This hacker might seem shady, but throwing him in jail is bad for everyone (opens in new tab)

This is really the main point to me and I'm really confused as to how the law doesn't agree with this. How can you claim unauthorized access to something when there are no systems in place to grant or deny authorization? Comparing this to walking into someone's home who left the door unlocked (as someone in this thread has done) is bogus to me. Private property is private property and social norms (as well as the law) dictate that you don't just stroll into someone's home even if the door is open. The internet does not work that way and never has.

That can be construed as impersonation without unauthorized access, which is in some jurisdictions is illegal.

But that is not what AT&T did, which is more like a open brothel with conference rooms and private bedrooms. They just let in anyone that looked in one type of attire, and had some numbered badge come into one of the reserved conference rooms. IoW, the security person did not ask for ID, or a password to enter. The fault lies on the brothel, not the visitor. For all we know, anyone could have come in looking with that attire, and a matching badge out of coincidence (maybe there was a costume party, who knows, still the brothel did not do a good job of securing the reserved conference rooms).

> No password, no HTTPS, no access controls at all. Who is responsible for the security breach? You or the bank?

The bank, they are not complying with the legal statues, and more than likely violating their own privacy policy, if any exist.

> I would argue that if there are no technological access controls in place, there is no such thing as "unauthorized access" You can't be unauthorized if there is no authorization. The default on the internet is "can access"

That is correct. In that analogy, it would be an open business, like store or malls. It follows jurisdictions of private properties, with some business statues, but overall, since it is an open-doors business, there are no authorization requirements.

> They're prosecuting him for the digital equivalent of walking down a street and taking pictures of houses which don't display numbers on their mailbox.

No. Like in the example above, they are charging him of wearing an attire with a numbered badge, and coming into the reserved conference room, and learning the attendants names or addresses (which should not be there in the first place, esp. with no security protocols). The worst they can charge him is for impersonation. However, what can incriminate him is if the pages he visited clearly displayed or linked the Term of Services or EULA, which does detail this scenario, and he violated it in some way.

Or is it like walking into someone's private home because they left the door open? Or merely unlocked?

The law likes to operate on analogies, because analogous situations are ones for which we have precedent, and precedent makes the law predictable. The sad thing is, precedent goes back to the pre-computer era, too, and isn't necessarily overturned just because new technology with new social expectations is involved. Maybe in a couple generations.

I still bailed him out of jail for the time leading up to and during his trial. Why? Because UNPOPULAR SPEECH SHOULD NEVER BE CRIMINAL, no matter how revolting. Indeed, it is the unpopular and revolting stuff that needs the most defending:

"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all." —H.L. Mencken

William Roper: Yes, I'd cut down every law in England to do that!

Sir Thomas More: Oh? And when the last law was down, and the Devil turned 'round on you, where would you hide, Roper, the laws all being flat?

FTA: "His rise as a folk hero is a sign of how desensitized to the abuse of women online people have become," Sierra said. "I get so angry at the tech press, the way they try to spin him as a trickster, a prankster. It’s like they feel they have to at least say he’s a jerk. Openly admitting you enjoy ‘ruining lives for lulz’ is way past being a ‘jerk’. And it wasn’t just my life. He included my kids in his work. I think he does belong in prison for crimes he has committed, but what he’s in for now is not one of those crimes. I hate supporting the Free Weev movement, but I do."

She is so much better person than I am.

When we want weev free, we're fighting for law and society, for just principles, not for the individual.

If they want to charge him under any other numerous crimes (data theft, attempted extortion, being an asshat) then I wouldn't have a problem with it either because those are things he's guilty/might-be-guilty of.

Hacking and violating the CFAA is not one of his crimes.

If weev harassed this woman in the manner described in the article you reference, he probably should be prosecuted for that. But it's not ok for prosecutors to put him in jail for something that should be perfectly legal, just because they can't (or didn't) put him in jail for something else.

It has the form of an outrage article without any actual content, as if someone fed Tumblr and Vice magazine into a Markov text generator.

In any case, that is very typical IRC conversation for a large portion of that subculture. They joked about doing these things, but they didn't actually take steps to do them. He considers himself a satirist, so it's not much different than some comedians talking nonsense over beers and having it show up in an indictment.

One of the chatters observing said they should post the list to full-disclosure. Weev replied saying "no, don't do that, its potentially criminal." He then talked about how he gets to spin it in the media and he's won. That says pretty clearly that he was only out to make a scene, which is what he has always done.

Also, Weev himself says that he is unwilling to short AT&T's stock - I think he understood the ramifications that would have.

    1; DROP TABLE books; --

    You: Can I have this book?
    Worker: No, sorry, not allowed.
    You: It's ok, the boss said so.
    Worker: I don't think so.
    You: We're friends, right? You don't say no to your friends, do you?
    Worker: Well, ok, I guess you can have it.

In normative arguments, analogies are used to bend reality to make your position seem reasonable regardless of whether or not it actually is. It would be better to judge weev's case on it's own merits rather than try to justify a position using increasingly complex analogies.

> When is the onus on the web server owner to configure their security properly? When is a "200 OK" response actually not okay? This is the "mind reader" aspect the article mentions

This is why the laws usually care about the intent. It's a combination of the action and the reason that's important (which is why there's a difference between murder and manslaughter).

There are no hard and fast rules, and there simply cannot be.

Weev clearly knew that AT&T shouldn't be handing over the information. He wasn't there saying "Wait, this isn't a normal service?".

> The librarian is smart enough to not hand out things like access to the staff lounge, a list of employees and their salaries, or even things like an arbitrary library member's borrowing history.

If the librarian didn't know to restrict access to salary information, lets say the managers thought that if you knew the SSN that was enough of an ID to get access, and you repeat the example, it becomes a bit more clear how intent is important.

    You: Can I have the salary of IanCal?
    Recep: Sure, it's £X

    You: Hmm, hey Dave, I think there's a security issue here, mind if I know your salary?
    Dave: Sure, it's £Y
    You: Can I have the salary of Dave?
    Recep: Sure, it's £Y

    You: Best go tell the managers.

    You: Can I have the salary of IanCal?
    Recep: Sure, it's £X

    You: Hmm, hey Dave, I think there's a security issue here, can you generate SSN numbers?
    Dave: Yeah I think so
    You: Can I have the salary of SSN#1
    Recep: Sure, it's £Y
    ...
    You: Can I have the salary of SSN#147934
    Recep: Sure, it's £Y
    You: Hahahahaha, let's give all the info to a news site, bet you'd make money shorting the stock!

I've been trying to think of a proper analogy to changing your user agent. Wearing a fake mustache and requesting information from someone publicly giving information to only mustachioed persons?

    You: Can I borrow the book identified by ISBN 1234?
    Librarian: We restrict access to that book to only people who will read it with our page turning machine.
    You: Can I borrow the book identified by ISBN 1234? I am using your page turning machine now.
    Librarian: Sure, here you go.

AT&T should be rightly mocked for their poor security, but weev wasn't just stumbling through data, he'd made good attempts to impersonate the setup the server wanted. He'd put a pair of glasses and a funny moustache on and the server was alright with it, which is definitely ridiculous.

It also wildly disconnects around point 6. You make it sound like he stole everything that the users had in the accounts. In reality, he just copied their info. He didn't give himself anything from their accounts, like transferring credits to give himself free cable or something like that. Instead of stealing everything and selling it on eBay, it was more like him going through people's lockers, taking a picture of what they have inside, and then selling the pictures.

It looks like some of their site can be crawled and some not, that's how robots.txt has worked for a long time:

http://www.google.com/robots.txt

You are welcome to critique, not harass⸮: