News for hackers. Stuff that matters.
Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by tptacek on Tuesday October 22, 2013 @09:30PM (#6596154)
The Digital Bond blog, which covers the computer security subfield of SCADA assessments, is spinning this story pretty hard, which I think you'll see pretty quickly if you skim the actual court order.

What's happening here is that Cory Thuen, a former developer of a network security product called Sophia at a company called Batelle, was fired (he did not "leave") apparently after it was determined that he was making a personal copy of Sophia called Visdom that he planned on open sourcing. When Thuen went on to start his own company to release Visdom (Southfork), Batelle sued for copyright infringement.

Two things are happening at this point in the story, if I'm following it right. First, Batelle has prevailed in a preliminary injunction ordering Thuen to take down Visdom. It did so by making a showing that convinced the court it was likely to prevail in its suit, and that argument included admissions from Thuen that he had copied at least some of Sophia.

Next, Thuen is being ordered to comply with discovery in the suit. Hard drive images are standard ESI evidence in cases like these; it is not at all weird that a court would order an image of a hard drive. The idea that an adversary in a civil proceeding might get access to content like this isn't at all weird; it's a basic result of the Federal Rules of Civil Procedure.

There are two wrinkles to this case:

First, the court ordered that Thuen be served with the demand for his computer without prior notice. According to the order, this is something that the court can do in extreme situations to prevent evidence from being spoiled. The reasoning the court used here is janky: Thuen claimed to be a "hacker", and the court hung its assessment that he might be likely to blitz his hard drive on that.

Second, the court order escrows the hard drive image with the court, allowing Batelle's forensic expert to image the drive but not examine that image; the court hasn't yet determined what access Batelle will have to the image, but is instead taking steps to ensure that the image is available should it be needed.

Once again: hard drive images are not an unusual product of civil discovery. You do not have a "4th amendment right" to avoid civil discovery.

The "hacker" thing is facially ridiculous. But contra Digital Bond's claim, "hacker" didn't enable the hard drive imaging to occur; that was going to occur during discovery no matter what. Instead, "hacker" changed the prior notification procedure used to obtain the image.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by mpyne on Tuesday October 22, 2013 @10:52PM (#6596511)
> When Thuen went on to start his own company to release Visdom (Southfork), Batelle sued for copyright infringement.

I have no idea as to the merits of the case, but I find it funny how liberally some OSS types feel with regard to copyright.

At least for GPL advocates, copyright is a feature, not a bug. "Copyleft" may very well be just a hack of copyright law, but it depends on strong copyright to work at all. That's why so many Free and open source software projects take the progeny and licensing of source code so seriously. It's not simply that we wish to comply with the law, but that the laws regarding copyright are essential to the ecosystem as a whole.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by tsaoutourpants on Tuesday October 22, 2013 @11:08PM (#6596576)
I think you overestimate the necessity of copyright law to the open source community. Even if the community could not legally force people to play fair with open source code (by releasing modifications, not charging, or whatever the terms are), people would still continue to write it.
Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by mpyne on Wednesday October 23, 2013 @10:25AM (#6598899)
> Even if the community could not legally force people to play fair with open source code (by releasing modifications, not charging, or whatever the terms are), people would still continue to write it.

There was a reason I made clear to mention GPL advocates. There are differing definitions of "software freedom" that target the developers of software and the users of software.

When your political movement aims to ensure that the source code for the software that people are using is actually available and stays available then you need something like copyleft.

If your idea is instead to ensure that people are free to release source code for free if they wish, then there's not actually a battle to be had! That was how software started out after all, but that was also what led eventually to users being closed off from their source code.

RMS explains it better than I can: http://www.gnu.org/philosophy/open-source-misses-the-point.h...

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by reginaldjcooper on Wednesday October 23, 2013 @02:06AM (#6597196)
Source: BSD and MIT-licensed software.

(Unless I'm misunderstanding, you can charge for GPL software, you just cannot charge for the source once they've got a binary. You also can use your own fork of GPL on your hardware without releasing any source.)

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by nitrogen on Wednesday October 23, 2013 @03:17AM (#6597372)
You can charge a reasonable distribution/duplication fee for GPL source code. The early FSF funded itself by selling several hundred dollar copies of GNU (apparently that took a lot of tapes back then).

See https://www.gnu.org/licenses/gpl-faq.html#DoesTheGPLAllowMon...

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by mpyne on Wednesday October 23, 2013 @10:29AM (#6598923)
> You also can use your own fork of GPL on your hardware without releasing any source.

I believe this is no longer true (at least in general) as of GPL v3. In fact this "Tivoization" is one of the very things the GPLv3 was intended to combat.

Software-as-a-Service is another thing they were aiming at... I don't know offhand if it made it into GPLv3 or not.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by tikhonj on Wednesday October 23, 2013 @12:35AM (#6596907)
No, copyleft does not fundamentally depends on strong copyright law. That is just an implementation detail. It would work just as well--better, actually--if it was enshrined in actual law. In fact, I understand this is what the movement actually wants; unfortunately,a law like this is unlikely to get through the legislative process. Happily, we can use some "legal judo" to turn copyright onto itself, creating an opt-in system to remove copyright using existing laws.

In short: copyleft only depends on copyright because it has to, and it only has to because it's a minority position. Actual GPL supporters would be perfectly happy if the equivalent of the gpl was law and normal copyright did not exist.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by willvarfar on Wednesday October 23, 2013 @01:25AM (#6597069)
As its not enshrined in its own law, in reality it does depend on strong copyright law.

Some contributors that you know - perhaps the majority that you know - may be shaky about this, they may not understand this, but it doesn't make it false and nor does it mean that other contributors are ignorant.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by reginaldjcooper on Wednesday October 23, 2013 @02:03AM (#6597182)
So it's actually "receive a warrant, lose your 4th Amendment rights". Uh, yeah, obviously, that's what we want, reasonable search and seizure.

tptacek thanks for being the voice of reason in these infosec law threads.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by tptacek on Wednesday October 23, 2013 @01:58PM (#6600451)
Is it even a warrant? A warrant authorizes law enforcement to search a person/place/thing for evidence. A discovery order is a demand for a specific piece of evidence. Nobody is "searching"; the court knows exactly what it wants --- the whole hard drive image.

Remember in the Netscape vs. Microsoft case, when the contents of Jamie Zawinsky's "Really Bad Ideas" mailing list were released? That was because of a discovery order demanding Netscape's email spools.

It's for exactly this reason that large companies have specific policies about document retention.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by everyone on Tuesday October 22, 2013 @10:20PM (#6596392)
Why is it not standard practice for people who work in security or anything remotely contentious to keep their work OS, programs, data and so on, on a usb stick that you can just hide somewhere when you are not working on it?
Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by vidarh on Tuesday October 22, 2013 @10:36PM (#6596447)
Because people have a tendency to either think they're too good to get caught, or that they're not really doing anything wrong / anything anyone will go after them for.

Also, I'd assume we don't get to hear about the people that actually are too good, as they'd be more likely than most to avoid getting suspected in the first place.

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by rob05c on Tuesday October 22, 2013 @11:09PM (#6596582)
Also, laziness. Knowing proper protocol doesn't preclude procrastination. "I'll lock everything down tomorrow."
Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by aclevernickname on Wednesday October 23, 2013 @06:32PM (#6602209)
> First, the court ordered that Thuen be served with the demand for his computer without prior notice. According to the order, this is something that the court can do in extreme situations to prevent evidence from being spoiled.

I'd accept upon equal consideration being provided. Why should he have to be forced to pay for what is essentially a fishing expedition by the prosection? would they have a case should the computer not be taken?

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by tptacek on Thursday October 24, 2013 @08:39AM (#6604860)
They don't keep the computer. They image it quickly and return it, and the image is escrowed with the court. He doesn't pay for anything.
Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by aclevernickname on Thursday October 24, 2013 @08:24PM (#6609027)
I was considering the offering up the computer (asset) as payment, or, at the very least, collateral, on the charges. Since they're using accounting/banking terms for these charges anyway (how often do you see "Escrow" used in a court case?), no reason to not try to settle/close this as if it were just another probate/bankruptcy issue. :)
Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by nitrogen on Wednesday October 23, 2013 @03:21AM (#6597390)
...admissions from Thuen that he had copied at least some of Sophia.

Does it say whether he copied features in a new implementation, or copied actual source code from his employer's existing implementation?

Re:Call Yourself A Hacker, Lose Your 4th Amendment Rights by tptacek on Wednesday October 23, 2013 @01:55PM (#6600432)
It says only that he admitted to copying something.