Frenchman Fined For 'Theft' And 'Fraudulent Retention' For Finding Health Docs Via A Google Search
from the le-cluelessness dept
The basic downloading tool Wget is much in the news at the moment, and here's another story where it plays a central role. The French blogger and activist Olivier Laurelli, also known by his Twitter name Bluetouff, was searching on Google for something else when he spotted an interesting link that turned out to lead to several gigabytes of internal documents held on the French National Agency for Food Safety, Environment, and Labor's extranet (ANSES in French). Ars Technica explains what happened next:
Laurelli merely used the Linux Wget tool to download all of the contents of the Web directory that he found. He left the files on his drive for a few days and then transferred them to his desktop for more convenient reading (which the French government would later spin as "the accused made backup copies of the documents he had stolen"). A few days later, Laurelli searched through the documents he downloaded and sent some to a fellow … writer [on the activist news site Reflets.info], Yovan Menkevick. About two weeks later, a few interesting scientific slides pertaining to nano-substances from the cache were published on Laurelli's site.
When ANSES discovered this, it reported what it called "potential intrusion" and "data theft" to the police. Then France's Central Directorate of Interior Intelligence (DCRI in French) became involved. The lower court that heard the case decided Laurelli should not be punished for accessing data that was not secure; ANSES was happy to let it go at that, but DCRI appealed.
It was clear that things would not go well in the appeals court when the presiding judge seemed not to know even how to pronounce "Google " or "login" -- he said "Googluh" and "lojin" (original in French.) The prosecutor was just as bad: he started off his speech by admitting "I didn't even understand half the terms I heard today." Ars Technica reports the denouement of this high-tech French farce as follows:
The appeals court acquitted Laurelli of fraudulently accessing an information system but saw fit to convict Bluetouff of theft of documents and fraudulent retention of information. The court wrote: "It is well demonstrated that he was conscious of his irregular retention in automated data processing, accessed where he downloaded protected evidence; and that investigations have shown that these data had been downloaded before being... disseminated to others; that it is, in any event, established that Olivier Laurelli made copies of computer files inaccessible to the public for personal use without the knowledge and against the will of its owner"
Leaving aside the fact that the appeals court was clearly ill-equipped to understand the technical issues involved, and that the original files were completely unprotected and found by Google's crawler, not Laurelli, there is another disquieting aspect to this affair. Alongside his writing and activism, Laurelli also runs a small computer security company. One of the services it offers is a standard VPN. He was using this VPN service when he accessed the ANSES site, and the fact that his connection was routed via Panama -- the VPN's exit node -- counted heavily against him, he believes:
"This VPN (in fact above all this Panamanian IP address) is probably one of the strongest elements which had driven the prosecution to pursue a criminal case," he wrote.
VPNs represent one of the few tools available to ordinary Internet users to help them bolster their security and privacy against global surveillance. It's deeply troubling that the mere fact of using a VPN to access a Web site was apparently viewed by the court as evidence of criminal intent, rather than simply good online practice in the post-Snowden world.
Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: anses, bluetouff, documents, france, liability, olivier laurelli, retention, search, security, theft, wget
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in thread ]
[ link to this | view in thread ]
[ link to this | view in thread ]
It's their responsibility not to take advantage of my own stupidity!
[ link to this | view in thread ]
Wait, what now? Isn't the fact that he found this on a Google search prima facie evidence that the data was, in fact, accessible to the public?
[ link to this | view in thread ]
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re:
The fact that they still moved on with the case, despite both the judge and prosecution admitting that they didn't have a clue as to the technical details of what was being discussed just shows how little they cared about seeing justice done.
[ link to this | view in thread ]
Typical
The unfortunate truth of most of the worlds legal system is those deciding are deciding using the morality of several generation ago and the fiscal resources of the elite. They are unchallengeable for the most part (judicial independence) and have no liability for the quality of their decisions. The system does not really care if 100% of their decisions are overturned on appeal. Add to that governments who would like to pretend they don't understand (plausible deniability) and bureaucracies that traditionally have worked on regulation, not action and this is what you get. They don't need security... they have made a rule about security. Problem solved.
[ link to this | view in thread ]
Missed a rather important detail:
This was yet another case where the one 'hacked' didn't even care enough about it to want to bring it to trial, and yet a government agency stepped in to 'make an example' out of the 'hacker'.
[ link to this | view in thread ]
Re:
No, bureaucrats will only consider something as being publicly accessible if they have first said it is publicly accessible
[ link to this | view in thread ]
Re: Re:
That should count as sarcasm, it really should, but as various governments have shown, claiming that documents are still classified even when they've been widely made public, that's exactly their line of thinking.
[ link to this | view in thread ]
Googluh
[ link to this | view in thread ]
Re: Googluh
[ link to this | view in thread ]
wget
*Facepalm*
Freaking out over wget is almost as laughable as hearing something like "using "Ctrl+C" and "Ctrl+V", a group of elite hackers were able to steal the contents of several websites and recreate various articles on their own computers at home."
[ link to this | view in thread ]
Re: Re: Googluh
[ link to this | view in thread ]
Response to: Anonymous Coward on Feb 10th, 2014 @ 1:27pm
[ link to this | view in thread ]
Re: wget
Used previously unknown hack called "Save Page As".
The hacker will be charged with violating the CFAA, and also with 35 separate counts of copyright infringement.
[ link to this | view in thread ]
pffttt
[ link to this | view in thread ]
Re: Re: Re: Googluh
[ link to this | view in thread ]
[ link to this | view in thread ]
[ link to this | view in thread ]
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: pffttt
[ link to this | view in thread ]
Re: pffttt
[ link to this | view in thread ]
Seems to be standard these days, the NSA sees encryption as evidence of criminal intent.
[ link to this | view in thread ]
Re: Googluh
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: Re:
And it's up to the site owners, not Google, to manage site security, otherwise they'll have to charge for indexing websites.
[ link to this | view in thread ]
Re: Re: Re:
My point was that it is equally absurd to penalize a person who reads and caches a webpage that has no effective protection against unauthorized persons reading it. There is a cultural assumption that pages on the Internet are for public consumption unless there is some technical method which prevents straightforward navigation and reading. This is contrary to the usual trespassing analogies where the cultural assumption is that a place is private property and you are trespassing unless you have explicit permission.
Here, we have a situation where attempted webpage protection was completely ineffective. This allowed Google, and any other bot or human, to read, index, and cache a large set of pages that were intended to be private. You can't punish someone for doing a search and then reading the resulting webpages that are unprotected. Laurelli is being punished because, after reading those pages, he travels back to the home page and sees that ANSES intended those pages to be accessible only after logging in. This is very screwed up justice and I will dare to offer this trespassing analogy:
Suppose you have a park in the US which seems to be public. You walk into the park, wander around, and then leave through the main entrance. At this entrance you turn around and there is a sign, in Russian, which says "no trespassing". Is the government only going to prosecute those trespassers who can speak Russian?
[ link to this | view in thread ]
Re: Re: Re: Googluh
Hmmm
More like putting the files in a cabinet on the back steps, then locking the handle and deadbolt of the front door.
[ link to this | view in thread ]
Re: Re: Re: Re: Googluh
[ link to this | view in thread ]
Socialists
Lawyers, practicing and judicial, are notoriously incompetent at technical matters - did anyone think that electing socialists would improve this?
[ link to this | view in thread ]
Also, don't know anything about French law, but under many jurisdictions in US if I find a wad of cash on the street and not attempt to return it, I can be charged with theft or larceny. Just because something is in the public view doesn't mean it's ok to take.
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: Re:
Disclaimer: I'm from the UK.
[ link to this | view in thread ]