full-disclosure - Prosecutors admit error in whistleblower conviction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200310142341.17756.jeremiah@nur.net>
From: jeremiah at nur.net (Jeremiah Cornelius)
Subject: Prosecutors admit error in whistleblower conviction

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Prosecutors admit error in whistleblower conviction
By Kevin Poulsen, SecurityFocus
Posted: 14/10/2003 at 23:57 GMT

Federal prosecutors in Los Angeles will ask a court to set aside the 
conviction of a man who served 16 months in federal prison for blowing the 
whistle on an ex-employer's cybersecurity holes, officials said Tuesday. 

Without providing details, a spokesman for the U.S. Attorney's Office in Los 
Angeles confirmed that the office's appellate division will move this week to 
vacate Bret McDanel's felony conviction. 

McDanel, 30, was convicted last year under the Computer Fraud and Abuse Act 
for sending 5,600 e-mail messages to customers of his former employer, the 
now-defunct e-mail provider Tornado Development, Inc., warning about a 
security hole in Tornado's service that left private messages vulnerable to 
unauthorized access. 

After a court trial, federal judge Lourdes Baird found McDanel guilty of 
unauthorized access, accepting prosecutors' arguments that McDanel abused 
Tornado's e-mail servers to send the messages. The judge found that McDanel 
caused the statutorily-required $5,000 in damage in part by bogging down 
those servers, and in part by harming the company's reputation by disclosing 
the bug. 

McDanel appealed last August, arguing that the judge misconstrued the Computer 
Fraud and Abuse Act. 

A federal prosecutor said Tuesday that the government was conceding that 
point, and would file a rare "Confession of Error" acknowledging that McDanel 
was convicted through an incorrect reading of the law. "The Confession of 
Error says we don't believe that simply disclosing the fact of the 
vulnerability itself constitutes damage," said the official. 

McDanel's appellate attorney, Jennifer Granick at Stanford University's Center 
for Internet and Society, could not be reached for comment Tuesday. 

A government press release issued at the time of McDanel's sentencing colored 
him a "computer spammer," and touted the case as the first to go to trial in 
Los Angeles under the Computer Fraud and Abuse Act. McDanel has already 
served his full 16-month prison term. 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/jOwLJi2cv3XsiSARAhkQAKCq+zolPSRrZg1C8G/mPIUe35S7hgCgzspz
aw5DXqZ7u/M4ycAOpDqGmTE=
=CLRK
-----END PGP SIGNATURE-----