EBay Hacker's Conviction Upheld 174
An anonymous reader writes "The 9th Circuit Court of Appeals has ruled in the case of Jerome Heckenkamp, the former University of Wisconsin student convicted of federal computer crime charges in 2004 after hacking into Qualcomm, Cygnus Solutions and other companies, and defacing eBay. Heckenkamp was caught after a system administrator at the university hacked into his Linux box to gather evidence that Heckenkamp had been attacking the college mail server. The court ruled today that such counter-hacks are allowable under the 'special needs' exception to the Fourth Amendment, and upheld the warrantless search."
Correct decision (Score:5, Insightful)
The University acted to mitigate and prevent further intrusions, the scale of which were as yet unknown, into critical University servers and infrastructure upon which tens of thousands of people and many diverse University functions depend.
If you hack University servers from your computer (or even if the computer is being used a zombie), and then take steps to hide your identity or otherwise conceal your activities, your network access will be removed, such removal will be actively enforced and verified, and any immediate actions required to protect the security and integrity of the University network and computing resources will be taken.
Academic, legal, and possible criminal action will then follow, as warranted. These were exigent circumstances, and not done under the guise of law enforcement, but rather the protection of critical university resources from activities clearly and explicitly disallowed by numerous University information technology, housing, academic, and general policies (not to mention various federal and state laws).
Also, while we're on this topic, if the situation were reversed, I can imagine slashdotters would hardly call the equivalent situation a "hack" (i.e., "the university hacked into his Linux box"). Using the typical logic, he apparently didn't protect his machine well enough, so it's okay, right? Oh, but he's on the malicious side, so he's right, and the University trying to protect itself, from someone violating just about every University policy with no expectation of privacy on the network of a public research university, is wrong?
Let me know when you people get your stories straight.
And please, RTFA:
Here, Savoy provided extensive testimony that he was acting to secure the Mail2 server, and that his actions were not motivated by a need to collect evidence for law enforcement purposes or at the request of law enforcement agents.
Under these circumstances, a search warrant was not necessary because Savoy was acting purely within the scope of his role as a system administrator. Under the university's policies, to which Heckenkamp assented when he connected his computer to the university's network, Savoy was authorized to "rectif[y] emergency situations that threaten the integrity of campus computer or communication systems[,] provided that use of accessed files is limited solely to maintaining or safeguarding the system." Savoy discovered through his examination of the network logs, in which Heckenkamp had no reasonable expectation of privacy, that the computer that he had earlier blocked from the network was now operating from a different IP address, which itself was a violation of the university's network policies.
This discovery, together with Savoy's earlier discovery that the computer had gained root access to the university's Mail2 server, created a situation in which Savoy needed to act immediately to protect the system. Although he was aware that the FBI was already seeking a warrant to search Heckenkamp's computer in order to serve the FBI's law enforcement needs, Savoy believed that the university's separate security interests required immediate action. Just as requiring a warrant to investigate potential student drug use would disrupt operation of a high school
Re: (Score:2, Insightful)
Re:Correct decision (Score:5, Funny)
Re:Correct decision (Score:5, Interesting)
Can you guarantee that the System Admin didn't plant the evidence or the evidence was otherwise compromised? Well, now here is the problem, since you said you can guarantee it, that anyone that is called a System Admin is now allowed to plant evidence and vigilantism rules the internet.
Re:Correct decision (Score:4, Informative)
It also is very protective of personal and individual rights, liberty, and privacy, and does not err on the side of law enforcement or the state. It is probably statistically the most likely court to rule against the interests of the government and for the interests of the individual.
This one's not going to be overturned.
Also, you should really, really read the ruling [uscourts.gov].
There they go again (Score:2, Insightful)
Re: (Score:2)
You statement should be more to the effect of, Those darned liberals, always giving false hope up to individuals by inferring rights the don't really have. As i mentioned before, If the right was there, the other courts would have agreed with it. So the individual didn't have a right in the first place.
Re: (Score:2)
Re: (Score:2)
One is that there are more judges. Another is that the judges only have to consider the context of the ruling alongside the law and constitution. Another is that once removed from the drama of the case, you aren't tied up in it and subconsciously rooting for one side or another.
But more importantly, they have the final say in the matter. If they didn't find the right then the lower cou
Re: (Score:2)
That is why I generally distinguish (at least in my own head) between legally protected rights and
Re: (Score:2, Insightful)
Most evidence has to be authenticated by the person that recovered it. Just like if a store security guard see you shop-lifting, stops you and searches you, anything he finds, such as a bag of coke, you can be prosecuted for. How do we know he didn't plan it? He has to take the stand, swear to it, and then be cross-examined. That is how our system works, mostly.
Re: (Score:2)
You just missed the little fact about due process.
Re:Correct decision (Score:5, Interesting)
Problem with your logic there. If the University thinks being hacked is wrong, then why do they think hacking someone else is right? Two wrongs don't make a right. The hacker is a criminal, and the University (employee that did the hacking) is a criminal. It's that simple.
Re: (Score:3, Insightful)
And the fact that this user agreed that SysAdmins may take steps to end emergency situations doesn't immediately say to me "oh, they can then hack my machine to hand over my personal files to the government without a warrant."
To me that sa
Re:Correct decision (Score:4, Informative)
Also, at the time that this incident occurred, there wasn't an integrated capability to block MACs on the Housing network by the central IT organization, for various reasons. The most immediately available option was blackholing the IP, which was done, at which point the user simply manually assigned himself an unused IP on the DHCP network and continued malicious activity. The central IT organization does not operate the Housing network, and also didn't have immediate capability to physically disable ports in dorm rooms.
Today, we have all of those capabilities. Then, the only option for dealing with a very critical situation was taking all steps to actively ensure and verify that this computer did not come back on the network during the evolving emergency situation occurring over a very short period of time.
Re:Correct decision (Score:5, Interesting)
Additionally, whether the University had the means to sufficiently control its network is also not relevant to whether they had the right to break the law -- unless the man in question specifically allowed hacking into his computer by agreement. Did he do so?
IANAL, but I wouldn't be terribly surprised to see a lawsuit against the university over their actions. Frankly, I'm rather surprised no one has been charged with hacking the man's computer. Perhaps it's being "overlooked" due to the obviously bad actor involved -- but IMHO it shouldn't be. OKing this sort of vigilantism is a pretty dangerous thing to do, on many levels.
Now that I've read the ruling.. (Score:4, Informative)
Re: (Score:2)
This guy needs to go to jail because he's too stupid to not get himself hurt crossing the street.
Durrrr.....
Re: (Score:2)
This, however, was.
Your beef isn't with me. It's with the 9th Circuit Court of Appeals, which routinely upholds personal rights and privacy, and often sides against government interest. And yet, it still found this action appropriate.
Extremely poor use of car analogies, by the way.
Re: (Score:2)
The University was clearly correct in taking steps to ensure that the network access of the offending computer, in violation of numerous University policies and actively putting critical systems and services in jeopardy to unknown scope, was terminated and remained terminated in an emergent situatio
Re:Correct decision (Score:5, Insightful)
Even if access to the room were not possible, they could have simply gone down to the router, pulled the plug on that room, and called the police.
Illegally counter-hacking the attacking computer (which also was likely to taint any evidence in the system) was *not* necessary under the exigent circumstances.
Re: (Score:2)
Re: (Score:3, Interesting)
There were a limited amount of things that could be done centrally. One of them was blackholing IPs. Physically disabling the port was also not possible in a timely manner.
After a 5-year, $50 million network upgrade, a lot of these things people are suggesting from their armchairs are now possible. But they weren't then. This was an IMMEDIATE situation that required emergen
Re:Correct decision (Score:4, Insightful)
No, the only person with an armchair problem was that guy who couldn't be bothered to get out of his and make an appropriate response to the incident. Instead, he went the lazy/fun route, kept his butt firmly planted in his chair, and took matters into his own hands as a vigilante. Now 300 million Americans have just seen their bill of rights eroded by yet another increment because the university had to set new legal precedents to cover their asses from the fallout of this poor decision.
No matter what, they could have blocked access from the entire dorm for the hour or two that it would have taken to sort out the problem legally. If their network management was sooooo crappy that even that couldn't be done, they should have just turned off their own goddamned mail server to protect it from this omnipotent hacker that was apparently impervious in his dorm room a couple of blocks away. Committing new federal felonies as a first option was not the answer.
Re: (Score:2)
Re: (Score:3, Insightful)
I'd saw remotely unplugging the room at the router is probably better than entering the room and unplugging the computer.
That way the admin would never obtain *physical* access to the computer (e.g. this removes a tiny amount of doubt that he could have tampered with the computer, e.g. with a boot disk/cd before the police arrive ).
Re: (Score:3, Interesting)
Cutting off his network access wouldn't have been able to happen immediately. The central IT organization does not operate or have physical access to the Housing network. The only option, at the time this occurred, was blackholing the IP and ensuring insofar as was possible that the same computer not reappear on the network and continue malicious activities.
Today, after a 5-year, $50 million network upgrade, there are numerous options for blocking MACs, remotely disabling network ports, and so on. None
Re: (Score:3, Insightful)
If the University thinks being hacked is wrong, then why do they think hacking someone else is right? Two wrongs don't make a right. The hacker is a criminal, and the University (employee that did the hacking) is a criminal. It's that simple.
Scenario:
You are at the mall and some psycho starts shooting everyone in sight with an AK-47. You work in the mall as an armed guard. If the mall thinks being shot at and killed is wrong, then why do they think shooting someone else is right? Two wrongs don't make a right. The shooter is a criminal, and the mall security guard is a criminal. It's that simple.
Re: (Score:2)
There are specific laws involved in self defense, as well as laws that govern people who carry weapons as part of their job. The two situations simply aren't c
Re: (Score:3, Insightful)
The sysadmin initially blocked the port and called it good, probably with the intent to inform management and let them deal with it. One could argue that "I pay tuition and I was blocked illegally" but nobody here is saying that violated any rights.
Blocking was not sufficient to prevent the attacks, so the sysadm escalated his effort. That is a
Re: (Score:2)
Re: (Score:2)
The ruling in question didn't address whether hacking the man's computer was right or wrong under the law.
However, unless the terms of service directly allows an admin to obtain unauthorized access in the name of protecting the network, I would bet the "terms of service" argument wouldn't hold up.
To me, the factors that would save the university sysadmin are the extremely limited nature of the break-in, as evidence for the purpose of that break-in, and the ci
Re:Correct decision (Score:4, Interesting)
Re: (Score:2, Informative)
Re: (Score:3, Insightful)
Do you see a pattern here? Sometimes in order to protect yourself, illegal actions don't
Re: (Score:2)
yes, clearly you have no idea how to keep an anology in context.
Re: (Score:2, Insightful)
I'm not sure how connecting to someones network gives them the
Re: (Score:3, Informative)
It also held that the emergency search fell under the doctrine of the "special needs" exemption to the Fourth Amendment.
These two principles were balanced, and special needs won out.
I really wish people would read the ruling [uscourts.gov], as it speaks in great detail about the principles of privacy, expectations thereof, why the search was acceptable in these circumstances, and so on.
Re: (Score:2)
Speaking as one who has read the ruling, I'll simply note that it applied to whether or not the evidence was admissable (a matter of law, as this is an appeal), not whether the university was right to hack the man's computer. In fact, reading the ruling, it would appear that that might not be the case.
However, I would also imagine that the limited nature of the search and the circumstance
Re: (Score:2)
Re: (Score:3, Interesting)
Again, this was specifically for the purpose of determining the admissibility of the evidence. The 9th Circuit was addressing an appeal, so could only rule on matters of law pertaining to that appeal.
Whether or not the university sysadmin would be convicted under the circumstances is a fairly open question, if he were charged with unauthorized access of a computer system. Now that I've read the ruling and the facts considered, it cert
Re: (Score:3, Interesting)
I understand that this ruling is only speaking to the conviction that is unrelated to the University efforts with regard to ensuring this computer remained off the network.
However, since special needs only applies to the explicit and direct action the University took, while this ruling is speaking specifically to the appeal of the conviction, it is still reasonable to believe that the action itself would be viewed legal upon consideration of that action
Straight Stories (Score:2)
Re: (Score:2)
As I read it, and given the fact that this story appears to be regarding an appealed ruling, the 9th Circuit was simply upholding the admissibility of the evidence obtained through the university's hacking. It wasn't ruling as to whether the University had the right to hack, or whether they ran afoul of the law in the process.
IANAL. That said, I would bet what the university sysadmin did ran afoul of at least one computer crime law. Whether or not he'd be convicted or suffer le
Re: (Score:2)
because the4 contitution should only be upgheld if it's conveniant.
Re: (Score:2)
"Let me know when you people get your stories straight."
Yeah, because we, the collective Slashdot posters, have an oligation to you to speak with one voice. We ought to ensure that everyone in our midst presents the same argument. If they disagree, we ought to silence them so they will not disturb the unified presentation. We are Borg of Slashdot.
Seriously, either talk to specific people
Re: (Score:2)
Re: (Score:2)
This was. And the 9th Circuit agrees. It probably wouldn't have agreed that murder was an appropriate response, whereas this intrusion for protective purposes was, on balance.
Read the ruling [uscourts.gov]. It's pretty informative.
Re: (Score:2)
Re: (Score:2)
The articles give a pretty vague picture of what happened though, because they say the passowrds to the
Re:Correct decision (Score:5, Informative)
You may be interested in reading the entire ruling [uscourts.gov].
The applicable bit:
Once a court determines that the special needs doctrine
applies to a search, it must "assess the constitutionality of the
search by balancing the need to search against the intrusiveness
of the search." Henderson, 305 F.3d at 1059 (citing Ferguson,
532 U.S. at 78). The factors considered are the subject
of the search's privacy interest, the government's interests in
performing the search, and the scope of the intrusion. See id.
at 1059-60.
[...]
The district court did not err in denying the motion to
suppress the evidence obtained through the remote search of
the computer.
[...]
Here, even without the evidence gathered through the
allegedly improper search, there is sufficient information in
the affidavit to establish probable cause. The affidavit recited
evidence that the server intrusion had been tracked "to a campus
dormitory room computer belonging to Jerome T. Heckenkamp";
that "[t]he computer is in Room 107, Noyes House,
Adams Hall on the University of Wisconsin-Madison"; and
that "Heckenkamp previously had a disciplinary action in the
past for unauthorized computer access to a University of Wisconsin
system." This was sufficient evidence to obtain the
warrant to search "Room 107, Noyes House, Adams Hall."
So, the search warrant exemption applied, and even without the information in question, there was, regardless, already sufficient information for a search warrant.
Re: (Score:3, Insightful)
I cannot find the quote but I think they hold over 60% of the overturns the supreme court has done in the last 20 or so years. They tend to have what some would call "activist decisions" and have been questioned about which constitution they were looking at when deciding some cases in the past. The tend to have a liberal interpretation of the laws too.
Re:Correct decision (Score:5, Informative)
Re: (Score:2)
No court is immune from bad decisions - even SCOTUS. Whether a court leans towards private interests, corporate interests, left, or right shouldn't matter to the people - as long as ALL of the courts aren't leaning in one particular direction (one that is unfair to
Re: (Score:2)
I don't think we need to go that far. It is somet
Re:Correct decision (Score:5, Insightful)
And since there's an entire huge section in Wikipedia and over 1 million hits on google for "9th circuit liberal", regardless of "how much" it's true, there is no denying that, among all appeals circuits, the 9th is the "most" liberal.
But in this case, it's so clear cut that the University acted properly, it wasn't difficult for the court to rule on the side of the University's actions.
The point is, the court most likely to overturn the conviction didn't. And therefore, it's reasonable to believe this is how it will remain.
Re: (Score:3, Interesting)
What recourse does the person have if the Admin planted evidence?
This may or may not be the case here(probably not) but we know how petty people who illusions of power can behave, espcially in college.
Re: (Score:2)
Concerning the banks (Score:2)
Did they really 'hack' the system over the network (Score:2)
Or do you have expectation of privacy in your dorm room, but not in your computer....
Re: (Score:2)
So while the University was within their rights I am not as certain that the conviction was valid. I will give an example that might help show why I would be hesitant to accept this type of behavior: so lets say that a bank wants to do the "right thing" and starts searching all its records for odd behavior in their customer's records and reporting them to the police. Would this be a valid action?
In the USA banks already do this under the Bank Secrecy Act[1]. So I guess the answer is yes.
[1]http://en.wikipedia.org/wiki/Bank_Secrecy_Act [wikipedia.org]
Re: (Score:2)
Re: (Score:2, Funny)
DUH!
Re:Question (Score:5, Funny)
Re: (Score:2)
The ruling [uscourts.gov] answers all of your concerns.
Don't be so sure it was illegal. (Score:2)
Re: (Score:2)
Students and everyone else using University network and computing resources agree to abide by the University's policies on appropriate use of these resources.
While one might argue that if the RIAA believes its interests critically need to be protected, why wouldn't they be able to use the same tactics? But the RIAA has no standing with the University or its students in that manner. They have a general legal standing to prot
Re: (Score:2)
Re: (Score:2)
I should have said (and, believe it or not, actually intended to say) "some slashdotters", not "slashdotters".
Re: (Score:3, Informative)
Re: (Score:2)
Just as requiring a warrant to investigate potential student drug use would disrupt operation of a high school, see T.L.O., 469 U.S. at 352- 53 (Blackmun, J., concurring in the judgment), requiring a warrant to investigate potential misuse of the university's computer network would disrupt the operation of the university and the network that it relies upon in order to function.
[...]
The district court was entirely correct in holding that the special need
Re: (Score:2)
This is pretty much the only article I've paid any attention to...
Re: (Score:2)
I'm also not at work from 9:00:00AM to 5:00:00PM every day, either.
Yet, somehow I manage to work more than 40 hours a week.
Re: (Score:2)
But various IT components (in fact, many components) of the University don't have specific start and end times for work hours, as some clerical and administrative positions may.
You are expected to do your work, be available in the office and for meetings and other duties as dictated by your job, fulfill your job responsibilities, report your hours accurately, and so on. But that doesn't mean non-work-related or quasi-work-related acti
Re: (Score:2)
Fourth Ammendment? (Score:2, Redundant)
So, does it fit? What was the evidence before the hack? IANAL, just curious.
Re: (Score:2)
and even if it was the government, there is probably case law that says a warrant can be given out after the fact if the government can prove they had proof or a compelling reason to gather this evidence at that time and getting a warrant would take too long, etc. it's like if a police officer arrests you without an arrest warrant
Thank God (Score:4, Interesting)
Now I don't feel so bad about killing those zombies that keep trying to ssh into my box.
"special needs" section? (Score:2)
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Um, there isn't a "special needs" section of the Fourth Amendment. Is it too much to ask Slashdot editors to assume some journalistic responsibility?
What? (Score:4, Funny)
So suddenly the retarded aren't protected by the bill of rights?
This is preposterous!
Implications for RIAA/MPAA lawsuits (Score:4, Insightful)
Not at UW... (Score:3, Informative)
University of Wisconsin-Madison Bucks RIAA
http://slashdot.org/article.pl?sid=07/03/20/015121 6 [slashdot.org]
UW to RIAA: No way
http://badgerherald.com/news/2007/03/21/uw_to_riaa _no_way.php [badgerherald.com]
It may be illegal...
http://www.doit.wisc.edu/news/story.asp?filename=8 12 [wisc.edu]
Re: (Score:3, Informative)
Well, one reason is that apparently this guy was connected to the university's network. He was using it to actively hack other systems, which is more clearly an "emergency" tha
Re: (Score:2)
Cuts both ways (with the general interpretation you make). If they try to break into your box and you didn't do anything wrong, then *you* would then be allowed to break into their machines... Then again, I'm pretty sure there are lots of restrictions.
Excellent (Score:2, Insightful)
Counter-hacking (Score:2)
But what if that evidence had not been there? Would the so-called "counter-hack" have been a punishable offense had the target turned out to be innocent?
It'd be fun if you could hack anyone you wanted at that University as long as you're looking for evidence of wrongdoing.. especially since all the skills you'd need to hack into a box
Forensics Anyone? (Score:5, Insightful)
Is anyone familiar with forensics? "Hacking" into another machine alters a ton of stuff..even if you're just logging in remotely with username/password you found. You've change login dates, profiles, logs, etc. How would this sysadmin have known this machine wasn't already compromised and was just being used a launching point?? If this was the case and the guy adamantly denied having been a part of it, he would have essentially *ruined* any and all evidence. This is just rediculous.
Re: (Score:2)
On another note, The courts have in the past allowed evidence that was obtained illegally but not by a law enforcement officer or officer of the courts (including anyone acting on their behalf). It is assumed that the evidence would become public knowledge if the illegal act went to trial and then become fair game. And seeing how the constitution primarily re
Re: (Score:2)
Sure you do (Score:2)
Not even a close question. (Score:2, Insightful)
Just to hammer things home, if a thief breaks into your house and then turns in evidence of illegal doings over to the
Too Bad... (Score:2, Flamebait)
Wrong. (Score:2)
"superhacker??" (Score:2)
I've said it before and I'll say it again, the only things that anyone is ever punished for in this world are being unpopular and being incompetent. This punk defi
Can't have it both ways (Score:3, Interesting)
I'm not defending the 'ebay hacker', but I think if he's in trouble then the sysadmin should be as well. There are a lot of physical solutions to cut off someone's net access if you have control of their building, in the event that you can't handle it on the technological side. The responsible thing to do if neither of those options were available would be to remove your server from the net, or actually make your system secure, and report the attacker through the proper channels.
And to all the people defending the sysadmin as justified, I would like to know why - if he thought blackholing the first ip was enough at the time - did he bother to find a working password on the system in question, and what methodology did he use to do that? Seems like he's just using the second attack as a CYA to hide his proclivity to hacking students machines when he wants to. (If you RTFA it says that he used a password from the first time to log in the second time and snoop around to verify it was the same computer)
Too bad (Score:2)
Re: (Score:3, Insightful)
Regardless, as a former residential network admin at my college, I fully understand the position of the university. All students on my previous campus, anyway, were made to sign a use agreement prior to connecting their computers to the network. That agreement ensured the university's authority in main
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)