"Frossie" <frossie@...> writes:

> "m" == merlyn <merlyn@...> writes:
>
> >>>>>> "Tom" == Tom Phoenix <rootbeer+fors-d@...> writes:
>
> Tom> I agree. But it won't be easy to accomplish, since I'm sure that most
> Tom> legislators (judges, juries, reporters, columnists, employers) think that
> Tom> "breaking in" to a computer shows sufficient "mal-intent" all by itself.
> Tom> "After all", they'll say, "if you broke into my _home_, we wouldn't need
> Tom> to show that you had evil intentions."
>
> m> We need to show that "breaking in" is done by both white hats and
> m> black hats. That *is* different from the way it's done in the real
> m> world. We can design a lock, and test it in a lab, and then install
> m> it in a door, and not test that door because we know the door is
> m> correct. But we can't build complex systems that way... we have to
> m> field-test them, and field-test them repeatedly, because systems
> m> change.
>
> It would be best if we moved away for the whole house breaking analogy
> to one where intent is relevant in the *current* body of law. Let's
> face it, theory aside, 99% of people who enter your house without your
> knowledge *will* probably want to rob you. Whereas the proportion of
> people who access your system without specifically asking for
> permission and who do not want to cause damage is, to hazard I guess,
> orders of magnitude more frequent.

Agreed.

As Randall argued in his trial, our computers (as agents of our
bidding) access and modify the content of computers owned by other
organizations every day, without prior authorization from those
organizations. The computer domain is radically different than the
physical domain, and as such, existing precedent cannot be rotely
applied to computer cases.

Why should access to port 80 be considered perfectly legal while
running an ssh connection on port 23 not be? Both have the potential
to modify data on the other side of the fence, the difference is my
intent. Most port 80 accesses are requests for information being
made available by the organization. Someone talking to port 23 wants
shell access, and is walking into non-public space.

jas.