Comment by ewillbefull | Hacker News Reader

Comment by ewillbefull | Hacker News Reader

Parent Full thread

Mirroring the arguments about MAC spoofing in another thread, I have a question.

If I got banned from an IRC server, switched my proxy settings and came back on to spam a channel with "I Dunno LOL ¯\(°_o)/¯" Can I be prosecuted and sent to prison for it? After all, I'm "evading access restrictions" and every other ridiculous vague threshold for illegal activity Aaron was charged with.

The programmer/lurker in me would react by banning open proxies (DNSBL?) and requiring registration. Which is what we've been doing for decades. Would the federal prosecutor in you hunt down this potentially 10 year old kid and charge them with computer fraud to set an example?

I think the sane reaction to a security issue is to fix the issue. Especially in the cyberlibterarian utopia I wish the Internet was. If it was exploited with enough maliciousness, I can look the other way while the hacker is sentenced for it.

But for something this stupid? An open wifi network? An open closet? Aaron broke through no walls but made-up protocol restrictions. Where is the line drawn?

"Can I be prosecuted and sent to prison for it?" Probably not, but even if so, this is where prosecutorial discretion comes in. This is what people aren't understanding.

If you avoid a channel ban, or sign up as "Mickey Mouse" to get free WiFi, nobody's going to prosecute you. If they did, you "stole" $30 worth of stuff and the penalty would be tiny.

I'm not criticizing Aaron, but what he did was to intend to compromise a valuable database. If the gov't could prove beyond a reasonable doubt that he intended to make that valuable database public, that is a serious harm at issue.

You might (and I might) not agree that the harm is important, but that's what many parties (journals, authors, JSTOR, universities who pay JSTOR) have relied on. Do we think one person should change the rules just because the can?

Also, I didn't think even libertarian extremists would think that just because you installed windows rather than armed steel plating around your house, nobody could be blamed for breaking in. And I hate to say it, but the security - the combination of personnel and online monitoring - WORKED in this case. They outsmarted Aaron, as is clear when you read the docket. They engaged in a ruse to trap him and it worked.

If an IRC channel, or HackerNews, kicks me off, and while I know that they don't want me back I reconnect, that's almost assuredly illegal.

It won't hit CFAA standards until damages exceed $5,000, though. The IRC channel, or HackerNews, probably doesn't have $5,000 worth of stuff to damage, unless I really harass them for months. JSTOR and MIT, whether you like them or not, did have something that valuable.

The physical analog is entering a store that you have been forbidden to enter. That's misdemeanor trespass and probably only a small fine for the first time you do it. However, if you harm people or take/harm property while trespassing, you can quickly find yourself in the neighborhood of felony trespassing.

Reply on news.ycombinator.com