[jessaustin]

Wow I wish that "rule" applied somehow to cyclists and pedestrians killed by motorists. That would be handy!

As described above, against a firm with a modicum of security procedure, this "attack" would have been a no-op. As in, all the same actions could have been taken, and they would have had no effect whatsoever. "Attacks" like this take place every day, and many even succeed, with no action from prosecutors whatsoever.

You and I have different conceptions of justice. It may well be that yours conforms more exactly to that enforced by the courts; we don't live in a perfect world.

[tptacek]

That rule very much does apply to cyclists killed by motorists! But remember, the rule is that you impute harm caused by a tort or a criminal offense. You have to start by establishing the driver was at fault.

[jessaustin]

It's a commonplace that motorists are very rarely charged in these situations, because they "didn't see the cyclist" and also "why was the victim riding a bicycle on the street?" I guess we've established that the eggshell rule is yet another legal instrument to increase the "discretion" of LEOs, prosecutors, and judges, as if they really needed more of that.

[tptacek]

That's a coherent argument, but then I feel like I get to point out that you're litigating the whole concept of the justice system, not Keys sentence in particular. Keys is both extremely lucky and extremely privileged compared to the average person serving a multi-year sentence.

[jessaustin]

I'm much more concerned with the obvious flaws of the system than I am with the "concept" of the system. I'm sure Keys would prefer not to trade sentences with e.g. the average drug "offender", but I doubt he'd consider himself "extremely lucky and extremely privileged". What could that even mean, for a person who shouldn't have been incarcerated a day, convicted, with evidence circumstantial at best, of an act that shouldn't even be a crime?

[tptacek]

Wait, you think that exfiltrating a password to a giant newspaper's CMS to a hacker group and exhorting them to "fuck shit up" shouldn't be a crime?

[jessaustin]

Despite the big scary words [seriously, "exfiltrating" and "exhorting" in a single sentence; whom are we trying to convince?], it shouldn't be a crime. No fraud took place here. No personal or business data was stolen. No one was hurt. The damage was the online equivalent of "Kilroy was here" on a bathroom wall. The "victim" in the case is a giant media conglomerate responsible for the silencing of thousands of independent local voices. That is, they have no difficulty continually broadcasting their animating political philosophy: "More power and wealth for us! Glory to the top-down authoritarianism that makes us rich!" We don't hear the opposing side in that debate.

Rather, when it's heard, it's quickly silenced as in this case. (Keys was explicitly fired for political reasons. Who doubts he was prosecuted for the same reasons?) There isn't a chance that a similar episode at a small-town newspaper or independent broadcaster or even a popular online-only media site would receive the publicly-funded attention of a federal prosecutor. Most of those dream of higher public office, and they all know whom to make happy and whom to ignore, to make those dreams come true.

Resident HN Qin Dynasty fans might think the problem I describe is one of insufficient enforcement, that if only every knucklehead site defacement could be punished with the full weight of the USA-Justice Dept., we'd live in a utopia. Please realize, however, that this arbitrary authoritarianism is the only possible use of such a law, because it is the design of the law. There will never be enough federal prosecutors to send everyone involved with any defacement anywhere to prison. The point is not to prevent site defacement. The point is to centralize, to provide every benefit to large corporations and deny the same to other firms. That's actually the point of most laws that get passed nowadays. In this case, since this is a media company, the specific point is to control public discourse and destroy those who challenge it, and thereby to keep those profits and campaign donations up. For the rest of us, the cure is worse than the disease.

Security experts are the real fools, when they support the criminalization of minor shit like this. You're going to get paid anyway, whether someone goes to FPMITAP or not. In fact, you'd probably get paid more, if more people were comfortable poking giants in the eye. Executives bitch about all consultants, but do you imagine there is any particular type of consultant they'd be happier to fire? Giant corporations are not good, they are not your friends, and you owe them only the services they purchase. You don't owe them any political allegiance, and sending people like this to prison actually harms you in the long run.