DoJ ‘very disappointed’ with probation sentence for Capital One hacker Paige Thompson
- Reference: 1664947866
- News link: https://www.theregister.co.uk/2022/10/05/paige_thompson_sentence_doj_unhappy/
- Source link:
Thompson infamously [1]raided cloud storage buckets operated by financial services company Capital One and made off with over 100 million individuals’ personal information, in addition to other data heists.
Capital One was [2]fined $80 million for its lax security and Thompson was [3]convicted of wire fraud and unauthorised computer intrusions.
[4]Capital One: Convicted techie got in via 'misconfigured' AWS buckets
[5]Senators Wyden and Warren sic trade lapdog on AWS over Capital One hack culpability
[6]Capital One 'hacker' hit with fresh charges: She burgled 30 other AWS-hosted orgs, Feds claim
Reports from the Monday sentencing hearing suggest Judge Robert S. Lasnik was moved by Thompson’s statement that she hopes to make positive and meaningful future contributions to society but was disappointed not to have received a letter admitting culpability.
The judge also reportedly stated the sentence he imposed was based, in part, on his belief Thompson will not commit further crimes.
Judge Lasnik, upon sentencing Paige Thompson to probation, said he's putting his reputation on the line that will not commit any further crimes. “If that does happen, I’ll admit my mistake. I believe in her, and believe she will prove this is the right sentence.” — Amy Miller (@Siliconlaw) [7]October 4, 2022
The US Department of Justice has also [8]stated that Lasnik said time in prison would be particularly difficult for Ms. Thompson because of her mental health and transgender status.
“While we understand the mitigating factors, we are very disappointed with the court’s sentencing decision. This is not what justice looks like,” [9]said U.S. Attorney Nick Brown. “Ms. Thompson’s hacking and theft of information of 100 million people did more than $250 million in damage to companies and individuals. Her cybercrimes created anxiety for millions of people who are justifiably concerned about their private information. This conduct deserves a more significant sanction.”
[10]
Prosecutors sought a sterner sentence, arguing in a sentencing memo that “…Thompson’s crimes … were fully intentional and grounded in spite, revenge, and wilful disregard for the law.”
[11]
“She exhibited a smug sense of superiority and outright glee while committing these crimes…. Thompson was motivated to make money at other people’s expense, to prove she was smarter than the people she hacked, and to earn bragging rights in the hacking community.” ®
Get our [12]Tech Resources
[1] https://www.theregister.com/2019/07/30/capital_one_hacked/
[2] https://www.theregister.com/2020/08/07/capital_one_fine/
[3] https://www.theregister.com/2022/06/20/captial_one_wire_fraud/
[4] https://www.theregister.com/2022/06/20/captial_one_wire_fraud/
[5] https://www.theregister.com/2019/10/24/wyden_warren_amazon/
[6] https://www.theregister.com/2019/08/29/capital_one_fresh_hack_charges/
[7] https://twitter.com/Siliconlaw/status/1577370943470841861?ref_src=twsrc%5Etfw
[8] https://www.justice.gov/usao-wdwa/pr/former-hacker-sentenced-stealing-computer-power-mine-cryptocurrency-and-stealing
[9] https://www.justice.gov/usao-wdwa/pr/former-hacker-sentenced-stealing-computer-power-mine-cryptocurrency-and-stealing
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yz1VwqZNN74azz13@bH1wQAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yz1VwqZNN74azz13@bH1wQAAAM4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://whitepapers.theregister.com/
Re: Whose fault is it?
Well, the company certainly has something to answer for, but it's still the fault of the hacker.
If I leave my front door unlocked, that doesn't make it OK for you to come in and rob the place.
Re: Whose fault is it?
The bank must, by law and by expectations, lock the door so your analogy is wrong. Everyone is guilty in this case but there's hardly any punishment.
Re: Whose fault is it?
Nice victim blaming. Something the IT industry is all too good at and needs to grow up about.
Disappointed with whom?
The hacker does porridge, those responsible for security but put all that data in a "cloud bucket" (read a third party computer that was not properly secured) do not. Which is what justice looks like?
It's the fault of the hacker, no question.
The fact someone "promises" not to commit future crimes doesn't change the fact that they already committed a crime they should be properly punished for, especially in light of the millions of people affected by this yahoo.
Well, that kinda raises all sorts of philosophical questions. What is justice, and what, ultimately, is the point of it? How does it relate to courts and the penal system? What exactly is the judge's role, and who are we to second guess their decision?
If you really want to get into that, this probably isn't the right forum for it.
But now there's the "get out of jail" card - mental status, gender status, etc. - we all should be equal before the law - but when committing crimes someone immediately starts to assert they are "different" and should not bear the consequences of their deliberate actions.
Your "equal" or not "equal" - unless you're a Schrödinger's cat you can't be both.
"the sentence he imposed was based, in part, on his belief Thompson will not commit further crimes"
So, a judge with a touch of naiveté.
How touching.
Whose fault is it?
> millions of people who are justifiably concerned about their private information
Is that the fault of the hacker, or the host company that cheaped out on bad security?
Since the sanctions were probation and an $80m fine, respectively, it seems to me that the judge's message was clear - if somewhat naive the sentence he imposed was based, in part, on his belief Thompson will not commit further crimes.
As it is, a fine of $80m for losing the data of 100million people sounds remarkably low. That places a value of only 80¢ on each person's "justifiable concern about their private information".
Shall we see the company making good the $250million of damage done? Or was that an exaggeration for effect.