full-disclosure - Re: [inbox] Re: Supporters urge halt to, hacker's, extradition to US

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58187.1222831046@turing-police.cc.vt.edu>
Date: Tue, 30 Sep 2008 23:17:26 -0400
From: Valdis.Kletnieks@...edu
To: Miller Grey <vigilantgregorius@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [inbox] Re: Supporters urge halt to, hacker's,
	extradition to US

On Tue, 30 Sep 2008 20:47:42 CDT, Miller Grey said:
> Legally, is there any precedence that private systems owned by the
> government are public domain?

At least in the US, systems owned by the federal government are considered
"protected" under the Computer Fraud and Abuse Act of 1986 (18 USC 1030
has most of the legalese for this:

http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html

For this scenario, the interesting words are in 18 USC 1030 (a)(2)(C):

(C) information from any protected computer if the conduct involved an
interstate or foreign communication;

"protected computer" is defined in 180 USC 1030(e)(2):

(2) the term "protected computer: means a computer:

(A) exclusively for the use of a financial institution or the United States
Government, or, in the case of a computer not exclusively for such use, used by
or for a financial institution or the United States Government and the conduct
constituting the offense affects that use by or for the financial institution
or the Government; or

(B) which is used in interstate or foreign commerce or communication, including
a computer located outside the United States that is used in a manner that
affects interstate or foreign commerce or communication of the United States;

Yes folks - that means that laptop is protected if it's used for eBay or
Amazon or even Yahoo Messenger, and if you hack it from across the state
or country line, you're in violation...

>                             Furthermore, has there ever been any legal
> precedent that any private system, if left unsecured, is in the public
> domain?

In the US, there have been a number of successful prosecutions in cases where
people used an unsecured wireless access point to launch attacks.  You'd
probably need to show *all* of the following:

1) That it was unsecured.
2) That it was *intentionally* unsecured.
3) That the security was set up for the explicit purpose of allowing free
guest access, and people were actively invited.

In other words - if the sign at the coffeeshop says "Free Wifi", it's fair
game.  If the login banner says "Free guest shell access - no password needed",
it's fair game.   However, if you happen to find an unsecured WAP while
wardriving, or an account that accidentally has a null password, things are a
*lot* stickier for you...

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/