Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Sarah Palin’s email hacker is imprisoned, against judge’s recommendation (sophos.com)
33 points by thedoctor on Jan 14, 2011 | hide | past | favorite | 45 comments


Instead of the blather at this blog, read the original news report here: http://www.bbc.co.uk/news/technology-12176463

The judge didn't "recommend" that he serve it in a half-way house; he just said that 'even a half-way house would be sufficient punishment' . That doesn't mean he said "it must be in a half-way house".

Also: he's been sent to a low-security prison, and not a Super-Max.


The burden of being sentenced to a prison significantly far away from your current home and family is a terrible burden, regardless of security level. The justice system understands the punitive damage of this sort of measure, and surely took this into account in sentencing.


The facts of the case are (almost) undisputed. What the guy did implicated him for several felonies. He had exceedingly good legal representation --- just read any of the court record to see that. His team managed to deadlock the jury on the most serious charge he faced. The one felony he got dinged with resulted from his destruction of evidence. And all this after (quick reminder) the guy broke into the still-active email account of John McCain's running mate during the 2008 election.

It is very, very hard for me to imagine mustering much sympathy for him. People are routinely imprisoned for computer-related crimes less blatant than this one. More importantly, people are routinely imprisoned for truly victimless crimes like "intent-to-distribute" escalations of simple drug possession. None of them have the resources this guy seems to have had.

I'm not sure the "burden" of a low-security prison far from his home is an injustice of a cosmic scale.


There's so such thing as being "dinged" with a felony. He will wear that albatross around his neck for the rest of his life.

It's not an "injustice of a cosmic scale" so it may not rise to your threshold of caring, but he's still a young man going to prison for what is essentially a prank. Have a little compassion.


This isn't a prank. This is an attempt to influence the election of the most important position in the land using felonious means. He's lucky he's only getting what he's getting, what he did is far more serious.

It is blindingly obvious that most expressions of sympathy here are because people approve of the target of the felonious actions. Had he hacked Biden's email the press would have called for his head and wrung their hands so hard about the evils of people who oppose Obama/Biden that they might have fallen off due to lack of blood flow.

But creating an environment where it's OK or acceptable to do this sort of this thing to "acceptable targets" is creating an environment where one day, you'll be an "acceptable target". Take a stand. Attempting to influence elections like this is wrong and can't be tolerated, in addition to the fact that hacking emails is wrong and can't be tolerated. Being sympathetic because you like the target is embracing the rule of men, not the rule of law.


Had he hacked Biden's blog, he probably wouldn't have found official business illegally done on a personal email.

How come Palin hasn't been charged with anything? She just resigns and people don't bother to follow up. That's fine and all, but it's a nice backdrop to this kid getting the book thrown at him.


There is immense incentive within the state of Alaska --- where Palin is extremely unpopular (in Wasilla, her hometown, her memoir is shelved at a bookstore under "Alaska Fiction") --- to charge Palin with crimes. She has been under near continuous investigation since assuming statewide office.

The only people I see suggesting that this email spool contained evidence of wrongdoing are partisan armchair legal theorists. And, for the record, I think Palin is a genuine force for evil in our country.


Is there, though? I mean, she was being investigated for a bunch of things, going after people who had p'd off her husband and such, and then it just dropped after she left office. Bush is unpopular too, but I don't see anyone going after any of the stuff that his admin did.

Meanwhile, if your email was hacked? No way the feds take the case. That's what I'm upset about, mostly. The dufus broke the law but it seems we have an entirely different standard for enforcement.

RE: evidence of wrongdoing, state business over personal email is illegal, period, and for very good reasons. This is professional ethics 101 if you've taken an oath to serve the public in elected office. If you're doing public business, it has to be on the record. It's legal not theory, it's legal fact.. if it applies to an Alderman, it applies to the Governor.


So, there are two wrongs here instead of one. So what? When did "two wrongs make a right" become the height of debate instead of a childish error?

And people wonder why I see "politics!" pouring forth from every orifice here. Put them both in jail. If that's what the rule of law demands, do it. Doesn't bother me. I want to live in a country where my elected officials do their dealings on the record as required by law and people are not allowed to break into my email merely because I am a politically unpopular target. (Thanks to the fact that I think this way, I'll never not be on the politically unpopular list if one is ever actually allowed to come into existence. Freedom's important.)


Being sympathetic because you like the target is embracing the rule of men, not the rule of law.

No. I'm sympathetic because it was a very stupid prank, not because of the target.

What was the actual damage caused? It certainly didn't "paralyze" Palin's campaign.


I have no idea where you're inferring my support of the kids actions based on his target, but please don't that get in the way of your political tangent.


See, I disagree with 'jerf and agree with you: it was a prank.

Which makes it worse.

Tens of thousands of people, many of them parents, are currently serving time in prison because they were at random selected to be among the 1% of American drug users arbitrarily selected for prosecution, and inhabited the (large) subset of those drug users who lacked the means to defend themselves once charged.

THIS nitwit went out of his way to harm somebody else for his own amusement.


Did I say anything about injustice? Sympathy is a commodity regularly dispensed to those in the wrong. The point of my comment is to explain that a low-security prison is one thing. One far away from anyone who cares about you is an added punishment. I'm not saying it's unjust, only a considerable part of the punishment worth consideration, on a human--not cosmic--scale.


Maybe the bigger question is, is this a proportional response for his crime?


No. The prosecution screwed up and hung a case on identity theft and wire fraud instead of 18 U.S.C. § 1030 or similar statute, so he is essentially serving time solely for destroying evidence.


So you think somebody who broke into an email account should serve more time if the wheels of justice are properly turning?

Would that imply then that other, clearly more serious crimes, that result in similar sentences, should have their sentences increased to be proportional?

I'm not asking to be judgmental, I'm honestly curious. In my mind, breaking into a mailbox isn't that big of a deal in most cases. But I can recognize an alternate argument such as "what if the mailbox in question contained corporate secrets worth billions of dollars".

In the former a year or more sentence seems excessive, in the later case a year would seem insufficient.


Correct. That is what I think. Incidentally, breaking into a physical mailbox is a much bigger deal, which makes zero sense to me.


Perhaps then, there should be wider sentencing leeway?

Incidentally, breaking into a physical mailbox is a much bigger deal, which makes zero sense to me.

So far, most people think that physical incursions into a person's private things are more serious than virtual incursions. Perhaps it's the physical safety aspect of it that they think is important.

For what it's worth, I think virtual privacy should be treated exactly the same as physical privacy, and sadly the law hasn't quite figured that out (I think we're in agreement on this)

But I disagree with you that punishment should always be severe. I think data shows that severe punishments do little to prevent crime, and end up just costing everybody lots of tax dollars in incarceration costs.


I agree that there should be wider sentencing leeway in general. I think much more should be left to the discretion of judges.

I do not agree --- in fact, I militantly disagree --- with the notion that physical harm should be more severely punished than virtual harm. Crimes should be punished based on the harm they cause and based on society's interests in deterring crimes. The ease with which a crime is committed should not be a factor in its sentencing.

All crimes are going to get easier to commit this century.


Ashland is about a four-hour drive from Knoxville, and federal prisons don't exactly dot the landscape like mushrooms. Feel free to look it up, but I suspect it's the closest appropriate facility to his home.


Another story on the matter:

http://www.commercialappeal.com/news/2011/jan/13/convicted-p...

If he shows good conduct, they might release him as soon as November 23rd as confirmed by his entry in the The Federal Bureau of Prisons website:

(It was a very long search URL so I shortened it) Inmate Locator - Locate Federal inmates from 1982 to present http://tinyurl.com/6cv8r93

For those interested, here is the location he will be serving time at:

http://www.bop.gov/locations/institutions/ash/index.jsp


The BBC certainly know how to choose their pictures.


from the other thread: http://news.ycombinator.com/item?id=2099885

The flip side to "I want my e-mail treated like normal mail" is that the same penalties will need to be levied. Private citizens can get in a lot of trouble for tampering with regular mail.


Just be be sure we're clear on the "crime", it was that he guessed Palin's yahoo mail security question "Where did you meet your spouse?" to which the answer was "Wasilla High".

source: http://www.wired.com/threatlevel/2008/09/palin-e-mail-ha/

He didn't even have to guess or crack a password. This is really a major security flaw on yahoo's part, which still exists. The fix in the meantime is to avoid accounts with such questions, or to answer them with random strings of characters.

Should this even be a crime? I propose that to keep something secret you should have reasonable security measures. Easily guessable security questions like mother's maiden name as used by banks should not be considered legitimate protection any more than using a bag twisty to hold a gate closed should be considered the same as a chain and padlock.


Using a bag twisty to hold a gate is considered _exactly_ the same as a chain and a padlock for the purposes of trespassing.

If it's clear to you that you aren't to enter my property, you don't enter my property and it doesn't matter how difficult I make it for you to do what you already know is wrong.

The issue here is the severity of the sentence, not his guilt, and especially not blaming the victim.


Just be be sure we're clear on the "crime", it was that he guessed Palin's yahoo mail security question

No actually the "crime" was "anticipatory obstruction of justice" for destroying evidence in a federal investigation. Actually accessing the account was a misdemeanor.

Look I think this is a stupid kid who doesn't deserve a year a in jail. But you don't get to trivialize a crime because it was "easy". Just because my neighbors door was unlocked and I "just walked in" doesn't give me the right to do so.


Inaccurate. The crimes charged were identity theft, wire fraud, and obstruction. The prosecution has broad discretion to choose what to charge. They chose poorly here. There are US felony statutes that pertain to unauthorized statutes; they require a (low) threshold of quantified damages and have a lower penalty attached to them compared to identity theft, but had he been charged with them, he'd be doing significantly more than a year in prison.


I'm actually just speaking to the charges for which he was convicted, not what he was charged with (based off the wikipedia article).


I'm just making it clear that they didn't take him to court for clearing his browser cache; they went after him for breaking into the email account, but did so hamhandedly.


It does affect the crime though and is a big difference.

If the door is closed and locked it is breaking and entering which is a felony that brings prison time.

If the door is open and unlocked it's trespassing which is a misdemeanor and will seldom get jail time.


Nope, picking a lock and entering a house and entering a house with an unlocked door is the same crime the only differences between trespass and burglary are based on the intent with which you enter and what you do once you get there. Its also a lot easier to prove intent if you break a window or pick a lock.

Do you really think a criminal who walks up to a house with a lock pick in hand and then finds the door unlocked gets charged with a lesser crime?

From Legal Dictionary's entry on "Breaking and Entering"

"The criminal act of entering a residence or other enclosed property through the slightest amount of force (even pushing open a door), without authorization. If there is intent to commit a crime, this is burglary. If there is no such intent, the breaking and entering alone is probably at least illegal trespass, which is a misdemeanor crime. 2) the criminal charge for the above."


What do you mean "nope", you just repeated what I said!


How many guesses am I allowed before it's a crime?


ZERO.

The world is not a video game.

The difficulty required to break into someone's email account has absolutely nothing to do with the legal implications of doing so. It is very possible that you could be convicted of a felony for reading mails on a passwordless email account.

Stay the hell out of other people's email accounts. Jiminy.


Exactly. (I hope you understood I was using irony.)


> Easily guessable security questions like mother's maiden name as used by banks should not be considered legitimate protection any more than using a bag twisty to hold a gate closed should be considered the same as a chain and padlock.

Related: http://i.imgur.com/rGtgr.jpg


Yes, well that's an edge condition. Hard cases make bad law.


That's ridiculous. That means that EVERYONE who has used http://codebutler.com/firesheep can go to prison.


I don't see how that's ridiculous.

Firesheep is a tool whose sole purpose is to facilitate hijacking a user's session. If you use Firesheep to gain access to a user account which you don't own, you're guilty of breaking the law.

The fact that the tool makes this easy has no bearing on its legality.

So yes, everyone who has used Firesheep to gain access to another user's account without their permission is guilty of breaking the law.


I'm well aware of that. But I think that's ridiculous, it's Internet, not your house. Even though people nowadays seem to think that you have privacy on the Internet, you don't. Do you go to jail if you open another phone in your house while your sister is talking to someone on the phone? You don't. Yes I think he did put some effort in guessing the question and took control of her account, and yes he should be punished. But jail?

That's ridiculous. He didn't deform anything, he just presented the information he had. You also break the law when you go too fast on the highway and you don't go to jail.


This isn't listening in on the phone to your sister's phone call. This is closer to listening to someone else's voicemail by guessing what their PIN number is (also not legal).

There are things which are yours, and there are things which are not yours. In many instances, accessing things which are not yours without the express permission of the actual owner is a crime.

And I'm not going to argue with you if you're saying that the sentencing for computer-related crimes is ridiculous. I agree, I think it's totally out of whack (like a lot of sentencing in this country).

And depending on how fast you are going on the highway you do indeed go to jail (most jurisdictions will charge you with reckless driving).


Firesheep is a tool to enable the easy theft of credentials. If you think it's legal, I don't know what to tell you.

The thing about Firesheep is that it is inherently difficult to figure out which of the 30 people in the coffeeshop hijacked your session. It's not exactly as if they have a separate IP or something. Just because it's hard to get caught doesn't mean that it's okay to do, though.


"Palin went on to claim to the court that the email hack paralysed her campaign to become the USA's first female vice president."

Palin has done 100x worse than this kid, but she doesn't get caught because she paralyzes other candidates campaigns the legal way. By not getting caught when dredging dirt on other people's campaign. However Palin was still unsuccessful because now we have a muslim Kenyan extremist turban-wearing islamic terrorist fist-bumper as president.


Yes. That is how it works. When you do things the legal way, even if they are evil things, you tend not to end up in prison. On the other hand...


If this was really the tipping point for keeping that lunatic out of public office I would have done it myself.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: