Identity fraud for a list of emails? Really?
It's insane even if you assume they were pristine and never received any spam before weev came along and "stole" them. Furthermore, the list was never sold, distributed, or published.
An excerpt was sent to the media.
They kicked around the idea of spearphishing, of spamming, of pastebinning it, of selling it. In full knowledge of the value and leverage that this data allowed, they contacted the media and deleted their own copies. It profited them nothing.
The idea that this is akin to trespassing is simultaneously both obtuse and dangerous. There were _no_ access controls; ATT themselves said in court that the information was published (by them) on the web.
Collecting lists of e-mail addresses from private databases without authorization should be.
> Identity fraud for a list of emails? Really?
Weev said in IRC conversations that he was going to sell the e-mail lists. Maybe you don't believe him, but it's hard to argue that no reasonable person could have believed that he was going to do what he said he might do.
> Furthermore, the list was never sold, distributed, or published.
If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.
> There were _no_ access controls;
I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.
Society charges you with being a normal functioning human being and respecting obvious boundaries. Obviously this is too high of a bar for people like Weev.
Unauthorized I can see, but "private"? What was "private" about this database he accessed? It was a public API on a public server with no authentication required.
> Weev said in IRC conversations that he was going to sell the e-mail lists.
Yes, but he didn't. Is he being prosecuted for doing something he said he would do, but did not do? That seems dangerous.
> If someone breaks into your house with safe-cracking tools in his possession, he doesn't have to actually break into your safe to be charged with and convicted of burglary.
This is death by bad analogy. He wasn't breaking into a house, no safe-cracking tools were required (nor, probably, on his person).
Why not argue to the actual point? The list was not sold, distributed, or published -- why is it necessary to fall back to analogy there?
> I don't lock the door to my apartment. That doesn't mean you're welcome to walk in and look around. If we were in Florida or Texas, I could shoot you in the face for walking into my unlocked house and nobody would convict me.
Death by bad analogy, again. Surely you don't think that downloading publicly available data is analogous to B&E? And if the email addresses are so precious as to warrant a 41-month prison sentence merely for accessing them, shouldn't the idiots at AT&T be held at least partially responsible for making the data publicly accessible?
> Obviously this is too high of a bar for people like Weev.
Ah: guilty people are lesser people?
I'm not even sure what Weev's crime was here, in layman's terms. Was it accessing the public API in the first place? Was it sending the list of email addresses to Gawker? Was it talking about doing nefarious things with the list of email addresses? Was it not contacting AT&T first?
If I had to describe this case to someone who knew nothing of computer systems and explain why the 41-month prison sentence was justified, how would I do that?
While I think the responsible disclosure could've happened in a better way, I don't think this is akin to walking into an unlocked house. This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.
What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time. It just doesn't sit well with me and I don't think the boundaries are obvious.
I'm not a hacker if I increment a URL by 1. I wouldn't even call you a hacker if you used DNS reflection attacks. To identify cheap parlor tricks as hacking is offensive to the professional breakers and ludicrous in the larger scheme of things.
That's a separate issue.
> This is a web server that's only protection was prayer. There was no authentication, no verification and no accountability.
The protection was the fact that the information therein was obviously sensitive and not intended for public disclosure. In a civilized society, that's all that should be necessary.
> What makes me so mad is that AT&T can be so goddamn careless with my information and skate away free while the gentleman who exposed this lack of attention is sent to a jail for a very long time
He's not being sent to jail for "exposing this lack of attention." He's being sent to jail for exploiting this lack of attention tens of thousands of times more than was necessary to prove his point and for talking smack on IRC that led people to believe that he might sell those e-mail addresses for profit.
Given that history, it's really easy to claim that he was intending to do harm with that list of emails, and it's also pretty easy to think of ways for him to do harm. Idendity fraud might be a bit of a reach, but computer abuse with malevolent intent? Not too hard to get there from his public statements.
Anybody COULD have done harm with those emails. He didn't. He used them as a fodder for public discussion about internet security.
AT&T should owe him a "thank you".
AT&T customers owe AT&T a boycott for being irresponsible with their information.
I think the question of AT&T having responsibility for inadequate controls is very interesting. I would like to see AT&T face some repercussions for it. Not _instead of_ weev receiving punishment, but _in addition to_.
They could have been really bad guys. That didn't happen.
Hackers move easily between different levels of abstraction and believe that things in general can and should be understood. They try to never stop asking 'why?' and this leads them to find places where the system is incongruent. Many of these realizations are benign or even progress the system, and the advantage gained just helps the hacker succeed within it (eg. pg's main use of the word hacker). But some realizations contradict a foundation of the system (like insecurities of its central nervous system!).
The system is built on abstractions, takes them for granted, and reacts extremely harshly when they are broken (for this is an existential threat). The system can only understand a broken abstraction in terms of the abstraction itself, rather than in terms of underlying reality. Hence we end up with phony blame-shifting terms like "identity theft" instead of reality-based "fraud". Meanwhile, hackers see the failure of the abstraction in terms of the underlying reality and have a hard time seeing what the big deal is - just reprogram the abstraction!
Most people's thoughts are contained mostly within the system, having been indoctrinated into it from birth (constant rote memorization in primary school, blind repetition of contradictory facts, scolded by adults with tenuous justifications every time they don't follow the pack, etc). So they take what they're told at face value and follow along, all the while never seeing the whole picture and hence remaining afraid of mysterious agents that can take advantage of them for what they don't understand. If they're told that a collection of email addresses is a threat to their way of life, they'll actually believe this because they lack the broad framework to analyze the truth of this statement. They'll instead trust the system and assume it's correct, feeling that if it were indeed wrong they would no longer be able to take anything for granted.
I theorize that all religions begin with understandings of fundamental truths that are summarized to pass along. They then ossify into mechanical words and take on an oppressive life of their own :/.
Bruce looks at his, then checks that he can look at some others - he collects 100 examples and angered by this he takes those examples and posts them on his blog as proof of a major security failing so bad it's embarrassing
Now weev it seems is an Unpleasent person who has been looking for ways to attack AT&T. - but is the strawman argument above an accurate analogy to the facts of the case?
If so I really don't see what his motives or personality have to do with anything other than his sentencing. It's the prosecution and conviction that seem wrong afaik
The world is full of sensitive information that's basically protected on the honor system, for the same reason the world is full of unlocked doors: because we assume some assholes won't come around and abuse the situation.
AT&T had a duty of care to protect their Data which they signally failed to do. Then some asshole finds out and makes that situation public. He did not do so in a responsible manner but four years is a long time to get for being an asshole.
If that is commonplace HN is going to be a smaller forum
Weev was convicted, by a jury, of fraud in connection with personal information. The jury believed he intended to sell the e-mail addresses he collected to people who would use them for various nefarious purposes. Given that he claimed he was going to do so in IRC conversations, it's really hard for you to sit there and argue that the jury was unreasonable in reaching this conclusion, and that all they are really punishing him for is blowing the lid on AT&T.
What you're doing is trying to create a particular narrative about Weev's intentions, but ignoring that the jury in this case heard and rejected this narrative.
Whilst I see that there are times and crimes it is viable, it's just a vicious circle.
He intended to commit a crime, but did not? And so he got jail?
I admit I am taking this too far on too little reading of the case (any links to original docs would be useful) but intention is real flimsy.
The way the CFAA works is that it's a misdemeanor unless the illegal access is pursuant to some other crime, which bumps it up to a felony. Had weev simply stumbled upon AT&T's security flaw and reported it AT&T, the worst they could have gone after him for is a misdemeanor.
People are acting like the fact that he downloaded tens of thousands of pieces of personal information is totally irrelevant, but it's not. It's highly relevant. It's why he's been convicted of a felony rather than a misdemeanor. And it should make intuitive sense and it's mind-boggling to me that somehow people on here intellectualize the situation to the point where they write out this part of the facts.
In meat space, the crime of trespassing can range in severity from a nothing to a serious felony depending on what the surrounding circumstances says to a jury about the trespasser's intent. Here, it was totally reasonable for a dispassionate observer to conclude that weev's intent in downloading tens of thousands of pieces of personal information (not to mention the IRC conversations) was seriously malevolent.
It should finally be noted that the "fraud in connection with personal information" conviction would have been by itself sufficient to support the sentence.