The Computer Owner - Guilty or Not Guilty? 539
Von-at-Infosec_Writers asks: "It is relatively easy to trace a hack back to a particular computer, but proving that a specific person committed the crime could become much more difficult especially since, as a recent CNN.com article stated, a hacker's legal defense can be: it wasn't me but my hijacked computer that committed the crime. 'In some cases, I do suspect there are people whose computer is taken
over by third parties. It's also a clever defense to exculpate your client,' says Michael Allison of the Internet Crimes Group.What are possibilities to overcome this problem; to prove that the computer owner, without a doubt, is in fact responsible or not responsible for the crime?" As computers become more and more prevalent in our infrastructure, the consequences for computer crime become that much more serious. How much responsibility does the owner of an Internet-connected computer have for crimes committed using their equipment, and what are ways we can best determine their involvement, or lack of it, in said crimes?
Innocent Until Proven Clueful (Score:5, Insightful)
In all three cases, no one has suggested that the verdicts were anything other than correct.
I think it's going to be pretty easy to tell, within the law, whether the computer owner knew that a hack attack or illegal download was occurring on his/her computer. Most of the time, the court's answer will be "no".
If a remote-control Trojan is on the PC, then the prosecution would have to prove that:
* The computer's owner is 133t enough to hack into a remote system, but clueless enough to allow a Trojan free rein on his own.
* Or, the computer's owner in fact installed the Trojan program on his PC for the explicit purpose of throwing off investigators.
While the defense attorney needs only argue that his client is just an average Joe(anne), and wouldn't know what a Trojan [trojancondoms.com] was if he/she bought one at the drugstore. The defense attorney should be facing a receptive audience. Remember, in the US at least, he'll be facing a jury of 12 average citizens who know as little about how computers work as I do about brain surgery.
Or perhaps less. At least I know which box my brain is in.
The courts will work this out....eventually (Score:5, Insightful)
defense will be all too common. How can you hold people
responsible for holes in their system while microsoft produces
software with numerous holes in it, but is not held responsible.
An interesting analogy is gun crimes. If someone owns a gun,
and it is proven conclusively that the gun committed a crime,
but it cannot be proven conclusively that the owner of the gun
is the one who pulled the trigger (opportunity), then it is
difficult to establish a case.
I think a similar idea will work itself out with computer
crime. The fact that your computer did something isn't enough,
you have to be a willing participant in the incident.
Perhaps there should be laws to punish people who leave
unpatched, unprotected computers sitting on the internet. There
are laws that punish irresponsible gun owners, should we also
punish negligent computer owners? What about negligent
programmers?
As an aside, in the last court case I was involved in, e-mail
was admissible in court. The only thing I had to do was produce
some e-mail correspondence between myself and the other party.
The lawyers and the judges all accepted them without a word.
While the e-mails were in fact real, and the transmission could
be verified by isp records, the simple fact that the opposing
council didn't so much as raise an eyebrow shows me just how
ignorant the legal system still is when it comes to technology.
This happened less than a year ago.
well (Score:4, Insightful)
on the other hand, if someone cuts your brake lines, you crash and kill someone, you are not at fault.
I would think that viruses and trojans and worms and such would fall more under the 'someone cuts your brake lines' category.
For better or worse a pretty valid argument (Score:2, Insightful)
And since there currently is no crime for keeping a computer unsecured on the internet, I doubt there is much that can be done.
Re:Innocent Until Proven Clueful (Score:5, Insightful)
Responsibility (Score:1, Insightful)
I don't know. How responsible are you for a drive-by shooting, done with your stolen car?
Same as in a car! (Score:4, Insightful)
If your computer was hijacked and you did nothing to prevent it, its YOUR fault. If you ran antivirus/firewall/whatever, then it's the fault of the hacker, and you shouldn't be held responsible.
Of course, we need a good definition of a "good faith attempt at computer security", but that's a grey legal line. Personally, I think that if a patch has been available for more than, say, 2 months, and you aren't patched, its your damn fault. If you installed a program explicitly, then it's your fault (even if it was spyware)-- the analogy, if you get super-duper-hood-attachments for your car and they fly off and impale someone, its your fault.
Of course, that sucks, but it's the only way I can see to segment culpability for crimes in this case.
Re:well (Score:3, Insightful)
Re:If this were the case... (Score:5, Insightful)
if a computer is compromised, never believe the logs.
Re:The courts will work this out....eventually (Score:5, Insightful)
Hmmm (Score:2, Insightful)
I'm waiting for a case to set precedent in this realm. What happens when grandma is on the hook for $250,000 in damages because she was judged for "willful neglect" in not actively taking responsibility to ensure that her computer was adequately protected against trojans? I feel it's only a matter of time before someone proposes that owning a computer carries the same ramifications and responsibilities as owning a gun.
I hope such a thing never actually holds up, but I still fully expect to see it proposed.
Damon,
Guilty by precedent (Score:5, Insightful)
If I have a knife and I leave it on a table, and a neighborhood kid comes over and stabs himself in the head, I'll probably get sued (and lose) even though I didn't do the stabbing.
If I leave the keys to my car and somebody steals it, drives all over town and runs over a group of teenagers, I'll probably get sued as being somewhat responsible because I provided the car (indirectly).
If I'm a parent with a house full of handguns, and my child finds one and blows his sister's head off, I'll probably end up in jail even though I didn't pull the trigger.
I can't think of too many examples where our society wouldn't sue the hell out of anyone, even if you're just a by-stander, when something goes wrong. Whether or not that's "right" or "the way things should be", it certainly is. So why should it be any different if my computer is used to do something malicious or damaging? I say stick with the established precedent and blame the computer owner, even if he had nothing to do with the crime. It might not be fair, but at least it would be consistent. We don't live in a society of fairness anyway, we live in a society of blame and accusation.
Re:Innocent Until Proven Clueful (Score:5, Insightful)
If a remote-control Trojan is on the PC, then the prosecution would have to prove that:
* The computer's owner is 133t enough to hack into a remote system, but clueless enough to allow a Trojan free rein on his own.
* Or, the computer's owner in fact installed the Trojan program on his PC for the explicit purpose of throwing off investigators.
Really you tell me how to detect a kernel level trojan on a windows box besides running your own seperate intrusion detection system that knows what way the trojan works. (So if its an unknown one you aint gonna find it). And if the person removes the trojan and overwrites itself you aint gonna find any evidence of it
Re:Innocent Until Proven Clueful (Score:3, Insightful)
Re:The courts will work this out....eventually (Score:5, Insightful)
The problem with computer crime is that the alibi part of the equation is harder for the computer owner to prove. He may very well have been actively using the computer in question that hacked the Bank of North Elbonia at the time of the crime, but that doesn't mean he did it. In spite of that, proving that he wasn't the perp is difficult. Most other alibis work because of physical bias placing the individual in some other place than the crime in question. This is harder to prove in a virtual setting.
Any hacker (cracker) with a clue (Score:5, Insightful)
As long as wireless networks remain as insecure as they are right now its going to be cracker paradise. I don't see an easy solution to the problem, it almost seems like if a hack can be traced back to your computer you almost certainly didn't commit the crime (unless you're a complete asshat).
Comment removed (Score:5, Insightful)
Actions and consequences (Score:3, Insightful)
It's a harsh position, I know, but it seems like it might work.
Re:The courts will work this out....eventually (Score:3, Insightful)
I think a better analogy is that of possession of stolen goods. I can buy a used bike, for example, in good faith from a garage sale, use it for months, then one day the police stop me and tell me that bike was stolen. How can I prove that I didn't steal it myself? How can the police prove that I am the thief and I'm lying about the garage sale? Same goes for counterfeit money.
In this analogy, one continues to perform a crime (possession of stolen goods) cluelessly, just like in the case of a trojaned computer. How does the law handle possession of stolen goods? The same procedure should apply to trojaned computers.
The issues (Score:3, Insightful)
Re:Innocent Until Proven Clueful (Score:4, Insightful)
That's right, because there is no such thing as batch jobs and scheduled tasks. Any "expert" witness the prosecution calls upon to talk about such things must be getting bribed to do so.
Re:Breaking Point Chaos and Destruction Online (Score:4, Insightful)
For example:
Staffer: "Hey, I have no idea where that child pr0n came from!"
Manager: "Look, don't make this harder than it has to be. Just pack up your stuff and we won't tell your wife or the paper."
Staffer: "But I never saw that before!"
Manager: "That's what they all say."
With a careful admin, even browser history and caches can be faked. And there's not a thing that the poor staffer could do about it.
Re:The courts will work this out....eventually (Score:3, Insightful)
> vulnerable systems on the web? I think not.
I think that day is coming.
I think we're at a point of time in computer ownership that was probably a lot like the early days of car ownership.
I'd be fairly certain that there were hardly any rules for the first few years that cars were on the roads, since there wasn't sufficient public perception that lots of rules were required. It was only after enough people got run over, enough cars run off the road, enough general havoc was wreaked that rules against this behaviour were drawn up.
I can even remember the days before seatbelts were compulsory in cars, and when you could drink as much as you liked then drive home. These rules only came in in the last 20-30 years, yet it's almost impossible today to imagine that they didn't exist all along.
As more and more home computers get hijacked and used for "bad things", legislation will start to come in making people responsible for what goes on on their own PCs. Maybe it won't be directed at end users - maybe the responsibility will be put on ISPs, or on the owners of routers that filter traffic into and out of legal jurisdictions - but it *will* be enforced regardless of whether the laws are credible or not.
If not, what will we be left with? - a mass of rogue PCs capable of bringing down major companies and financial and legal systems. No responsible government is going to allow this to happen.
You may or may not like it (personally I've got mixed feelings about it), but it will happen.
Re:The courts will work this out....eventually (Score:3, Insightful)
programmers?"
Not a fan of either. A significant chunk of vulnerable machines out there are owned by people who don't have a strong enough interest in computers to know they should be patching. Making sure your computer is secure is not as simple as putting a lock on your gun. On top of that, it's not a life or death situation. You'd be asking too much of the casual computer user.
What about negligent programmers? Nope. There's a can of worms you don't want to open. First off, whether or not somebody built something exploitable, the guilty party is still the one who exploits it. Secondly, how do you judge how negligent a programmer is? His job is to write a program that performs a task. There are a lot of security issues out there that the average programmer is not even going to consider. Who would want to contribute to the Open Source Community if one little human mistake made on their part could make them liable because of some script kiddie?
There's one more fundamental problem here that needs to be considered. Computers fail. Power surges happen. Parts wear out. Shit happens. Nobody in their right mind would put somebody's life into the hands of a computer without considering the possibility that the system won't behave as needed. If a virus or worm put somebody's life in danger because a computer wasn't doing what it should be, then where's the punishment for the dude who didn't make the system fail safely?
If you want laws passed that'll help security, try stiffer punishments for the jackasses that create these self-propogating headaches. Not only does the right person get punished, but it also creates incentive for those maintaining these machines to make sure that hacking attempts are traceable.
Re:Innocent Until Proven Clueful (Score:2, Insightful)
The only one that should be prosecuted is the creator of the software that allowed the PC to be taken over. Average Joe has no clue about securing an unsafe PC. They buy the box at BestBuy and hook it up when they come home, just like it was your average DVD player.
Analogy: If your car, parked with the breaks on, suddenly late one night decides to start rolling due to a bug in the break system and rolls over a kid who gets killed, you the owner, will not be prosecuted if investigation shows the breaks were on. They might go after the producer of the car in this case. Same for a PC.
Re:Innocent Until Proven Clueful (Score:3, Insightful)
I worked for several years as a support tech for an ISP. When Mellissa came around, most of the techs were running around like chickens with their heads cut off, while I laughed. Same thing with the Love Bug. Why? Because unlike everybody else, I used Eudora for email, not Outlook. It doesn't have the well-known security holes, so it's safe from the trojans aimed at Outlook. (OK; that's not the only reason, or the main reason I use it. But it was what kept me safe.)
The point here is, that techs are just as likely to follow the path of least effort as anybody else, and either use vulnerable software or not bother to secure what they have. Not only that, but just working as a tech doesn't mean you actually know what you're doing; I could tell numerous horror stories about techs using Reply All to ask a question about a message sent to a number of people, using "fixes" known to cause the issue to get worse, and otherwise proving that having a job as a tech doesn't make you one.
No, just proving the defendant worked in a tech field or as a tech or was studying CS isn't going to be enough, at least if the defense lawyer is any good. You're going to have to prove that he or she knew enough to have installed the trojan, had access to it and had a reason to do so. Just like with any other crime, Motive Means and Opportunity have to be demonstrated.
Guilt by ignorance/incompotence (Score:2, Insightful)
Re:Innocent Until Proven Clueful (Score:3, Insightful)
The issue I have here, is that frequently the offender is using an unprotected computer to exploit a hole in the security of the target computer. Is it really fair to assess damages against someone in favor of a victim who was equally negligent?
Re:"If a computer gets infected, no one dies" (Score:3, Insightful)
Precedence has already been set. (Score:2, Insightful)
A legal precedent for this type of defense is already set. This type of case should not be considered differently from other crimes.
If my car is stolen and later used in a bank robbery I am not culpable in any way. I was not an accomplice before, during or after the fact, I did not commit the crime. In fact, I am one of the victims. My lack of culpability remains intact weather I am aware of my care being stolen or not, and wither I report it stolen or not.
In all such cases regardless of the items used to commit the crime or how they where obtained the burden of proof lies with the prosecution to demonstrate that it was in fact the defendant who was in control of the items at the time, and therefore the guilty party.
The only complicating factor in computer cases is that the computer may be in the virtual control of one person while in the physical control of another. This has the net effect of slightly shifting the burden of proof towards the diffident; his control of the computer is implied. This is, in my opinion, unfortunate and I hope that future cases will set precedent that shifts the burden back to the prosecution.
In a truly free country the legal system must expend most of its effort keeping innocent people free, not punishing the guilty.
Naturally, a different set of guidelines exist for civil cases.
Re:Innocent Until Proven Clueful (Score:3, Insightful)
While it would be great to prosecute only the people that deliberately exploit holes in programming, your idea would do more harm than good. (Much like the DMCA...). If I write code to work around a known Windows API bug that exploits a not-quite-normal workaround, am I hacking Windows?
Re:Innocent Until Proven Clueful (Score:1, Insightful)
If someone deliberately, with intent, hacks a critical system and evidence (logs) show clearly a course of malicious actions ultimately causing loss of life or livelihood then yes, send em dowm! You should be culpable of the actual crime. It is a murder investigation inthe first place, and
only incidently a computer related crime. Come to think of what _isn't_ in some way computer related these days.
If on the other hand you deface a website the worst you should face is a $200 fine to cover the webmasters time to clean up your mess.
And - if like many of us who have stumbled across an open port, wandered in and gone
#wall 'Hey - party? You left the door open'
that should not even be an offence.
If I spot an open box these days I'm more inclined to just walk on by and leave then to the script kiddies. So much for well meaning social conscience in 2003.