idea would be moving mathematicians into the almost celebrity status of lawyers. They'd be fun to watch when interviewed too.
Just to be clear, I'm not proposing to teach kids to be lawyers. Being a lawyer would be like having a PhD in mathematics. But we do teach kids basic calculus, algebra and stuff like that, so why not "basic legal stuff" (whatever it's called)?
New rule: (forall ?X (implies (and (isa ?X USCitizen) \
(locatedIn ?X UnitedStatesLegalJurisdiction)) (bearArms ?X)))
- Rule 2 added.
New rule: (thereExists ?X (isa ?X USCitizen) \
(locatedIn ?X UnitedStatesLegalJurisdiction))
- Rule 20 Added
New rule: (implies (and (locatedIn ?X ?Y) (isa ?Y USState)) \
(locatedIn ?X UnitedStatesLegalJurisdiction))
- Rule 21 Added
...
New rule: (isa California USState)
-Rule 1850-342 Added
...
New rule: >(forall ?Y (implies (locatedIn ?Y California) (not (bearArms ?Y)))
- Error: New Rule #4422 conflicts with Rule #2
Request Ruling:
(locatedIn JamieBriant224112344 California)
(bearArms JamieBriant22411234)
- Data is consistent.
1. You need a law degree to even practice - control.
2. The government can selectively prosecute - corruption.
3. Fear of losing, even when morally right.
4. Everyone is a criminal.> In other words, no court has gone so far as to adopt anything close to the absurd outcomes suggested in this piece.
Pardon me if I'm missing something here, but doesn't the post exactly say that that has what weev has been charged for?
> This is the issue behind the recent conviction of Andrew Auernheimer for “hacking” AT&T.
weev's actions are a gray area. I don't think that convicting him under the CFAA is absurd. It might be unreasonable or unconstitutional, but there's a valid security issue at stake. To liken weev's actions to viewing a deliberately published-for-public-consumption blog post is a false equivalence: and precisely what makes the piece alarmist.
He's saying that the courts can make distinctions between what Congress intended (to make it illegal to bypass computer security systems without permission), and what the law might technically forbid but what is completely normal and innocuous to do (like browsing someone's website without their explicit permission).
Now, is this something that I, with a bit of idle time, curl, and awk might have done on a lark - yup. Does it scare me that I then might have been found guilty of criminal behavior? Yes. Would I have done something like publish people's personal information on Gawker? Not anymore. Would I let AT&T know personally that they had a security hole? Probably not - likely to be the messenger that would get shot. Is the NET result of this that the bad guys, who keep quiet, and make use of this information for nefarios purposes now have free rein, because nobody will mention it to AT&T? Yes. Is the NET-EFFECT of this law a reduction in security and increased number of security exploitations? Yes. Should the Law be Fixed? Yes.
There are plenty of physical crimes that are easy to commit. For example, opening up someone's unlocked mailbox is technically a federal crime in the US (even if you don't take any thing and just put a leaflet there). Pointing out that a 'bad guy' could easily steal someone's mail by opening their mail box does not constitute security research.
Also: let's say someone accidentally exposes their password because it's on a post-it in the background of a photo. Clearly this is crappy security; clearly, at that point, information protected by that password is readily available until the password is changed.
The intent of the owner of the data does, in fact, count.
Sort of as if AT&T had chosen really bad, unchangeable default passwords for all their users.
The security on a ICCID is arguably better than any of these things. Unless it's transmitted in the clear? I don't know.
This is all silly.
Realistically, there isn't any legitimate reason for me to be doing this to AT&T's website anyways, other than idle juvenile curiosity (which I'll admit to having an abundance of).
I really don't see how. He used the exact same query that AT&T's own script used. The server did not break, or expose any unexpected behavior - in fact it worked exactly as AT&T designed and intended for it to work. I don't think you can pin any of this on weev when it's clearly AT&T who screwed up and provided all their customers' data for the asking.
Look, I'm not arguing that this should be criminal behavior, and it certainly doesn't merit a jail term. I can't tell you how many times I've done stuff exactly like this - probably in the hundreds of times. Is it hacking when I paid $15 for a 1 week pass and then used curl to download 11 gigabytes and 10+ years of the American Journnal of Clinical Nutrition? Probably. But, to give all due credit to the AJCN, they detected my repeated queries, and redirected me to a page that asked me to wait 30 seconds between each query when doing bulk downloads.
So, there is a case where I wasn't doing the obvious (downloading through the web interface), "hacking", if you will, but the AJCN was clearly fine with it, they just wanted me to ease up a bit, and instructed me how to do so in a friendly way.
If weev is guilty of anything, it was not realizing that posting high-profile individuals names onto gawker was probably a Really Bad Idea (TM).
I think the worst part about this is that it once again sends the message to companies that its OK to be this negligent. The law came in and fixed everything, the system works! Bad things were done, the bad people are in jail, full resolution.
I don't feel safer if every hacker ends up in jail. I feel safer when things are too hard to hack, or at the very least not brain dead easy to hack. This is very similar to Sony's response to repeated hackings of their customer's credit card numbers stored in plaintext: "We'll get those perpetrators!" instead of "oh we'll stop being ridiculously negligent now". The arguments of discouraging future hackers with harsh sentences don't work when 15 year olds are doing this all around the world. I want my information protected so that my money can't be stolen, not to receive retribution for it afterwards. If my bank left all the security boxes wide open for anyone to steal from, sure its still a crime to steal from them but I'd be much more pissed at the bank -- I pay them to keep that stuff safe!
I think we have too often come to accept crime followed by punishment as an ideal scenario, forgetting that sometimes there even exists the possibility of avoiding the initial crime in the first place.
Edit: To be clear, ICCID's are not private, they're printed on the outside of the SIM card.
In addition, there's a whole grey area which he highlights and you disregard just by trusting the courts, which doesn't prevent you from getting arrested and sued with all the financial and mental stress those things entail.
If you want better legislation, then you need to make sure the people writing it are well-educated in the areas you care about. This is the original purpose of lobbying.
The article's claim about the chilling effect was, of course, highly specific to the author's personal area of expertise. This is based on something I can't comment on: that the details of weev's case are generalizable to all cybersecurity researchers. I don't know the details of weev's case; do you think it's generalizable? My quick Google yielded me a Wired article that ended with weev laughing about how it might be illegal and the likely possibility it would damage a legitimate business's stock price. Is that a thing all cybersecurity researchers do?
I mean, I agree that the law sucks. That's fairly self-evident here. But what, exactly, do you guys want done about it? "Oh no, something bad happened 26 years ago and I just realized it because of something that happened recently" is weak. Talk to the EFF. Talk to your Congresscritters. Ask other people to do so. Sound and fury signify nothing. If you feel so terribly chilled, explain it to the politicians and get some lawyers working on the problem. I'd suggest civil disobedience, but you probably don't have the courage to get arrested if you're busy being chilled.
Yes, it sucks to be a case study. Cancer patients go through it all the time: the result? LESS CANCER. That's what the courts are also for. You go up there and say, "My situation shows how this law is stupid." You take a beating as all the relevant details are dragged out and scrutinized so that they can be sure. And hopefully, they agree with you and set precedent that the law is, in fact, stupid and fewer people have to deal with it in the future.
I'm not personally scared, but I understand what the problems with this kind of laws (bad, vague ones) are. The problems almost disappear when everything works as expected.
The real problem which you ignore is that laws of this sort give the authorities a big loophole for abuse (which probably is not what has happened to weev, but that's not what I'm discussing.) If you think that's not a worry, I envy your worldview.
That said, I fully agree that more formal action should be taken, contacting EFF and congressmen and whatnot. But writing about it can motivate people who were not in the know to act, it's not just empty "sound and fury."
I recommend this book that's somewhat related to this problem: http://www.amazon.com/Nothing-Hide-Tradeoff-between-Security...
Let me know how that works out if you get dragged into a patent lawsuit in East Texas. :-)
Having such a law on the books means that a boss, computer service provider, etc. could show a laymen this law, even let them look up the law themselves and then threaten to have someone prosecuted for things which may be proper (or at least not illegal). The person being threatened would be able to verify that the law was real and without having a lawyer to explain the full situation may feel they are in a very bad bargaining position for whatever demands the other side makes.
As the court said, "We shouldn't have to live at the mercy of the local prosecutor" but neither should people without lawyers have to live at the mercy of those who could use such a law to threaten prosecution for negotiating purposes.
When they have a law that seems on first reading to say what the employer says it does, then the employer can show it to the employee to gain credence and the law itself will confuse any employee who does a little research without going further.
More than that, the employer may not realize they are misrepresenting it when the law seems to say something. They may be misusing the law in good faith. Something that will happen less often with clearly written laws that are not heavily interpreted in the common law.
http://www.technologyreview.com/view/507661/jail-looms-for-m...
Legal uncertainty is not something that any company would prefer to endure.
The opinion is not only compelling, it is a brilliant example of law at its best, for it shows how a wonderful legal mind wrestles with a knotty problem that can be summed up with the question, "Should courts apply a badly drafted piece of legislation to lead to the absurd result of criminalizing a whole host of minor misdeeds committed by individuals every day in using the web and their computers?" Judge Kozinski answered this question with a resounding "no."
He did so by applying the "rule of lenity," which requires "penal laws . . . to be construed strictly." (at p. 3872) "The rule of lenity not only ensures that citizens will have fair notice of the criminal laws, but also that Congress will have fair notice of what conduct its laws criminalize. We construe criminal statutes narrowly so that Congress will not unintentionally turn ordinary citizens into criminals." Applying this rule, he held as follows: "Therefore, we hold that 'exceeds authorized access' in the CFAA is limited to violations of restrictions on access to information, and not restrictions on its use." (emphasis in original)
In other words, though the CFAA is so badly worded that one might potentially give it an absurd and unconstitutional interpretation so as to criminalize things one would think shocking for Congress to have criminalized, the courts have the power to apply well-established rules of statutory construction so as to avoid such an absurdity. Here, the Ninth Circuit did so by construing the CFAA to criminalize violations of access restrictions (i.e., hacking) and not violations of use restrictions (terms of use on website and the like).
Now, there is a split in the federal circuits on this issue and it will either be resolved by an amendment to the statute or it will eventually find its way to the Supreme Court for resolution. But, even granting the split, the most extreme cases in which the CFAA has been applied criminally have involved things such as employees misappropriating trade secrets and other items that go far beyond innocuous things such as violating an employer's computer use policies by surfing the internet on company time.
In other words, no court has gone so far as to adopt anything close to the absurd outcomes suggested in this piece. Even the government in its arguments to Judge Kozinski strongly stated that it would never consider prosecuting such items as crimes. ("The government assures us that, whatever the scope of the CFAA, it won't prosecute minor violations. But we shouldn't have to live at the mercy of the local prosecutor." at p. 3870)
Thus, it is fit and proper to call out the alarmist tone of this piece as being wildly outside the mainstream of where the courts have gone with the CFAA and of where they are likely to go. Is it badly drafted legislation? Yes, it is a mess (if you want to lose your mind, try reading through the text of the statute here: http://www.law.cornell.edu/uscode/text/18/1030). Can it be interpreted to criminalize things that Congress might not have intended to criminalize? Yes, including acts by employees that, though wrongful, may not have been within the contemplation of Congress when it passed the statute. But, that said, is there a risk that the CFAA can be applied to criminalize our daily interaction with computers and the web? No, not unless normal, sound principles of law are wholly disregarded by the courts, which they won't be.