Hacker News Reader

Comment by pnathan | Hacker News Reader

I'm going to argue contrariwise: say I write a compiler for a language I created. It's a niche thing and some guys find that it works really well for, e.g., doing network traffic analysis (work with me here, it's just an example), and it becomes the preferred tool to write hacks using network traffic (WPA2 sniffers, etc).

Do I have a responsibility to turn these people in? I know some/many/most of the users are grey/black hats. I might even have a notion of who those people are.

---

Let's flip the argument a wee bit. Say you're working for a weapons contractor building simulators and other tools for drones & ICBMs. You have a pretty good idea that your work is being used for death and destruction. You see some videos on the evening news of some people getting killed by a drone you helped build. Do you bear responsibility for the use of that drone?

Because I see the answer to both to be about the same.

View on HN

There is nothing novel about this situation. The law on aiding and abetting has been stable forever. A person does not is not responsible if an, otherwise legal, tool they create is used to commit a crime. A person is responsible if an, otherwise legal, tool they create is used to commit a crime, and they know at the time of rendering that aid that there is a certainty or high probability that aid will be used to commit a crime. There is nothing illegal, for example, about opening a door. It is illegal, however, if you open a door for someone being chased by cops to help him escape and you know that the person is running away from a crime scene.

> You see some videos on the evening news of some people getting killed by a drone you helped build. Do you bear responsibility for the use of that drone?

Of course you do. You created a tool that you knew not only had the potential to kill people, but would be in fact used to kill people. But it's not a crime because it's not a crime to kill people in war.

The article says it was a packet sniffer. How would he know what the planned use was? In terms of your analogy, it would be like finding out only later that you opened the door for a crook. (Of course, he might have known from other correspondence, but it seems strange to assume that.)

The article cannot substitute for what the jurors saw, to be fair. Not that jurors are infallible, but still, all we know comes from a few lines on Wired. Presumably the jurors saw the evidence and didn't believe his denials.

There is knowing with all its degrees but also there is 'should have known.' I suspect that he knew what his pals were up to and that's good enough.

The article, if you read through to the second page, also says:

1) The prosecutors had IRC logs found on his computer that suggest he knew in general terms what Gonzales was doing with his packet sniffer, and was receiving links from Gonzales about his break-ins; 2) Watts admitted that he knew Gonzales was doing something wrong.

If he genuinely had no idea what his software would have been used for that would be a totally different case.

As I understand it (that is: minimally) it was not just a packet sniffer. Why would anyone bother to write a packet sniffer anymore? It was a sniffer designed to capture credit card transaction information.

Moral answer or legal answer?

There is a reason why we do not charge Soldiers with murder when we tell them to go fight for us. It is the same reason we don't charge weapon makers for the deeds there weapons/tools are used for. In the first case, the responsibility lies with the people who elected that government that gave the order. Not the Soldiers following legal/moral orders. In the second the same applies, the tool maker can not be responsible for the actions of the tool user, that falls on the tool user no where else.

In the case of the person in the article, he just got screwed over by the government, by lawyers shifting the personal responsibility to the tool maker instead of the tool user.

This is not a "toolmaker" case (i.e. suing gun manufacturers for murders). Because of his knowledge of the crime, it's a straight up "aiding and abetting" or "conspiracy" case. He didn't just make a tool. By making the tool knowing what it was going to be used for, he participated in the actual crime.

"Watt, by contrast, evidently earned no money from the scheme and didn’t participate directly in the breaches or possess stolen card data. His primary overt act was to code the sniffer tool for Gonzalez, for which he received no payment

But Watt refused to cooperate with authorities to help make their case against Gonzalez — aside from the fact that he was resolved not to snitch, he also maintained that he had no specific knowledge of his friend’s hacking scheme. His defiance may have been what did him in"

Sounds like a tool maker to me.

What's with people taking what accused computer criminals say at face value?

"Watt says he didn’t know the code would be used to intercept credit card data. 'I assumed it would have something to do with web traffic or instant messaging conversations or logins of some other protocol not related to the credit card information,' he told Wired in 2010.

Prosecutors disputed this and maintained that chat logs recovered from Gonzalez’s computer described illegal carding activity that Gonzalez conducted and showed that Watt at least had broad knowledge of what Gonzalez was doing, if not the details. As Gonzalez and his gang hacked target after target, he sent Watt links to news stories describing the breaches, though he didn’t acknowledge in the correspondence that he was behind the attacks.

Watt’s attorney told Wired in 2010 that his client accepted 'responsibility for aiding people that he knew would commit wrongdoing. However, he is very disturbed by the government’s aggressive attempt to make him into more than what he is.'"

It sounds like the jury didn't believe his story, particularly given the IRC logs and the links from Gonzalez describing the hacks. I can't say it's an unreasonable conclusion on their part.

Sounds more like Alinskys methods in use by the Prosecutor, just throw shit till it sticks.

Let's use a different example.

You have a friend who is into lockpicking. Hey, that's a perfectly legal hobby as long as you're picking your own locks.

You have a Dremel tool and a grinding wheel, so he asks you to make him some custom picks. You don't know initially what these things will be used for, and you intentionally don't ask him what they're for. As it turns out, they're built for breaking into a specific make of lock that is only used on government installations. So, there is no way that it's just a hobbyist thing.

Your buddy then goes and steals government secrets with your custom picks so that he can sell them to China. He then sends you links to news stories talking about the thefts. You know that he's doing the crimes, but you say nothing. And when the police come by and ask you if you made the picks, you lie and pretend that you don't know anything.

Do you deserve the same sentence as him? No. But I'd say that you deserve prison time.

>>>> And when the police come by and ask you if you made the picks, you lie

Right here you're screwed, regardless of the rest. Making false statement to a government agent is a crime of itself, regardless what this statement is about. You could say "I'm not talking to you" or "Fifth amendment, to the rescue!" but if you lie, they can knit a nice prison sentence out of it.

> What's with people taking what accused computer criminals say at face value?

Well so far, accused computer criminals have a lot more credibility than Stephen Heymann. Whats with taking anything that guy says at face value?

> I can't say it's an unreasonable conclusion on their part.

To be fair, you can't say it's a reasonable one either, unless you've also seen the logs.

"There is a reason why we do not charge Soldiers with murder when we tell them to go fight for us."

Usually the winner gets to decide how strong a defense following orders is.

No its not like it or not sovereign states use of force in a Just war is not the same as knocking over a bank.

Anyone whose worked in high end technical computing will have faced this and you have to decide at the time if you are cool with that.

For example at my first job I had to anlyse data from one of our test rigs and I commented to the guy I shared an office with that that looks like a REDACTED and his comment yeah probably REDACTED the Upgrade for the REDACTED weapon system - the one the then PM hadn't told the Cabinet about for a long time.

I had to sit down and think how I felt about this and if I was happy working on this sort of thing.

If you could reasonably foresee that the thing was going to be used in that way, yes, you bear responsibility. It's not like you just happened to make something that just happened to be used for crime in addition to the more reasonable uses you expected it to be used for instead.

Oh, granted, other people are responsible too - perhaps even more responsible than you. However, responsibility isn't an exclusive property, two or more people can be jointly responsible.

Reply on news.ycombinator.com