Nova Scotia filled its public Freedom of Information Archive with citizens' private data, then arrested the teen who discovered it

Reminds of how the US cops used to send out mail order catalogs for pornography, and if anyone ordered what looked like legal porn they would get arrested as soon as they picked it up because the cops had included underage pictures.

It certainly could lead to some unintended consequences if typing a URL and accessing the content within amounts to you “representing that you have been granted the right by the owner of the materials to access the materials within” - particularly when the person typing the URL doesn’t know it contains protected content or you know, is a search engine bot.

1 Like

Skinny Puppy demanded payment for their music being used in a similar fashion - also @euansmith :

8 Likes

Sounds like a nice Sunday…

1 Like

If it does, Google has some prosecutions to worry about :slight_smile:

The “Barney the Dinosaur” theme was used for similar, I think it was detailed in “The men who stare at goats” book. The creators checked the royalties they were owed, and then decided against it as the horror dawned.

2 Likes

It’s a good question, I think. In the US, the Computer Fraud and Abuse Act is really badly designed for cases like this, where it becomes difficult to say what constitutes “access” that is unauthorized. The mental state requirement of “intentionally,” just means that one intended to bring about by one’s conduct whatever result it is that’s criminalized. We’re not helped much there.

A decision like U.S. v. Morris make it clearer, I think (a case about the original internet worm!) Whether an access to features is unauthorized is about if they’re used in a way “related to their intended function,” or rather use a “special route.”

If the intent is to criminalize hacking, itself, then the law should reckon with the unique nature of that activity: a hack will usually put together a number of misused functions and unintended side effects and such, minor little things, into this one magic result that is much more than the sum of its parts. Normally, criminal statutes deal with this problem of minor, technical violations by limiting the scope to cases with damages above a certain level. But that doesn’t work for CFAA. There is never any question of meeting the damages threshold. The damage is in the fact that a security vulnerability has been made apparent, so then there’s this pressing need for mitigation and future prevention. You end up with very black-and-white application of just the vague and overbroad “unauthorized access.”

2 Likes

Generate a page with links to all the possible documents. Carefully put it on the net where webcrawlers will find it. Webcrawlers follow the links. Documents show up in search engine results.

Mission Accomplished!

4 Likes

Not surprising at all. Most parents would also agree Barney was torture (and lots of other kids tv is indeed torture)… For me, it was Caillou and whatever that one show with Dragons was… Pure torture at normal volume.

3 Likes

Google’s search engine won’t dial sequential document numbers trying to find a hit. It needs a breadcrumb that leads to a particular URL. But if anyone posts the URL of a confidential document anywhere on the public net, then it’s game over for that document. (See my post above.)

3 Likes

I’m not a parent, but my brother’s girls liked this show. As did I as a kid. A 60 minute DVD of this with the theme playing at the beginning and end of every 3 minute episode? *shudder

2 Likes

Like they said in the movie Hackers, never do your work from your home network. However the information was supposed to be public so why should it matter that a Canadian citizen decided to scrape everything that was supposed to be freely available? I hope this guy manages to get good representation because the arrest is BS.

1 Like

Let’s hope that Nova Scotia’s law enforcement and prosecutors have the good sense to thank this young man for pointing out their reckless mishandling of the public’s sensitive information and apologise profusely for having terrorised him…

I would love to live in the world where that would happen. Unfortunately…

Thought experiment: Assume your wallet is empty (this is not about steaing personal ID, data, credit cards, etc). If someone comes along with a device that lets them copy this wallet left outside your house, and they make a copy, is that theft?
These documents were not stolen. They were copied. Accidentally and unknowingly.

Thank god there was always Sesame Street and Mr. Rogers! And I think this generation of kids also has some good cartoons to watch, stuff like Adventure Time and Stephen Universe, which has some complexity and good storytelling.

I did always like the shows Word Girl and Ruff-Ruff Man. When she was really little, I wasn’t so bothered by Dora the Explorer or Blues Clues… We had a whole alternative universe for the Blues Clues guy, that he was stuck in that universe for crimes he committed or some weird shit.

4 Likes

Not quite a good analogy. These records, or rather the directory everything was on was supposed to be public. A good analogy i think would be is going to a university library, going to one of their cabinets that is supposed to have research information and finding out that mixed in there are also financial information from existing and past staff and students.

I am not sure how sound my analogy is, but assuming it is. Is a person going through said cabinet free to copy all of that information or should they be expected to treat the misfiled information as private?

Additionally if the copying was done unintentionally, as i suspect, can the person doing the copying be held responsible even if they haven’t done anything with that information? My hunch is yes they can be held responsible but if its apparent that there was no malicious intent they should be let off relatively easy.

I started off pretty sour on Dora but it really grew on me. Especially because of this little song I sing to myself often (even if it’s now anachronistic):

:musical_note: Who’s the guy you need to know
When you want to score some blow
I’m the mayor (say it again)
I’m the mayor, I’m the mayor
I’m the mayor, I’m the mayor, I’m the mayor, I’m the mayor
I’M THE MAAAAAAAAYYYYYYYOOOORRRRR :musical_note:

3 Likes

1 Like

I believe the whole point of an offshore torture site is that the law does not apply.

4 Likes

In the UK, driving while uninsured is a strict liability offence. If you are uninsured you get fined, no excuses. (Recent case was driver who insured two cars on 2 credit cards and was told they’d auto-renew, but one card expired and driver failed to see warning letter/claimed it had not arrived. Fined, even though he had highly reasonable grounds to believe he was insured.)
Are you suggesting that if I download a file advertised as X but someone has inadvertently added illegal Y to it, I am strictly liable for possessing a copy of Y? Would it make a difference if I had not even opened the file (yet)?
I do not believe cases such as this Nova Scotia one should be held to strict liability standards.
If it’s apparent that there was no malicious intent they should be let off, full stop. (But the local relevant law and requirements ref this case are not known to me.)