Speculated reasoning in the comments on the article was that it then gives an admissible account of who owns the twitter name. Otherwise the assertions about who owns it are inadmissable hearsay. That said it's still really weird that the accounts were subpeonaed

EDIT: fixed link. Just noticed it went to an old article. Apparently the new one is up but not listed on the homepage? (Similar topics so I didn't notice right away)

https://www.popehat.com/2017/10/24/in-which-my-identity-is-s...

Also, if I were trying to intimidate people who read a lot of Ken White's opinions, I wouldn't try to do it by filing questionable legal things about Ken White, thereby forcing him (as you say, a former USDA with a wide network) to enter into legal proceedings with me and inviting him to discuss my actions to his audience.

To a first approximation, that seems like it has a high likelihood of backfiring.

I guess that if you work for a company you're probably not looking at anyone's website that's not explicitly paying you/your company and under some contract.

Not all specialists or researchers are doing penetration testing. Of those, not all of them are penetration testing third party stuff, and of those, not all of them are doing it without permission. That's the only one that will get you into trouble.

I'm not, technically, a "security specialist" of any stripe, but I take a very careful interest in the defensive side of security, and am currently in the middle of implementing a fairly security-sensitive system. I don't worry that the FBI is going to bust down my door at 2am because I've tweaked the API of my code to make it harder to write cross-site scripting attacks, or because I fixed the architecture so that authentication is done very early in the request cycle instead of ad-hoc and inconsistently very late in the request cycle in a way that requires every developer of every individual web page to have to enforce all authentication. Most security work is going to involve internal matters and the fixing thereto, and, yeah, the job isn't going anywhere any time soon.

(Though it does have the eternal challenge of convincing people they need to pay for it, and the problem that even in companies where programming is the major product like Facebook and Google, you're still going to be a cost center.)

https://en.wikipedia.org/wiki/Randal_L._Schwartz

How can we put an end to ridiculous infringements on rights and wasteful use of resources?

It certainly starts with voting for representatives that won't allow thus, but damn. There aren't a lot of good choices out there. And even if there are, how do we fix the issues that allow the bad actors to get elected over a "good" rep?

It's not getting any better, it's probably getting worse. We're not that far away from people being arrested for the tweets they post: http://www.cnn.com/2017/03/17/us/twitter-journalist-strobe-e.... Millennials don't see anything wrong with that sort of thing: https://www.theatlantic.com/education/archive/2017/07/why-it....

http://www.factcheck.org/2016/07/dueling-claims-on-crime-tre...

But if you are in the Chicago area, you should know that like wealth, crime is incredibly unevenly distributed. There are communities that have effectively zero risk of violent crime, and communities within 30min drive that have violent crime rates that rival the most dangerous cities in the world.

Which ignores the context of the data that while still double the 1960 rate, it is also half the peak 1991 rate, and has generally been decreasing since then. The murder rate is similar to the early 1960's, after it's peak in the 70s/80s.

I have nothing to disagree with your comment on Chicago, which sounds plausibly accurate.

https://blog.nycdatascience.com/student-works/pressure-cooke...

>Americans say they worry a "great deal" about crime

Maybe because in a country with profit-driven media and little in the way of media laws (arguably a good thing in many ways), media companies are beholden to their shareholders to maximize profit above all else - doing research, they discovered that the most profitable thing is fear mongering and "riling up the masses." Reminding news-readers every single day about the Vegas shooter, for instance. For example, here's the very first link on news.google.com for me this morning: http://www.latimes.com/local/lanow/la-me-ln-bruce-paddock-20... "Brother of Las Vegas shooter Stephen Paddock arrested in child porn case". "Did you forget about the MASS SHOOTING YET?! Don't forget about MASS SHOOTINGS!!!!!!"

>Millenials

Hmm, I'm skeptical whenever I see this word now. Looking at your article:

>Is iGen so different from the millennials because the former faces more chronic, long-term stress? Have the country’s colleges suddenly become brutal, toxic places, increasingly hostile to members of various identity groups?

Appears that your source isn't referring to an entire generation, but rather some college students. Also, I don't see anything that unilaterally supports your claim that "millenials don't see anything wrong [with being arrested for a tweet]." In fact, I've yet to meet a member of the nebulous "millennial" class that isn't appalled by this thought.

That's not a contradiction. You can have a situation where people have to deploy numerous countermeasures[1] to head off crime, and where criminals pounce if any of these aren't active, but where the aggregate effect is to keep crime at bay. In that case, crime warrants being worried about, even if the rate is low.

You might as well say it's irrational to "worry a great deal about crime" in Brazil "because you can just stay in your gated enclave, what's the problem?"

[1] Locking your possessions, carrying little of value, traveling in groups, steering clear of strangers, living far out in suburbia where it's inconvenient for crime to reach, preventing buses (disproportionately used by the poor and criminal) from having stops near your home, etc.

I'd add an addendum that confuses me and adds to the problem at hand; not only is there a culture of fear, there isn't even the empiricism to ask for accountability. No one seems to be asking what the outcomes of these various efforts are, and a handwavey "we've caught SOME people despite ruining the lives of others and catching millions in a massive dragnet" seems to be enough for many electorates.

I had written a much longer response, but I can be more concise to summarize as: "I think there are other incentives that serve to worsen the fear"; our election process and media finance structure are two components of this. I have no good ideas on how to decouple all of these without throwing out various babies with the bathwater, but right now the fear seems to benefit the status quo and is thus going to be rather hard to displace, especially alongside an often shaky education system.

What kind of weak, fussy little scaredy-cat acts like that? Saying he doesn't have enough to do is being too nice about it. Judging from the facts of this story alone, he sounds like a vain petty bitch. Exactly the kind of person you don't want behind a badge, and a discredit to everybody else in law enforcement.

The problem is that statement has always been true, even in good times.

The internet age changes the dynamics and visibility, so that is actually some comfort. In decades past, this exact same action to "protect their own" would have gone down without a blip on the national radar. It should be noted, however, the agency's power to use all the data they're wanting (phone IDs, in particular) to conduct ongoing intrusive surveillance at low cost is new and worrisome.

It should also be noted that prosecutorial power works both ways: reading about the tactics used by Mueller against Trump, et al, is both encouraging and scary to me. It's nice when your friends are powerful, but scary when you realize their loyalty is fleeting.

Call your Congressperson [1], U.S. Senator [2] and state representatives. Tell them why you think this is ridiculous, in a calm and collected manner. Ask them, politely, for written follow-up.

I do this about issues I care about. In my urban district of three-quarters of a million people, I'm almost always the only person calling about tech-related issues. Multiple times, the LA has asked me to email them supporting materials I reference.

[1] https://www.house.gov/representatives/find/ Find your Congressperson

[2] https://www.senate.gov/senators/contact/senators_cfm.cfm Find your U.S. Senator

More like what can we do, which is essentially nothing besides begging elected officials to do something about it (spoiler: they won't).

Alternative is court cases, but those take a lot of time and money, and rulings won't necessarily have the reach you want even if they're in your favor.

Try making it clear to candidates that you would not support such behaviour in an elected official, and that if their interests are aligned with such causes you will not vote for them.

  the FBI is requesting information about the Twitter users 
  that were part of the conversation.

I feel like your use of the phrase "part of the conversation" -- a phrase often used as euphemism for actual involvement -- is a subtle deception to anyone reading your comment. The totality of their involvement is tweets discussing the case.

You go even further by following up claiming it "doesn't seem quite as sensational once you know the backstory" and in the next sentence you mention the alleged crime that they were talking about, not that they were involved in.

To me, it feels like your comment is either missing the point that these 5 were simply talking about the case; or you are being willfully deceptive.

> Doesn't seem quite as sensational once you know the backstory.

Though your summary was sensationalised by the addition of the term doxxing (usually negative connotations there), whether you meant it to be or not. It is all about how the spin is put on it. An innocuous situation can be played up, or down, by either side.

P.S. @Spivak, it's your 1024 days anniversary on HN! :-)

Still not sure why that gives them grounds to subpoena everyone on the thread.

[1] https://assets.documentcloud.org/documents/4116064/Shafer-Co...

> search for and publish private or identifying information about (a particular individual) on the Internet, typically with malicious intent.

Sounds appropriate, doesn't it? If you still disagree, here's a thought experiment: If someone were searching and posting that info about you, or anyone else reading this very thread, wouldn't we call that doxxing?

It was information I obtained from "whois".

I also wonder how many people are unaware that many counties in the US make property records available over the Internet. It is, after all, public information.

Doxxing is a bit more than just posting information someone’s trying to hide. It’s identifying that person to basically aid in harassment. If the doxxers provide private info to aid in the harassment, even better (for the doxxers/harassers), but the doxxing doesn’t need to be private info to b doxxing.

I'm sure they'd say they take any 'threats' against their agents seriously, even seemingly benign ones. It's possible most of this stuff is automated anyway, so they can do deep searches with all identifiers into their NSA-fueled databases on anyone talking about FBI agents on social media.

The list itself could have private and protected information.

It's the same as fat fingering a website in your browser. Are you saying I should go to jail if I type the wrong website, it loads, and it turns out that site was supposed to be "private"? My browser downloaded the home page and all the files on it.

What if I click the wrong wifi network and use it all day without noticing? Should I get charged for "unauthorized access"?

There needs to be a reasonable standard for security above "so insecure you could do this by accident" to send people to jail. Whoever set up the server that shitty should be charged with negligence.

I see this all the time in technology: people come up with contrived counterexamples to expose some non-existent flaw in the legal system that they get really defensive about. The legal system isn’t like a computer. If you really did make a mistake, that should become obvious in the ideal case.

You may have fat fingered a URL, but your browser still asked for it and any content located there.

I don't agree with prosecution on things like this, but the reality is the best analogies are still doors and locks: My front door is connected to a walkway, which is connected to the public sidewalk. You may see my door is open and unlocked, but you're still trespassing if you walk in. If you did, I may decide not to press charges, but that's my choice. And I'd be mad as hell at anyone who created a law that said I couldn't just because my door is open.

I think the best solution is for people to treat others with a little more goodwill, and find other ways to make society less litigious overall. Unfortunately, corporations drive a lot of that because a corporation's only goal is to make money. People, however, can make different choices.

In the cases of house front doors in the suburbs, the overwhelming expectation is both that the door is intended to be locked and that the public is not intended to freely come and go from the interior of the residences. This is a custom so well-established that it is essentially universal, and a house with the door open and unlocked is an obvious outlier.

In the case of fileservers on the public internet, the overwhelming expectation is that anyone may connect to them, and if anonymous logins are accepted, access the files on the server. Again, this is well-established custom.

Because the customary behaviour in the two situations are so different, the analogy is inapplicable.

After walking away from this I thought of an analogy to fit the other side: Attractive Nuisance

Maybe a security researcher/group/company could sue on behalf of customers affected by an open FTP server because it's an "Attractive Nuisance" on the Internet. Affecting a company's bottom-line is about the only way to get some to take notice.

Certainly, most? I can't think of any FTP GUI application I've ever used not displaying a list of files stored on the remote host upon connecting.

No, I'm not saying anyone should go to jail. The person in question did not do this by mistake though.

In general I'm in agreement with you. I'm just making sure we don't mix analogies. Looking through an open door is not the same as connecting to an FTP server and getting list of files.

The law needs to be at the same standard as real life. For example the police can search your belongings unless they're locked, then you need a warrant. If you've got a service wide open on the internet with no security it shouldn't be a crime just because somebody found it.

The difference between doors and locks is that going through real life doorways is a lot different than connecting to a service. On the internet the act of connecting to it gives you access to the inside, there's no second act of walking in.

It's like an open door that throws a copy of it's contents at anyone that finds it.

Unless you're intending to make the argumet that accessing those files is the same as you leaving all of your personal belongings on the street, I'm not seeing any differences.

> For example the police can search your belongings unless they're locked, then you need a warrant.

The police need a warrant, I [an individual] do not. By your argument, I can come to your house and go through all of your things just because you left the door unlocked.

> If you've got a service wide open on the internet with no security it shouldn't be a crime just because somebody found it.

I don't think anyone here is saying it is. The argument is it's illegal to search through the data made available by that service without permission.

> It's like an open door that throws a copy of it's contents at anyone that finds it.

It's really not. Here's an exercise: Name a protocol used on the Internet that does NOT make a distinction between connecting and the client requesting information.

Http, among almost everything else. In HTTP the browser will call GET / as soon as a TCP connection is established. If you want to go down a level yes TCP doesn't leak info on connect but what kind of client does that?

The L4 protocol doesn't matter, too low level. What matters is what a normal client does. In HTTP, every browser will make a GET request for info immediately on connecting

Say Bob tells me to connect to his ftp server and gives me a different IP. I go into my client, type the IP, and hit connect. I have a directory listing of all the filez now. A crime? You've gotta be kidding.

To even know you're connected to the right place in most protocols you need to request information. It's like I said, a door that throws the contents inside to anyone that finds it. It has to be that way because otherwise all the doors look the same and you couldn't find the right one

> Say Bob tells me to connect to his ftp server and gives me a different IP. I go into my client, type the IP, and hit connect. I have a directory listing of all the filez now. A crime? You've gotta be kidding.

Say Bob gives you the address to his house and says "Open the gate and go in the back yard. My grill is in the corner, you can have it". Unfortunately, you transposed the numbers and took someone else's grill. Is that not trespassing and stealing?

I don't disagree with you that the prosecution in this case probably should not happen, but it's not nearly as simple as making a blanket statement that "Whoops! I connected to the wrong server." is enough to make an act no longer illegal.

As @poorrights commented, a lot of it has to do with intent as well.

Well, you just can't legally break into and search my locked property at all; it's true that the remedy for a police violation (the exclusionary rule) doesn't apply to a private violator of property rights in this way, but that's because regular civil and particularly criminal process is available, without governmental immunities and, at least in theory, without the conflict of interest that arises when government law enforcement agents pursuing law enforcement evidence are the ones violating property rights.

That's my point and counter-argument to the item I quoted; Just because something is visible, or behind an unlocked door, it is NOT available for someone to search through it.

It's more like looking across the street and seeing a private act through an open window, and going to the front door and knocking and telling them that the window is open.

There are laws against leaving patient data in the public. There are laws against public indecency.

There are also laws against unauthorized access and laws against being a peeping Tom.

Which one is going on is not necessarily easy to determine.

I guess that fits with throwing legal charges at people that laugh at you.

The subpoena against the comment poster is questionable, but targeting people who were named in the Tweet is ridiculous. In particular, Dissent Doe never engaged with the thread in any way, but was only named in the exchange.

If you can spawn an invasive data request against someone just by including their handle in a tweet, that's a shocking overreach or a misunderstanding of the communication system.

Seems relevant. The allegations are that he was harassing the family on FB.

As the article makes plain: "Then, to subpoena a ton of info on 5 totally unrelated Twitter users... just because Shafer tweeted a smiley face emoticon at them?"