Former STL Cardinals Scouting Director Gets Jail Time For Illegally Accessing Astros Scouting Database

from the the-cardinal-way dept

If you'll recall, early on this year we wrote about the very strange story in which the at-the-time scouting director for the St. Louis Cardinals, Chris Correa, used the old passwords of a former employee who had since taken a job with the Houston Astros to break into the opposing team's scouting database. The actions were fairly brazen, leading many to wonder how in the world Correa thought he was going to get away with this. The government charged him under the CFAA, to which Correa pleaded guilty. At the time, I concluded the post guessing that Correa, given his standing and the fact that he isn't named Aaron Swartz, would get off with minimal if any jail time.

Well, when you're wrong, you're wrong. While Correa didn't get anything like the half-a-century jail time that the feds had threatened Swartz with, he is getting nearly four years worth of jail time, which is much more than I had expected.

Chris Correa, the former St. Louis Cardinals scouting director who illegally accessed the Houston Astros database known as Ground Control, was sentenced to 46 months in prison today in Houston federal court.

Correa, who was fired by the Cardinals in July 2015, pleaded guilty in January to five counts of unauthorized access of a computer. According to prosecutors, Correa used an old password of a former Cardinals employee, who took a job with the Astros, to log into Ground Control and download the Astros’ scouting reports, information on possible MLB draftees, and other notes. Correa has also been assessed a fine of $279,038. Prosecutors valued the damage done to the Astros from his actions at $1.7 million.

Without wanting to dance on another human being's jail sentence, I will say there is something slightly satisfying in seeing this case conclude with real jail time, as opposed to some kind of slap on the wrist. It does nothing to soften the still gaping wounds stemming from the Swartz tragedy, of course. Still, so much of the time we see laws like the CFAA applied in the most haphazard way, whereas this was about as perfect an application for it as I can think of.

Somehow the rest of the Cardinals organization has skated by unscathed. The Cardinal Way and all that, I guess.

Filed Under: cfaa, chris correa, hacking, jailtime, scouting
Companies: houston astros, mlb, st. louis cardinals

Expose A Blatant Security Hole In AT&T's Servers, Get 3.5 Years In Jail

from the now-the-holes-will-be-open-longer dept

We've written a few times about the case of Andrew Auernheimer, perhaps better known as weev. While he has a bit of a reputation as an online troll, and self-admitted jerk, his case is yet another example of how ridiculously broken the CFAA (Computer Fraud and Abuse Act) remains. In this case, what he did was expose a pretty blatant security hole in AT&T's servers, that allowed anyone to go in and find the emails of any AT&T iPad owner, merely by incrementing the user ID. This isn't a malicious "hack." It's barely a "hack" at all. This isn't "breaking in." This is just exploring a totally broken system. To call attention to this, weev collected information on a bunch of famous folks who had iPads and alerted the press. This is what security folks do all the time. And for his troubles in helping AT&T discover and close a pretty bad security hole, he's been sentenced to 41 months in prison plus he has to pay $73,000 to AT&T. One hopes AT&T will use it to hire half a decent security person or something.

The sentencing, by the way, was near the top of the "guidelines" the judge had, for those who insisted that the courts in other CFAA cases, such as Aaron Swartz's might be lenient.

Plenty of people -- especially in the security community, are realizing what a ridiculous ruling this is and how dangerous it is. As people are starting to point out, while he may be a jerk, that doesn't mean he's a criminal. The prosecution used chat logs in which Auernheimer and a friend, Daniel Spitler, discussed the effort, and the fact that they talked about harming AT&T's reputation and promoting themselves as security experts. I don't see how that leads to any criminal activity though. AT&T's reputation should be tarnished for having crap security. And why wouldn't some researchers talk about using the discovery of a really bad privacy hole by a major corporation to boost their own credentials. Pretty much anyone in their shoes would reasonably think the same thing.

Prosecutors, of course, played up Auernheimer's history of being a jerk, but that alone has little to do with his actions here:

"His entire adult life has been dedicated to taking advantage of others, using his computer expertise to violate others' privacy, to embarrass others, to build his reputation on the backs of those less skilled than he," wrote U.S. Attorney Paul Fishman, who went on to note the "atypical recalcitrance by the defendant to conform to the laws regarding unauthorized computer access."

While that may be true, none of that, by itself, is illegal. And the actions that exposed a glaring hole put in place by bad programmers at AT&T shouldn't be either.

Filed Under: andrew auernheimer, cfaa, hacking, jailtime, research, security, weev
Companies: at&t

Feds Ask For Jailtime For GNR File Sharer

from the with-fans-like-these... dept

I have to admit that I'm still confused why the FBI was spending time going around arresting the guy who put up Guns 'N Roses' latest album, rather than focusing on issues that really matter these days. The arrest alone actually led to much more downloading than if they had just let it go. Yet, now, following a guilty plea, the feds are demanding a six-month prison term for the guy. For promoting the band. Considering how much downloads picked up after the news of the arrest broke, why isn't anyone demanding that we put the FBI agents who spent taxpayer money on this behind bars for even longer? Sure, unauthorized sharing of files breaks copyright law, but it's difficult to come up with any reasonable explanation for (a) spending taxpayer money on having the FBI track down and arrest the guy and then (b) sending him to jail. Every album that's released gets leaked online -- and plenty of musicians have learned how to use it to their benefit. That should make it clear that getting your music leaked online isn't about any economic loss. It's all about what sort of business model you choose. So, because Axl Rose chooses a bad business model, some guy who was sharing GNR music needs to go to jail and the FBI and the Feds need to be involved? Doesn't something seem wrong with this picture?

Filed Under: copyright, fbi, file sharing, guns n' roses, jailtime, music, promotion

So Why Did The MPAA Need New Camcording Laws Again?

from the please-explain dept

You may recall that throughout 2007, the MPAA was on something of a worldwide campaign to get governments to pass new laws with stricter punishment for "camcording" movies. Of course, camcording is not really a big deal. The quality is bad, and DVD-quality releases find their way to pirates pretty quickly anyway. The "losses" from camcorded movies are minimal, though it didn't stop the MPAA from totally making up numbers that were clearly bogus. Each place they pressured to get new laws apparently represented some huge percentage of camcorded movies on the market, such that if you added them up, you were talking about well over 100%. Then, of course, there was the case where they claimed that anti-camcording laws in the US had wiped out piracy in the US. Of course, that was when they were pushing for such laws in Canada. Two months later when they were pushing for such laws in the US, suddenly New York represented 40% of all camcorded movies.

However, what was most disturbing was the idea existing laws weren't already enough to deal with whatever "problem" camcording represented. So, it's rather interesting to see that a guy who was caught camcording movies in Maryland was just sentenced to 21 months in prison under a 2005 law. So why did the MPAA scream bloody murder about needing new, more stringent laws in 2007? As for someone getting 21 months in prison for filming a movie that was probably already available online from a studio leak, well, that's a different issue for another day...

Filed Under: camcording, jailtime, laws
Companies: mpaa

As US Looks To Re-legalize Online Poker, Germany Bans It

from the moving-in-opposite-directions dept

Just as the US seems to be moving forward with efforts to relegalize online poker, it appears that Germany is moving in the opposite direction, passing a law to ban online poker -- even to the point of allowing German authorities to put online poker players in jail (though, no one seems to think that's likely to happen).

Filed Under: ban, germany, jailtime, online poker

Phishing Scammer Gets Seven Years

from the this-ought-to-make-some-folks-happy dept

People seem to get pretty excited whenever we have stories of spammers and scammers getting long jail sentences, so I'm sure plenty of folks will be happy to hear that a phishing scammer just got sentenced to seven years in prison. Considering that he was scamming people's passwords to use elsewhere, this seems a lot more reasonable than the folks who get long jail sentences just for spamming. But, with all of these stories about spammers and phishers getting convicted, it always seems like the punishment is rather arbitrary. There's no clear pattern at all.

Filed Under: jailtime, phishing, scams

Why Are People Being Sent To Jail For Unlocking A Mobile Phone?

from the bad-news-all-around dept

For a few years, we've been covering the various lawsuits over mobile phone unlocking, mostly involving the company TracFone. TracFone focuses on the "prepaid" mobile phone market. That is, rather than selling long term contracts to people with various total minutes, it just sells phones with a certain number of minutes already on them that can then be re-upped at the buyer's discretion. However, like typical mobile phone service providers, TracFone subsidizes the price of the phone in order to make it seem quite cheap (sometimes as low as $10 or $15). The idea is to hook people and make money on selling the minutes. However, there's no requirement that people buy more minutes.

What's happened, of course, is that people figured out a huge arbitrage opportunity. They buy TracFone phones on the cheap, unlock them, and then resell them for a higher price (often outside the country). The problem here is TracFone's choice of a business model. It decided to subsidize the phones and it set up a business model that doesn't require people to sign a long term contract or ever agree to buy more minutes. However, if you listen to TracFone tell the story, this is a case of felony interference of a business model, and anyone unlocking those phones must be stopped.

For a while it was abusing the DMCA for this purpose -- using it to claim that the unlocking was circumvention of copy protection. Of course, that's exactly how the DMCA is not supposed to be used -- and that was made even more clear when the Library of Congress explicitly carved out an exemption for mobile phone unlocking, making it quite clear that this is perfectly legal. TracFone has whined about this, but it still doesn't amount to much more than that the company just picked a bad business model.

However, the situation keeps getting more bizarre. Some folks involved in one of these arbitrage opportunities were eventually arrested for terrorism, after US officials assumed that anyone buying so many prepaid phones must be planning some sort of attack (don't ask). This had companies in the space suddenly claiming that this action of unlocking prepaid phones was a national security threat (seriously). What's scary is that some officials seem to believe it.

It turns out that TracFone actually is winning a bunch of the lawsuits it's filing, using both questionable copyright and trademark claims. However, the real kicker is that one man is actually facing jailtime for this. It's a little unclear from the wording in the article, as the jailtime may actually be as a result of him ignoring a judge's order to stop the practice of reselling unlocked TracFones -- but it's still not clear why it's illegal to unlock these phones that were legally purchased. The DMCA exemptions say that unlocking a phone is perfectly legal, and as long as the phone was legally purchased, it's now the possession of the buyer, who should be allowed to tinker with the software and resell it without having to worry about lawsuits or (worse) jailtime. Yes, TracFone is upset that it wipes out their business model, but the law isn't designed to protect their own poor choice of business models.

Filed Under: jailtime, legality, mobile phones, prepaid wireless, unlocking
Companies: tracfone