Reporter likely to be charged for using “view source” feature on web browser
boingboing.net
boingboing.net
That reporter is a victim of harassment, and that if it wasn't for "view source", it could be for some unrelated stuff. It's the same as protesters being arrested for all kinds of bogus reasons, or random people being arrested with planted evidence. The goal is to deter someone you don't like from exercising their legal right (journalism, protesting, standing in the street in the wrong neighbourhood), by weaponizing unrelated laws.
The only reason "view source" is being talked about is because that looked like the best case when the book was thrown at that journalist.
I hope that case remains at threats and doesn't get to actual charges.
[1] https://revisor.mo.gov/main/OneSection.aspx?section=569.095
"A person commits the offense of tampering with computer data if he or she knowingly and without authorization or without reasonable grounds to believe that he has such authorization"
No one could possibly prove beyond a reasonable doubt that the reporter did not have "reasonable grounds to believe that he has such authorization". The reporter did not know that the website had private information on it when he accessed the page.
The law does allow for a civil action to be taken by the owner of the computer system (In this case the state) which would lower the standard of evidence to more likely than not- but given the facts of the case, I don't think it comes even close to meeting that bar.
That said, it seems like a prosecutor could articulate an argument that the reporter accessed information he had no reasonable grounds to believe he was authorized to access because he deliberately decoded some Base64-encoded strings that the reporter expected to contain sensitive information. Further, that because the reporter knew the site was using encoding to "protect" this information, by decoding the information he had believed might contain unauthorized information, he had "examined information about another person" that he had no "reasonable grounds" to believe he was authorized to access.
For every objection that is coming to your mind reading this, think to yourself whether you are confident you could convince a tech-illiterate prosecutor (who is looking to "hold fake news accountable") to see things your way. Further, is a jury or a judge going to be able to find salient AND relevant differences between "decoding" and "decrypting" or "client-side" vs "server-side" software? And are those differences great enough to affect their interpretation of the reporters actions in the context of the statute? Judges, prosecutors, and juries cannot be relied upon to unwrite bad tech laws.
“It is difficult to get a man to understand something when his salary depends upon his not understanding it.”
— Upton Sinclair
From a mathematical or CS perspective, i.e. from the perspective of objectivity and rigor, the Base64-encoded strings contain precisely the same information as the decoded version.
Even from a lay perspective... it's as if the state issued a public declaration in Chinese, and translating to English was "accessing" different information than the Chinese original.
Ask the prosecutor if sharing stolen Base64-encoded SSNs would be _legal_ because Base64-encoding makes them _different information_ than the original SSNs.
You won't be able to convince the prosecutor of anything ever, but you won't get a straight answer to that question either.
As a juror your job is to convict or acquit based upon the law and jury instructions given to you. Your job is not to convict or acquit based upon your opinion on what the law should be.
I suppose it's true, though, that poorly-encrypted ciphertext still contains the original information as the plaintext.
Encryption has the clear intent of removing all the plaintext information from ciphertext, producing a random string that is useless without a secret key, but this may fail, and then the plaintext information remains.
However, encoding information (in Base64 or otherwise) has the intent of removing no information.
My original formulation of argument was flawed, since it made no reference to or distinctions of intent.
If the law is overly broad about unauthorized access of the information and if by default the information being accessed is not plainly readable without conversion requiring special knowledge or software, I think a conviction might be likely and justified.
What does "raise eyebrows" mean?
You hypothesize a jury that simply doesn't understand the word "encoding," and can't be taught its meaning because it sounds like "encryption"?
If a message were broadcast in Morse code, then you could be convicted for unlawful access if you were to decode that into letters, right? Because it's Morse "code," an encoding.
I guess juries might not convict in that case because they've heard of "Morse code", but not "Base64 encoding"?
Anyway, if communication with juries is this fragile (and maybe it is) then a jury conviction really means nothing and the trial system as a whole is pretty hopeless and certainly cannot justify imprisonment of anyone.
To use a metaphor—if a state building is closed, but a person with certain knowledge knows that the windows on the building are easily opened by lifting and pulling in a certain way. Then, that person opens the window, enters the building, takes pictures of sensitive information, and later tells the government about the window, then writes to the world later after the government replaces the windows about how easy it was for them to enter and find that sensitive information, would they be guilty of breaking in and stealing information? I think yes.
Even if their intent was not malicious, and ultimately resulted in more secure data, they did something that was not authorized and then capitalized on it after. If the law doesn’t have a caveat for that situation and if the jury is doing its job and doesn’t have an instruction to allow the out, a conviction is likely.
> I think the standard lay person on a jury would not necessarily be open to a defense attorney attempting to explain that the word “decode” in goes against their base understanding of the word.
If they're not "open" to understand what Base64-decoding means, then they're not open to understand what the defendant did. Maybe that's true. If so it's a very deep indictment of the process. If what you are saying is true, the judge should not allow the prosecution to use the word "decode."
> To use a metaphor—if a state building is closed, but a person with certain knowledge knows that the windows on the building are easily opened
We don't need a metaphor. I used another actual example (not metaphor) of a encoding -- Morse code. A person who takes a transmission in Morse code and writes it down on paper has decoded it.
Is decoding Morse code allowed "without authorization"? Do I have a right to broadcast information on my HAM radio and then demand prosecution of any people who decode it?
It seems you would argue yes. Or else "no, but only because juries have heard of Morse but not Base64."
If the state, in this case, had used strings of "." and "-" to encode the data in Morse code, instead of Base64, do you think they would have the same case?
Or what if they had used Greek instead of English? (I think if you insisted to use a metaphor for encodings, that would actually be a good one.)
But all of that still doesn’t matter if that reporter was in possession of data he was not authorized to have and the law prohibits that . So what you have is decoded data in possession by someone who wasn’t allowed to have it but could be valid for him to have possession if it was encoded. If that is the way the law is written or the jury instruction is given…it’s a hill for the defense to climb.
But I can say with a very high level of confidence that ultimately this case has no legs to stand on.
That's basic legal harassment 101.
My feeling is that this is deliberate; the American right wing appears to rather like performative stupidity these days.
You tell me how indirect influences could possibly happen in separated and just legal system.
Sorry for the snark, but your post seems very naive on how the legal system works.
The punishments for missing these dates are among the most extreme and disproportionate in the whole system.
(With no due process, and COVID infections for all.)
Whether a jury would convict. Juries are much more complicated than most people imagine. For a start, the prosecutor is going to show the statute and the evidence and show how the person violated the statute. There might not be a proper legal defense.
You might be thinking of jury nullification where a jury acquits a defendant even where they are proven guilty, simply because the charges are bullshit. This almost never happens. Although it really should happen much more often.
I prefer the Verge article on this one though [1]. Relevant quote from the article:
> They turned the case over to Cole County Prosecuting Attorney Locke Thompson on Monday, December 27. Governor Parson then held a press conference on Wednesday, December 29, where he cited a state statute related to computer tampering and repeatedly suggested Thompson should use it to prosecute Renaud and the paper.
It was just earlier this week that this was turned over to the prosecutor's office. This prosecutor is an elected official, and the Missouri conservative PAC has put their money behind this by placing attack ads against the reporter, and framing this as "holding the fake news accountable" [2]. Also, IANAL but if we're going by the letter of the law, the local Missouri computer crime section certainly does seem to include the actions of the reporter [3], even if the SSNs weren't Base64 encoded. Bad law, but the fact that the law is bad doesn't have bearing on whether they'll decide to prosecute.
[1] https://www.theverge.com/2021/12/31/22861188/missouri-govern...
[2] https://www.youtube.com/watch?v=9IBPeRa7U8E
[3] https://revisor.mo.gov/main/OneSection.aspx?section=569.095
I will not name any in specifics because that may start an internet slap fight.
-Lavrentiy Beria
https://www.oxfordeagle.com/2018/05/09/show-me-the-man-and-i...
I don't like the framing either, but for different reasons. From my reading, the journalist is being targeted for reporting the vulnerability or perhaps for exploiting the vulnerability- I'm not sure.
To be clear, most websites have some disclaimer that says "don't use this website for unauthorized purposes". This is deliberately vague and includes "don't use SSNs that we leave laying around".
Should the website leave SSNs laying around? Definitely not.
Should the web site owner have the strong arm of the law come smashing down on them? Absolutely.
Should others use those SSNs? Definitely not.
If the journalist saw the SSNs and then did nothing, leave him alone. If he did something with them, charge him. If he reported them, and he is being harassed for reporting them, then write an article about that.
The only way he should be charged is if he committed identity theft or sold the numbers.
This entire debacle is a direct attack on journalists.
As if this attack on a free press wasn't brazen enough, local PACs have already put out attack ads against the journalist, to frame this as the governor "holding fake news accountable." [1]
He reported on the vulnerability, even telling the state it existed. He never exploited it.
Honnestly, if I was a young, college educated innovator would that make me more likely to move to Missouri (or stay there) or move out of state?
Is Missouri attracting talent with these policies and practices?
Conservatives are swinging for the fences with their base in decline. I can come up with no other explanation for these disingenuous actions.
I really hate the idea that trying to do the right thing (reporter telling MO DoE about SSNs being in their HTML) results in prosecution to save face instead of reflection and congratulations. This is how you get more crime.
Also, REALLY?!
That means that Google indexed those SSNs!
Not necessarily. The SSNs were returned in search results from an HTML form. Last I checked, google's crawlers don't POST forms.
Imagine requesting a voter registration form and you receive a letter in the mail with all previous residents social security numbers encoded in QR codes that were added as a "convenience feature" for the voting office
In that case, it'd be ridiculous to claim you "hacked the voting office"
It's not like picking a lock. It's more like turning over a sheet of paper to read what's on the other side. If this guy gets convicted, I'll eat my hat (I wear a fedora).
"Thy just thow their fedora wherever the floor is And start doing horas and taps".
That isn't adequate protection at all.
It allows the voters to elect officials who will persecute the minorities that those voters want persecuted.
Most especially, black people in the USA definitely need protection beyond that.
This was only a few lines below that.
You don't get to publish a "rendered webpage"; what you publish is raw HTML. If you didn't want people to read it, you didn't ought to have published it.
[Edit] Also, taking a copy of the HTML isn't like taking keys and a purse. If you take keys and a purse, the owner has been deprived of them. That's not the case with taking a copy of a webpage.
The journalist literally only saw what you legitimately see from the street, just as “view source” only shows you what you’re supposed to see anyway.
As far as the technical analogy goes, I’d probably agree.
This data is what forms the page that is displayed and is accessible to anyone that can tap the server. This data is what they broadcast to the public
You wouldn't be able to go and shout a bunch of SSNs in the middle of the street and then prosecute anyone who was listening
Shouting your information in public is not and should not be grounds to prosecute those who are listening.
That you focus on the technology side, fine, but don't dismiss people who say the "theft" is not in fact theft, regardless of "technology" involved.
It's a good analogy.
The "open front door" analogy works in some instances of "hacking," like enumerating an ID field in a URL. But in those cases you are making an active request to "enter the door" for each ID. That's not the case here – you downloaded a page you have access to, and the server included more data in the page than it should have, without you asking for it.
It's like somebody tossed a phone book into your open door, and then prosecuted you for reading it.
A bad actor would have actually stolen the purse. Just like a bad actor would have used the social security numbers to commit identify fraud. Since neither of those things happened, prosecuting anyone is ridiculous, in both the analogy and real life.
I say the example is good.
GET / HTTP/1.1
If you don't happen to have a GUI ([Edit] or something like Lynx), that's how you read a website. It's not reverse engineering, or de-compiling; that's just displaying exactly what the server served.
Say your neighbor has an atrium and gets medication delivered. Said medication is clearly labeled as light/heat sensitive, and the package is left by the delivery person in direct sunlight. Their front door is unlocked.
You open the door and tuck the package safely inside.
Breaking and entering?
Anyone telling me that qualifies has some serious thinking on Mens Rea to do.
https://www.law.cornell.edu/wex/breaking_and_entering
Breaking and entering is the entering of a building through force without authorization. The slightest force including pushing open a door is all that is necessary. Breaking also includes entering a building through fraud, threats, or collusion. To constitute entering, it is sufficient if any part of the accused’s body is introduced within a building. It is not considered breaking and entering if the premises are at the time open to the public or the person is licensed or privileged to enter.
I completely agree though that nobody in their right mind should want to prosecute you for this. This is the differences between the actual letter of the law as it would be applied by a computer algorithm automatically and a good judge / jury that interprets the law and the facts.
Where's the force? Door unlocked. I'll give ya the lack of auth though as I'm not willing to die on the hill of unlocked doors being an implied grant of authorization.
The slightest force including pushing open a door is all that is necessary.
As in, I would agree with you that force in regular use is usually used in the sense of a large force. But that is not the actual definition and o ly possible use of the word.
You ordered some medication, and the delivery guy drops it in your atrium. You open the package and find that it includes your neighbor's medication, too. You tell the delivery guy that he sent your neighbor's medication. The delivery guy calls the police and requests you be arrested.
It's more like if the New York Times dropped a newspaper at your house with the answers to next week's crossword puzzle included on the page.
Your analogy is much more apropos. Nothing was tampered with or “pulled” from another location, virtual or otherwise. Everything the reporter saw was already there and accessible (the public website), they just knew how to use their lens (browser) in a perfectly legal way to see it.
You should do that regardless.
I don't know what it is; maybe they think it's vanity and fashion. If you asked anyone I know whether that matched me, they'd all burst out laughing - I'm a notorious slob.
I wear a hat because my natural scalp insulation is wearing out, and when I buy things I like to buy good things. A good felt hat with a brim is resistant to heavy rain, for example, and makes a brolly unnecessary.
I like to cook; but I don't know how to cook rabbit-fur felt so that it can be chewed. And my digestion isn't that great. Maybe I went too far, saying I'd do that.
The web page used an old .NET framework that serialized the application state, base64 encoded it, then dumped it in a hidden form field at the bottom. When you navigate pages, the data is POSTd back to the server to achieve a "stateless" web app on the server side
The reporter had to view source and base64 decode the data
Obviously still trivial but I think the laws are also very ambiguous on "decoding" and "accessing"
Wow. I was a C# developer for many years and I never realised that ViewState encryption was _opt in_[1].
[1] https://docs.microsoft.com/en-us/previous-versions/aspnet/bb...
It would be trivial to loose a bot on government TLD's and see who else is putting unencrypted PII in their viewstate.
It would be hilarious if those docs got updated to say customer IDs or SSNs. Lol.
The craziest part is that if you had made that same mistake and leaked a bunch of SSNs the same government would be fining you and accusing you of being negligent. It's insane.
If base64 is an encryption, then so is jpeg or *.docx .
Reporter notices, reports it to the state, waits for it to be fixed, then runs the story.
State governor goes after reporter.
The state governor is either an idiot, or trying to cover up iltheir incompetence, or both. And doing so in a way that makes him look like more of an idiot.
If the prosecutor takes this up then either they're an idiot or being pressured to do so, by the idiot in charge.
He's both, in addition to trying to "stand up to the fake news" for his voter base.
“Likely to be charged” is a huge stretch.
In between the grandstanding some of the politicians asked such odd questions, I think an introduction to digital safety should be a requisite course for all public servants along side antidiscrimination and inclusivity.
I wouldn't be surprised if there is someone already in jail who has been charged and convicted to a similar action.
Here is a Canadian example of a similar event.
https://edmontonjournal.com/news/politics/covid-19-records-w...
It’s news if he’s actually charged, it’s much less news if a frustrated governor blows off steam about it.
This is, so far, nothing more than the latter.
And this isn’t harassment yet. This is just a statement, nothing has actually happened.
If you want to see where this could go, check out the story of the data scientist who whistleblew on the Florida government hiding COVID deaths [0].
But none of that’s happened here, yet.
[0] https://www.beckershospitalreview.com/healthcare-information...
At this point it really is unlikely that the reporter will be charged.
The feds' involvement would be for prosecuting the reporter for CFAA violations. Missouri has its own computer intrusion legislation that would be the basis for charges from the state.
> They turned the case over to Cole County Prosecuting Attorney Locke Thompson on Monday, December 27. Governor Parson then held a press conference on Wednesday, December 29, where he cited a state statute related to computer tampering and repeatedly suggested Thompson should use it to prosecute Renaud and the paper.
As of the time of writing this comment, that was four days ago, and during the holidays. It certainly seems like charges will be brought unless Thompson chooses to side against the Governor and decline to pursue charges (I'm not sure what the political implications of that would be in either direction.) State statute is here [2]. IANAL, but this statute seems very broad. Especially sections 3, 4, and 5:
>A person commits the offense of tampering with computer data if he or she knowingly and without authorization or without reasonable grounds to believe that he has such authorization: [...] (3) Discloses or takes data, programs, or supporting documentation, residing or existing internal or external to a computer, computer system, or computer network; or (4) Discloses or takes a password, identifying code, personal identification number, or other confidential information about a computer system or network that is intended to or does control access to the computer system or network; (5) Accesses a computer, a computer system, or a computer network, and intentionally examines information about another person;
Like, yeah, factually the reporter did examine information about another person without authorization. This law sucks, but it is not a stretch to think they will prosecute the reporter.
[1] https://www.theverge.com/2021/12/31/22861188/missouri-govern...
[2] https://revisor.mo.gov/main/OneSection.aspx?section=569.095
My guess is the prosecutor will decline to pursue.
For example, you could decide that a prosecutor is the best at knowing the law, so let's have a law exam where the one with the best score is named prosecutor. However, being a good prosecutor can't always be reduced to a technical know-how. And those good at laws might be those who were able to pay to go to the best universities, buy the textbooks, be allowed to study for years without working, etc. So you also have a bias on wealthy families.
I don't think that the problem of allocation of power in our modern societies is a solved problem...
Politicisation is endemic to the US justice and policing system, it’s an absolute disgrace. I agree no system is perfect, we have miscarriages of justice here in the UK too, but perfection is not the enemy of the good and your system is below mediocre. You can do, and deserve, a lot better.
The state attorneys and police are part of the executive branch and subject to directives of the politician in charge. Theoretically, electing the state attorneys directly would motivate them to not just do whatever the administration wants, be that legally reasonable or not. In practice it probably does not matter.
Until the 70s, the role was filled by the office of the attorney general, who's a direct government appointee (strictly speaking appointed by the president on direction of the government). The separate agency was created to defend against bias.
The same way you select the heads of hospitals, or police chiefs, or head librarians?
What a strange question. Only in the US do you VOTE for prosecutors!
As Wikipedia recalls it, a judge in a sexual harassment and attempted rape trial issued an order to keep the accusers anonymous. Mr Murray was found to have broken that order. Unless you want to elaborate on the specifics, I think your comment is without merit
"Yes, Minister" was documentary not fiction (also, since we seem to be remaking/rebooting everything good, can we have an updated version of this, please?)
This, incidentally, is precisely the sort of thing that Humphrey would stop Hacker doing, if Hacker had the ability, which he didn’t. The only times Humphrey lets Hacker indulge in overreach are to put him in a situation that Humphrey can then save him from.
Thanks, I must have missed it. I'll check it out (even if it's crap).
I agree with your take on it, I was more indicating that the way Things Are Supposed To Work is almost not How They Actually Work, and usually that's How The Old Boy Network Want Them To Work.
Someone anonymous on Twitter threatens to kill you. You go to the front desk of your local police and they say "You have our sympathies, but we have limited resources, and we don't know whether it's really a serious matter or not, or even if the perpetrator is within our jurisdiction."
You threaten on Twitter to kill your MP. They go to the head of the local police force who decides it _is_ a serious matter, looks into it and finds you _are_ in their jurisdiction, and some police officers come knocking at your door.
Is this the rule of law operating as intended, reflecting the reality that MPs have been murdered before, and in a world unfortunately constrained by finite policing budgets?
Or is it a double-standard, where a wealth of usually-unenforced laws allow the powerful to oppress their opponents?
Actually, I would think that it would be in the US, too, if done on a _federal_ level.
On the other hand, the President of the United States does have some constitutional power over the Department of Justice, and appoints the US Attorney General (With confirmation by the Senate), and can fire the AG, so at the Federal level, there is a direct line of such power.
I think the trial would come under enormous scrutiny.
If the reporter lost the case in local banana republic courts, I do believe it would go up to Federal or Supreme and it would win.
The goal of threatening reporters with prosecution is to intimidate others and prevent them from investigating areas that could embarrass the state government.
So the server holds all the power, and as long as I got a "200 OK" response with whatever contents you sent me, you have absolved the client of wrongdoing without a much bigger burden of proof of fraud, identity theft, etc...
Otherwise, the Internet literally becomes unusable - if even submitting this comment might result in me receiving illegal content, how does one proceed?
Sidenote: this is tangentially similar to the CitiGroup Revlon case, where Citi accidentally paid out the full principal on a loan to Revlon to a bunch of small lenders, and the lenders refused to return the money.
https://www.npr.org/transcripts/1019909860
The court ruling is interesting, in that as long as the lenders assumed the money was sent on purpose - that that was the intention of CitiGroup - then there was no reason to send the money back. But if they assumed the money was sent on accident, then it was illegal to keep it.
The court ruled that under good faith argumentation ("discharge of value") that if someone owes you money and they pay it back, even "on accident" or otherwise, you have no obligation to return it.
And again, it hinged not on the individual case per se but the effect of ruling otherwise - that you could never truly spend money that was sent to you because someone might come later and claw it back, which would just grind the financial industry to a halt.
I think the same conclusion would have to be made here: if you send something and stick a 200 on it, the recipients are entitled to what you sent them.
Disclaimer: I don't work with web tech, but wouldn't that also permit a lot of activities we would absolutely consider unethical, like SQL injection? It seems like you could certainly craft a request to circumvent security controls to receive a 200 response back that we'd absolutely consider to be unethical.
Just because the browser only renders certain parts of the returned document doesn't mean that the government site didn't send you the whole document
Politicians can get away doing what they want with whatever reason.
And politicians are being used to make the internet more opaque. Since 'view source' is being made a scapegoat, expect it to disappear soon.
Reporter may be prosecuted for using “view source” (currently 151 comments): https://news.ycombinator.com/item?id=29737412
Reading someone's postcard in the mailbox is like looking at the source.
He opened the letter that was in the encoded viewstate.
The envelope doesn't offer any real security but it is illegal to open someone else's mail, and decoding a site's viewstate might technically be illegal as well, but unless you tell someone you did it no one will know.
The reporter should have notified them directly, anonymously, or kept their mouth shut.
If you send information to the client, it is your responsibility to make sure it doesn't contain private information.
The reporter should probably not be prosecuted, pardoned if convicted, and we should repeal the laws that make using anything sent to client illegal.
If you are sent something you didn't order in the mail the FTC says you don't have to pay:
https://www.consumer.ftc.gov/articles/what-do-if-youre-bille...
"By law, companies can’t send unordered merchandise to you, then demand payment. That means you never have to pay for things you get but didn’t order. You also don’t have to return unordered merchandise. You’re legally entitled to keep it as a free gift."
This reporter was gifted some viewstate because it came to his computer.
Edit:
To the person claiming it is "another language", I don't know anyone that does Base64 decoding in their head, and this is clearly not meant for human consumption.
Here is what viewstate is:
http://www.nullskull.com/articles/20060208.asp
There are many tools for consuming it through decoding and deserializing but that doesn't make it legal. There are tools for decoding DVDs which meet this same category.
It’s my impression that the reporter didn’t have to go so far as thumbing over to the network tab or otherwise open any envelopes, the social security numbers were instead embedded in HTML, just not visible in the painted layout. Kudos for attempting a framing for the prosecution, but I don’t think there are laws against opening mail addressed to me.
Edit: just saw the comment about .net using base64 encoded state, so I understand your argument better now. In that case, if a ROT13 encrypted message was sent to me without the key, being trivial to crack doesn’t imply I have the right to share state secrets… agreed the case is a little more complicated than journalists have made it appear, go figure.
The outside of the letter is a kind of lock, like encryption.
You don't violate the laws for translating the French on the back of the postcard to English if you happen to see it right?
Opening the letter is illegal, and breaking that lock is where the act becomes a crime. He didn't do that. He only translated what was delivered to him.
Not specifically that he doesn't understand how the web works - more that he didn't care to find out before opening his mouth.
Or worse is aware, but is disengenuously pushing for a prosecution of somebody he disagrees with.
https://www.wsj.com/articles/federal-judges-brokers-traded-s...
https://iadllaw.org/2020/09/more-than-200-lawyers-file-judic...
Apologies if that was a joke.
Executive presidency/governor systems, like those used in the US, have a generally higher dependency on individuals behaving properly.
That's hardly exclusive to government work.
Are you living under a rock? This has been happening for a while.
I find it reasonable that the government should be held legally liable for introducing users to the hazard of accidental exposure to confidential data.