<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/">
<channel>
<title>Techdirt. Stories filed under &quot;ahmed al-khabaz&quot;</title>
<description>Easily digestible tech news...</description>
<link>http://www.techdirt.com/</link>
<language>en-us</language>
<image><title>Techdirt. Stories filed under &quot;ahmed al-khabaz&quot;</title><url>http://www.techdirt.com/images/td-88x31.gif</url><link>http://www.techdirt.com/</link></image>
<item>
<pubDate>Thu, 24 Jan 2013 10:40:01 PST</pubDate>
<title>Newspaper Editorial Insists Hackers Must Be Punished, While Misunderstanding Nearly Every Detail</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130124/01543521775/newspaper-editorial-insists-hackers-must-be-punished-while-misunderstanding-nearly-every-detail.shtml</link>
<guid>http://www.techdirt.com/articles/20130124/01543521775/newspaper-editorial-insists-hackers-must-be-punished-while-misunderstanding-nearly-every-detail.shtml</guid>
<description><![CDATA[ We just recently wrote about a trio of recent situations -- all involving young hackers probing for information, leading to either criminal charges or threats of criminal charges against them -- that show what happens when people in power <a href="http://www.techdirt.com/articles/20130122/15111221754/war-computing-what-happens-when-authorities-dont-understand-technology.shtml">don't understand</a> how technology works.  They were all cases where the individuals involved may have done things that some would think <i>inconsiderate</i>, but that hardly should rise to the level of "criminal" behavior -- especially with threats of many years in jail.  Presenting the flipside to that argument: the editorialists at the Toronto Globe and Mail, who show why those who don't understand technology have no business writing about it.  The editorial is headlined <a href="http://www.theglobeandmail.com/commentary/editorials/when-did-it-become-wrong-to-punish-hackers/article7654240/" target="_blank">When did it become wrong to punish hackers?</a>, which already suggests problem number one.  Hacker is a generic term that does not automatically imply malicious attacks, yet the Globe and Mail immediately seems to assume otherwise.  That might be news to the US government, which just announced its own <a href="http://hackforchange.org/" target="_blank">National Day for Civic Hacking</a> (despite filing charges against such civic hackers...).
<blockquote><i>
A Montreal school is being widely criticized for expelling a student who hacked into its computer system and helped expose flaws in the system&#8217;s security. The student now has been offered jobs by computer security companies, including the one that ran the system he hacked into. In the Internet age, the hacker is celebrated as a hero and the school is pilloried for being an overbearing, defensive holdover from a bygone age. It&#8217;s an unfair presumption that needs to be corrected.
</i></blockquote>
That's one version of the story.  The hacker is celebrated as a hero because he did something useful: exposed a security flaw that could have been used by someone malicious for nefarious purposes.  We generally want to celebrate those who spot danger and warn people away from it.  And the school is being pilloried because it expelled this person.  Without Ahmed Al-Khabaz's help, the data of students would be at risk.  Doesn't it seem somewhat overbearing to blame the messenger?  What exactly is "unfair" about the presumption?  After pointing out that Al-Khabaz "discovered a serious flaw" the editorial still supports his expulsion, apparently entirely based on the fact that the company, Skytech, felt his probing was an attack:
<blockquote><i>
... Mr. Al-Khabaz then went on and carried out what the company considered to be a &#8220;cyber-attack&#8221; on the school&#8217;s production servers. The company notified the school, and Mr. Al-Khabaz was hauled on the carpet. The company accepted the student&#8217;s explanation and noted that he &#8220;demonstrated great talent in computer science.&#8221; They dropped the matter and offered Mr. Al-Khabaz a job, but Dawson&#8217;s administrators felt the student had gone too far and expelled him on the grounds he had violated the college&#8217;s code of conduct.
</i></blockquote>
What the company considered a "cyber-attack" could also be described as "checking to see if the flaw was fixed."  And, clearly, they didn't think it was a huge problem if they offered him a job, and noted his "great talent."  So why does the school still think he went too far?
<blockquote><i>
 Dawson&#8217;s officials are right: Rules exist for a reason, and students cannot expect to break them without consequence. Why have them, otherwise?
</i></blockquote>
Ahhhhhh.  Rules are rules. Rules exist for reasons, but sometimes those reasons are bad.  And punishing people for breaking rules in ways that help people seems like sending the exact wrong message.  Sometimes rules should be broken, because the rules are wrong.
<br /><br />
The editorial then moves on to Aaron Swartz:
<blockquote><i>
Swartz, who had a history of depression, was facing a slew of charges for allegedly downloading publicly funded academic journals from a large database that charged a fee for access. His family and supporters blame overzealous prosecutors for his death; the prosecutors insist &#8211; again, quite rightly &#8211; that &#8220;stealing is stealing.&#8221;
</i></blockquote>
Uh, "stealing is stealing" is a tautology, so of course it's right.  But what's "wrong" is arguing that what Swartz did was "stealing."  He stole nothing.  He downloaded papers from MIT's <i>open</i> network, which was set up with a site license from JSTOR allowing <i>open</i> downloading of those journal articles, all of which remained on the site for anyone else to download.
<br /><br />
Go ahead, explain what was "stolen"?
<blockquote><i>
In the age of the Internet, the massive downloading for free of music and movies and other copyrighted material has muddied the waters for many people.
</i></blockquote>
It seems to have "muddied the waters" for the editorial writers of the Toronto Globe and Mail who don't seem to realize that neither case had anything to do with the "massive downloading for free of music and movies."
<blockquote><i>
They seem to have forgotten that privacy rights and copyright laws are among the foundations of our economy. These are things that are not to be shoved aside by the absolutism of Internet activism.
</i></blockquote>
Oh really?  If privacy rights are the foundation of the economy, then, er, isn't it a <i>good thing</i> that Al-Khabaz alerted officials to a hole that <b>exposed</b> the private info of students.  He did nothing to compromise anyone's privacy rights at all.  Similarly, Aaron Swartz did not violate any copyright law, and he was not charged with copyright law violations.
<br /><br />
So, seriously, how does a huge mainstream publication like the Globe and Mail get away with writing a piece of garbage this ridiculous?  It claims things that simply aren't true, completely flips around reality, and then seems to wrap it up in some bizarre "rules are rules" argument, that makes no sense since the rules it says people violated... weren't even violated.
<br /><br />
And the Globe and Mail thinks people should <a href="http://www.theglobeandmail.com/report-on-business/the-globe-to-roll-out-metered-paywall-as-industry-shifts-to-digital-revenue/article4612259/">pay its meter</a> to access this kind of crap?<br /><br /><a href="http://www.techdirt.com/articles/20130124/01543521775/newspaper-editorial-insists-hackers-must-be-punished-while-misunderstanding-nearly-every-detail.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130124/01543521775/newspaper-editorial-insists-hackers-must-be-punished-while-misunderstanding-nearly-every-detail.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130124/01543521775/newspaper-editorial-insists-hackers-must-be-punished-while-misunderstanding-nearly-every-detail.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>apparently-never</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130124/01543521775</wfw:commentRss>
</item>
<item>
<pubDate>Wed, 23 Jan 2013 12:13:00 PST</pubDate>
<title>The War On Computing: What Happens When Authorities Don't Understand Technology</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130122/15111221754/war-computing-what-happens-when-authorities-dont-understand-technology.shtml</link>
<guid>http://www.techdirt.com/articles/20130122/15111221754/war-computing-what-happens-when-authorities-dont-understand-technology.shtml</guid>
<description><![CDATA[ We've obviously been covering a lot about <a href="http://www.techdirt.com/blog/?tag=aaron+swartz">Aaron Swartz</a> lately, but his case is really just one of many similar cases involving people in positions of authority who simply don't understand basic technology, but <i>feel</i> that something must be illegal because they try to overlay an analog view on a digital world.  In the Swartz case, Carmen Ortiz famously used the incredibly misguided and misleading "stealing is stealing" concept.  However, as Cory Doctorow has been fond of <a href="http://www.techdirt.com/articles/20111231/01431617249/ongoing-war-computing-legacy-players-trying-to-control-uncontrollable.shtml">pointing out</a> lately, we're entering a war on general purpose computing, and this is just one battle front.
<br /><br />
Two other recent skirmishes show the same sorts of things happening in slightly different contexts.  A few months ago, we wrote about the case of <a href="http://www.techdirt.com/articles/20121121/09030521112/expose-blatant-security-hole-att-face-five-years-jail.shtml">Andrew Auernheimer</a>, the security researcher who's been convicted and likely to face a long period of time in jail for exposing a blatant security hole from AT&#038;T that allowed him (and <i>anyone else</i>) to gather personal data on the owners of any iOS device.  Remember, AT&#038;T set up some stupid security, making all of this data public via its own API.  Now about to be sentenced, Auernheimer was asked to write up a "statement of responsibility" for the court, and chose to do a <a href="http://techcrunch.com/2013/01/21/ipad-hack-statement-of-responsibility/" target="_blank">blog post in which he calls out what a farce the whole situation is</a>:
<blockquote><i>
The facts: AT&#038;T admitted, at trial, that they &#8220;published&#8221; this data. Their words. Public-facing, programmatic accesses of APIs happen upwards of a trillion times per day. Twitter broke 13 billion on their API ages ago. This is something that happens more than the entire population of Earth, daily. The government has no problem with this up until you transform the output into something offensive to important people. People with &#8220;disruptive&#8221; startups, this is your fair warning: They are coming for you next.
<br /><br />
The other one of my prosecutors, Zach Intrater, said that a comment I made about Goatse Security, my information security working group, starting a certification process to declare systems &#8220;goatse tight&#8221; was evidence of my intent to personally profit. For those not in on the joke: Goatse is an Internet meme referencing a man holding open his anus very widely. The mind reels.
<br /><br />
I can&#8217;t survive like this. I am happy to be hitting a prison cell soon. They ruined my business. The feds get approval of who I can work for or with: they rejected one company because the CEO had a social network profile with an occupation listed as &#8220;hacker.&#8221; They prohibit me from touching any computer that isn&#8217;t federally monitored. I do my best to slang Perl code on an Android device to comply with my bail conditions. It isn&#8217;t pretty.
</i></blockquote>
Meanwhile, up in Canada, there's been a fair bit of talk about how Dawson College computer science student Ahmed Al-Khabaz <a href="http://news.nationalpost.com/2013/01/20/youth-expelled-from-montreal-college-after-finding-sloppy-coding-that-compromised-security-of-250000-students-personal-data/" target="_blank">was expelled for discovering a security hole</a> in a system used across many Canadian colleges to store personal data of students.  In his case, part of the problem was that, after alerting people to the hole, he went back a few days later to run a script to see if they had closed the hole.  This caused the company that managed the system to accuse him of criminal activity:
<blockquote><i>
&#8220;It was Edouard Taza, the president of Skytech. He said that this was the second time they had seen me in their logs, and what I was doing was a cyber attack. I apologized, repeatedly, and explained that I was one of the people who discovered the vulnerability earlier that week and was just testing to make sure it was fixed. He told me that I could go to jail for six to twelve months for what I had just done and if I didn&#8217;t agree to meet with him and sign a non-disclosure agreement he was going to call the RCMP and have me arrested. So I signed the agreement.&#8221;
</i></blockquote>
Even with the signed agreement, Dawson expelled him.  While Dawson stands by its decision, the company Skytech says that it's <a href="http://www.cbc.ca/news/canada/montreal/story/2013/01/21/montreal-dawson-college-hack-hamed-al-khabaz.html" target="_blank">now offered to hire him part time</a>.
<br /><br />
Yes, in all three of these cases you can make a case that what the individual did went further than others would go.  Some might call it discourteous.  Swartz downloaded a lot more than the system intended, even though the network was open and the terms allowed for unlimited downloads.  Auernheimer didn't just find the hole, but he scraped a bunch of data and sent some of it off to a reporter.  Al-Khabaz didn't just find the security hole, but he also went back and probed the system again later.  But, in the context of someone who lives in this kind of world and understands technology, all three represent <i>completely natural behavior</i>.  If the technology allows it, <i>why not</i> probe the system and see what comes out?  It's the natural curiosity of a young and insightful mind, looking to see what information is there.  When it's made available, how do you <b>not</b> then seek to access it?
<br /><br />
But there is a fundamental disconnect between an older, non-digital generation who doesn't get this.  They think in terms of walls and locks, and clear delineations.  The younger generation, the digital native, net savvy generation looks at all of this as information that is available and accessible.  The limitation is merely what they can reach with their computer.  But this isn't a bad thing -- this is how we discover new things and build and learn.  Treating that as <i>criminal</i> behavior is insane and backwards.  It's trying to apply an analog concept to a digital world, and then criminalizing exactly what the system allows and what we should be encouraging people to do -- to push the network, to explore, to learn and to access information.
<br /><br />
This is a culture clash, of sorts, but it represents a real problem, when we're criminalizing the most curious and adept computer savvy folks out there.<br /><br /><a href="http://www.techdirt.com/articles/20130122/15111221754/war-computing-what-happens-when-authorities-dont-understand-technology.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130122/15111221754/war-computing-what-happens-when-authorities-dont-understand-technology.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130122/15111221754/war-computing-what-happens-when-authorities-dont-understand-technology.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>here-we-go</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130122/15111221754</wfw:commentRss>
</item>
</channel>
</rss>