Hacker News Reader

Comment by Molitor5901 | Hacker News Reader

Interesting, but does this rise to the level of a crime? Only in Australia? What if I put a box that says fill out this card and be entered into a drawing to win a free car. Instead I steal the data. It sounds like fraud, but there's no exchange of money and the data itself would have diminutive value. Only when I use the data might it rise to the level of a crime.

Anyone with knowledge of Australia's legal system that could please explain how this is a crime?

View on HN

I'm not a lawyer, nor know anything about Australian law, but from the police press release [1] the charges are:

Three counts of unauthorised impairment of electronic communication, contrary to section 477.3 of the Criminal Code Act 1995 (Cth). The maximum penalty for this offence is 10 years’ imprisonment;

Three counts of possession or control of data with the intent to commit a serious offence, contrary to section 478.3 of the Criminal Code Act 1995 (Cth). The maximum penalty for this offence is three years’ imprisonment;

One count of unauthorised access or modification of restricted data, contrary to section 478.1 of the Criminal Code Act 1995 (Cth). The maximum penalty for this offence is two years’ imprisonment.

One count of dishonestly obtain or deal in personal financial information (being usernames and passwords) contrary to section 480.4 of the Criminal Code Act 1995 (Cth); The maximum penalty for this offence is five years’ imprisonment; and

One count of possession of identification information with the intention of committing, or facilitating the commission of, conduct that constitutes the dealing offence, contrary to section 372.2 of the Criminal Code Act 1995 (Cth). The maximum penalty for this offence is three years’ imprisonment.

I think even your example would fall under these, since these types of laws are not about technicalities. [1] https://www.afp.gov.au/news-centre/media-release/man-charged...

sweepstakes are highly regulated so without looking it up I expect you cannot offer a prize unless you're prepared to deliver one, even without accepting money

I think OP is referencing this this blog article about how the sweep stakes car is actually a marketing gimmick that is never won.

https://news.ycombinator.com/item?id=17392995

damn that's depressing, thanks

The article:

> The 42-year-old has been charged with unauthorised impairment of electronic communication; possession of data with the intent to commit a serious offence; unauthorised access or modification of restricted data; dishonestly obtaining personal financial information; and a possession of identification offence.

Thank you, I missed that part. I get some of that but "possession of data with the intent to commit a serious offence" seems awfully weak and broad.

Yeah, I believe many charges get added on to work towards plea deals, at least in the U.S. “disturbing the peace” is pretty common here and can be applied to anything.

Intent is a critical piece of prosecution, though. Hard to argue that you were storing passwords for any good faith purpose, so I’d expect that charge to stick.

Ah good point, like the FBI's overkill in charging people; obstruction of justice, lying to an agent, withholding information, etc.

https://www.newyorker.com/news/news-desk/how-the-legal-syste...

In this case, I think the charge fits the crime. This is a pretty bog-standard MITM attack with a clear-cut motive and intent to cause harm. It wasn't simply that they were mirroring a connection to others, but that they had compromised it with the purpose of tricking the users.

None of this is to say that overkill doesn't exist in the intelligence/policing communities. But this guy was running a Kali Linux social engineering party trick from 2013; it's about as clear-cut of a computing crime as you can get.

Reply on news.ycombinator.com