Comment by chimeracoder | Hacker News Reader

Comment by chimeracoder | Hacker News Reader

Parent Full thread

> He walked into an unlocked house,

He sent an HTTP GET request, and the server responded. This isn't walking into an unlocked house. It's more like walking into an unlocked storefront during business hours, asking permission to view a certain item behind the counter, and being granted said permission by the clerk, who hands it to you.

> Just because he didn't use a crowbar doesn't make it any less intentionally criminal.

If those documents were not supposed to be viewable, the server should reject the request. Making a request is not a crime. You are literally asking, "Can I please see the document stored at $LOCATION?" If the answer is no, the server has a means to do that: send an HTTP 403 response.

The "unlocked house" analogy might hold if he tried to ssh into their server as the root user, but in this case, AT&T should have been held responsible for gross negligence for allowing people browsing[0] their open "storefront" (their website) access to personal customer information.

To use another analogy, if you submitted a FOIA request for classified documents, can the government satisfy your request (by sending you the documents) and then charge you with a felony for requesting those documents? I wager that most people would say that the fault lies with the government for failing to deny your request.

Publishing the documents later on is a separate matter, but the crux of weev's case focused on the fact that he obtained them, not the fact that he published them, which is maddening, because that logic would break the entire model of the web by breaking HTTP.

[0] Not to get too hung up on terminology, but notice that we use the term "browsing" the web to refer to HTTP requests, but we don't talk about "browsing" an ssh login.

> If those documents were not supposed to be viewable, the server should reject the request.

It certainly should, but it also should be obvious that this was not information that he was authorized to have, and he was prosecuted for intentionally scraping it after noticing the misconfiguration - not for making an HTTP GET request.

The idea that a GET request is like asking a clerk for an item under a counter is appealing, but doesn't really work because granting access is not the same as granting authorization. Authorization requires intent, and an HTTP server is incapable of intent (at this point in history, anyway). The fact that the server can be misconfigured and is fundamentally incapable of realizing it means it makes a lot more sense to think of it as the counter rather than the clerk, and items with 403 responses as items that are under a glass counter. For this same reason, the FOIA request example doesn't work either. A human (or many of them) processes that request.

Additionally, the items he took were not items the store sells, they were clearly items the store should not have out in a public place (so yes, the "store" is absolutely not blameless).

In light of these observations, I think a better analogy is this:

A man walks into a store. He spots a binder on the back counter, just close enough he can reach it without actually stepping behind the front counter. It contains a printout of the store's mailing/cold-calling list that they use for [whatever silly purpose]. The clerk is busy elsewhere, so he starts flipping through it page by page, taking a photo of each one with his smart phone.

Now, I'm still not sure what I think of the legality or morality of the situation, especially when you try to factor in intent. I'm also not a legal professional of any kind, so I know even less about what a court would think about all that. But I do think that these details are relevant, and leaving them out of an analogy creates a false impression that there's nothing even debatable about the situation.

Edited to add: FWIW I do agree that AT&T is very much at fault, mainly for the reasons phaus gave in the comment sibling to yours. I just don't think it is obviously the case that their guilt excuses the person that takes advantage of that negligence.

>A man walks into a store. He spots a binder on the back counter,..

Your analogy, for the record is wrong. Completely wrong in fact. But enough with the analogies. We have 20 years of mainstream HTTP usage. We know how it works. Authorization over HTTP is a solved problem and can be done in multitudes of ways, trivially. If he's breaking the law than so is Google millions times over because there are a shit ton of indexed pages that technically Google wasn't authorized to crawl. If your web server is configured to fulfill all anonymous requests, then you are implicitly granting the authorization to access this data. This is the way HTTP was designed. That's the only way this all makes sense, otherwise youtube can change their TOS to make every person who views a video a criminal.

Intent intent intent. The analogy of grabbing the binder on the back counter fits perfectly, because it shows the intent.

Googlebot is incapable of intent. It is a computer program that simply crawls accessible pages. It cannot distinguish between a website for which access is obviously not intended (i.e., Weev's case of accessing *other people's private information) and a website for which access is intended (i.e., a public Facebook or LinkedIn page).

Someone has to use Googlebot though. Google is therefore liable for what it does. Just because a machine or a piece of software is the main actor does not mean there is no culpability.

Google is trying to index as much of the web as possible so that it can provide a better service, attract more customers, and make more money from its advertisements. Therefore, the use of a program that scans the web and accesses documents which Google does not have permission to view makes Google responsible for routinely and intentionaly breaking the law.

Also, that your tool cannot filter content particularly well does not mean you get a free pass. It means you were negligent.

...or at least that is one way to interpret the law. The law is bad. You can't just say it's illegal when its illegal. It should be as cut-and-dry as possible (e.g. killing someone is always illegal, even when it is an accident a la accidental manslaughter).

Reply on news.ycombinator.com