Imagine being [1]prosecuted and fined , not for password hacking, but just for typing “../../../” into your browser’s address bar.

[1] https://www.theregister.com/2005/10/11/tsunami_hacker_followup/

When non-nerdy judges meet people arguing over tech things, those mystical boxes of woo-woo that are never wrong (*), it can be hard for them to sort out who is culpable. If the guy had the password then clearly he took it from somewhere, right? The idea of dropping a file into an editor and reading a plaintext password built into it would be little more than gibberish.

Maybe courts attending to tech matters should be obliged to demonstrate a prior level of understanding of the sorts of issues that could arise?

* - one word: Horizon.

Summarised perfectly by the astoundingly insightful Not the Nine O'Clock News team, all those years ago...

https://youtu.be/9VgwxKW0J6I

I knew exactly which clip that link was for. Still went for a view cos it still makes me laugh 40 years later!

Missing the point completely by the astoundingly popular Not the Nine O'Clock News team, all those years ago...

If you understand how courts work you know that judges are required to ask these kinds of questions to make sure the jury understand what is going on.

I thought this was the Tory back bench for a moment!

Great clip!

In that specific case, it doesn't seem to be a problem with the law, but rather with the judges themselves. Remember that the first decision was found in favor of the consultant.

The second one is very unlikely to stand. Let's be patient and keep an eye on the evolution of the case. Hoping that ElReg will report again, even if the appeal decision is not shocking as this one is.

The problem is geeky types like to find pedantic reasons why a password isn't a password but judges are wise and usually old, and the law older still, so they see straight though it. Nobody is not calling it a password because it is one, and a straightforward translation to bricks-and-mortar ethics says you don't have permission to go inside someone's house just because you find their front door key lying around outside for anyone to access. I'm not at all familiar with the interpretation and nuance of German law but a quick glance at the code in question says you shouldn't try to use passwords you know you don't have permission to use, regardless of how you came across them, and how tempting it is.

It is harsh, and very arguably the company should be prosecuted for terrible security practice too, but you can see in an age where there's a legal responsibility to report data breaches an ethical hacker creating a data breach in many cases won't be that much less of a headache that a non-ethical one doing it.

"straightforward translation to bricks-and-mortar ethics"

I pass by a warehouse where the key is stuck in the lock on the door outside. I open the door to go inside and shout "Hallo, anyone there? You left the key in the lock!!". What that would usually result in is a "Gosh, thanks, I forgot that" - not a police report for trespass, and certainly not even a prosecution let alone a conviction.

"Hallo, anyone there"... No one is there. So you take it upon yourself to rummage through a filing cabinet containing 'extensive customer data from the online stores operated by Modern Solution's clients'.

Is that okay? Or should a genuine security researcher be expected to know when to curb their curiosity?

An only slightly generous reading of the law says he might have been okay if he'd connected to the database, thus confirming the password worked, and then immediately disconnected without even listing any tables etc. That would be closer to your scenario.

One would like to think that in similar cases that prosecution was not "in the public interest" but ....

but a quick glance at the code in question says you shouldn't try to use passwords you know you don't have permission to use, regardless of how you came across them, and how tempting it is

So the law is saying, 'Just because you can, doesn't mean you should.'

But which is going to be worse in the long term?

1. Someone finding and using that plain text password to access the systems and potentially steal information which would critically affect that companies reputation and possibly cost them a lot of money?

2. Someone finding and using that plain text password to access the systems, recognising what has happened and going no further, and then telling that company they are doing their security wrong?

There's a serious lack of common sense here.

If you read the blog where the data was leaked it's clear there is an attempt to damage the company's reputation. It's not clear what the relationship between the security researcher and the blogger is, but you can kinda see where the paranoia about a competitor comes from or at least why that becomes a plausible smear the company then uses.

I suspect it's more likely just typical hacker hubris ('Haha we pwned you but it's okay because as well as telling the world about it and sharing screenshots of customer info, we also emailed you how we did it"). Personally I'm all for giving professional-acting security researchers some leeway, ideally written into law (in the UK the public interest test is probably sufficient, except for the thorny issue of Post Office style private prosecutions), but clearly there has to be limits and where there are limits arrogant types will occasionally cross those limits.

And regarding Horizon, just read what a judge is capable of understanding, at least is expert witnesses have provided evidence:

https://www.judiciary.uk/wp-content/uploads/2022/07/bates-v-post-office-appendix-1-1.pdf

Remember folks, the first thing we do is shoot the messenger.

I feel like the word “reasonable” needs to get into these laws. Is it reasonable for me to be able to type admin/admin on my ISP page to make sure they’re not fucking idiots and my data is safe (ish)? I think so. Does it constitute hacking to go down to my local council office and walk in the front door without an appointment? No. It’s not breaking and entering if all I have to do is push the door open, that’s a failure of the institution to secure the important public assets.

Where we draw the line on reasonable, is what judges are for, but we can’t just have: you were not authorized therefore you’re a criminal. If I didn’t see any indication of security that would prevent me from walking in, how was I to know I wasn’t allowed? If there is a note by the door that says “door code is 1111”, I mean, I just think a receptionist has left that there as they can’t be assed to open the door. You’re telling me I’m not allowed to read a note and make a reasonable interpretation?

If I found a text password in a dodgy exe, who’s to say I can’t save myself a heap of trouble and just bypass that exe to get *my* data without all the trouble? If I didn’t know the origin of the exe, I could well assume it was built specifically for the client who’s brought me in to make it work (get the data)!

What constitutes a password, by the definition of the law? admin/admin is secure then? or would the judge call me a criminal for that specialist hacking knowledge?

Bit different from walking into a building. I think one can reasonable expect the local community to adhere to the principle that they shouldn't enter unauthorized areas. One can also, obviously, apprehend and prosecute such people easier if they're in your jurisdiction.

With the internet you are exposed to all walks of life. Including those from enemy countries over whom you might have no jurisdiction. Not like anyone can do much about North Korean hackers. In this case, one should reward people that identify vulnerabilities in your systems (assuming they did not exploit those vulnerabilities).

In my opinion, this is how one can identify companies that actually care about security and those that just do the bare minimum required by law.

assuming they did not exploit those vulnerabilities

He did that though, that was his mistake.

This reminds me of the "Johannesburg job" - city of Johannesburg's billing system had a flaw (URL manipulation) which was not fixed even when reported.

Chap who discovered it, went public with the knowledge, and a whole host of curious types visited the CoJ website and had a shufty at the URL manipulation thing. In desperation CoJ shut the webserver down.

City threatened with legal and court action, but nothing came of it.

But they fixed the vulnerability.

Seems like security consultants now have to toss a coin and decide on whether to report a vulnerability and risk getting taken to court, or keep quiet about it and hope it never get abused...

Well it certainly seems that security consultants in Germany will need a signed contract from their client giving them permission to do a security review of their website.

Given how Modern Solution reacted in a very Dark Ages way, I doubt that that would happen.

So the solution is triple the fines for companies who shoot the messenger, then get their databases hacked by some miscreant.

If a district court in Germany is similar to anywhere else, they deal with low-level everyday stuff like speeding tickets and shoplifting. I'd hardly expect a district court judge to have a grasp of IT security, although FTA it seems like they made the correct decision (for whatever reason) originally but a higher court told them to look again.

Time for an appeal...although appeals cost money.

The higher court looked again, but forgot to ask the right questions.

I sincerely hope that the appeal will succeed, that Modern Solutions will be found guilty of negligence and fined for all court costs and an indemnity for abusing the hacker's good faith.

Screw them then. Next time just post the damn thing somewhere and let them get screwed. This is what happens when good people try to the right thing. No more mr nice guy!

Modern Screw-up, more likely. They can hardly claim blaming the messenger is modern, after all