Frenchman Fined For 'Theft' And 'Fraudulent Retention' For Finding Health Docs Via A Google Search

from the le-cluelessness dept

The basic downloading tool Wget is much in the news at the moment, and here’s another story where it plays a central role. The French blogger and activist Olivier Laurelli, also known by his Twitter name Bluetouff, was searching on Google for something else when he spotted an interesting link that turned out to lead to several gigabytes of internal documents held on the French National Agency for Food Safety, Environment, and Labor’s extranet (ANSES in French). Ars Technica explains what happened next:

Laurelli merely used the Linux Wget tool to download all of the contents of the Web directory that he found. He left the files on his drive for a few days and then transferred them to his desktop for more convenient reading (which the French government would later spin as “the accused made backup copies of the documents he had stolen”). A few days later, Laurelli searched through the documents he downloaded and sent some to a fellow … writer [on the activist news site], Yovan Menkevick. About two weeks later, a few interesting scientific slides pertaining to nano-substances from the cache were published on Laurelli’s site.

When ANSES discovered this, it reported what it called “potential intrusion” and “data theft” to the police. Then France’s Central Directorate of Interior Intelligence (DCRI in French) became involved. The lower court that heard the case decided Laurelli should not be punished for accessing data that was not secure; ANSES was happy to let it go at that, but DCRI appealed.

It was clear that things would not go well in the appeals court when the presiding judge seemed not to know even how to pronounce “Google ” or “login” — he said “Googluh” and “lojin” (original in French.) The prosecutor was just as bad: he started off his speech by admitting “I didn’t even understand half the terms I heard today.” Ars Technica reports the denouement of this high-tech French farce as follows:

The appeals court acquitted Laurelli of fraudulently accessing an information system but saw fit to convict Bluetouff of theft of documents and fraudulent retention of information. The court wrote: “It is well demonstrated that he was conscious of his irregular retention in automated data processing, accessed where he downloaded protected evidence; and that investigations have shown that these data had been downloaded before being… disseminated to others; that it is, in any event, established that Olivier Laurelli made copies of computer files inaccessible to the public for personal use without the knowledge and against the will of its owner”

Leaving aside the fact that the appeals court was clearly ill-equipped to understand the technical issues involved, and that the original files were completely unprotected and found by Google’s crawler, not Laurelli, there is another disquieting aspect to this affair. Alongside his writing and activism, Laurelli also runs a small computer security company. One of the services it offers is a standard VPN. He was using this VPN service when he accessed the ANSES site, and the fact that his connection was routed via Panama — the VPN’s exit node — counted heavily against him, he believes:

“This VPN (in fact above all this Panamanian IP address) is probably one of the strongest elements which had driven the prosecution to pursue a criminal case,” he wrote.

VPNs represent one of the few tools available to ordinary Internet users to help them bolster their security and privacy against global surveillance. It’s deeply troubling that the mere fact of using a VPN to access a Web site was apparently viewed by the court as evidence of criminal intent, rather than simply good online practice in the post-Snowden world.

Follow me @glynmoody on Twitter or, and +glynmoody on Google+

Filed Under: , , , , , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Frenchman Fined For 'Theft' And 'Fraudulent Retention' For Finding Health Docs Via A Google Search”

Subscribe: RSS Leave a comment
Rikuo (profile) says:

There’s an update on the Ars Technica article, where they note that Laurelli, after clicking on the link that Google gave him but before he downloaded the several gigabytes worth of content, went to the home page of the directory he was on and was presented with a user name and password login box. This was used by the prosecution as indicative of his knowledge that he was on an intranet that he had no business being on and therefore he was guilty of the cyber equivalent of trespassing.

aldestrawk says:

Re: Re:

Effectively, there was no security, but why didn’t the Google bot notice there was a log-in required on the home page? A person not as technically astute as Laurelli would not have known they weren’t supposed to be looking at these documents. It seems that the security was supposed to be limiting access to URLs to only those who logged in on the home page. I am speculating that the mistake was that at the same time someone was logged in (who had the password “Fatalitas”) the Google bot came by to index all the linked pages without needing a separate login. Once indexed, and also in the Google cache, this allowed any person access to the pages. Laurelli has been fined only because he admitted traveling back to the home page and noting there was an authentication step. It seems that knowledge is enough to warrant a penalty. This goes beyond the matter of criminal intent being a required element of a crime. What we have here is mind boggling in that a crime is only a crime if you know it is a crime.

Pragmatic says:

Re: Re: Re:

At a very rough guess, they hadn’t bothered to put robots.txt or any other “do not index” indicators on that particular page. Bots aren’t sentient, you know. They’re dumb, they only know what you tell ’em.

And it’s up to the site owners, not Google, to manage site security, otherwise they’ll have to charge for indexing websites.

aldestrawk says:

Re: Re: Re: Re:

My comment about the Google bot was rhetorical. Of course, it is not up to the web spiders, or the companies that build them, to try to figure out if the builders of the website really wanted a page to be public or not. Outside of the convention of robots.txt, if a bot can read a page then it gets read, indexed, and cached. If ANSES had done the authentication and authorization correctly they wouldn’t even need to use robots.txt.
My point was that it is equally absurd to penalize a person who reads and caches a webpage that has no effective protection against unauthorized persons reading it. There is a cultural assumption that pages on the Internet are for public consumption unless there is some technical method which prevents straightforward navigation and reading. This is contrary to the usual trespassing analogies where the cultural assumption is that a place is private property and you are trespassing unless you have explicit permission.

Here, we have a situation where attempted webpage protection was completely ineffective. This allowed Google, and any other bot or human, to read, index, and cache a large set of pages that were intended to be private. You can’t punish someone for doing a search and then reading the resulting webpages that are unprotected. Laurelli is being punished because, after reading those pages, he travels back to the home page and sees that ANSES intended those pages to be accessible only after logging in. This is very screwed up justice and I will dare to offer this trespassing analogy:

Suppose you have a park in the US which seems to be public. You walk into the park, wander around, and then leave through the main entrance. At this entrance you turn around and there is a sign, in Russian, which says “no trespassing”. Is the government only going to prosecute those trespassers who can speak Russian?

Sheogorath (profile) says:

Re: Re:

Which is stupid. I’m an admin of a forum, and on the homepage there are boxes in which to put a user name and password. So do I or the webmaster have an issue if you access the forum without being signed in? Of course not, it’s open to public view. Thus the evidence that the mere existence of user name/password boxes do not prove that a network is a ‘private intranet’.

Anonymous Coward says:

is there any difference here with what has happened to people in the USA and UK? the government can twist the law so it means whatever they want it to mean under whatever the circumstances are at the time. is it any wonder people dont say anything when it could mean peoples safety? they would be accused, then locked up for creating the hazard in the first place! and all because the government refuses to be wrong!!

Mason Wheeler (profile) says:

that it is, in any event, established that Olivier Laurelli made copies of computer files inaccessible to the public for personal use without the knowledge and against the will of its owner

Wait, what now? Isn’t the fact that he found this on a Google search prima facie evidence that the data was, in fact, accessible to the public?

That One Guy (profile) says:

Re: Re: Re:

No, bureaucrats will only consider something as being publicly accessible if they have first said it is publicly accessible

That should count as sarcasm, it really should, but as various governments have shown, claiming that documents are still classified even when they’ve been widely made public, that’s exactly their line of thinking.

That One Guy (profile) says:

Re: Re:

Quite, you’d have to look hard to find a better reason for a judge to recuse themself from a case than ‘I don’t understand a single word they just said’.

The fact that they still moved on with the case, despite both the judge and prosecution admitting that they didn’t have a clue as to the technical details of what was being discussed just shows how little they cared about seeing justice done.

MadMatt (profile) says:


It is typical of courts in general and higher courts in particular. They have no idea, are presided over by people who should be in a retirement home due to their forgetfulness and usually completely technophobic.

The unfortunate truth of most of the worlds legal system is those deciding are deciding using the morality of several generation ago and the fiscal resources of the elite. They are unchallengeable for the most part (judicial independence) and have no liability for the quality of their decisions. The system does not really care if 100% of their decisions are overturned on appeal. Add to that governments who would like to pretend they don’t understand (plausible deniability) and bureaucracies that traditionally have worked on regulation, not action and this is what you get. They don’t need security… they have made a rule about security. Problem solved.

That One Guy (profile) says:

Missed a rather important detail:

Incredibly, although a lower criminal court ruled that Laurelli could not be penalized for accessing data that was not secure, the DCRI decided to appeal the decision. That’s after ANSES, the organization from which the documents were ?stolen? in the first place, decided not to pursue any civil action.

This was yet another case where the one ‘hacked’ didn’t even care enough about it to want to bring it to trial, and yet a government agency stepped in to ‘make an example’ out of the ‘hacker’.

alex says:


There was a case in the UK couple years back where Google cars were downloading off people’s unsecured wifi. At first I thought, well that’s public, it’s linked and unsecured, so Google are getting something that is effectively internet. Then I changed my view. Leaving your door open is not an invitation to come in and go through your filing cabinet. Then I changed my view again. Walking into someone’ property through an open door and going through their filing cabinet is not illegal. Then I started getting confused over where the line lies exactly.

kyle clements (profile) says:


If the authorities think “wget” is some sort of elite hacker tool, just wait until they find out about “dd”.


Freaking out over wget is almost as laughable as hearing something like “using “Ctrl+C” and “Ctrl+V”, a group of elite hackers were able to steal the contents of several websites and recreate various articles on their own computers at home.”

dmitryb says:

So when Google grabs people’s info from wide open access points that’s labeled as evil and they are being dragged through courts under happy applause from Europeans, but this somehow is not the same? Let’s at the very least pretend to be consistent.

Also, don’t know anything about French law, but under many jurisdictions in US if I find a wad of cash on the street and not attempt to return it, I can be charged with theft or larceny. Just because something is in the public view doesn’t mean it’s ok to take.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...