Hacker News Reader

Comment by wallace_f | Hacker News Reader

As a layman on the subject, I guess cryptographers are attempting to crack keys every day...

With house locks, it's a plain distinction between breaking into a lock and breaking into a house. With cryptography, I imagine that distinction is really problematic?

Though I'm aware in Assange's case they do have proof of intent, but I wonder if it sets bad precedent, or is a case where they just dug up either far-reaching, obscure, or some law which is practically never really enforced?

Edit: my original comment was written poorly

View on HN

It's illegal if someone "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any department or agency of the United States; or... information from any protected computer". It doesn't matter that much how you try and do it, cracking a password would seem to naturally count. It doesn't matter if you guess the password because you knew the owner's dogs's name and date of birth, it's still intentional access (and it doesn't matter if you failed because the password was too tricky, attempted crimes are still crimes).

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act#C...

Attempting to crack a hash locally is distinctly different from trying to gain access to someone elses computer.

Intent is very important in the judicial system.

If Assange can show that he was cracking the password of a US military login as a hobby, he might get away with it.

But I don't think even his ardent supporters would buy that theory.

I would hope that the government would have to show actual acts in furtherance of the conspiracy to charge people, but that's not what happened here.

The only supposed criminal act here is agreeing to help, not actually providing help. This does nothing at all to further the conspiracy.

So you're saying he... conspired to do something illegal?

Yes, but where I'm from you need to actually do something in furtherance of the conspiracy to face prosecution.

I'm not trying to make a legal argument, this just feels fundamentally wrong to me.

https://www.law.cornell.edu/uscode/text/18/1030#b

"(b) Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section."

Seems pretty straightforward.

Please don't post about how the law works from your gut feelings about the matter. This forum is awash in people just imagining what the law is every time it comes up. Go look at the law itself. There's no requirement as you've imagined there is.

This was a bit snarky before my edit - please excuse me.

Assange wrote in a chat "No luck so far" to Manning.

Where you are from, can you go around trying to pick locks on front doors and are only prosecuted if you succeed? And the same with cars?

This is a very poor analogy and I think you know it. Cracking the password isn't the same as using it to log in. There are still some extra steps required. In the case of picking locks there are no extra steps, you gain access immediately.

I'm only critizing the analogy, what he did, or tried is still illegal but it's barely a hack attempt and it's obvious they are desperate to charge him with anything, no matter how small the charge.

That's how conspiracies work. Each participant does only a part of the overall conspiracy. If I forge a document and give it to you so you can sneak into a secure area and commit a murder, I am not just guilty of forgery, I am guilty of conspiracy to murder.

They guy who drives the getaway car is guilty of murder as much as the people who walk into the building.

This is the entire point of conspiracy law. Driving a car is not a crime! But it is if you're conspiring with other people who are committing crimes. Otherwise, you would be able to take part in a murder and be let off, because all you did was act as lookout.

If you and a friend plan to poison someone, and you buy the poison and give it to your friend who then poisons the target, you are guilty of conspiracy to murder, even though buying the poison may not actually be a crime. Prosecutors may legitimately not have anything else on you because that's "all" you did!

I think you read over the part where I said it was illegal.

You don't need to invent scenarios, you can use the facts of this case.

Manning already had access and didn't need the password to be cracked. Wikileaks already received information from Manning. Someone in the chat log told Manning they would pass the hash to someone else. They then told Manning "no luck so far".

Keep in mind, they haven't provided any proof that the person Manning was talking to was Assange. They haven't provided any proof that Assange did in fact try to crack it He never wrote that he would try, only that he would pass it on. Or that he actually send the hash to someone else to crack it, and that this person did in fact tried to crack it.

And to top it all off, Manning did not need the password in the first place! People keep forgetting this. The case against Assange appears to be very weak and is probably only intended to get him on US soil to question him about things other than what he is charged with.

>Or that he actually send the hash to someone else to crack it,

Still a crime.

>And to top it all off, Manning did not need the password in the first place! People keep forgetting this.

Still a crime.

What are talking about? Is it because I said it was illegal instead of it being a crime?

The first sentence you quoted was also part of a larger piece about we still need to see the proof that he actually sent it to someone else. So replying "Still a crime" makes zero sense.

In any case, the point is that these are trumped up charge probably to get him to the US so they can question him about russiagate.

> Manning already had access

To Manning's account. She didn't have access to the account she was trying to crack. Getting access to accounts that aren't yours ("exceed[ing] authorized access")- or conspiracy to do so- is more or less exactly what the CFAA is meant to prohibit. Maybe that account had exactly the same permissions that her account did, but the fact remains that she was not authorized to log in to that account.

> proof that Assange did in fact try to crack it

Proof is for trial. A grand jury just has to find probable cause to bring the indictment. Probable cause is quite a low burden of proof. You may not like it! but this is extremely normal in the American system. You don't need proof to bring an indictment, just probable cause. Assange is not special here. A chat log of someone saying "brb gonna go do the crime" followed by "no luck so far" seems pretty probable-causey to me.

I suppose Assange's defense will be that he never actually even tried to crack the password- if he was lying or bloviating, he would not have actually done anything in furtherance of the conspiracy. If that turned out to be the case I'd be with you. But if you have chat logs saying "I will do the thing to try and help you commit a crime" then that sure seems like evidence that you did the thing, or at least tried to.

It's not aupposed.

The court's job is not to enforce ryanlol's idea about what the law should be. The court's job is to enforce the actual existing text of the actual existing laws.

The actual existing laws say that attempting to break into a computer to which you do not have access is a crime, even if your effort alone is not the lynchpin. And that conspiring to help someone else attempt is also a crime.

>The court's job is not to enforce ryanlol's idea about what the law should be.

Ah great. Did I ever suggest that?

>The actual existing laws say that attempting to break into a computer to which you do not have access is a crime, even if you do not succeed. And that conspiring to help someone else attempt is also a crime.

This is correct, but doesn't mean that it's right.

> Did I ever suggest that

You called it a "supposed criminal act". Usually "supposed" used in that way means something similar to ostensible. That's why I started my post with "It's not supposed". In fact, that's the first definition Oxford gives for supposedly...

So if someone tried to poison you to death, but failed because he mistakenly bought sugar instead of poison, there was no crime committed? Is that how it works in your country? Is that right?

Similar to A Few Good Men, my brother's high school suspended him for selling oregano as weed.

"He's selling it as weed, not oregano, so we're punishing him as if he was selling weed".

> I would hope that the government would have to show actual acts in furtherance of the conspiracy to charge people

It does, in fact, have to allege such an act in order to charge conspiracy (but the act in furtherance can be by any party to the conspiracy; that's how conspiracy works.)

Three such acts are charged in the indictment; two by Manning, one by Assange.

How is Assange attempting to crack a password locally not an act in furtherance of the conspiracy? Attempting to drive a getaway car that breaks down is still an act even if it failed.

That is what is being alleged and the chat logs seem to support it. It might come out at trial that he didn't actually do it, of course, but that's what the trial is for.

>intentionally accesses a computer without authorization or exceeds authorized access

In this case it was Chelsea Manning accessing the computer. Assange didn't touch it.

>It doesn't matter if you guess the password because you knew the owner's dogs's name and date of birth, it's still intentional access

...by Chelsea Manning, not Assange.

Conspiracy to commit a crime is a crime.

Cracking a password is one thing; cracking a password for someone else so they can commit a crime (and you knew this was what they were doing with it) is a crime.

If I know Joe's password, and I pass it on to Steve so Steve can log in and steal Joe's secrets and pass them back to me, I am in a conspiracy to commit a crime under the CFAA.

The guy driving the getaway car is on the hook for the bank theft!

Yes, but US seems to like to slap conspiracy charges on people who've done essentially nothing in furtherance of the conspiracy.

Maybe it's a crime in the US, but it's still a ludicrous crime.

> If I know Joe's password, and I pass it on to Steve so Steve can log in and steal Joe's secrets and pass them back to me, I am in a conspiracy to commit a crime under the CFAA.

This is of course not at all similar to what happened here, a very strange example.

In this case it was cracking a password to blow the lid on US war crimes in Iraq.

I'm not saying anything about whether it was morally here or there, but that it's not at all an unreasonable application of the CFAA.

The guy driving the getaway car from the FBI field-office break-in* (or whoever) is going to be on the hook for burglary, even if the burglary was done for laudable reasons. I think Obama 100% did the right thing commuting Manning's sentence, and was pleased to see her go free. I'm not at all sure prosecuting Assange for essentially the same crime is in the interest of the nation or justice or whatever.

* https://en.wikipedia.org/wiki/Citizens%27_Commission_to_Inve...

Exposing government corruption (and sketchiness) isn't really the best area to apply black-letter law though - it is usually going to be illegal; governments routinely try to stop people publishing embarrassing information.

If a whistleblower can't intend to get information of a government network, how are they meant to make an allegation with some substance behind it? Are they meant to have unsubstantiated word of mouth? We had that for years with ECHELON, the moderate middle just didn't take any of it seriously until the breaking-the-law levels of leaking happened (yes, the legal details are different with Snowden, but the strategy is very similar - leaker gets hit with incidental charges).

The argument here seems to be that while in theory whistleblowing would be OK; none of the ways to attempt a credible whistleblow in the real world are legal. There is a lot of disagreement in this article's comments about what the law says, so it isn't obvious how a whistleblower, who could be anyone here, is meant to follow the details of what they are and are not allowed to attempt.

Assange isn't even a US citizen, so he isn't expected to know US law. Functionally, all this rigmarole is to ensure that if the US government does something sketchy or even illegal then any foreigner who talks about it is legally subject to one of the US's famous black-bag-over-the-head abductions. The charges seem to be independent of what he leaked.

>Assange isn't even a US citizen, so he isn't expected to know US law.

Ignorance of the law is not a legal defense. Most Americans are not aware of the bulk of laws that apply to them.

Apparently there was a solid legal defense for the journalist murderers in the videos released by assange. They are not facing any kind of legal action.

What defense are you suggesting? I'm not defending the killing of those journalists and I agree that what Assange did is petty in comparison. But nobody looks good in this saga. There are no good guys and bad guys. Assange exposed instances of over-classification and the potential cover-up of war crimes by the United States but eventually became a propagandist for Russia and their war crimes in Syria. Assange shouldn't benefit because some of his actions were in line with a benevolent ideology. This shouldn't be seen as an ideological clash between proponents of free speech and war hawks because it's not that black and white.

Assange can't even get a hostile media to report what he said correctly. The idea that he is running a propaganda campaign is as fantastical as the idea that you are running your own personal propaganda campaign.

Assange cannot frame narratives, suppress journalism or push talking points through media outlets under his control. He didn't control anything except one twitter feed.

The only thing that people really pay attention to and the only reason he has a platform at all is because of what he leaks. Most people don't even have any idea what his opinions are - although the effect of the leaks is felt far and wide.

This absolutely SHOULD be seen as an ideological clash between proponents of journalism (it's not even about freedom of speech, it's about freedom of journalism) and war hawks. And taking the side of the journalist murderers? Not a good look.

It is that simple and you can tell it's that simple because Assange is getting prosecuted for exposing the murders and the murderers are going free and nobody even disputes (except in a very legalistic sense) that they were murderers.

The idea that he's a stooge for Russia? There's your propaganda - it's pretty much no different to the red scare of yesteryear.

Robbing or attempting to rob a bank to donate to the local food bank is still a crime.

That is irrelevant to the fact that he's being charged with conspiracy to, which doesn't require that he's the person who actually gains access.

The indictment alleges Assange induced Manning to do it, which makes it a conspiracy.

I do think that presents big press freedom issues; it'd be easy to see news organizations under fire in this fashion. Convincing a source to hand over stuff isn't much (or at all, really) different than the behavior described in the Assange/Manning case.

Yes, that concerns me too. Where does inducement start? There must be case law on it and maybe it really is a bright line, but it seems like a bit of a reach.

> I assume attempting to "crack keys" is something cryptographers do every day?

Sure, but context matters. I drive a car every day. If I drive off in someone else's car without permission, I've stolen it.

I believe in this case it is because that key belonged to a US military computer system and was being cracked to access the data it protected.

I guess with house locks, it's a plain distinction between breaking into a lock and breaking into a house. With cryptography, I imagine that distinction is really problematic?

Though I'm aware in Assange's case they do have proof of intent, but I wonder if it sets bad precedent, or is a case where they just dug up some law which is practically never really enforced?

He's charged under the Computer Fraud and Abuse Act.

https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

I would say a more accurate distinction is breaking into someone's home vs trying to break into a military base. In the first case you're likely to get arrested, in the second they'll probably shoot first and ask questions later

Picking your own door lock is legal.

Picking someone else's door lock is legal if they ask you to.

Picking someone else's lock, if it's not actually in a door and isn't protecting anything, is not illegal, even if they don't ask you to or give permission. You're just picking up a lock and fiddling with it, there's no trespass.

Picking someone else's door lock to burgle their home is illegal.

Handing someone a lockpick so that they can burgle a home for you is illegal.

> Handing someone a lockpick so that they can burgle a home for you is illegal.

Even more so, trying to create a key that you can hand to someone to get into that home....

It's like as if Manning copied the lock at the military base and Assange agreed to see if he can figure out how to pick the copy, but failed (or never even tried, we don't know).

He took specific steps (cracking a hash) with the clear intent of helping break into a government owned computer system.

I'm not sure what the gray area is supposed to be here.

If I teach you lock picking skills as a fun hobby, that's clearly okay.

If I teach you lock picking skills knowing you aspire to be a house robber, that is grayish legally and wrong ethically.

But if I break into a specific bank vault for you to help you steal stuff, and we talked about stealing the stuff before I helped you, then I'm clearly involved in a criminal conspiracy.

Assange committed a crime, and if he played the same role in helping to empty your bank account you'd want these laws to exist.

The ethical question here is about whether that crime was ethically jusified. I.e., it's about civil disobedience, not about whether blatant conspiracy should be legal.

>Assange committed a crime, and if he played the same role in helping to empty your bank account you'd want these laws to exist.

But for your bank account comparison to make sense Manning would've already have emptied your bank account before JA broke the law.

How do you know the Administrator account wouldn't have yielded more documents compared to a user account?

Regardless, imagine two independent people trying to murder someone. The first shoots a fatal bullet and the victim is about to imminently die, even if the best medical aid were to be immediately provided. Then the second murderer comes on the scene, does not realize that the victim is fatally wounded, and shoots another bullet, instantly killing him.

Both these people would be fully responsible for the murder, not just attempted murder. Arguments from them saying "no, the other killed him, I did not", do not fly in court.

Reply on news.ycombinator.com