Hacker News Reader

Comment by JoachimS | Hacker News Reader

Indeed. The company has now gone to the police to report the newspaper and its journalist for hacking.

It's good to see that we Danes have exported something to Sweden. The same thing happened after someone "hacked" some school webapp-thingy, I can't remember the exact details, by changing the URL to get access to another students data. He was promptly reported to the police for hacking after he reported it to the company.

If I recall correctly, that's very similar to how Weev went to jail.

https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

A very objectionable fellow, but I'm sure they'll move on to more sympathetic ones now that the precedent is set.

The ruling was overturned, so was a precedent really set?

I guess not. But he was still in prison for 2 years. And anyone else can be put in prison for 2 years without actually comitting a crime too. The CFAA is just that vague. And they likely won't have the legal support that weev did.

That's the real precedent here. The feds can and will throw you in prison for years for not comitting a crime.

From Wikipedia: "On April 11, 2014, the Third Circuit issued an opinion vacating Auernheimer's conviction, on the basis that the venue in New Jersey was improper.[48][49] While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.[50] He was released from prison on April 11, 2014.[51]"

My (foreign layman's) take on it is that the lower court precedent still stands, as it was not formally overturned.

I just looked it up again, and he actually did hack them:

"Forælderen, Henrik Høyer havde blandt andet opdaget, at den infoskærm, som hver enkelt børnehave havde i systemet, var befængt med et sikkerhedshul, der tillod cross-site scripting. Ganske enkelt blev de beskeder, som man skrev til den fælles infoskærm, ikke renset for tegn, der gør det muligt at indsende Javascript-kode.

Det udnyttede Henrik Høyer til at skrive en simpel Javascript alertbox, der poppede frem med beskeden 'Ring til Infoba og sig at jeres nye intranet løsning er blevet hacket', hvorefter brugeren skulle trykke ‘OK’.

Det var der flere af pædagogerne, som så, og som undrede sig over, ifølge Infobas produktchef.

»Jeg skrev til Infoba og hørte aldrig fra dem. Så lavede jeg den her løsning, som måske var lige på grænsen for, hvad man må,« siger Henrik Høyer og fortsætter:

»Jeg lavede et harmløst javascript, men kunne have gjort det meget værre.«"[0]

(Sorry for the danish ya'll)

[0] https://www.version2.dk/artikel/foraeldre-finder-banale-sikk...

My porridge-language is limited, but if I understand correctly he used an XSS vulnerability to place an alert box on the page telling the users of the system they should contact the provider and tell them the system had been hacked. It could of course has been much worse. He was later found not guilty:

https://www.version2.dk/artikel/derfor-blev-henrik-hoeyer-fr...

Yeah totally benign, the only ones guilty of anything is that awful contractor. I just wanted to point out that there was more to the story than a police report over emails.

A classic move. Do you have any sources to link for this? I'm interested in reading more about them reporting the journalist.

You can read more here[0], unfortunately it is in Swedish, and not that much. More or less, the editor in chief of the journal denies to comment. The charges are suspected data breaches, suspected instigation of data breaches and unauthorized disclosure of personal data.

[0] https://omni.se/medhelp-polisanmaler-tidning-efter-avslojand...

This surely will end well for the company.

Reply on news.ycombinator.com