"There weren't any signs saying, 'Don't go in.'

Quote:

---

There weren't any signs saying, 'Don't go in.'

---

There probably wasn't a welcome mat out either!

Quote:

---

Former University of Texas student indicted for allegedly hacking into computers, stealing info

The Associated Press Nov 4 2004 11:23AM

A former University of Texas student was indicted on charges he hacked into the school's computer system and stole Social Security numbers and other personal information from more than 37,000 students and employees. In a four-count indictment announced Wednesday, Christopher Andrew Phillips, 21, was charged with fraud and storing credit card and bank account information with intent to defraud. He allegedly hacked into the system in February and March 2003. Officials said the university spent $167,000 responding to the security breach and warning people of possible identity theft. Phillips was not accused of using the information for illegal purposes, and his attorney, Allan Williams, said his client had no criminal intent. "He didn't use any hacking tools. The system was open," Williams said. "There weren't any signs saying, 'Don't go in.'" Phillips previously told officials he had no intention of using the information to harm anyone.

http://www.securityfocus.com/news/9861

---

So why did he collect the information in the first place?..............

As in "well yes, my client did have 200kilos of anthrax spores but he didn't mean any harm................" :rolleyes:

Maybe this guy's other hobbies were collecting automobile registrations and locomotive numbers? :)

ACK! there are times when I believe that lawyers who unsuccessfully defend lusers should get the same sentence, and have to share the same cell. It might focus their minds a bit :eek:

agreed. but still. social security info and who knows what else. that stuff should be properly secured. it's down to common sense. thats plain stupidity on the part of their IT people.

your absolutly right secure_lockdown, but that's still no defense.

"He didn't use any hacking tools. The system was open,"

what exactly does "open" mean and what do they mean by "hacking tools"? is a sharp mind considered a hacking tool?

is it that the site wasn't patched or was there a link they didn't expect people would click on or a hidden directory that someone could guess the name of> was the information found on google...?

if you have a web or ftp site and you dont post a statement of use its your fault if someone accessed it in a way you didn't intend.

if some one takes advantage of a directory transversal or downloads and changes an authentication form or injects code into a query then they've broken the law even though they havn't used any third party "hacking" tools. it's my understanding that the laws regarding computer crime are very clear on this. if you bypass authentication processes you've broken in. if you use phony logon credentials, those that are not yours, you've commited computer fraud..this doesnt make the admin any smarter but the perp is still very much at fault. im too tired to look up the law right now but that's my understanding of it.

hmmmm, i do believe lawyers that defend/lie for people that are (a) obviously guilty *cough* OJ *cough* or (b) defend people that arent quite "guilty" but have obviously done something wrong (in this case, its kind of hard to explain how you ended up having lots of credit cards and socials that arent your own) should suffer the same punishment that the defendant recieves. I mean, yes, they are simply doing their jobs and what they are paid to do, but there should be a moral distinction between good and bad, black(hat) and white(hat).....just my 2 cents :-)

-z3

What, so now we have to have our networks "posted" before we can prosecute perpetrators of unauthorized/unwanted access, or for theft of information? Sounds to me like the lawyers are going to put us in the same position of farmers who don't want people hunting on their property and killing their farm animals or children. If we don't "post" there is no foul? That is a very huge step backward.

a.) He hacked the system on the network

There was most definatly something in his student hand book that gave a broad 'computer misconduct' charge. Bascially: if you mess with our computers in any way that we see unfit, then you are in the wrong.
Conclusion: The sign was there and the student signed a contract saying that he understood and agreed to obide by 'the sign'

b.) He had a whole crap load of info that he stole which was on his personal computer

Yeah, you really can't dispute that.

c.) There are plenty of systems on the internet that are insecure. There are plenty of backroom doors in the mall that are open too and people who leave their cars unlocked, and wallets that are loosely placed in pockets, and items and stores too close to the door, and SS checks that are just left in mail boxes....

Point being, it is still breaking the law. If he wanted to point out a shortcoming in the network setup, he could have contaced the officials and told them.

d.) No hacking tools were being used??? WTF kinda argument is that. Many people have robbed stores without 'tools' (aka weapons). Last time I checked Uncle Sam doesn't give bonus points for robbing banks without a gun.

Another case of "It's your own damn fault now live with your mistake instead of making silly excuses."

Quote:

---

Phillips previously told officials he had no intention of using the information to harm anyone.

---

Because he is too retarded to be able to do it himself.

That does not mean that he wouldn't sell the information to someone who did know how to harm people.

AND:

Quote:

---

his attorney, Allan Williams, said his client had no criminal intent.

---

For which you can read "did not have the requisite skillset, and was just waiting to meet someone who did"

This smells of plea bargaining for a lesser charge of conspiracy?

I do just love lawyers, but I don't think that I could eat a whole one :D

Quote:

---

Originally posted here by Lansing_Banda
[B]
c.) There are plenty of systems on the internet that are insecure. There are plenty of backroom doors in the mall that are open too and people who leave their cars unlocked, and wallets that are loosely placed in pockets, and items and stores too close to the door, and SS checks that are just left in mail boxes....

---

true, but you will be very hard pressed to find a backroom door of a mall that takes you right into the back entrance of the bank branch located in that mall. most of the backdoors will most probbaly lead to a emergency stairwell or toilet!

Quote:

---

hmmmm, i do believe lawyers that defend/lie for people that are (a) obviously guilty *cough* OJ *cough* or (b) defend people that arent quite "guilty" but have obviously done something wrong (in this case, its kind of hard to explain how you ended up having lots of credit cards and socials that arent your own) should suffer the same punishment that the defendant recieves.

---

I think that its kind of stupid if i am a lawyer and i lie to a judge or a police officer nothing happens to me but if i am just a person who is not a lawyer i go to jail for obstruction of justice so why can a lawyer lie to a cop or judge and i can't. i just thought that i would through that out their for you guys to think about you know why shouldn't all laws apply to lawyers.

Quote:

---

hmmmm, i do believe lawyers that defend/lie for people that are (a) obviously guilty

---

Bold annotations are my own.

I am by no means an expert in jurisprudence, but the phrase "obviously guilty" does not sit with 'innocent until proven guilty' and the right of 'due process' under Anglo-American jurisprudence. Note: 'innocent until proven guilty' is not codified in the US Constitution but, "is embodied in several provisions of the Constitution, however, such as the right to remain silent and the right to a jury."

http://www.usconstitution.net/constnot.html#innocent

In English law, "Everyone charged with a criminal offence shall be presumed innocent until proved guilty according to law." The standard to which it [guilt] must be proven is, "beyond all reasonable doubt."

In US Law,, "The Trial of all Crimes, except in Cases of Impeachment, shall be by Jury; and such Trial shall be held in the State where the said Crimes shall have been committed; but when not committed within any State, the Trial shall be at such Place or Places as the Congress may by Law have directed."

http://www.usconstitution.net/const.html#A4Sec3

Also, see "Specific factors that define a crime, which the prosecution must prove beyond reasonable doubt in order to obtain conviction. Elements that must be proven are (1) that a crime actually occurred (actus reus), (2) that the accused intended the crime to happen (mens rea), (3) a timely relationship between the first two factors."

http://www.courts.state.pa.us/Index/Aopc/Glossary/e.htm

Hence, there is a codified judicial process that determines 'innocence' or 'guilt' based on the bedrock principle "beyond all reasonable doubt".

Regards,
Riotgirl

P.s. All that googling took me back to studying 'Politics' and having to remember elements of jurisprudence such as the extent of "executive privledge".

Quote:

---

Also, see "Specific factors that define a crime, which the prosecution must prove beyond reasonable doubt in order to obtain conviction. Elements that must be proven are (1) that a crime actually occurred (actus reus), (2) that the accused intended the crime to happen (mens rea), (3) a timely relationship between the first two factors."

---

Quote:

---

and his attorney, Allan Williams, said his client had no criminal intent. "He didn't use any hacking tools. The system was open," Williams said. "There weren't any signs saying, 'Don't go in.'" Phillips previously told officials he had no intention of using the information to harm anyone.

---

Quote:

---

(1) that a crime actually occurred (actus reus)

---

Isn't he saying my client went into the computer system and stole the files, so really he pleading guilty for hacking the system but pleading not guilty for intent to use the information to defraud.

Quote:

---

(2) that the accused intended the crime to happen (mens rea)

---

If he intended for it to happen or not he committed a crime. If i take out my gun and kill some one but i didn’t intended to kill him dose not matter i still committed a crime. so if he intended for it to happen or not is really irrelevant

Quote:

---

(3) a timely relationship between the first two factors.

---

His lawyer is saying that he did it and they have the evidence to prove it about 37,000 socials to prove it.

Obviously the university did not practice due care and due diligence in the protection of their systems. The reason, as best practices, you are supposed to put up banners and even minimal protection mechanisms is so someone can't say, “Ooops, I accidentally invaded that system.” If you can prove that someone bypassed some sort of authentication mechanism, then you can prove that they knew they were somewhere they were not supposed to be, even if you don't use any “hacking” tools.

I think that is a good point sysmin770, but a problem for curious people not such a problem for admins is that most people have no idea of what could have happened, might have happened, or can happen with this kind of a break in or how it is done. so when a person is put on trial for something like this the Jude and jury alike have no idea what he did or didn't do all they really need to hear the that some one broke into a computer system and stole a bunch of socials and they will automatically convict them because all they know is that "hackers" are mean and malicious people who like to destroy stuff and that’s what they have been brought up to believe and so the prosecutor will not need much evidence agents him even if the system was unsecured and he was just messing with it and found all this stuff and their was nothing saying not to enter or that this file is not to be seen by unauthorized people he will still go to jail because of uneducated people so puting up a banner or something saying don’t access really isn't needed because on uneducated people but I think that it should not be needed.

Almost as a guide line, they could use the WIFI laws to define if he had illegal intent.

If my home network is set up on an open WAP with no filtering or WEP/WPA and the SID open and available, anyone who is in range of my WAP is then allowed to connect to it and gain free internet access. (not access to my network computers though) In fact, it would be hard for them to not connect to it, if there is not another WAP also in range that they could connect to also.

As soon as I disable the SID broadcast, and or make use of WEP/WPA and IP/MAC filtering then for them to bypass these protections and connect to my WAP (for any reason) is illegal.

This guy though, even if he didn't use any 'hacking/cracking' tools, went into the system and copied data from it. If it was a wired system, he would have to have made a physical connection, like openning a closed door. Even on a wireless system, to gain entry to the network computors he would have had to purposefully made a connection through the netbios or some other means.

Just being curious can not be used as an excuse. That would be like being a guest in somebodies home, and poking through their drawers and cabnits. And then taking what ever he wanted.

At the very least it would be an invasion of privacy, and then to take things would be componded into theft.

Quote:

---

Just being curious can not be used as an excuse. That would be like being a guest in somebodies home, and poking through their drawers and cabnits. And then taking what ever he wanted.

---

if your refering to my statment that i made about curious people what i ment by curious people was people who actualy ment no harm who did not go through netbios or use a trice to gain access but someone who was just messing around with a comp and found out that they could gain access to something they are not allowed access to i did not mean some one like the guy in the artical who we all know just wanted the socials and other info for profit at the coast of others.

Quote:

---

Originally posted here by Riot
if your refering to my statment that i made about curious people what i ment by curious people was people who actualy ment no harm who did not go through netbios or use a trice to gain access but someone who was just messing around with a comp and found out that they could gain access to something they are not allowed access to i did not mean some one like the guy in the artical who we all know just wanted the socials and other info for profit at the coast of others.

---

But then no one would probably ever even know they have been there, unless they told someone.

Quote:

---

But then no one would probably ever even know they have been there, unless they told someone.

---

Ture very true.

Just because its the law, doesnt make it right

In respect to what was said about lawyers defending guilty parties and lying for them also, in reality, inside the courtroom there is no right or wrong, its just a game lawyers play to see how many people they can get to believe their story... simple as that. once a verdict has been given, the facts and truths are irrelevant as the "truth" is now what the judge/jury decided.

Also, i just wanted to say that the system is not fair, considering innocent people can be prosocuted and the guilty to be let off - Just goes to show that justice really is blind.


CTO

Doggon’ better ante-up my two bits as well.

True story that runs somewhat parallel to this scenario and I would imagine the ex-student will suffer the same fate.

Quote:

---

There weren't any signs saying, 'Don't go in.'

---

I knew a young man who was out running around one night and he wanted some booty so he headed over to a girlfriend’s house. He tried the door and found it unlocked so he entered. He’s still in jail.

cheers

Quote:

---

Originally posted here by Relyt
Doggon’ better ante-up my two bits as well.

True story that runs somewhat parallel to this scenario and I would imagine the ex-student will suffer the same fate.
I knew a young man who was out running around one night and he wanted some booty so he headed over to a girlfriend’s house. He tried the door and found it unlocked so he entered. He’s still in jail.

cheers

---

I am going to one up you.....I knew a man who thought his wife was cheating on him, so when he was suppose to be on a buisness trip he snuck back in his own house one night. He is still dead. (and she got away with it....even though I think she planned it that way)

Sorry, kind of off topic......but the moral being that openning a closed or locked door can be hazardous to your health.

His attorney is using a classical defense used in computer-related cases. The most difficult thing to prove on the prosecution's part is 'criminal intent.' Unfortunately for us, and fortunately for the skiddies out there, that 'criminal intent' must be present to constitute the crime.

I mean - the guy could've been a raving idiot, out trying to connect his box to the 'internet' and blundered blindly into the 'open network' and downloade a bunch of junk. Highly unlikely yes, but then again you and I aren't on the jury, and you can bet your bottom dollar there won't be any IT professionals on it either. I find it quite amazing that in this age of technology there's so many computer illiterate people out there. I find it still more amazing that a jury in its right mind would honestly believe someone to be that moronic, but odds are if the jury is picked correctly, they will.

Quote:

---

Also, see "Specific factors that define a crime, which the prosecution must prove beyond reasonable doubt in order to obtain conviction. Elements that must be proven are (1) that a crime actually occurred (actus reus), (2) that the accused intended the crime to happen (mens rea), (3) a timely relationship between the first two factors."

---

1 ) Ok, so the guy has to commit a crime - he did. He stole a bunch of stuff.
2 ) Intent - there's the rub. He either intended it, or he's a bloody idiot.
3 ) Timely relationship - He was in their system at the same time the crime was committed - a moot point to prove.

I'm quite curious how the prosecution will build it's case, considering the 'idiot defense' is in play.