When will they ever learn?
: Republican election-season break-ins. Hmmm. Where have we heard this before?
47 responses to “When will they ever learn?”
-
Your pal Glenn Reynolds, the guy confused by the Plame affair, thinks this is nothing too:
“I don’t know. This may or may not be illegal — I wouldn’t be surprised either way — but it’s certainly cheesy. “Gentlemen don’t read other gentlemen’s mail,” and all that. But nobody ever mistook these guys for “gentlemen.” Certainly no hacking skills seem to be involved:”
Disinformation as usual from the Professor of Law. Whether the documents were stolen through the use of cracking skills and techniques is irrelevant. If I walked into your unlocked apartment Jeff, and took your bible from your bedroom it would still be theft. -
Near as I can tell, there was no break-in. The system was “jointly owned”, there was no firewall of any sort, and one side “merely” accessed and copied the other side’s stuff. Surely not nice. Probably not ethical. Perhaps a violation of some Senate code of conduct. But hardly equivalent in the eyes of the law to a literal break-in at the Watergate.
-
Where have we heard it before? Well, we heard it in the prior post on Buzzmachine!
-
anne@anne.anne
Someone who is confused is usually not able to spread disinformation. -
Ignorant as usual, Anne. They were working on a shared server, with shared workproducts in a shared file space without protection. If you leave an incriminating memo on my desk and I read it, I might be a jerk, but I didn’t break into anything.
-
Hi Charles, I admit you’ve got me stumped. I don’t know how it is you spell so well, when you can’t read worth beans:
From the spring of 2002 until at least April 2003, members of the GOP committee staff exploited a computer glitch that allowed them to access restricted Democratic communications without a password. …A technician hired by the new judiciary chairman, Patrick Leahy, Democrat of Vermont, apparently made a mistake that allowed anyone to access newly created accounts on a Judiciary Committee server shared by both parties — even though the accounts were supposed to restrict access only to those with the right password.
The documents were not in a shared file space. Come on, not even you think gov’t is that dumb. -
Anne: “…a Judiciary Committee server shared by both parties…”
As a techie, I would NEVER expect the mainstream media to give an accurate representation of the technical details of any issue. This is no exception. -
Yes I do, anne. How dumb is the government let me list the ways…
-
Where have we heard of this before? Well, recently, it happened when Democrats stole then candidate Bush’s debate preparation materials.
I hear the heavy breathing already… “but, the Gore campaign returned those!” Well, we’ll never know if they didn’t have a look see first, will we? It could explain some of Al Gore’s cockiness which, of course, backfired. -
Rootbeer, I absolutely agree with you.
Whatever is reported now as the facts, it almost certainly is not what actually happened as us techies would understand it.
The one thing I believe is most likely true, having read the article, is that the documents were in accounts that should have been password protected, and probably were, but that were given world readable permissions.
If this had been a DoD computer and the documents had been classified, it would absolutely have been a crime to read them, especially to have continued reading them for over a year.
If this had been Jeff Jarvis’ apartment, and the document was his medical records, it would almost certainly have been criminal. Repeatedly stepping through Jeff’s apartment door would have been illegal, even if Jeff had purposefully left it unlocked.
Now translate that into the world of cyberspace and out world of politics…. -
The pubbies explained this a couple of weeks ago.
Leaky Leahy (D) hired an idiot.
Hey, anyone notice the timing? Spring of ’02 when Leaky was in charge(?) of the committee until 4/03 when the pubbies were in charge?
Dems were minority in January of 03.
And wait – only NEW accounts, not old accounts.
Oh, and anne: apparently made a mistake that allowed anyone to access newly created accounts
ANYONE to access (I’m not yelling just emphasizing).
Sounds like not password protected to this luddite. But I’m sure our computer experts will be happy to clarify. Is it like letting everyone in the office see the boss’s calendar but not letting anyone make appointments, yet the glitch allows them to do so???? -
Sandy P., I have no idea what actually happened, but what you’re describing could easily occur on a unix/linux system, and a windows nt/xp based system.
The accounts are password protected. Frist can’t login as leahy without knowing leahy’s password. Leahy can’t login as frist without knowing Frist’s password. All new accounts are placed in the 2004 group. Files are protected so that the owner has full access, the system has read access (to make backups), the group has read access, and everyone else has no access.
Under that scenario, the mistake was to place all new accounts in the same group. So each senator, congressman, staffer, or whatever thinks the files are protected — and they do have a password protection, but the wiley Miranda discovers he can just read the files anyway.
Again, if this had been DoD and those docs had been classified, the IT guys would have been sacked, and Miranda would be in jail.
If you and Jeff live in an apartment and Jeff locks his door but leaves his window unlocked and you repeatedly enter through the fire escape, you are committing a crime. -
Anne.Elk –
It’s not DoD. The files weren’t classified. And it would depend entirely on the nature of Sandy and Jeff’s legal relationship. Other than that, Mrs. Lincoln … -
A fall ’02 strategy CD was found in Lafayette Park. The “right thing to do,” one would suppose, would be to give it back to its owner. Instead, it was used as a way to attack the other side… the other side, this time being Republicans. I don’t recall much critical coverage of this in the Boston Globe…
http://www.politicspa.com/mehlman-rove_files/v3_document.htm -
There should be a Latin maxim, Cave Geekem? (Beware of the geek)
-
Anne, in this particular case I don’t need to read the press on these things: this is my profession, I’m one of the top people in the world (including having written the book, literally, for the Navy) and I hear these things from the horse’s mouth. And this is what I hear:
- it was a shared Windows server;
- the files were in a single big area for work products of the committee;
- the files were draft memos, not emails or something of that sort;
- the default permissions for all accounts had been set up to make all work products readable to all uses. This is, believe it or not, the most common setup for a staff group that is (theoretically) collaborating;
- the people using the files never thought to change permissions to restrict them (which you can do on Windows, but most people never learn the ACL commands);
- Leahy is trying to slack it off on the techie, who is scared to death he’s going to be fired or arrested.
Frankly, I don’t expect this to change your mind at all, since you seem to be peculiarly invincable in your ignorance, but that’s your problem.
-
Oh, and Anne, I’ve got a measured IQ of 180 and two PhD’s, so I don’t tend to be real sensitive to “you’re stupid” slurs. Try fat jokes.
-
Well my IQ goes up to 11.
-
how about your insecurity issues, Charlie? Sheesh, “I have a measured IQ of 180, so I go around accusing people of ignorance”. Grow up.
Now, I don’t know about that horse of yours, but what seemed clear was that a mistake was made by inaccurately setting up the security, or not providing enough assistance (politicians are not tech-savvy). Anyway, that doesn’t matter much, since cybercrime laws are pretty biased in favor of the victim. If it was clear that the accounts shouldn’t be accessible (e.g. they’re supposed to be private), accessing them is illegal. What’s more, doing it a year long is a quite a breach of ethical standards for “a staff group (theoretically) collaborating”.
I’m not sure I can convince you, but iq my goes up to at least 12, so who knows… -
Unless somebody can name a specific law that was broken, this is a non-story. Bueller? Anyone?
Sure, it wasn’t a super-duper-nice thing to do. Welcome to Politics.
Watergate wasn’t a true scandal until the huge coverup ensued. A break-in is minor league.
And irony of ironies, the real story here is the obstructionism by Leahy and Co. at the specific direction of un-elected lobbyists. Gosh, I wonder why that isn’t getting covered?! -
I’m sure it’s a bit rude to point this out, but what’s worse here, the filching of unprotected files (apparently legal, even if, as IP puts it, cheesy), or the reprehensible content of those files themselves? “We have to block this qualified nominee–he’s the wrong ethnicity for our purposes.”
To put it another way, for the lefties: what was worse, stealing and publishing the Penatgon Papers (and that really was, indisputably, a violation of the letter of the law), or the contents of the papers themselves? Hmm? -
Will,
Shame on you for trying to redirect the discussion back to the relevant part.
No, no, no, all the sound and fury must be directed at those reprehensible Republicans who want and “illegally” read the files that were left in plain view.
Frankly I think even worse than the Estrada complaints was the corresponsdence over holding up judge appointments in one district while a particular case was working it’s way through appeals. -
I suggest when anne.elk’s IQ hits room temperature she sell.
-
Charlie is right and I hate to say it but his kind of thing happens all the time. I worked for a company that had an outside consultant putting in time on a time card and he forgot the job codes. He went looking for them and found himself looking at IP (intellectual property). From that point on any company I’ve worked for I’ve moved all IP to a sever that can’t be accessed from a remote location. It’s a pain but it’s safe. You can’t pin this on one tech guy all systems have glitches and half the time your not aware of them till a security flaw has been found or breached. As to the breachers once is a mistake but if they continually breached the system then that’s wrongand maybe criminal. This might fall under the DMCA jurisdiction (Digital Millennium Copyright Act of 1998). This law makes the manufacture, distribution, and trafficking of an access control circumvention device illegal. It would be a broad interpretation but, who knows.
-
Yeah, Sander, I’m really insecure. That’s why I was giving Anne advice on things I’d find more hurtful than “stupid” jokes.
Part of the real point here, I think, is that my understanding is these things were on a file server that was consistently used for shared work products. This is, after all, a committee that theoretically is doing something other than sniping at one another: the Judiciary Committee writes a lot of work product which is necessarily shared among both parties’ staffs. If it is as I understand it — and I have some good reason to think I’m getting good information — then I just don’t think any crime occurred, and I can’t get excited about the ethical breech because my general impression is that most people on either side in Washington would need a dictionary to even spell “ethics”. -
You know the funny thing about this entire episode, if all were in the same acount and all had access, wouldn’t access go both ways?
-
Why would everyone think the files are protected? All newbies were logging on w/the same password. Nobody sat next to or in the vicinity of each other?
I used to work for the pres/owner of the company. I expected his files to be protected, as I would accounting. But sales? Why? There were certain things which everyone could use.
And that brings up another point. While Leaky is blaming the tech, who gave what instructions to the tech? Maybe that’s what he was told to do. -
From the NYTimes
Manuel C. Miranda, a former Republican Judiciary Committee staff member, whose name appeared as a recipient of one of the Democratic e-mail messages and who has been questioned by Mr. Pickle’s investigators, said in an interview Thursday that he knew how the documents were obtained by Republicans. He said that a junior member on the staff of Senator Orrin G. Hatch, Republican of Utah and chairman of the Judiciary Committee, had discovered a flaw in the computer system that allowed him to read some of the Democratic computer traffic.
(snip)
“Those documents that I did read were, in my view, not obtained in any way that was improper, unlawful or unethical,” he said. He described them as “inadvertent disclosures that came to me as a result of some negligence on the part of the Democrats’ technology staff.” His only obligation, he said, was to see that the Democrats were told that the computer system had a flaw that allowed Republican aides to read some of their memorandums.
.
“I knew our people had told their people about it,” Mr. Miranda said. “Once I knew that, I had no further obligation.”First of all, it was because of a flaw, NOT because these files were supposed to be accessible to anybody.
As KMK says, if they did it for periods of time, it’s quite probably illegal, despite the ‘warning’ Mr Miranda gave. -
‘Leahy is trying to slack it off on the techie, who is scared to death he’s going to be fired or arrested.’
He’s not fired yet? -
What I’m wondering is why they didn’t use the information they did retrieve to better effect. You “steal” the other teams playbook and they still make you look like monkeys on the playing field?
-
Sander, if you really imagine that the NYT can tell the difference between “wasn’t set up to protect the files” and “hacked”, I’d like to make you a deal on some Colorado mountain swampland. We’ve even got alligators.
The “flaw” could easily be as I have been hearing it was; “flaw” doesn’t necessarily mean Angelina Jolie and Jude Law found some mysterious exploit. And, contrary to your supposition, if they were notified about the flaw and didn’t take any further steps, that alone probably precludes any prosecution. You can’t prosecute for tresspass if you know people are walking around on your land and you don’t even close the gate. -
Happens that Jack Shafer at Slate covers the same topic and demonstrates great insight by agreeing with me.
-
Charlie, that was the NY Times reporting what Miranda said. Do you honestly believe that the system was set-up for everyone to see each others communications?
Whether or not the accounts were adequately protected (a stupid mistake for sure), accessing private account without proper authorization and lifting files, certainly if it continues for a year is quite probably illegal. So, the only question is how authorized the Republican staffers were to enter Democrat users’ accounts. My guess is they weren’t at all. -
Sorry Charlie, what the article suggests is that you were 180 off course when posting that:
# it was a shared Windows server;
# the files were in a single big area for work products of the committee;
# the default permissions for all accounts had been set up to make all work products readable to all uses. This is, believe it or not, the most common setup for a staff group that is (theoretically) collaborating;
If they got it through My Network Places as is claimed in the article, then it buttresses the argument that the files were in password protected accounts and not in a single big area for work products of the committee.
That more than one computer was seized and that access was via My Network Places indicates that these accounts were on different computers.
If they got it through My Network Places it indicates that someone, somehow shared the file systems. That was a technical mistake, and a mistake should be checking, automatically, on a regular basis. The security consultant, as you know, since you wrote the book for the Navy, should be conducting these inspections and audits on a regular basis, and discussing the results with the senate staffers.
If the systems followed basic government security rules, each system has on it, in various places, banners and warnings telling users they need authorization to access each computer. The DOJ suggested banner reads as:
“WARNING! By accessing and using this system you are consenting to system monitoring for law enforcement and other purposes. Unauthorized use of this computer system may subject you to criminal prosecution and penalties.”
I do not know, but I suspect that senate staffers are aware of such warnings.
In Windows before XP, the default for Windows was often to share these filesystems. That’s why so many ISPS would tell their customers how to turn it off. It means that if you walk into a McDonalds with wifi and you have the systems shared that someone else in the neighborhood could access your files. There is a word for that, and you named it, trespass, and it is criminal.
The picture is much more akin to what I hypothesized and the analogy is made to some entering your apartment through a window that opens onto the fire escape.
If this was you or your kid doing this in a school, place of business, coffeehouse, or federal building, you could be charged. -
I went through two cases involving somewhat of the same issue. Doesn’t make me an expert but I have some insight. If they unintentionally found their way into dem documents (and I think it was unintentional at first) no big deal. Just because they notified them of the security flaw doesn’t relieve them. The fact that they knew they shouldn’t acsess the files and did was wrong. The relevant questions will be when did they notify them? The first time or after a period of acessing the files. After they notified them they should have stopped. Did they? I don’t think so as far as I can tell from the reporting. (which could be inacurate). Did they distribute the knowledge of the security flaw amongst the rep party? Looks that way. That is a violation. This is what the inquiry is for. If after they assemble the case they decide they have enough to prosecute it still doesn’t mean they are guilty of anything. A judge will have to rule on the content of the information they received. Was it personal or common knowledge? If the judge decides it was personal (meaning personal property) they then can proceed to try the case. Can they stretch the DMCA law to cover this? Maybe under a broad interpretation. The law makes the manufacture, distribution, and trafficking of an access control circumvention device illegal. The dems did distribute the material and the did circumvent access control. This law was initially set up to protect companies software from being hacked and having the hackers distribute the access flaw to other (or use themselves) for illegitimate purposes. However, they did arrest Dimitry Sklyarov for a paper and presentation, at a hackers conference, of detailed explanations of flaws and encryption used by Adobe’s ebook format. The judge told jurors that in order to find the company guilty (Sklyarov worked for Elcomsoft), they must agree that company representatives knew their actions were illegal and intended to violate the law. He was found not guilty by a jury.
The long and short of it is did the reps do something wrong? Yes, they did. You and I would feel violated if someone accessed our computers and information. Was it illegal. That remains to be seen. -
The dems did distribute the material and the did circumvent access control.
This should read the reps not dems. -
Anne “reachable though My Network Neighbors” means is was accessible through a network share. It nowhere says any password protection was circumvented, just that a “flaw” made it available. By far the most common flaw of this sort is to not set the protrections high enough. Having siezed more than one computer doesn’t suggest in any way that there was no central server — which is a damned uncommon way of setting up a Windows network in any case, and has a bunch of disadvantages — because in any investigation (and I do a lot of them) you want to seize or image every computer that could potentially have been used for illegal access: finding copies of illicitly obtained files is good evidence. In fact, doing this with chain-of-evidence is the first big task in forensic computer security gigs.
I agree with you that checking for unauthorized or out-of-policy shares is one of the first things that a security audit should do, but you’re continuing to assume that the access was contra-policy for some stated policy. That’s not what I understand to be the case: rather the opposite, as I said. (The fact that the RP side revealed the flaw to the D-side, and nothing was done, supports this notion.)
If it’s not contra policy, the audit would not discover the flaw because the audit wouldn’t consider it a flaw! An audit, by definition is examination of a system’s compliance with the stated policy.
And that’s if there were even an audit, or for that matter a stated policy, which I doubt frankly. The only Government systems that seem to get audited on a regular basis are systems with classified material, and we can be pretty confident these weren’t containing actual classified material, because Windows isn’t highly certified enough to be used to manage classified data in an unclassified environment. In other words, this is a mistake, but it’s a common one.
If you don’t actually know any of this stuff, why do you bother to comment? -
Um, other answers:
Sander, yes, that’s what I believe. I see it often enough that I have stopped being surprised by it.
Sandy, I think you’re absolutely right. If I were a betting man — which I am, actually, but I don’t know any way to confirm this — I’d bet at least $1.85 (didn’t say I was a big spender) that as soon as the flaw was discovered, someone on the D side tried the same trick.
KMK, I agree that it was probably ethically wrong; as I said, I’m not certain anyone in Congress knows what ethics is — except academically — anyway. The original question appeared to me to be of legality, and given the Sklyarkov and DeCSS cases, I suspect the “circumvention” parts of the DMCA may be a dead letter anyway.
In the mean time, however, if some of you want to impress me with your wroth and indignation about this, you need to first of all convince me of equivalent or greater wroth and indignation about the Pentagon Papers (actually classified and actually illegal to disseminate) the publication of the contents of the Rove powerpoint CD (more likely strictly illegal, because it wasn’t access to information that a stated policy said should be accessible) and the Newt Gingrich cell-phone intercepts (strictly a felony, but revealed on the floor and thus protected by Congressional immunity.)
As I said, I agree with Jack Shafer: the striking thing is that it appears this kind of subornation of information, and leaking of same, is a lot more exciting when it’s a Republican doing it. -
Charlie,
You know that a password was circumvented. All these guys are working on Windows machines and none of them have setup password protections on their accounts?
If I lock my door and you enter through the doggie door to still my copies of PlayElk are you going to tell the judge, no harm no foul, you didn’t break in through the lock?
You were whining the tech guy was in fear for his job and alluding that Leahy was going unfairly to go after him for it.
Uh, clue to Ph.D.^2, the tech guy did a craptacular job according to your scenario. The whole crux of your argument is that the guy got in through really well known and trivial mistakes. Where was techboy? The material may not have been classified by DoD but it sure was sensitive. Where was his audits? Where were the firewalls and the firewall checks? Where was he in informing Leahy AND Frist that their systems needed auditing and firewalls?
Let’s watch Genius Charlie of the two Ph.Ds pile it higher and deeper by moving the goal posts. First he says “shared server, with shared workproducts in a shared file space without protection” now he’s down to “accessible through a network share”
Sorry, got to get back to an article in the latest PlayElk. -
(It’s almost rutting season :)
-
Anne, do you use Windows machines? If not, I suppose you don’t know that the comment about Windows password protection is nonsense, so I’ll explain: once you log into a Windows network via the Windows login, the “Network Neighborhood” icon gives you access to knowledge about any processor on the network. If the processors are set up shared — which Windows did up to fairly recently by default — then you can pretty much explore anything in your domain. It’s very clear from the description that there was only one domain, which is exactly what I’d expect when the committee is working on shared workproducts, which we know they do. That’s the job of the committee staff — generating committee workproducts.
As to the rest — I didn’t move the goal-posts, you quoted me without context. I said “accessible by network share” AND “damned unusual not to have a central server”. In fact it’s bloody near unknown in any real work environment. I’m continuing to assume that you don’t use Windows at least as an expert, because if you do then you’re being purposefully misleading.
As far as needing firewalls and audits, you’re preaching to the choir: they should have them. Especially if the Dems are going to leave incriminating memos lying around.They apparently did not. This is, sadly, not unusual.
They should also have a written policy stating what is and isn’t shared, and should enforce that by technical means. This is also not unusual.
(I would guess that at least nine times out of ten, when I am working with someone on security, the question “what’s your policy?” is answered with a blank stare.)
In fact, in many environments — law offices, for example — you’ll often find that they depend entirely on ethical constraints and otherwise leave things completely open, because attorneys in the same firm regularly explore or comment on one another’s work products, and paralegals and clerks are often in charge of managing the files or maintaining them. This leads to an environment in which the major organization is by client or project, and all files are shared … which is still the way I hear it the committee did things.
This is not necessarily wrong, nor is it necessarily an incorrect way of handling things that are sensitive or confidential; all law firms deal with sensitive, confidential, and privileged information. Unlike most other organizations, they have statutory protection against searches and illicit use, so they are entitled to depend on those.
If you’d really like to know more about security policies, you could check out my Sun Blueprint on them. http://www.sun.com/blueprints, I think is still the path. -
(It’s almost rutting season :)
Tease.
-
Sorry Charlie,
But the DMCA sadly would trump you. You and I may both think that Windows Password protection is easily circumvented, but the DMCA doesn’t make any claims to efficacy.
The original articles states “the accounts were supposed to restrict access only to those with the right password.” You basically acknowledge that with a Windows Domain, even with Windows Workgroups, the users would have to login and so the users would have the expectation that others could not read their work.
We’re not talking about one entry here, or even multiple entries within a few days. We’re talking about repeated entries over an extended period of time. Even assuming the users were in the same domain, of what relevancy is that? If you take things from other people that you are not authorized by them to have, when is that not stealing?
Happens in the workplace, in schools, in the military etc. Happens to workers, to students, to kids, to hackers, etc. -
scarshapedstar’s comment at Matthew Yglesias’ blog
http://www.matthewyglesias.com/archives/002400.html#002400
Okay.
These files were supposed to be protected, but the system failed, and the Republicans knew it, and they stole them, for an entire year.
Also…
18 U.S.C. 1030. Fraud and Related Activity in Connection with Computers
[snip]
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains–
[snip]
(B) information from any department or agency of the United States; or
(C) information from any protected computer if the conduct involved an interstate or foreign communication;
(3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States;
[snip]
(c) The punishment for an offense under subsection (a) or (b) of this section is —
(1)
(A) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(1) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and
(B) a fine under this title or imprisonment for not more than twenty years, or both, in the case of an offense under subsection (a)(1) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph
Yes, it’s illegal. If you know anything about the Kevin Mitnick case, and you say otherwise, you’re lying. If you don’t know about that case, your opinion is worthless anyway.
Case closed.
Posted by scarshapedstar at January 24, 2004 03:39 PM -
Anne, I not only know about the Mitnick case, but I’ve met Kevin a couple of times, and you’re still not getting the technical point: once you’ve logged into your own account under Windows, you generally have access to the whole network.
Let’s look at the statute:
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains–
Here’s what I believe happened, based both on press accounts and other information I have reason to trust: someone logged into their own account discovered they could access files the Democrats didn’t want them to see, but which weren’t protected. There was no stated security policy. Thus their immediate access was authorized, and (given no policy) could not have exceeded their authorized bounds. What’s more, since the access was granted by the sysadmin, and wasn’t changed after they pointed out the issue, the implied policy appears to be that it was indeed authorized.
(As I said, it is my understanding that the servers were being used for shared work products, so this is a perfectly plausible policy.)
This pretty much obviates the point in para (3) as well; I don’t believe that the access was unauthorized by stated policy, and therefore under the law. Mitnick’s case doesn’t apply: all of the people involved were employees of the same committee and had authorized access.
Similarly, the DMCA doesn’t apply: there’s nothing I’ve seen that suggests password access to copyrighted materials was being circumvented. While under the Basle Convention the work products are indeed copyright, under US law the work products of the government are not restricted under copyright, so there’s no claim of copyright protection being circumvented. What’s more, the stories all seem to suggest that password protection wasn’t being circumvented, because it was never implemented.
Now, you’re absolutely right that the various users may have had the expectation that their works would be protected, but that’s a whole ‘nother kettle of fish: it clearly wasn’t set up that way, and according to the stories that have been quoted, the sysadmins knew they weren’t set up that way and let them run as they were.
Is that the right way to do it? Hell, no. (I wouldn’t even go so far as to say that using Windows for this kind of information is well-advised.) But neither of us are claiming the security setup was good or right.
I’m just pointing out that if you’re claiming illegality, you’ve got to meet the requirements, as eg., 18 USC 1030 that you quoted, or the DMCA. I don’t think that you can, and while I’m not a lawyer, this is my specific area of expertise. So long as the facts are as stated, I don’t think a crime has been committed. Period.
As to its ethical standing, I think I’d probably agree with you it was ethically wrong — but then I thought the publication of the Pentagon papers was wrong too, ditto the release of the Gingrich intercepts, and Orrin Hatch’s leak of our successful intercepts of bin Laden’s cellphone calls, and the Rove powerpoint slides, and the negotiation memos between Rush Limbaugh and that DA in Florida (Miami county? Palm Beach county? My grasp of the geography of South Florida is pretty spotty.)
But then, so is refusing to confirm Miguel Estrada because he’s Hispanic; and accusing a man who risked his life to testify against the Klan and chose to send his kids to desegregated schools particularly because he didn’t believe in segregation of being a racist, isn’t just wrong, it’s despicable. (Even Nat Hentoff thinks so.)
Let’s see some of the famous outrage against what’s being done to them, hmmm? -
Hi Charlie, I admit, I’d never heard of the Basle Convention before now. I may in fact be all wrong.
It may just be relevant after all. Would you tell me more about this? -
Sure — I may have spelled it slightly wrong(it’s one of those words I learned in Europe and in German and I get confused about the English spellings. In German it’s Basel) and naive Google-ing is thwarted by the fact that damn near every page has the word “copyright” on it somewhere.
But the gist of it is this: the US changed its copyright laws some years ago to fit with the common convention, which was (as I recall) adopted in Basel. Thus the “Basel Convention”, although since then there’s been a Basel Convention on moving hazardous wastes. (No doubt from the release that killed all the eels in the upper Rhine some years ago.)
Under this change, several things happened:- Any written work is automatically copyrighted; you no longer have to register to preserve your ownership rights. The only exception is a “work for hire” in which case your employer owns the rights; this must be conveyed by an explicit contract in writing. (Note that you must still register to recover monetary damages, but your right to regulate the use of your work is automatic, extends from the first moment you type it, and doesn’t require the ‘Copyright 2004’ notation.)
- Term of copyright is automatically extended to 50 years past the death of the author. (This has been extended in the US by a bill authored by Disney’s wholly-owned subsidiary, Fritz Holling.)
- At the death of an author, the authors’ heirs can recover the rights of any work. (Ginny Heinlein did this with a lot of Robert Heinlein’s stuff.)
The point about the DMCA (“Digital Millenium Copyright Act”) is that it only covers subverting copy protection mechanisms in order to violate the rights of the copyright holder. Since no Government-authored material can be withheld under copyright, DMCA can’t apply.
