Minnesota Public Radio Reporter Faces Hacking Charges For Reporting On Data Leak
from the federal-shield-law? dept
We were just noting how the Computer Fraud and Abuse Act is regularly abused to bring "hacking" charges where none are really warranted. And here we have yet another example. Alex Howard points out that a Minnesota Public Radio reporter, Sasha Aslanian, is potentially facing "hacking" charges from a Texas company called Lookout Services. Lookout creates employment/compliance software for large organizations, and Aslanian was reporting on a supposed data vulnerability in the software used to verify employment eligibility that could potentially reveal private info. Aslanian's report noted that she was able to see info from the state of Minnesota, and the state was now directing agencies to stop using Lookout. The details are not entirely clear, but from what's written at the MinnPost link above, it sounds like there were some vulnerabilities, poor security, and a bungled demonstration which revealed a vulnerability -- all of which Lookout admits -- and from those vulnerabilities (which Lookout claims it closed), someone was able to adjust the URL to find private data.So, basically, the company admits to a series of vulnerabilities, which exposed info that allowed the reporter to eventually see some private data... but still claims that the reporter was "hacking" and is now looking to sue under the same Computer Fraud and Abuse Act, which could lead to 5 years in prison. Because our federal government still hasn't passed a journalism shield law, the reporter is potentially liable, though, as the MinnPost reporter notes, Lookout seems particularly shortsighted in bringing this lawsuit in the first place. All it does is call more attention to its own vulnerabilities and failings. And the CEO of Lookout basically responds that she doesn't care:
While the legality and severity of Lookout's security breach remains to be adjudicated, there's no doubt Aslanian was trying to serve the public interest -- something a prosecutor might consider. As Dalglish says, "The state of Minnesota should be grateful MPR exposed what's going on. It seemed like a pretty good story."So, even though this will publicize not just Lookout's failings, but also how it responds to people who notice and report on vulnerabilities, the company still thinks it needs to bring a lawsuit because exposing those vulnerabilities "was wrong"? I would argue that the company's reaction to this gives many more reasons never to do business with Lookout -- more than any discovered vulnerabilities. Vulnerabilities in software happen -- and it's more telling how a company reacts when they're exposed. Suing those who expose them isn't what you want to see. Update: Lots of good points in the comments, pointing out (of course) that Lookout cannot bring criminal charges against the woman, only prosecutors could do that, and it seems unlikely they would do so in this case.
I asked Morley if she realized, by filing a high-profile suit, how hapless her timeline made Lookout look. After all, there's the webinar screwup, letting clients pick lame IDs/passwords and caching security credentials in such a way that rendered them useless.
"Yup," she admitted. "It was a perfect storm that came together. Our communication with the state really broke down -- in our contract, we had 60 days to fix any problem. But there was still an unauthorized intrusion, and that was wrong."
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: computer fraud and abuse act, data leak, hacking, reporting, sasha aslanian, shield law
Companies: lookout
Reader Comments
Subscribe: RSS
View by: Time | Thread
If Lookout Services sues, it would be a civil lawsuit and Sasha Aslanian would face no prison time or criminal conviction.
My guess is that if Lookout Services is pushing for criminal charges to be brought, any sane prosecutor will refuse to do so.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
> to sue under the same Computer Fraud and Abuse Act, which could
> lead to 5 years in prison. Lookout seems particularly shortsighted in
> bringing this lawsuit in the first place.
There's a lot about this that doesn't make sense. A private company can't sue someone into prison. They can sue for monetary damages, but only the state can press criminal charges and lock people up.
> Because our federal government still hasn't passed a journalism
> shield law, the reporter is potentially liable
This also doesn't make sense. Even if the feds passed the journalism shield law, it wouldn't protect a journalist from charges of computer intrusion. It would merely allow a journalist to "shield" his/her source from discovery and prevent judges from holding them in contempt for refusing to reveal them.
[ link to this | view in chronology ]
New Laws
Just knowing this is a offense of the new law. Sorry
[ link to this | view in chronology ]
re: New Laws
[ link to this | view in chronology ]
Re: re: New Laws
JFGI
[ link to this | view in chronology ]
Re: Re: re: New Laws
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Deja Vu
[ link to this | view in chronology ]
My 0.02USD take it or leave it
if they had a legitimate login to the system, no hacking. legit in this case being a source telling them their ID/password(assumming the source claimed that it was their auth), or the journalists own account on the system.
If the initial login was not legit(blank passwords and exposed UIDs not being counted here, especially if they were handed out at a demo. You have no excuse for letting demo accounts having full access) then yes it was a crime, but not because they viewed other data than the account contained, but because they gained access to the system in the first place.
IMO putting things on the internet without security/password is like putting a big "FREE STUFF, HAUL AT YOUR OWN EXPENSE" sign on it. no complaining that it then was viewed/copied/played with/etc.
During the internal tests of the software no one thought of trying to change the or even using greasemonkey to modify fields in the form. REPEAT AFTER ME "ALL USER SUBMITTED DATA SHOULD BE TREATED AS HOSTILE, UNTIL PROVEN OTHERWISE AND SANITIZED", that includes data that you sent them, no guarantee that it didn't have bits flipped while moving across the internet, or that someone in the middle isn't trying to play games. What amazes me more is that this was contracted out to a third party to be hosted on their hardware in their building with god only knows what physical security. WHat happens when you call a random extension at this place and then act confused and say you have this number as tech support for using the system, and that you are just trying to verify some data but it isn't showing up, and ask if they could try there? Also electronic access to computer systems is not the same as physical access to a card catalog, or warehouse of boxes with this info in it, the rules need to be different.
[ link to this | view in chronology ]
Hacking
[ link to this | view in chronology ]
Re: Hacking
It seems unlikely that there will be a prosecution without this intent, but the law should be clearer about what is hacking and when it should be a crime.
[ link to this | view in chronology ]
Re: Hacking
[ link to this | view in chronology ]