and found is in quotes for a good reason, as the drugs “found” near
me were “found” in the execution of a warrant for computers only
For what it's worth, the Fourth Amendment protects against 'unreasonable' searches and seizures. Anything found in the reasonable execution of a search warrant is admissible.
I don't know where the myth came from that only evidence related to the probable cause of the warrant is admissible. This is an on-face absurd interpretation: by that logic, if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer.
There is plenty of case law establishing limits on reasonability. For instance, in the execution of a lawful search of an apartment looking for weapons, officers saw a stereo that 'didn't fit the furnishings'. They lifted up the bottom of the stereo to take down serial numbers, and the person was arrested for having stolen the stereo. The problem, of course, is that weapons aren't stored under the bottom of a flat-bottomed stereo, and certainly the serial numbers weren't a reasonable part of the search for weapons.
But having drugs out in the middle of the room in 'plain view' is clearly reasonable. Even from weev's own post, the drug evidence passes the Horton test.
The argument that there was no probable cause is very unlikely to hold up in practice. The law is very lenient to the issuance and execution of warrants.
Warrants are favored in the law and utilization of them will not
be thwarted by a hypertechnical reading of the supporting
affidavit and supporting testimony. For the same reason,
reviewing courts will accept evidence of a less "judicially
competent or persuasive character than would have justified an
officer in acting on his own without a warrant." Courts will
sustain the determination of probable cause so long as "there
was substantial basis for [the magistrate] to conclude that"
there was probable cause.
Shouldn't the person the warrant applies to be served and/or notified of the warrant and given a copy? I was under the impression that a warrant was a way to give police rights that they do not typically have according to civil rights. It's a civil contract that they will not exceed the rights they are given, so I'd assume he should be given a copy with an explanation of why his rights are being lessened temporarily.
Is that really the case? If the police is executing an illegal warrant, but comes across someone, say, murdering someone else, is that not considered evidence?
(This might very well be the case, considering the "Fruit of the Poisonous tree" doctrine).
It is, but there's a loophole: the prosecution can argue that the police inevitably would have discovered the evidence eventually. It's fairly easy to claim for something like a murder because hiding a body permanently tends to be fairly difficult, and arguing that the murderer would have successfully hidden the body is very close to an admission of guilt.
Edit: if the police interrupt and prevent a murder, the testimony of the murder victim is also admissible. I don't think the argument "if the police hadn't illegally searched the area, the victim would be dead and unable to testify" works.
if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer.
But they couldn't cite the murder as admissible evidence of felony tax evasion, it would need to be separate charges, wouldn't it?
Well, at least you were able to dodge the tax evasion charge by distraction/misdirection. Now, about this little murder thing...
I think it's shameful that no one has stepped up to provide him with free, top notch legal assistance. I'm relatively familiar with the case (I know weev personally, too), and he is actually not exaggerating. This is exactly the kind of case the EFF exists to defend. Yes, weev is a troll and a media whore, but that doesn't automatically make him wrong.
Goatse behaved in the industry accepted standard way in popularizing a security vulnerability -- full disclosure. I personally would have done the same (although I would not have kept illegal drugs at my residence after doing so, but I also would probably ventilate anyone breaking into my home without clearly announcing a warrant...)
> Goatse behaved in the industry accepted standard way in popularizing a security vulnerability
Well, as someone working in the security industry I take slight issue with this. They appear to have cashed in on the media coverage as much as possible rather than focus on proper disclosure practices. I (and a lot of people in my job, I think) would consider it just on the wrong side of unethical.
Agreed; and if he is being unfairly refused representation that is a serious matter.
Additionally if he has broken no actual laws then that needs to be cleared up and he needs to be apologized too.
However I feel there is an important distinction between defend and approve; I would, for example, represent him. But I don't condone his approach to disclosure :)
Non-disclosure, vs. Responsible disclosure, vs. Full disclosure (with various levels of warning to the vendor), vs. Aggressive full disclosure is certainly an open point of debate within the security industry. It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however.
My personal position varies based on the kind of vulnerability, actual risk to end users, etc. For something which causes minimal harm to the end users (publishing email addresses? really?), which was the result of utter incompetence on the part of a single vendor, and where the vendor can trivially fix it, I think aggressive full disclosure is the right course of action.
If it were something like a flaw in cisco bgp, I would support responsible disclosure, on a very long timescale; give the vendor enough time to fix it, and get the patch deployed to as many users as possible.
If it were a flaw in a no-longer-maintained system which were critical to life safety, I could be convinced to not disclose at all, provided there were something put in place to transition users off of the system.
It's pretty unambiguously clear that he didn't use the fruits of the vulnerability in a black hat way to hurt the end users, however.
No and I don't think that accusation has ever been made.
However; he has used the data very unethically and I don't think that it is reasonable for him to claim journalistic privileges or the cover of full disclosure to assuage that.
I have not been following the case, nor am I an expert on security disclosure. Could you expand on how he has used the data and what was very unethical about the uses made?
EDIT TO ADD: Reading your other postings I think you mean giving a copy of the leaked data to Gawker media was unethical. Is that so bad, considering they redacted it and appeared to generally handle it responsibly?
Yes. Your latter point does (and I cant believe I am saying this...) credit to Gawkers handling of the data. But Goatse handed it out (so far as we know, I admit) with no idea of what would be done with it.
Also from a security perspective (at least from mine) it is just unethical to hand over data you got - no matter how trivial :)
Why is it "shameful"? It wasn't clear whether or not weev even asked the EFF/others to defend. It seems like he only asked the judge for a public defender and was denied, and then he ranted about that for awhile.
Did he ask others to defend or at least give him some free consult/referrals? Did he get denied by them?
The problem is that weev doesn't understand how a grand jury subpoena works. He has not been indicted, nor charged with any crime related to the "hack" yet. He has only been asked to testify in front of a federal grand jury. The government has no responsibility to provide a public defender, because he hasn't been indicted and charged with a crime yet. Technically, he's not yet a defendant.
I should mention the other charge for possession is most likely completely separate, and being handled at the state/local level, since he didn't commit a federal crime in that regard (it would have to be interstate trafficking).
In short, weev doesn't understand how the federal justice system works and is asking for help.
That makes sense. His jump to conclusions made the essay longer and more convoluted and confusing than of he just said "I need legal assistance and I don't have any funds. Help!"
Why aren't we reading about that, and instead reading about zionists and why a judge denied him a public defender for a misdemeanor drug charge unrelated to the computer security issue?
Not to mention that those opposing the EFF's agenda of open network access must see weev's behavior here and earlier as exemplary of why such access is dangerous.
I don't think the EFF should be spending donated money defending black hats from potential criminal prosecution. There are far more white hats out there that have been unfairly targeted for true responsible disclosure. There are also a lot more important free speech issues to defend than your right to shout private AT&T account information in a public theater...
I would have been 100% behind him if he had said, "hey, I noticed this hole, visit http://att.com/account_info.php?omg=noes and have a look!" By actually publishing the information, he proved that he accessed information he was not authorized to have, which the law does technically say you are not supposed to do. (The "hey, I noticed this hole", IMO, is not enough to build a solid case against him for accessing data he was not supposed to have. IANAL, though.)
Either way, though, prison is not an acceptable outcome for this behavior. "Don't do this again," maybe, but not being locked in a cage for years. How would that help anyone?
He definitely needs to get an attorney to prevent him from writing future statements/positions in public. Now whomever represents him will have a much harder time defending him since he's written an entire essay on the matter. Each and every word, sentence, statement, and position can and will be used against him.
He seems to be unfamiliar with the legal process, and really needs to get a lawyer. From the partial scans of the US attorney's letter, it sounds like a federal grand jury would like to subpoena him as a witness to testify about the gathering of AT&T subscriber email addresses and "electronic chip IDs" (I think the letter is technically incorrect). The letter informed him that if he failed to appear he might also have criminal charges filed against him.
This is a normal part of the process of a federal criminal investigation. What happens first is that a grand jury is formed. The jury investigates evidence, calls witnesses, and tries to determine if a crime has been committed, and if so, who committed the crime. Then, the grand jury might issue a federal indictment, or it might just determine that no crime was committed and drop the case completely.
If he or someone else is federally indicted, then he would be formally arrested and have to go to federal court to stand trial as a criminal defendent. It sounds like it has not gotten close to this point yet.
Edit: I also wanted to mention that you have no right to an attorney as a witness of a grand jury. You may choose to have an attorney represent you and be present, however, the financial burden is in no way the federal governments to provide one for you. IF you are charged, then you may receive a public defender if you have insufficient financial means to pay for your own defense.
Federal cases take months and years to prosecute. By refusing to participate with the grand jury, he might be opening himself up to the fact that another witness could implicate him and he might be indicted. Of course, there is also the saying "if nobody talks, everybody walks."
He really needs to get good legal counsel and decide if he wants to testify in front of the grand jury, and decide what he wants to say.
Also, he's not helping his cause any by speaking out on the web. Mentioning his past anti-semite ramblings is also probably not the best way to gather sympathy.
I also think he does a disservice to the security community as a whole to advocate black hat ideology at hacker conferences, and then talk about "responsible disclosure" and how he was just trying to protect the poor customers of AT&T. This seems to be rewriting history.
You cannot just publish personal data and then call it 'free speech' and 'industry standard practice' of a 'journalist'.
Seriously .. where is the ethics in that?
How about actually trying to work with AT&T to get this fixed behind the scenes? Oh no, of course not, because that would not result in the right kind of exposure for these 'security experts'.
These things are all about ego and status. Hidden behind a thin shell of 'full disclosure'.
Testing/Evaluating/Disclosing an exploit isn't immoral in my mind, nor should it be illegal (in a perfect world).
Disclosing private details of third paries is certainly immoral in my mind, and should be illegal.
According to this logic publishing the exploit, so long as you're censoring output, is fine. If someone uses your exploit to download personal data, it's AT&T who is doing the immoral/hopefully-illegal disclosure. If that someone uses your exploit and then publishes the data or does some other naughty thing with it, book 'em.
You get moral brownie points under this logic if you notify the target after you discover the exploit. It's not required, because disclosure is notification. Nefarious-types aren't going to call up a bank to say "hey, we're stealing all your customer records", nor will they disclose this hole to the world.
Unpopular statement ahead: if you collect personal details, it's your job to secure your systems, and it's your fault if your systems leak them. Of course there's no such thing as 100% secure, but you're the one doing the risk analysis and design.
> It's not required, because disclosure is notification.
In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive)
Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days).
It is also very definitely not ethical to hand the data you got to the media. :)
Evaluating an exploit, unless sanctioned by a bilateral agreement between both parties (like in pentesting), is in fact illegal in most countries. Disclosure without proper notification of the affected parties can also lead (and sometimes does) in a lawsuit against you.
I don't completely agree, but it's the prevailing point of view (and/or law) at the moment.
The problem with "responsible disclosure" is that a vendor can convince you not to disclose at all -- they can drag out the process of patching for months, and can try to convince you never to release the disclosure, or at least to wait until no one cares anymore, because some users may not have patched.
The purpose of disclosure is twofold: you want the vendor to fix the bug, but you also want the marketplace to take notice of the existence of the bug.
Knowing that Vendor M was informed of a bug and took 6 months to fix it, whereas Vendor L was informed of a bug and took 1 day to fix it, is useful to me when I'm evaluating an operating system vendor. The best way to have this information out there is to cause a big splash when you release it.
Fundamentally, the assumption is that white and gray hat hackers do not discover every bug out there. If you sit there and do semi-sophisticated static analysis on a lot of software, or fuzzing, you can discover a lot of 0-day vulnerabilities which no one has yet announced.
If end users don't feel pain from security vulnerabilities, they will not prioritize adequate security when they make purchasing decisions. Vendors with a strong security focus should support aggressive full disclosure of all vulnerabilities of all vendors.
Are you even remotely familiar with the facts of the case?
weev claims to have received the data from an unknown source.
He then has AT&T informed through a third-party.
After that has happened and AT&T has fixed the vulnerability, he gives the data to a journalist and deletes it.
The journalist then writes about it and includes a small, badly redacted portion of it.
So, in summary weev did not publish the data in any meaningful sense and did make sure that the flaw was fixed before going public. What exactly about this is unethical?
He didn't have to. We're talking about the real world here, not kindergarten. If he absolutely had to go public, he could at least anonymize the data before handing it over to a journalist.
Maybe I'm just cynical, but it seems like working behind the scenes with the vendor doesn't seem to bear fruit very often. It's pretty frequent to read about companies that have ignored vulnerabilities until they're fully disclosed. Plus, AT&T doesn't exactly have a recent track record for keeping their network or services in good order.
Of course, the vulnerabilities that are fixed by working directly with vendors never end up the topic of news articles, so I'm sure it's not as cut and dry as an outside perspective would indicate.
That is because you only hear about those cases where it did not work out.
Take a look at for example Apple's release notes for a security update: dozens of fixes, most reported by external companies and persons, all with proper attribution.
I'm fairly sure that the process does work most of the time.
I would agree that this seems to have been more about ego and status than an example of journalistic integrity and responsible security research.
That said, does the irresponsible disclosure of names attached to e-mail addresses justify what he's gone through, assuming a modicum of truth to his assertions of being denied a legal defense, gag orders, FBI raids, etc? In my personal opinion, his point that URL scraping is not in and of itself a crime is substantially true, and renders the subsequent raid unjustified. Whether that would render the drugs inadmissible or provide him any legal cover from that charge I certainly am not qualified to say.
On that note - could anyone point me towards literature on 'gag orders' in the course of U.S. justice? I'd be curious to read on the history and justification for these.
I don't know anything about the story, but right now, it somehow looks like he's quite a nutjob. Writing shorter, more precise and in a chronological order of the events would really help the text to be more understandable and get the point across.
The situation is probably quite stressful for him, but he somebody should really help him work on the text so others understand what it's all about.
He has some posts which suggest the FBI was bugging his apartment and covertly following him around town. This was months prior to the release of the iPad accounts. So, yes, I suspect he is dealing with some mental issues.
I am highly suspicious of the fact that this deals a lot with other cases and his past run ins with the government and very little with the actual case (at times it even seems to deliberately skip details).
As always; this is one side of the story and (thought I hate to say this) from a somewhat troublesome person. I think it is reasonable to treat this as a serious matter, but there needs to be a lot more objective insight before I'd send him some money :)
Has he contacted the EFF or other similar organizations? What's with all this defense of anti-semetism? Someone needs to proofread this. What's the call to action? If the domain name's not going to change, fine, but get rid of the giant anus illustration for such a plea. Yeesh.
He's being denied legal counsel for the drugs charges -- according to the letter, they are all minor misdemeanors, although originally he was alleged to have felony weight on him. That's actually a victory for him, so far.
The problem is there are potential actual felony charges under discussion, related to the original computer crime warrant. While he hasn't been charged, he doesn't get a public defender. If he's charged, he gets a public defender.
If I were in his shoes, I would absolutely be getting a lawyer (and I sent him $100 toward that, and asked some friends who are lawyers to consider it).
Honestly, not getting an Arkansas Public Defender is probably a victory for him, too. I would rather represent myself than rely on AR PD to defend me in a case like this.
I upvoted you for bringing clarity to why he was denied a public defender.
The fact that he can't get a public defender because no charges higher than the misdemeanors were filed against him is, like you said, a good thing. He misunderstood, and creates a conspiracy theory around it. This is likely the case with most of his other points in the essay as well.
Just because you don't "like" someone is no reason to violate the hell out of his rights. If they do it to him, they will do it to you. And your being "liked" won't help you one damned bit.
I'm still not convinced that his rights were violated. He says they are, but this is a guy who wrote a giant essay about his case, and then published it on the net, and ended it with a plea for donations/money. If I were in his shoes, I'd have spent the time calling the EFF to see if they can help, and asking for referrals. It almost seems like he is seeking attention.
Also, he seems to be able to obtain documents and requests from the gov to print online, yet also claims he can't get access to them but mentions some deadline. If you're not able to read the request/denied access to it, no judge will hold the deadline over you. That's just conspiracy/crazy talk.
Of course he's seeking attention. So would you if you were being handled as he says he is. And who says the EFF has the manpower right now to handle his case? This is like people who turn to Legal Aid at the last minute and are shocked to find out they have limited resources, if not an outright waiting list. And given the behavior of both the government post-9/11 and Apple several years ago suing a rumor site out of existence, I'd rather bet on him than either of them.
Disagree. He's not being "handled". It's essentially all in his head. And no, I wouldn't seek attention like this. There is no upside. You fight the case in court. That's where the battle is. His essay only hurts him.
To be clear, he's just being asked to serve as a witness and hasn't been charged with anything related to the iPad security. He just doesn't understand the legal process and is requesting things he is not entitled to yet, such as a public defender, and spinning conspiracy theories when they are denied. As of this moment, he is only facing a misdemeanor related to the drugs the police found.
It's not clear whether or not the EFF has the manpower to help him. The essay he wrote doesn't seem like he even tried. However, the EFF is usually very helpful with referrals or pointers. This is from personal experience.
If you want to bet on him over the government or Apple, that's your choice. Based on his actions so far (black hat approach to security disclosure; writing a long, ranting essay filled with conspiracy theories about the case and the way he is being "handled" and publishing it on the net), I'd most certainly call your bet and laugh all the way to the bank.
Unfortunate site logo as well. Between his writing style, the content of some of his posts, and the choice of name and logo, I'm finding it very difficult to take this author seriously.
Civil rights are actually not dependent on domain name, writing style, content of writing, name, logo, or in general any damm thing at all. They are called "unalienable rights" for a reason.
As Americans declared in a few days ago in 1776, "But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security."
If what he says is true, then it is our right, and our duty, to stand up for weev. If the government is this far in the wrong, then that is more important than any single individual's actions. Give him some cash (http://security.goatse.fr/help); write to the EFF; call your congressman; ask an America you know to do the same; but please, find another thread for discussing logos, e.g. http://news.ycombinator.com/item?id=1493603
If he is lying, then we need evidence he is lying, not that he has bad taste in logos.
EDIT: I clarified the above to add the "If what he says is true... // If he is lying..." without marking the edit, which I am now doing. I apologise if I edited after the children had posted.
Of course civil rights aren't dependent on anything. But whether we believe his story that his civil rights are being violated is partially dependent on his credibility, which seems at first glance to be pretty close to zero.
He claims that his civil rights are being violated in the same breath that he claims that it happens to him all the time and that anti-semitism is okay. Why should we believe any of this, exactly?
EDIT: Okay you edited your post to be conditional on him telling the truth and requesting of evidence that he's lying. My point is just that crankishness is typically evidence that someone is lying, or at least good reason to not take things that people are saying at face value and to wait for independent confirmation for whoever cares to look for it. There's a burden of proof issue here.
Kindly retract that he said "anti-semitism is okay."
Screenshot 1 and 2 of the threatened indictment seemed believable and imply he is in legal trouble over a security disclosure. A quick search online implies the disclosure was responsible, proportionate and AT&T are pissed about it (e.g. http://bits.blogs.nytimes.com/2010/06/13/att-explains-ipad-s...). So, from those two things, coupled with the fact legal aid is being denied to him, implies he is serious about needing help with a lawyer.
Is he already on some kind of FBI shitlist? Maybe, maybe not, it's irrelevant. Would it have been better not to mention it? Probably. Is he credible? I don't see why not given the corroborating evidence.
> Kindly retract that he said "anti-semitism is okay."
Fair enough. He didn't say anti-semitism is okay. What he did do, which prompted my inaccurate comment, is admit to make "joking" videos about the genocide of Jews which are in egregiously poor taste. And then go on to make paranoid comments about the FBI manipulating the Jewish lobby and Jewish reporters to alleging that he bombs synagogues, or something (I wasn't too clear on this part).
Thank you. He certainly did make such videos which he claimed to be parody adding useful balance to the Israel/Palestine debate -- I think we would agree that this was not useful, but I don't believe his intentions were anti-Semitic.
He does (going on his online postings) regularly spout anti-semitic nonsense, but then he is a very troll like person. So it is hard to figure where his real beliefs lie - he often sounds serious, but then he may just be a serious troll.
(and, also, I suppose it is arguable his intentions [trolling or meaning it] are irrelevant because it still goes out there and communicates to people without being clearly ironic)
The whole "goatse" thing is part of the performance art. Hacker groups have a long history of over the top stuff like that -- look at the Cult of the Dead Cow (cDc), Phone Losers of America, Legion of Doom, etc.
weev is a troll (in the 4chan sense), and a performance artist, but on this issue, he's actually being pretty straight up. He got some information about a security vulnerability, was asked to publicize it, did so, and is now being unlawfully screwed for it.
Was what he did prudent, especially for someone already on the FBI shitlist? No. Was it lawful? Yes. And, it certainly brought the security vulnerability, which was an incompetent decision by ATT, to public attention.
There's also a long history of cranks falsely claiming that their rights are being violated and that due process in their case is being trampled.
I'm not saying that that cranks shouldn't be defended when their rights are violated or that his claims are false. But he's certainly not helping his credibility with his disorganized, rambling writing, and his juvenile website, etc. It makes it so that my immediate inclination reading this is to suspect that most of it is wildly exaggerated.
Don't know why you're being downvoted (I upvoted you), but I had the same thought and impression as you did.
weev talking about "this is not the first time" -- that whole section should have been left out. That makes it very conspiracy theory-like, and really has no bearing on what's going on now.
I agree -- he has definitely not helped his credibility in defending himself from some "fruit of the poisonous tree" drug charges resulting from an illegal search warrant.
There is a reason why test cases usually find really unambiguously "safe" people for the test case -- e.g. the elderly, unambiguously law abiding and moral, African American gentleman in Chicago used for the recent 2A case McDonald vs. Chicago, or the same with Heller vs. DC.
I am pretty sure no one expected search warrants when this all started. If it was expected that the FBI and local law enforcement would get involved, an academic security researcher would have been a far better spokesman.
A goatse symbol as his logo, makes anti-israel videos, has drugs lying around his apartment, describes his own blog posts as excellent, and apparently publicized some type of private information.
This is not a housewife being attacked by a SWAT team, it's someone who is likely to drift in and out of such problems who happens to have drifted in.
There is no doubt some ego-based confusion in his mind. It's evident from the first sentences: "...I’m sure you’re all familiar with from my previous excellent blog posts"
I feel sorry for the dude. He is asking for our help via cash or writing to our local, state and national representatives. That's a rock and hard place.
I don't know where the myth came from that only evidence related to the probable cause of the warrant is admissible. This is an on-face absurd interpretation: by that logic, if the police entered a house to search for evidence of felony tax evasion and stumbled upon a murder in progress, that wouldn't be admissible because the police weren't in the house searching for a murderer.
There is plenty of case law establishing limits on reasonability. For instance, in the execution of a lawful search of an apartment looking for weapons, officers saw a stereo that 'didn't fit the furnishings'. They lifted up the bottom of the stereo to take down serial numbers, and the person was arrested for having stolen the stereo. The problem, of course, is that weapons aren't stored under the bottom of a flat-bottomed stereo, and certainly the serial numbers weren't a reasonable part of the search for weapons.
But having drugs out in the middle of the room in 'plain view' is clearly reasonable. Even from weev's own post, the drug evidence passes the Horton test.