He was _absolutely_ doing this maliciously. It STILL SHOULD NOT BE CRIMINAL.
This is a fundamental misattribution of responsibility.
His intent was to defame AT&T as much as possible, using only factual information about their own (negligent) business decisions. This, too, should be legal (and I believe it is).
Why does it have to be either/or? Why can't both people be responsible? Why can't AT&T be civilly liable for leaving a gaping hole on their application, and whoever abused that information be criminally liable?
Incidentally, every time you blame AT&T for what happened, you tacitly acknowledge that wrongdoing actually occurred, which harms your argument that the data was "published".
(In the interest of combating the fundamental attribution error: I'm not happy with Aurnheimer receiving a custodial sentence for what was pretty obviously just another dumb prank. We probably agree that the sentencing component of CFAA is absurdly constructed.)
There were neither "people's credit card numbers" nor "publishing" in this instance. It seems like you're being intentionally confusing.
We're talking about a list of email addresses (which I don't think should be protected data in any way, they're just email addresses) and a journalist running a blacked-out screenshot of a dozen of them.
I think you know I'm not being intentionally confusing; that's not who I am. I'm responding to part of your comment. I'm not writing a brief against Auernheimer. The way you know that is, my comments have repeatedly agreed with yours that his sentence is unjust.
I'm responding to the zero-sum nature of your comment above, about how the company harboring the vulnerability should be the one penalized for security incidents. And all I'm saying is, there's no reason why we can't penalize both: companies, when they're negligent, and people who exploit that negligence.
Also: we both know there's more to the story with Auernheimer than simply sending material to journalists.
Once again, we probably agree that Auernheumer doesn't belong in prison over this particular incident. He was overcharged and oversentenced. But I find the exact philosophy that drives you to that conclusion challenging, which is why I called it out.
> Also: we both know there's more to the story with Auernheimer than simply sending material to journalists.
Uhh, excuse me? They discussed what could have been done maliciously with the data, and then DIDN'T DO ANY OF THOSE THINGS. I honestly don't know what else you're alluding to.
To answer your main point:
I figured it out yesterday. I believe that sending packets over the internet, of any kind, with any content, is protected speech.
We're allowed to say what we want. It's the responsibility of a listener to determine how they respond.
This is how the world works, and it should be how the internet works, too.
The kind where squabbles between two private parties are civil matters until and unless someone commits (or conspires to commit) an actual crime?
Particularly when the "harm" here is harm of reputation due the target's public actions? If I assemble a bunch of potentially-reputation-harming data on a public figure and post it on the internet with the clear intent of convincing people that public figure is incompetent, should that be an act that can get me landed in jail? Or is that speech?
Is the automated collection of that data really a thing that should be criminalized? Should it be criminal because or only when it includes identifying information of innocent bystanders?
Hypothetical scenario as an existence proof (not related to the situation currently at trial):
Suppose you're an investigative reporter. You regularly investigate a person or company that you feel gets away with too much, whose public actions always skate right on the line, and figure they must be doing something wrong. You feel vindictive about it because you haven't managed to find anything about them in the past. You fully intend to find something to report on that will cause their business harm; it's less about the story at this point, and more about you versus them. You find your story, you report on it (truthfully), and the result is serious enough that their business takes a major hit.
You had malicious intent to cause harm, and managed to cause the intended harm, and yet you've still done absolutely nothing wrong. (Remember that truth is an absolute defense against slander/libel accusations.)
Malicious intent to cause harm is frequently a necessary condition for a crime (leaving aside things like negligence), but never a sufficient one. You still have to do something inherently wrong.
In legal terms, see "mens rea" versus "actus reus".
Breaking into a computer system without permission by exploiting a security hole: generally a crime.
Accessing data made accessible to the general public: not wrong in the slightest, regardless of intent.
Changing your user-agent isn't exploiting a security hole (modulo changing it to ');drop table students;-- ), nor is automated access to a website (modulo DoSing). And embarrassing a company by showing that they made private user data publicly accessible definitely shouldn't be criminal.
>modulo changing it to ');drop table students;-- )
As an aside, about a year ago I made a simple web crawler that got (among other things) HTTP headers from all the servers it found. After an hour of crawling, I took the headers to start working on a parser for them, and found 7 attempts at an sql injection. Do I get to prosecute whoever set up those servers?
> What kind of reality do you live in where malicious intent to cause harm to someone or some group should not be a crime?
It depends somewhat on what you class as malice. Starting a business is usually a deliberate attempt to cause harm to competitors, and success at it may well cause thousands of people to lose their jobs, etc.
The world is simply becoming too complicated, all these "trajedy of the commons" type economics are blowing up in ways that are so harmful all over. I feel it is wrong for Weev to be in jail, the same way I feel it was wrong for max hardcore (paul little) to have went to jail, and so many others. I have been writing weev, he says he wishes more people will write him, it is very lonely in solitary confinement, in this complicated world, writing a letter to another human being seems the least I can do. I hope more people here do so too, even though I hated looking at all those goatse buttholes over the years and condemned the person who was doing that to me - LOL! I don't wish a human being to be locked up for years for what Weev has done.
Similarly, should the programmer(s) who implemented the feature (plus the staff who devised and approved it) be accused of reckless endangerment of the data?
He was _absolutely_ doing this maliciously. It STILL SHOULD NOT BE CRIMINAL.
This is a fundamental misattribution of responsibility.
His intent was to defame AT&T as much as possible, using only factual information about their own (negligent) business decisions. This, too, should be legal (and I believe it is).