In which I should WARN YOU that I am NOT A LEGAL EXPERT
I get myself a tech blog, and a week later this story blows wide open. Finally, UT does something good for me.
If you haven't been under a rock or too busy stuffing your mattress with greenbacks to pay attention to the local non-people-getting-shot news*, this happened. Since everyone else has a lock on the details, I think I'll go with the "unfounded opinions" angle.
Let's take a look at the indictment (.pdf) a little more closely. Kernell is charged with violations of various subparagraphs of 18 USC 2701 and 18 USC 1030. Both of these, as applied to the Kernell case, deal with the cybercrime equivalent of Breaking and Entering, which is only more scary than its meatspace equivalent because the internet still frightens people who can't get their VCRs to stop flashing 12:00.
My little brother did the same thing to me with my first Compaq, but I didn't have him arrested; instead, I figured out that hey, really obvious passwords might not be the best idea in the world. I learned a valuable lesson, and he learned to get his porn fix elsewhere.
Of course, Kernell's alleged history of such actions** could bugger him in the court of public opinion. The fact that it's the same kind of "hacking" that I did back in fifth grade to play Oregon Trail on an Apple ][ is beside the point, of course.
Or maybe it isn't. See, here's the deal - calling David Kernell a hacker is like calling Dave Prince a Pulitzer contender. Guessing a password on a Yahoo account - basically a form of social engineering without the social element - is as base and rudimentary a method as exists today, and it only works when the target is foolish enough to think that easily-obtainable information is a reasonable substitute for proper security measures. It requires no programming skill, no real knowledge of network security, and none of that console-cowboy swashbuckling finesse that people like to use to romanticize hackers with one hand while vilifying them with the other.
This kid's not a hacker; he's (allegedly) a 4channer*** who got in over his head when he forgot that some people A) don't like it when you publicize the ineptitude of the people in charge, and B) have all sorts of tools to cause problems for you when you do. He's not a major player, and his case shouldn't be treated otherwise. Get out of my town, CNN****.
Conversely, when people like the DoJ's Mark Krotoski***** (.pdf) go after kids like Kernell, they risk getting in under their heads. The Krotoskis of the world are wired for the kinds of acts that bin Laden would be committing if Pakistani caves had broadband access. When the FBI and DoJ make a mountain out of this potentially politically-charged molehill because they feel the need to take a few somewhat-untested sections of the USC out for a well-publicized spin, they threaten to undermine the seriousness of the problems they should be dealing with by focusing attention on a case which should by all rights only be serving to illustrate how far we have to go before we as a nation are free from idiot end-users.
Kernell faces up to 5 years and $250,000. Don't expect him to get that much.
----
* No disrespect to the victim of yesterday's Knoxville Center shooting. That crap's just abominable.
** Not to mention that hacky-sack haircut.
*** I wonder how many curious onlookers decided to check out 4chan as a result of this. I wonder how horrified they were at the results.
**** The Daily Show can stay if they show up, provided that Jon Stewart gives me a job.
***** This is from an International Telecommunications Union Cybersecurity Forum - I'm including this both to help provide perspective on the scope of the mindset and to highlight the fact that even the DoJ can't put together a non-crappy slideshow presentation.
If you haven't been under a rock or too busy stuffing your mattress with greenbacks to pay attention to the local non-people-getting-shot news*, this happened. Since everyone else has a lock on the details, I think I'll go with the "unfounded opinions" angle.
Let's take a look at the indictment (.pdf) a little more closely. Kernell is charged with violations of various subparagraphs of 18 USC 2701 and 18 USC 1030. Both of these, as applied to the Kernell case, deal with the cybercrime equivalent of Breaking and Entering, which is only more scary than its meatspace equivalent because the internet still frightens people who can't get their VCRs to stop flashing 12:00.
My little brother did the same thing to me with my first Compaq, but I didn't have him arrested; instead, I figured out that hey, really obvious passwords might not be the best idea in the world. I learned a valuable lesson, and he learned to get his porn fix elsewhere.
Of course, Kernell's alleged history of such actions** could bugger him in the court of public opinion. The fact that it's the same kind of "hacking" that I did back in fifth grade to play Oregon Trail on an Apple ][ is beside the point, of course.
Or maybe it isn't. See, here's the deal - calling David Kernell a hacker is like calling Dave Prince a Pulitzer contender. Guessing a password on a Yahoo account - basically a form of social engineering without the social element - is as base and rudimentary a method as exists today, and it only works when the target is foolish enough to think that easily-obtainable information is a reasonable substitute for proper security measures. It requires no programming skill, no real knowledge of network security, and none of that console-cowboy swashbuckling finesse that people like to use to romanticize hackers with one hand while vilifying them with the other.
This kid's not a hacker; he's (allegedly) a 4channer*** who got in over his head when he forgot that some people A) don't like it when you publicize the ineptitude of the people in charge, and B) have all sorts of tools to cause problems for you when you do. He's not a major player, and his case shouldn't be treated otherwise. Get out of my town, CNN****.
Conversely, when people like the DoJ's Mark Krotoski***** (.pdf) go after kids like Kernell, they risk getting in under their heads. The Krotoskis of the world are wired for the kinds of acts that bin Laden would be committing if Pakistani caves had broadband access. When the FBI and DoJ make a mountain out of this potentially politically-charged molehill because they feel the need to take a few somewhat-untested sections of the USC out for a well-publicized spin, they threaten to undermine the seriousness of the problems they should be dealing with by focusing attention on a case which should by all rights only be serving to illustrate how far we have to go before we as a nation are free from idiot end-users.
Kernell faces up to 5 years and $250,000. Don't expect him to get that much.
----
* No disrespect to the victim of yesterday's Knoxville Center shooting. That crap's just abominable.
** Not to mention that hacky-sack haircut.
*** I wonder how many curious onlookers decided to check out 4chan as a result of this. I wonder how horrified they were at the results.
**** The Daily Show can stay if they show up, provided that Jon Stewart gives me a job.
***** This is from an International Telecommunications Union Cybersecurity Forum - I'm including this both to help provide perspective on the scope of the mindset and to highlight the fact that even the DoJ can't put together a non-crappy slideshow presentation.
Excuse me? He committed a crime and should be punished. What he did was an invasion of privacy and criminal. He deserves EVERYTHING he gets. People who excuse crime cause crimes to happen more.
Right, because saying that this whole thing is getting more attention from the Feds and the media than it deserves totally equates to me being an apologist.
Whether committed in cyberspace or meatspace, crossing state lines to Break and Enter is a criminal offense. I never said otherwise - what I did say was that blowing this particular case up (for whatever reason) wastes time which the FBI and the DoJ could better use on more pressing matters.