Source: http://anonlaw.com/
Timestamp: 2014-12-21 19:26:15
Document Index: 343832218

Matched Legal Cases: ['§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030']

What harm social engineering?
by BeauHoward on October 31, 2013
I received an interesting question via Twitter this morning:
Dr.Krypt3ia ‏@krypt3ia Protected account 30m Question: You socially engineer an exec out of a password or access but you don’t use it. Instead you write about it. Legal troubles ensue?
My initial reaction was that the particular laws at issue are not specifically relevant to a more pressing, practical question. What would it cost to be sued for this stunt? Not just in legal fees and potential damages, mind you. Being accused of lying to a businessman in order to hijack his password would almost certainly also cost a person reputation points and credibility in the InfoSec industry. These days, the sad truth is that most people look at a judgment against them as nothing more than a starting point for a negotiation. A hit to your reputation, on the other hand, affects your ability to sell your services, and it therefore affects your cashflow. So there are practical concerns here that may outweigh the technical right-or-wrong question.
Having said that, I wanted to address the actual legalities briefly. I am a lawyer, after all, and my “practical concerns” don’t really add anything unique to the discussion.
Just to frame the discussion, my initial response was:
Fletcher Howard ‏@BeauHoward 30m @krypt3ia@theprez98 if you make him look dumb, and he can even say the words “computer fraud” with a straight face, you’ll have a bad time.
Which prompted a good follow-up question:
Dr.Krypt3ia ‏@krypt3ia Protected account 30m @BeauHoward@theprez98 Intersting as no computer has been touched.
So what of the issue that the Computer Fraud and Abuse Act is a statute designed to prevent the hacking or cracking of password protected computers, but “social engineering” doesn’t require a single computer to be involved? For those out-of-the-know, “social engineering” is a fancy new word for a confidence trick. It is lying your way into information. For example, if you called up the administrative assistant to the President of a company and pretended to be from the company’s third-party IT services provider, and you somehow used that little white lie to trick him or her into giving you the President’s username and password for his Citrix login, you might say you “socially engineered” the password from her… even though your grandma would just call you a “con man.”
Regardless of the semantics, the question remains. Does a computer actually have to be hacked before the theoretical company can file a lawsuit under the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030? Arguably, no. Here is the text of the law, from which I have quoted only the relevant parts:
(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; …
18 U.S.C. § 1030(a)(6) and (7).
So, under section 1030(a)(6), it is illegal to traffic in passwords. The term “traffic” is defined in 18 U.S.C. 1020(e)(5) to mean, “transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of” (emphasis added). In other words, our hypothetical social engineer would not not have to actually transfer a password to another person to be guilty of “trafficking” under the CFAA. He would simply have to obtain the password with the intent to transfer it. He might deny that he had this intent. It might even be possible for him to make a factual case that he did not actually have this intent. But this is going to be a uphill battle for obvious reasons. As a matter of evidence, a defendant’s actual, subjective state of mind is unknowable and unprovable except by the direct testimony of the defendant himself, or by circumstantial evidence. Because nobody trusts the defendant to tell the truth about his subjective state of mind, lawyers and judges judge peoples’ intent by their actions. In most cases, where a defendant has done all of the acts to have committed a crime, the jury will be allowed to determine what the defendant was thinking when he did those acts, and the jury will be allowed to disbelieve the defendant if they decide that he is not trustworthy. In the case of our hypothetical social engineer, he would have lied his way into retrieving the password, and so the jury would most likely be justified in finding that he was also lying about his intent not to “traffic” the password once it was obtained. They are not required to make this finding, but it would cost a lot of money to have a lawyer prove the social engineer’s case. So, we’re back to practical considerations. Regardless, just by social engineering a password and bragging about it online, our hypothetical social engineer could certainly expect to slapped with a CFAA trafficking claim, and the judge would likely let the question go to the jury.
It is important to note that the embarrassed company would have a cause of action based on the trafficking charge under the following CFAA section:
18 U.S.C. § 1030(g). Significantly, in order to bring this cause of action, the company has to be able to allege that it suffered “damage” or “loss.” “Damage” is generally defined to mean “any impairment to the integrity or availability of data, a program, a system, or information,” and so it would require an actual computer to have been touched. 18 U.S.C. § 1030(e)(8). However, “loss” means “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11) (emphasis added). Even if our social engineer never touched the company’s computers, the company might nonetheless suffer “loss” if it decided to conduct an expensive damage assessment or, similarly, to hire an outside consulting firm to inspect the integrity of its networks and data and to look for evidence of an intrusion. See, e.g., Multiven, Inc. v. Cisco Sys., Inc., 725 F. Supp. 2d 887, 895 (N.D. Cal. 2010) (“[c]osts associated with investigating intrusions into a computer network and taking subsequent remedial measures are losses within the meaning of the statute”); Frees, Inc. v. McMillian, CIV.A. 05-1979, 2007 WL 2264457, *3 (W.D. La. Aug. 6, 2007) (“[t]he cost of hiring an expert to investigate the computer damage is clearly a ‘reasonable cost’ sufficient to constitute ‘loss’ under the CFAA”). This loss only needs to be $5,000 in value before the company can file a lawsuit, 18 U.S.C. § 1030(a)(4)(A)(i)(1) and (g), and it is not hard for the company to run up a $5,000 bill when it hires a law firm to hire an InfoSec consultant to conduct the investigation. In other words, the company will be able to satisfy the “loss” component even if the hypothetical social engineer never touched its computer network.
To make a long story short, we live in a climate that is very skittish about computer “hacking,” and lots of the decision makers are either baby boomers or greatest generation-ers who lack the critical experience with computer systems necessary to make rational decisions in these kind of cases. Old people don’t like “hackers,” regardless of MIT’s effort to reclaim that word for creative types, and you can safely assume that an older judge is probably going to decide close questions in favor of the business and against the clever social engineer. Thus, while we might privately acknowledge that the business’s most reasonable response to this scenario would be to change the password and move on without calling unnecessary public attention to its computer security holes, that doesn’t mean that the people in charge will understand this. They may well decide to try to make an example of the social engineer, and the court system might just go along with it as outlined above.
If I were a white hat, I would steer clear of any “social engineering” unless I already had a consulting contract with the business to perform an information security assessment.
So, Anonymous Wants to Kill Facebook…
by BeauHoward on August 10, 2011
Listen to the press release on YouTube by clicking here.
Read it on the Village Voice by clicking here.
…This should be interesting. In a fight like this, my money usually gets placed on the corporation generating $2 billion a year in revenue. That said, Anon has been about this game long enough now to know that it won’t actually “kill” Facebook. They could cost Facebook money through harassment, but the juggernaut social network will clearly weather the storm, whatever it is, because (1) it has a $50 billion market cap, (2) there is too much money to be made, and (3) people are addicted to it.
Take cigarettes as an example. They give you cancer and kill you, and everyone on Earth knows it. Even so, the tobacco industry is alive and well for basically the same three reasons that Facebook will be fine. Countless public service announcements and anti-smoking ordinances may have dented big tobacco’s armor, but Altria Group, Inc. (formerly Phillip Morris) still generated $3.9 billion in profits on more than $16 billion in revenue in 2010.
So this threat feels like a public service announcement and a publicity stunt from Anonymous. It will not kill Facebook, but it will certainly be interesting to watch.
One caveat: Anon has planned its operation for November 5, which is Guy Fawkes day. I presume they intend only a virtual detonation of Facebook with the usual denial of service attacks and associated grief, as opposed to actual detonation with kegs of gunpowder. Anon does, after all, appear to have a new toy to rep