Reply All: #43 The Law That Sticks
October 29, 2015 11:44 AM - Subscribe
The Computer Fraud and Abuse Act is a law. It's been on the books for almost 30 years. And it makes totally mundane online behavior illegal.
yeah, it sounds like they were trying to paint this as nothing more than a changed headline, but at the same time mentioning, "oh and he published accessed codes and sent harassing e-mails too, but nevermind that".
posted by skewed at 2:37 PM on October 29, 2015
posted by skewed at 2:37 PM on October 29, 2015
It did feel a little buzzfeed-y: "Man defaced headline, you won't believe what happens next!"
posted by jazon at 2:40 PM on October 29, 2015
posted by jazon at 2:40 PM on October 29, 2015
It was so weird hearing a sympathetic spin on the Matthew Keys story at the beginning of the episode. The guy caused actual harm, and I don't think that 5 years is crazy for what he did. I was wondering if the fact that he was a journalist made the crew feel a little softer-hearted towards him.
I mean, the CFAA has all kinds of problems, but Keys is not the poster child for prosecutorial overreach.
posted by sparklemotion at 6:47 AM on October 30, 2015
I mean, the CFAA has all kinds of problems, but Keys is not the poster child for prosecutorial overreach.
posted by sparklemotion at 6:47 AM on October 30, 2015
Wait. What actual harm did Keys cause? I don't doubt he wanted to cause actual harm, but ultimately it was a defacement almost no one saw and was quickly restored.
posted by inturnaround at 6:35 AM on October 31, 2015
posted by inturnaround at 6:35 AM on October 31, 2015
They covered it in the episode, he shared network credentials with Anonymous, and harassed network employees *and* listeners.
posted by sparklemotion at 4:25 PM on October 31, 2015
posted by sparklemotion at 4:25 PM on October 31, 2015
He didn't cause much harm, in my opinion, but I imagine I would feel quite a bit differently were I responsible for the LA Times security.
posted by graventy at 12:54 PM on November 5, 2015
posted by graventy at 12:54 PM on November 5, 2015
I appreciated the clear statement of how harmful this sort of "everyone's guilty!" statute is.
The Aaron Swartz section was like a punch in the gut. Nearly three years and it still hurts. We weren't that close. But he was a colleague and an acquaintance and good people like me. He deserved better.
posted by Nelson at 1:04 PM on November 7, 2015 [1 favorite]
The Aaron Swartz section was like a punch in the gut. Nearly three years and it still hurts. We weren't that close. But he was a colleague and an acquaintance and good people like me. He deserved better.
posted by Nelson at 1:04 PM on November 7, 2015 [1 favorite]
What actual harm did Keys cause? I don't doubt he wanted to cause actual harm, but ultimately it was a defacement almost no one saw and was quickly restored.
I've been on the response team for security breaches at large companies. I've seen very simple breaches consume weeks or even months of a dozen or more peoples' time, because (as explained in the episode), once you've found the evidence of a breach, you have to exhaustively investigate to make sure nothing else was done. Who is to say they didn't subtly modify other articles, place backdoors in the network, or download a bunch of confidential data? One would hope that a company as large as Tribune would have good enough monitoring and audit trails to be able to rule those things out with a minimum of work, but I've seen the innards of enough large corporations to never take that for granted.
They may have overstated the cost of this, but it's not really fair to say "he only changed a headline, and no one saw it."
posted by primethyme at 9:12 AM on November 8, 2015
I've been on the response team for security breaches at large companies. I've seen very simple breaches consume weeks or even months of a dozen or more peoples' time, because (as explained in the episode), once you've found the evidence of a breach, you have to exhaustively investigate to make sure nothing else was done. Who is to say they didn't subtly modify other articles, place backdoors in the network, or download a bunch of confidential data? One would hope that a company as large as Tribune would have good enough monitoring and audit trails to be able to rule those things out with a minimum of work, but I've seen the innards of enough large corporations to never take that for granted.
They may have overstated the cost of this, but it's not really fair to say "he only changed a headline, and no one saw it."
posted by primethyme at 9:12 AM on November 8, 2015
They may have overstated the cost of this
Well, yes. That's the whole point of this section of the podcast. That they overstated the cost, to abuse the CFAA to increase his felony sentencing. I'm all for taking computer crimes seriously. I'm even sort of OK with making them a matter of criminal law, not just civil law. But there has to be proportionality.
posted by Nelson at 9:19 AM on November 8, 2015
Well, yes. That's the whole point of this section of the podcast. That they overstated the cost, to abuse the CFAA to increase his felony sentencing. I'm all for taking computer crimes seriously. I'm even sort of OK with making them a matter of criminal law, not just civil law. But there has to be proportionality.
posted by Nelson at 9:19 AM on November 8, 2015
I'll go on record saying that I don't think 5 years is disproportionate for this, if he actually did all the stuff he's accused of. Regardless of financial impact.
posted by primethyme at 4:12 PM on November 8, 2015
posted by primethyme at 4:12 PM on November 8, 2015
You are not logged in, either login or create an account to post comments
It seems like maybe they should just have done an episode about Swartz instead?
The explanation at the end about what could potentially be illegal under the law was good, though.
posted by selfnoise at 11:57 AM on October 29, 2015