TWO RECENT HACKTIVIST TRIALS HAVE DANGEROUS IMPLICATIONS FOR A FREE INTERNET

26

by Andrew Blake

TWO RECENT HACKTIVIST TRIALS HAVE DANGEROUS IMPLICATIONS FOR A FREE INTERNET

Twice last week, the justice system heard cases related to hacking, and in both instances, information sharing and cyberlaw were dealt a seriously heavy-handed blow. The government was the bully here, and the dorky little hacker had his glasses knocked square off his face.

It reminds us that the Internet is serious business, but also that a man’s gaping butthole can cause a lot of damage — but more on that later.

On November 20, alleged Wikileaks source Jeremy Hammond was denied bail in a New York City courtroom, and told he’s more dangerous than a sex offender because he compromised the computers of a private intelligence firm. In New Jersey, just hours later, a jury of his peers quickly convicted Andrew Auernheimer on charges of accessing a protected computer, and disclosing an AT&T security flaw while working with a group called Goatse Security. Hammond could get life in jail for his crime, and Auernheimer is likely to do a few years on a trumped-up charge for involving himself with a collective named after an Internet-famous image of a man’s wide-open rectum. Really. Look it up.

But it’s more than just a matter of sharing information, vile viral photographs, and making the world a wee-bit smarter. These rulings offer an eye-opening example of how far the government is willing to go to deter future hacktivism, even if it sets a deleterious legal precedent that could affect us all.

***

Hammond, seen here, plotting teh evil cyber-terrorisms

There was no conviction in Hammond’s case, but in Manhattan a federal judge did deny bail for the twenty-something Chicago man accused of involvement with last year’s high-profile hack of Strategic Forecasting, aka Stratfor, a private intelligence company that advises customers on global issues and has been routinely commissioned by law enforcement to, among other activities, investigate political protesters in the United States. Federal prosecutors are charging Hammond with being one of a handful of persons responsible for compromising Stratfor’s data by collaborating with a group called LulzSec, an offshoot of the hacktivist collective Anonymous. Now he is stuck behind bars facing three charges relating to hacking and fraud stemming from months of undercover investigation.

UNTIL THE COURTS CAN CATCH UP WITH THE TECHNOLOGY, AND CONGRESS CAN FIND A WAY TO BALANCE PRIVACY AND SECURITY IN THE CYBER-SECTOR, IT’S AN INCREDIBLY HOSTILE TIME FOR ALL COMPUTER USERS, NOT JUST HACKERS.

Hammond likely won’t stand trial for quite a while. As of this writing, he’s been locked up more than 260 days with slim chance of release. On Tuesday, a judge said she will keep it that way indefinitely until the government’s attorneys are ready have at him.

“Jeremy, only 27 years old, has spent most of his young life contributing to charitable efforts and acting on his principles to right what he perceives as wrong,” reads a statement posted this week on an online support network for the hacker’s defense. “Now, due to his contributions to the Anonymous collective, Jeremy could, if found guilty, spend 30-plus years in prison.”

Sure enough, Judge Loretta A. Preska did acknowledge in court that Hammond faces a sentence of 35 years to life should a jury convict him on charges that have so far proven relatively victimless, with the exception of the few intelligence agents whose reputations were tarnished, along with the customers of the company whose log-ins were compromised. Coincidentally, details emerged last week that reveal that Judge Preska’s husband happens to be one of the thousands of Stratfor subscribers whose credentials were hacked by LulzSec. The court has not acknowledged the connection, and now the wife of someone with a vested interest in seeing a conviction controls Hammond’s fate. So far, she’s showing signs that it won’t be an easy case for the defense.

“Judge Preska and the prosecuting attorneys did state that Jeremy was more of a danger to the community than an online sexual predator because Jeremy has ways to hide his identity online and, pardon my sarcasm here, because Jeremy knows how to use Tor,” writes Sue Crabtree of the Hammond Solidarity Network. Tor, or The Onion Router, is an identity-masking software bundle funded by the US State Department and used to create anonymity for web users who wish to keep their digital footprint relatively untraceable, often over fear of prosecution and persecution. So far it seems like Hammond was right in thinking he needed it.

“The truth is, Jeremy has done no wrong and those determined to prosecute him are guilty,” reads a statement from his supporters. “The State is guilty of protecting their own interest, especially in their pursuit to prosecute those they consider dangerous to their agenda.”

According to Crabtree, the courtroom was informed this week that Hammond’s name is now on a federal terrorist watch-list and his pleas for bail were rejected because the judge considers him a flight-risk, despite the fact that he doesn’t have a passport.

***

Auernheimer, seen here, sporting a super-terrorist beard

Across the river in Newark, New Jersey, 27-year-old Andrew Auernheimer was found guilty of essentially punching his keyboard.

In 2010, Auernheimer found what was pretty much a massive AT&T fuck-up while working with a group called Goatse Security, or GoatSec. The Apple iPad that worked with the telecom’s 3G network was just a few weeks old at the time and still the coolest and most must-have item for upper-middle-class America, a fact that posed a pretty big problem when Auernheimer noticed that all of those privileged persons’ information was sitting on the Internet, unencrypted, open for anyone smart enough to see if they knew where to look.

“IF RECENT EVENTS HAVE TAUGHT US ANYTHING IT’S THAT CONGRESS IS ABSOLUTELY USELESS AND IS NOT LIKELY TO DO ANYTHING ON ANY ISSUE AT ANY TIME,” SAYS LEIDERMAN. “THEY ARE THE MOST IMPOTENT BAND OF INDIVIDUALS ON THE PLANET, SO WE NEED TO LEAVE IT TO THE COURT TO LET THIS SHAPE OUT.”

Auernheimer never stole any passwords, and he never hacked Apple or AT&T. Last week in court he was abundantly clear about his intentions. “No, I did not attempt to monetize off of this,” he said during testimony, a fact reinforced by the prosecution’s own evidence. When GoatSec was asked to sell their findings, Auernheimer told a colleague well before he was under indictment, “I am saying that it has been destroyed and we’re not going to violate principles for money. And none of our people have a copy of the data at all.” GoatSec never quite made the damage prosecutors led the jury to believe. AT&T patched the flaw almost instantly–a flaw they only learned of because of Auernheimer.

“I don’t think that people should keep software vulnerabilities secret,” Auernheimer explained to the court. “I think the consumer has a right to be informed when they’re put at risk by a company. And we have not only a right as Americans to analyze things that corporations publish and make publicly accessible, but perhaps even a moral obligation to tell people.”

While no nefarious hacks ever occurred, Auernheimer did, however, hype up his discovery. Just like how he used his noggin to discover a massive security breach and went public with his findings, he also sold himself goddamn brilliantly, using hyperbole and elusiveness in disclosing his findings with a cryptic allure that only a hacker could have. It worked in getting the story out, and it worked on convincing a jury to convict him.

A driving force during the prosecution’s questioning of Auernheimer was the specific language he used when he first approached the press with his findings. “I would be absolutely happy to describe the method of theft in more detail,” Auernheimer wrote on behalf of GoatSec in June 2010 to a few media contacts whose emails were compromised by the exploit. It was PR gold and likely the impetus behind the story’s success. Then the courts used it against him, bringing it up repeatedly during Auernheimer’s brief time on the stand.

“I felt I was free to use rhetoric and hyperbole like ‘theft’ because the underlying act of accessing public information–it boggles my mind that it could be considered a crime,” Auernheimer said on the stand this week.

“It’s a universal understanding,” he said, “when you put something on the Internet — http, to my understanding, is a publishing system. And when you put something on the open Internet and you didn’t protect it with a password or a firewall, you’ve made it a part of the public record.”

“And when you publish something, you can’t sit there and say–you know, when somebody uses it to embarrass you, you can’t kill the messenger and say, ‘Well, I didn’t want you to have that.’ Well, you shouldn’t have made it available if that’s true.”

For accessing a “protected computer,” Auernheimer could get fives years for each of the two charges. Security experts say a retrial is likely and Auernheimer himself is adamant about appealing. After all, his charges are dog shit.

“The ‘protected computer’ is any network computer. You access a protected computer every day,” Auernheimer told reporters outside of a courtroom on Tuesday. “Have you ever received permission from Google to go to Google?”

Auernheimer said moments after being convicted that he expected a guilty verdict and will appeal—news he tweeted from his phone since he isn’t allowed to touch an actual computer for a while. For the time being, he’s out on $50,000 bail awaiting sentencing or perhaps an appellate ruling that could eventually bring his case to the Supreme Court.

***

After details from both the Auernheimer and Hammond cases came in Tuesday evening, I called Jay Leiderman, a defense attorney from Southern California who has represented a fair share of alleged computer criminals, including some aligned with the Anonymous movement that spawned LulzSec. When Leiderman picked up the phone, he was just finishing a day of lawyering near Los Angeles and had barely heard any news from the East Coast yet.

Jay Leiderman

“Hammond was told he can’t do house arrest and could be put away for 39 years to life,” I told him. He paused. For a while.

Leiderman suggests there’s no way in hell that Hammond will be put away for life for sharing the Stratfor data, but says that the way his and Auernheimer’s cases were handled say a lot about the justice system.

“The way the government is reading these laws really makes about all behavior criminal,” Leiderman tells me.

In the case of Auerenheimer, Leiderman says, “He didn’t access a protected computer yet he was convicted of it.”

“It is clearly a situation of them striking while the iron is still ambiguous,” he says. For right now, there is a real lack of well-defined cyberlaw.

“At some point the federal courts are going to have a chance to consider these issues and realize the prosecutions that they are currently undertaking are in fact what the laws were designed to prevent,” he says. “But before that happens, the federal government is intensifying their pound of flesh. They are trying to scare everyone and make them think that every time they punch upon that keyboard that they are risking 15 years in federal prison. And for as long as that, it’s nothing but a scare tactic and one that ultimately can’t survive in an era of internet freedom.”

***

Hammond, who has been confined to jail since March, isn’t likely to be spared from those scare tactics as his case progresses. In a case that is highly under documented, even within the court reporting circuit, the federal charges against Hammond likely have as much to do with computer hacking as it does with making a domestic scapegoat out of one of the few US citizens the government might be able to directly link to Wikileaks. Unlike with Auerenheimer, though, there is at least a precedent and an actual burden of proof that Hammond acted on ill intentions.

To say either Auernheimer or Hammond went public with some Earth shattering knowledge wouldn’t exactly be correct. It is, however, pretty safe to acknowledge that Tuesday’s ruling—especially in the Newark case —accentuates the fact that the Justice Department is now willing to put anyone behind bars for crimes that aren’t yet properly defined.

Hammond’s story is one that has a bit more structure to it—in terms of current law, anyway—but both tales need to be talked about before another harmless hacker is locked away for exposing anything from botched, billion-dollar corporate security to handing “super-secret” intelligence to the enemy—in this case, Julian Assange of Wikileaks.

According to his indictment, Hammond and LulzSec stole credit card numbers from Stratfor’s servers as well as a trove of personal emails from employees, hundreds of thousands of messages that are still being combed through by researchers nearly a year later. If he is guilty of what he is accused, Hammond is likely to receive a sentence that will set an unfortunate precedent. It’ll also be perhaps the first real punch Uncle Sam’s landed on WikiLeaks.

As of this writing, no person has yet to be tried in civilian court for any crimes connected to WikiLeaks. Private First Class Bradley Manning, the accused source of sensitive military documents from the Iraq and Afghanistan wars, will be court-martialed early next year. Meanwhile, he’s been held in conditions considered torturous by the UN for over 900 days. Jacob Appelbaum, a computer researcher from the West Coast who represented Assange at a hacker conference in 2010, was recently informed that he is still under federal investigation nearly two years after the FBI first subpoenaed his personal Gmail account. At this rate, Hammond might be the first head from the WikiLeaks snake that the Justice Department can cut away, although information sharing and hacktivism isn’t likely to die as quickly. They will, however, have hard proof that their actions won’t be tolerated.

Hammond’s a self-described communist and anarchist, but his political leanings aren’t quite as sexy and dangerous as the US attorneys’ hyperbolic Hollywood portrayal  His indictment highlights his freeganism—digging through garbage for food. His rap sheet is called into question, which includes an arrest for “violently protesting” a speech delivered by a Holocaust denier. The court has been made aware that Hammond’s probation officer once found “questionable literature” in his residence—pamphlets for a protest against a white supremacist group.

“I do think that Hammond’s prosecution is 100 percent political, not withstanding whatever actions he may have taken,” Leiderman says.

“I think we’ve come to a place in America where we no longer value the political dissident. Where speech that is contrary to government is no longer seen as a valuable thing in society,” he says.

“The way that speech works and the way that free speech works is that if an idea is too radical and if an idea is too far flung and too far fetched—like dumpster diving for your food—it’s going to be rejected by the people in the marketplace of ideas, and that’s the way the marketplace of ideas works. But when it’s the government telling us, ‘Nah, this idea is no good. We need to reject it,’ then it’s no longer free choice in the marketplace of ideas. We’re being told what to think and that’s where it gets scary.”

“It is scary when you put it that way,” I told Leiderman.

LulzSec and Anonymous have both waged online campaigns to draw attention to efforts from Washington to pass cybersecurity legislation that, in every instance so far, sought to severely limit personal Internet freedoms. President Obama is soon expected to act on an executive order to do what Congress can’t, and prosecutions against harmless computer “criminals” could easily crescendo. After all, almost every attempt from Washington so far to put together cybersecurity legislation has allowed for the government to play grab-ass with any and all information stored on the servers of private companies. At the same time, existing legislation already lets the feds conduct surveillance over email accounts and other activity with little more than a court order. Just ask the last head of the CIA.

While lawmakers on the Hill and the country’s courts are both trying to make sense of how to approach computer crime, no one is safe in the meantime. Currently, over 5,000 people have installed a free browser plug-in that lets anyone comb through websites using a URL incrementing script in Firefox that more or less mimics what Auernheimer was charged with, and there’s another publicly available plugin for Google Chrome. Even Facebook was started with a script that combed through Harvard’s databases for public-facing images of the student population. Auernheimer’s discovery wasn’t groundbreaking, but his conviction would be. Until the courts can catch up with the technology, and Congress can find a way to balance privacy and security in the cyber-sector, it’s an incredibly hostile time for all computer users, not just hackers.

“If recent events have taught us anything it’s that Congress is absolutely useless and is not likely to do anything on any issue at any time,” says Leiderman. “They are the most impotent band of individuals on the planet, so we need to leave it to the court to let this shape out. And you know, the courts don’t suffer fools lightly. The courts have historically done a reasonably good job in protecting our freedoms and narrowly circumscribing crimes such that bold behavior isn’t criminal. And the way the government is reading these laws really makes about all behavior criminal.”

For now, says Leiderman, interpretation in regards to computer crimes is weak. While it’s arguable that the justice system will never keep up with the pace of technology, at this rate it could be too late before laws are finally structured in such a way that Hammond and Auernheimer aren’t looking at guaranteed, asinine sentences.

Meanwhile, says Leiderman, the state of affairs is ludicrous. “They’ve made a rule so broad, so amorphous and so ambiguous,” he says, “that reasonable people can’t ascertain what conduct is in fact covered.”

“We’re at a point in the history of these prosecutions where the government can literally charge anyone for anything and they seem to be doing that in a very targeted manner. They are going after people they don’t like for speech that they don’t like and they are going to get these convictions up until the point where courts start telling them, ‘Stop it. This isn’t what these laws were meant for.’”

That’s assuming the people have a voice long enough to make that opinion heard.

Blake is a web producer for Russia Today. Follow him on Twitter.

http://buffalobeast.com/404-error-justice-not-found/ 

Hearing scheduled in Andrew Luster's appeal of rape sentence

http://www.vcstar.com/news/2012/dec/10/hearing-scheduled-in-andrew-lusters-appeal-of/


Hearing scheduled in Andrew Luster's appeal of rape sentence

• 
  
• By Raul Hernandez
• Posted December 10, 2012 at 5:31 p.m.
• 
  

An attorney for convicted rapist Andrew Luster, an heir to the Max Factor cosmetics empire, said a hearing is scheduled for Dec. 17 to set dates and times when legal motions surrounding Luster's appellate court issues will be heard.

Attorney Jay Leiderman said Monday that Luster raised 20 legal issues in his appeal, including whether he was denied effective assistance of counsel at his trial and whether the judge used a proper method to calculate Luster's prison sentence in 2003.

Lawyers were in Ventura County Superior Court to pick a date for the evidentiary hearing, which will be presided over by a judge from Los Angeles.

Leiderman said Luster, 48, was offered a favorable plea bargain deal of six to 16 years in prison but that his lawyer didn't give him proper legal advice on the offer.

In April, a three-member panel of the 2nd District Court of Appeal, Division 6, in Ventura, ruled that the Superior Court must set a date for an evidentiary hearing.

Appellate Judges Arthur Gilbert, Kenneth Yegan and Steven Perren reviewed Luster's petition for a writ of habeas corpus, filed Aug. 16, 2010.

The case drew national attention because Luster fled in the middle of his trial in 2002 and was tried in absentia. Jurors found he drugged three women between 1996 and 2000 and videotaped two of the rapes of the unconscious women at a beach house north of Ventura.

Luster argued that the sex was consensual.

Ventura County Superior Court Judge Ken Riley, now retired, sentenced Luster to 124 years in prison. On June 19, 2003, Luster, who is Factor's great-grandson, was caught at a taco stand in Puerto Vallarta, Mexico, by bounty hunter Duane "Dog" Chapman.

© 2012 Ventura County Star. All rights reserved. This material may not be published, broadcast, rewritten or redistributed. 

We Are Weev

http://suicidegirls.com/news/culture/25394/We-Are-Weev/

We Are Weev

Submitted by SG_Blog

Edited by nicole_powers

by Nicole Powers

These days, it’s kinda like your computer illiterate granddad is laying down the law on the internet. Only worse. Cause your computer illiterate granddad doesn’t have the power to send your ass to jail for longer than most rapists for the crime of clicking on the wrong http link. Which is something the US government is trying to do. Fo’ realz. Yep. That.

Case in point. Andrew Alan Escher Auernheimer, a.k.a. @rabite, a.k.a. Weev. He’s just been found guilty on one count of not actually hacking anything and one count of having a list of email addresses, even though no one bothered to prove he ever actually had 'em, tho everyone agrees his mate did. Confusing right? You can totally imagine Gramps throwing his hands in the air at this point and saying to hell with this good-for-nothing with two too many silly-ass names – which is pretty much what the US government is doing.

Part of the problem is that the laws Andrew Alan Escher Auernheimer, fuck it, let’s just call him Weev, has been found guilty of violating – which came into being under the 1986 Computer Fraud and Abuse Act (CFAA) – predate Hypertext Transfer Protocol, the first documented version of which, V0.9, was codified in 1991. In light of the fact that we’ve yet to come up with a fully functioning flux capacitor, as you can imagine, the application of the CFAA on today’s internet works about as well as Doc Brown’s DeLorean time machine. 

***

“Couldn’t it be argued that Weev actually did something good and beneficial for society?” 

Wait? Wut? If that’s the case, remind me why Grampa Government is trying to throw his ass in jail?

I’m chatting with Jay Leiderman, a chap who knows a thing or three about the law and the internet. He’s an elite California State Bar Certified Criminal Law Specialist-grade lawyer who’s defended several high profile hacktivist types, including Raynaldo Rivera of LulzSec and Commander X of the Peoples Liberation Front. He also happens to be a Twitter ninja, which is how I got to know him. A quick perusal of his @LeidermanDevine twitter feed will tell you Jay’s a rare legit legal animal who clearly gets today’s wobbly whirly web, which is why I called him up to discuss Weev’s wobbly whirly situation, which is as follows...

On November 20, 2012, in a Newark, NJ court, Weev was convicted of USC 1028, “identity theft” (as in “stealing” a list of email addresses) and USC 1030 “conspiracy to access a computer device without authorization” –– which, according to Jay, is something we technically all do multiple times every day. Given that Weev was singled out of the entirety of America’s online population for prosecution, in real terms, it’s safe to say what he’s actually more guilty of is embarrassing the fuck out of a Fortune 500 company…and the government no likey that.

Let me explain: Back in 2010 when the iPad first came out, Weev’s mate figured out that AT&T was doing a sloppy ass job with autofill on an app, and in the course of achieving this great technological feat had publicly published the e-mail addresses and ICC-IDs (the identifiers that match a person to their SIM card in a mobile device) of its entire iPad customer base on the web – with no password, no firewall, no fuck off or die warning, no nothing to protect them. Yep. Really. They were that dumb.

“There’s an AT&T web app that had a URL on it with a number at the end, and if you added one to the number you would see the next email address,” explains Weev by phone after I tracked his ass down via teh twitters. Obviously there’s quicker ways to get kicks online than adding a digit to a URL and hitting return (have you tried Googling Goatse?), so Weeve’s ever resourceful mate, Daniel Spitler, created an app called the "iPad 3G Account Slurper" which sucked up well over 100,000 addresses. “My friend just wrote a script to irate though and add one to the number again and again and again,” Weeve tells me. “It’s not fucking rocket science. It’s basic arithmetic. It could have been done manually on any iPad.”

So that explains how they “stole” the list of publicly published email addresses, but why might be a better question to ask. “Comment and criticism against large companies which go unchecked in our country,” replies Weev, when I ask him. “And making a public spectacle and ridiculing them, which I think frankly makes me the best fucking American in the room. We used to be a country that valued criticism of the powerful, and we haven’t really been in the past three decades.”

To add context, at the time, Weev and his mate (who copped a plea bargain) were working under the banner of Goatse Security, and as such, their mission in life was to explore gaping holes (I told you to Google Goatse!). AT&T’s might not have been the sexiest of holes, but it was gaping and it could be argued that it was in the public interest that Goatse Security rummage around in it.

Among the private email addresses that AT&T were publicly publishing were ones belonging to politicians (New York Mayor Michael Bloomberg and White House Chief of Staff Rahm Emanuel), members of the military and multiple government agencies (DARPA, DHS, NSA, FAA and FCC), and high profile media types (Diane Sawyer and New York Times CEO Janet Robinson). Goatse Security could have had much lulz with the list and/or sold it for mucho dinero, an option which the duo allegedly discussed in IRC chats but put aside. Instead, they decided to go to the press to speak truth to power, which was really when the trouble began.

Weev served as Goatse’s spokesperson and spin master. It was his job to liaise with the media and present stories in a way that might titillate us lazy-ass scribes. “Hey, look, I just found a list of email addresses on a bunch publicly accessible web pages” might have been accurate, but it wasn’t the kind of story that would make copy even on the slowest of news days, so Weev sexed it up a bit. In a press release sent to several news outlets he wrote, “I stole your email,” and, like a magician offering to explain a trick, followed it up with, “Let me explain the method of theft.”

Because of this hyperbole, Weev essentially convicted himself on the first count of “identity theft.” The prosecution spent much of their time with Weeve on the stand discussing his use of the words “stole” and “theft” during cross-examination. I mean, I know it’s said that sarcasm is the lowest form of humor, but I didn’t know it was illegal! And speaking of the law’s humor bind spot, the prosecution also referred to Weev’s Encyclopedia Dramatica entry and used that against him, which, given the spoof nature of the site, is tantamount to using a Saturday Night Live skit as legitimate and damning character evidence. I. Kid. You. Not.

At no time did Goatse ever make the list publicly available – AT&T were the only ones doing that. The prosecution never really attempted to prove that Weev possessed the full list of email addresses. What neither side disputes is that Weev tapped the list for a handful of press email contacts (something he would have likely got by calling the media outlets direct anyways), then merely passed on a link to it to a journalist for verification. The journalist in question was Ryan Tate of Gawker. His story ran on June 9th, 2010, and it was because of this that the shit hit the proverbial fan.

“This access would have gone unnoticed if I hadn’t gone to the press. If I hadn’t informed AT&T’s customers,” says Weev. “They’re not really pissed about the access, they’re pissed about the speech attached to the access. God forbid corporations be subject to fair comment and criticism.” 

Talking of access, the second count Weev was convicted of – “conspiracy to access a computer device without authorization” – is something that should be cause for concern for anyone that has ever clicked on anything on the web. The way this law – which predates all of One Direction and the hyperlinked internet as we know it – is interpreted means that accessing a “protected computer” could get your ass slung in jail. But what is a “protected computer” and how the fuck are you supposed to know when you're accessing one? This is where the law gets interesting. And by interesting, I mean really fucking stupid. 

“The definition of protected computer comes from comes from the Computer Fraud and Abuse Act of 1986, and in 1986 http hadn’t been invented yet,” says Weev. “This was a long time ago when servers were things that were only accessible by dial-up that every single one universally had a password for. There wasn’t the concept of a public network. At the time, if you were accessing a remote server, and you didn’t have permission to be there it’s clear that it wasn’t public data. But now it’s the age of the internet. We click links every day. You’ve never gotten Google’s permission to go to Google, you’ve never gotten any website’s permission that you’ve visited. It’s the universally understood aspect of the web that you can visit a public http server without pre-written authorization. It’s a ridiculous notion that you need it. And the prosecutor is using an ancient antiquated definition of a protected system, which is any system that engages in interstate commerce. So essentially, every cell phone, every computer, every public web server is a protected system, and the minute you do something that a website operator doesn’t like – if they’re rich enough of course, if they’re a Fortune 500 company – then they can have you.”

That might sound rather dramatic, but Jay, my favorite SG-lovin’ lawyer agrees. “Based upon this case, the government’s new position is that you are required to be clairvoyant in terms of determining what a protected computer is and what a non protected one is,” he tells me. “From now on you have to be a psychic…because if it isn’t password protected but it’s a ‘protected computer’ you’re potentially going to be found guilty like Weev was.”

Thank god there’s free tittysprinkles on the internet, because otherwise the risks of clicking on something you shouldn’t wouldn’t be worth price. As Weev puts it, “The law says every time that you click a link, if the person at the other end has enough money and connections, and they just don’t like you, they can have you arbitrarily thrown in jail by declaring your access – after the fact – unauthorized.” 

But how did we get from “something good and beneficial for society” to “free tittysprinkles”? Well, some might see a very obvious linear connection, but those that don’t should consider this; There’s a cat and mouse game that goes on between big business and the internet security community, but it’s a symbiotic relationship nevertheless. And as consumers who are clueless when it comes to code, we should be grateful to those that are scanning for flaws, and pressuring big corporations to sort their shit out on our behalf.

“Perhaps the greatest lesson of Weev’s case is that not only is there no reward for helping these companies patch their holes and fix themselves, indeed now you’re going to be facing ten or fifteen years of prison if you do,” says Jay. “What’s the incentive to make these companies more secure? I mean, you’re better off just hacking them now. You’re better off just hacking these companies and not telling them. If you get caught essentially you’re facing about the same punishment anyway so what’s the difference?”

***

Weev is currently in the process of appealing his conviction. You can donate to help with his legal costs here.

And tell Grampa Government to get off our lawn and out of our emails. 

Isn’t it time we upgraded our legal operating system?

Hacktivist's Advocate: Meet the Lawyer Who Defends Anonymous

http://www.theatlantic.com/international/archive/2012/10/hacktivists-advocate-meet-the-lawyer-who-defends-anonymous/263202/

As a lawyer not particularly immersed in the technology world, Jay Leiderman first became interested in the hacker collective Anonymous around December 2010. That was when Anonymous activists launched distributed denial of service attacks (DDoS) against Mastercard and PayPal, who stopped processing donations to WikiLeaks.

Since then, he has represented a number of high-profile hackers, including Commander X, who is on the run from the FBI for a DDoS attack on a county website in Santa Cruz, California, to protest a ban on public sleeping, and Raynaldo Rivera, a suspected hacker from LulzSec who is accused of stealing information from Sony computer systems. Both Commander X and Rivera could face up to 15 years in prison.

Leiderman, who represents many of his hacker clients pro bono, argues that the law should be changed on DDoS. In an interview I conducted with Leiderman recently, he told me why slapping teenaged hackers with harsh prison sentences is counterproductive.

How did you first become involved with representing Anonymous?

The politics of it spoke to me and the fact that it was a newly emerging area of law really spoke to me. My partner and I do a lot of medical marijuana law. Primary among the reasons that we do that are that it's new and emerging so we can help shape the way that the law ultimately fits society. And because we believe in the politics behind it. And it's the exact same with Anonymous.

We have an opportunity here to make the courts, as these cases wind their way up, understand privacy issues, emerging tech issues, against the backdrop of civil rights and through the prism of free information. And that was something that was just an amazing opportunity for me and something that still engages me as I continue to take on these cases.

You've said about DDoS attacks that "they are the equivalent of occupying the Woolworth's lunch counter during the civil rights movement," but under U.S. law DDoS attacks are illegal. Do you think the law should be changed?

Oh, absolutely. Keep in mind that I didn't say that in an unqualified manner about DDoS. If you were knocking someone's front page offline to ultimately rape their servers and take credit-card information and things like that, that's not speech in the classic sense. When you look at Commander X's DDoS, what he was accused of in Santa Cruz, or with [the] PayPal [protests], these are really perfect examples. And very rarely in law do we have perfect examples.

Take PayPal for example, just like Woolworth's, people went to PayPal and said, I want to give a donation to WikiLeaks. In Woolworth's they said, all I want to do is buy lunch, pay for my lunch, and then I'll leave. People said I want to give a donation to WikiLeaks, I'll take up my bandwidth to do that, then I'll leave, you'll make money, I'll feel fulfilled, everyone's fulfilled. PayPal will take donations for the Ku Klux Klan, other racists and questionable organizations, but they won't process donations for WikiLeaks. All the PayPal protesters did was take up some bandwidth. In that sense, DDoS is absolutely speech, it should absolutely be recognized as such, protected as such, and the law should be changed.

But say that I had a rival law practice across town from you and I was perhaps a bigger more powerful rival with more money and perhaps I wanted to down your website every single day. Isn't that just the equivalent of me just going outside and spray painting and taking down your sign every day and preventing customers from coming to you?
​​
But both of those actions would be illegal in the abstract. Taking down my sign or vandalizing it would be a graffiti or vandalism type charge whereas repeatedly DDoSing my site would be similar in method and manner to that. It's why you have to be careful with the speech. What you have with PayPal, it's a pure form of speech -- it was a limited and qualified thing like Woolworth's. African-Americans went into Woolworth's and said, I want lunch, feed me lunch, I will eat it, pay for it, and leave. Same with PayPal.

Santa Cruz perhaps provides a more compelling case on that because Santa Cruz was about literally petitioning the government for a redress of grievances. Santa Cruz wanted to essentially criminalize -- or did criminalize -- homeless people sleeping in public without qualification. And the city council wouldn't listen, the police wouldn't listen, no one would listen. People regularly die from exposure, because they can't find safe and secure places to sleep in the community. Therefore getting your government's attention in that manner should not be something that the U.S. government is interested in criminalizing and spending resources to prosecute. So in those regards, it's different from the examples you gave, where I would be under perpetual DDoS.

So you're not saying decriminalize DDoS per se, but perhaps it's the way that DDoS is used and other legal factors would come into play there.

Here's what we conceived in terms of the DDoS. The government and people who write about tech tend to call it a "DDoS attack" but in certain circumstances it's not a DDoS attack, but a DDoS protest. So the law should be narrowly drawn and what needs to be excised from that are the legitimate protests. It's really easy to tell legitimate protests, I think, and we should be broadly defining legitimate protests. The example you gave of the rival law firms, that's not protest activities or traditional free speech activities.

The argument has been made that the problem with some of the sentences for Anonymous/LulzSec members is that a lot of them are really just foot soldiers, naive, young, vulnerable kids, who perhaps get into something over their heads. And they're not skilled hackers who are trying to bring down the U.S. government and they don't deserve long jail terms . Would you agree with that?

Absolutely, that's probably one of the most often-repeated and truest things about a lot of these Anonymous members is that they're not these ill-intentioned, misanthropes that really need to have the weight of the law come down on them. I agree with that 100 percent.

Who should the weight of the law come down on then? Should the weight of the law come down on the ringleaders who are behind these people?

Sabu's cooperation [aside], he would be a good example of someone who's cruising for one of these eye-popping over-the-top sentences. He was a bit older, he had been involved in the hacking world for 10 or 15 years; he had a lot of prior Internet misdeeds. He was very skilled, or at least reasonably skilled, he had special skills. He was involved in other criminal activity, he was selling pounds of marijuana, which they didn't charge him with. They dismissed those charges as part of his cooperation.

He was using his skills to commit credit-card fraud, without ideology, without politics behind it, without anything. He was literally stealing from people -- this was not a big, nameless, faceless corporation...There was no ideology behind him stealing credit-card numbers from Mr. and Mrs. Smith.... He was recruiting people actively into LulzSec. One of the allegations in the case I'm handling [Raynaldo Rivera] is that Sabu recruited my client based upon my client's skill, through another member of LulzSec, an intermediary.

Sabu was unquestionably the leader of LulzSec. When you read through the reports, as I have, it's very clear that Sabu was giving orders, pressuring people to "get their hands dirty." ... It was Sony Pictures and the databases were organized via movie sweepstakes -- names and password that were ultimately dumped on the Internet -- and Sabu made individual people go in there and do individual databases so everyone had their hands dirty so that he could exert more control and get them to do more. He had importuned them to criminality.

... He's looking at 124 years so that's obviously beyond ludicrous. But if Sabu were to get a decade or something, that [could be] a sentence for someone like him with a really malignant heart. But for someone like Rivera and the typical member of Anonymous, no, those sentences simply don't fit and for the most part I don't believe they should be going to jail. A lot of these kids -- and most of them are kids -- don't understand the criminal consequences here and could be rehabilitated; scared straight without a jail sentence. There are other things that we could do to them to make them understand that this is in fact illegal and not the way to express yourselves politically.

If we are not talking about harsh prison sentences, how should society respond to rehabilitate those hackers?

I really think this is a situation where a lot of these people are really scared of the consequences once they understand them. Usually someone like that, a criminal conviction in and of itself is a terrible black mark on someone's record now. It becomes difficult to get a job. If you're a person with computer skills, it becomes difficult to get computer clearances to be able to work your way up in a lot of these areas. So simply the conviction alone gets the message across, a probationary period where they're being monitored or checked in on, some community-type service, working with the community in a productive manner. All sorts of creative punishments like those that are available and at the government's disposal.

Do you think denying them access to the Internet is useful?

In some cases it might be useful and appropriate. You really have to look at the offense and the offender. If someone's really unhealthy in their Internet use, it may not be a bad thing to look at them and say, a year, 18 months, two years, let's see how you do without Internet in your life except work and school. That may well be a very good and healthy thing for some people, but you have to look at the offense and the offender before saying we should just yank this person's Internet privileges.

You don't think there's a purpose to passing harsh prison sentences in that it sends a message and acts as a deterrent to any potential offenders?

I don't necessarily think that message gets received by this population which are exclusively naive, not legally savvy, fairly young first-time offenders. That's not a population who can really understand in a practical sense that if you do this, you're going to get a harsh prison sentence. In some of their minds, it almost may be worse, to take away Internet use or modify their behavior in some ways as it so violently changes how their life ordinarily progresses.

Are there any Anons you wouldn't represent?

It depends. I've been asked that question before and I struggle with it and here's why. I don't have to like or agree with the people that I represent to represent them. I have represented neo-Nazis and I'm Jewish. I've been assigned them when I was a public defender and it never really occurred to me until someone asked me, how do you feel about representing this skinhead and I said, you know, I didn't think about it.

Everyone is entitled to a defense and the more reprehensible they are and maybe the more guilty they seem at the beginning of the case makes them more entitled to a vigorous and hard-hitting defense. So I don't necessarily know that there's someone I wouldn't represent based upon what they did or based upon their politics. I wouldn't go ahead and represent someone whose views I didn't agree with pro bono. I'm not going to spend my time and energy that way. ... Certainly there are many people I wouldn't represent pro bono.

Would you represent Sabu pro bono?

No. The damage he did by turning so completely on people he used to call his brother [was considerable]. People who cooperate, throw someone else into harm's way so they can soften the blow on themselves, I tend not to represent. For those reasons, I wouldn't represent Sabu at all. [...] He hurt a lot of people and he did it to save his own skin and he hurt a lot of people worse than they would otherwise be hurt.

---

Copyright (c) 2012. RFE/RL, Inc. Reprinted with the permission of Radio Free Europe/Radio Liberty, 1201 Connecticut Ave., N.W. Washington DC 20036.

Article about Jay Leiderman Client "Commander X"

http://arstechnica.com/tech-policy/2012/12/anon-on-the-run-how-commander-x-jumped-bai/