Re: [Full-disclosure] Vulnerabilities in *McAfee.com



I should clarify my use of "intent" in previous replies -

The "intent" part of the process would be from the judges point of view even in the absence of "concrete" evidence. As you know, actual court cases are not what we see on TV, and the judge has far more power than one may think. Even if the defense argues that the actions by the defendant were acceptable, if the judge thinks that the intent of the individual was to exceed access, then they are hosed.

It wasn't meant to imply that saying "I didn't intend to bring their network down" would be of any benefit to a defendant.

t

-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Valdis.Kletnieks@xxxxxx
Sent: Thursday, March 31, 2011 3:30 PM
To: Cal Leeming
Cc: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] Vulnerabilities in *McAfee.com

On Wed, 30 Mar 2011 20:33:56 BST, Cal Leeming said:
Like with most laws, the key point is "intent". If your intention was
clearly not malicious, then you are safe.

Ask Randall Schwartz how that worked out for him. "intent" doesn't enter into it as much as a defendant may like.

http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html

Intent is not mentioned at all. You exceed the authorized access, you're guilty under 18 USC 1030. 1030 (a)(2)(C) is the really expansive one, as "protected computer" is defined down in (e)(2)(B) to include anything used in interstate commerce (and yes, DA's *HAVE* argued "The computer has a web browser and thus could get to amazon.com, so it's interstate commerce time").

Doesn't matter if you were trying to save the world at the time (as Gary McKinnon found out).

A better approach is to argue the definition of "authorized access" as it applies to an Internet-facing server...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Volume 1
    ... I've been on jury duty once, and I was delighted when the invitation ... The prosecution claimed that the defendant kicked the ... of "assault causing injury with intent to injure" and find him guilty ...
    (rec.arts.sf.tv.babylon5.moderated)
  • Re: Volume 1
    ... and never once called for jury duty. ... The prosecution claimed that the defendant kicked the ... >of "assault causing injury with intent to injure" and find him guilty ...
    (rec.arts.sf.tv.babylon5.moderated)
  • Re: [Full-disclosure] ACM.ORG data leak still there 4 days after announcing to CEO John White
    ... "knowingly and with intent to defraud, ... pretty much limits crimes to those intent on committing fraud or ... argues against this access being a crime. ... Full-Disclosure - We believe in it. ...
    (Full-Disclosure)
  • Re: The Hero of UK.Legal....*cynic*...aka Dave Mould
    ... How the hell did they get a conviction on that, ... On the *intent* of the person who had the picture? ... If it was the Hamilton images case, he pleaded guilty. ... "Defendant had no intention to defraud". ...
    (uk.legal)
  • Re: [Full-disclosure] Vulnerabilities in *McAfee.com
    ... clients network goes down cos I accidently plugged a 12v cable tester into ... if you allert the publisher of your founding (most of the time remote ... showing that bug founding is still looked with diffidence ... the key point is "intent". ...
    (Full-Disclosure)