Media, industry and cops baffled as Qld Police return hack’s iPad

Hmmm

Qld police are not just a joke, they are thugs who think they are the best thing that ever happened to the world.

Useless pieces of s**t!!

Realised their error?

Perhaps they realised that they were stretching things somewhat in accusing him of a crime and that confiscating the iPad was, in fact, theft. Or maybe someone pointed out to them that a "tech hack" is actually a writer on technical matters, not a 'hacker'.

And then they wonder

why so many use the word "plod" to describe policemen (no disrespect to the better policemen out there intended).

The first step to colour the grey...

... is to stop using the term "hacking" for everything from "being overly creative with computers" via "anything more clever than this reporter understands" to outright criminal abuse.

For perhaps right after recognising the problem comes naming it. And here, various parties in or close to computing have consistently misapplied the relevant terms, causing lots of confusion.

There's an art and beauty to the thoughtforms we pour in programs that when done well enough there's a special word for it. And we shouldn't muddle it with criminal behaviour or not quite criminal things done for gain or really anything other than pushing the limits of making computers run with our thoughts, say as programs.

There's a word for hacking gone black hat, and it's cracking. Even the half-literate bunch of wannabe hackers that style themselves with various hat colours would do well to stop doing that, because it confuses the media and law enforcement. To the detriment of everyone else except criminals.

There's a reason you're not a hacker until, like Writers of Literature or heck Kentucky Colonels, the real hackers welcome you into their select club. Most of those popping up in the media with the monniker, and in fact most of the bunch in the IT security industry, are not members of that club.

This is pretty bad because plenty of jurisdictions have laws agains "hacking", which when taken at face value outright outlaws "too creative" innovation and invention in computing. It leads to bad precedents and worse IT security. It also does the reputation of computing as a whole no good at all.

Thus, those laws should go and be replaced by laws that draw a line at "criminal action" not "hacking", so that even judges will come to understand just what it is that they're trying to stamp out and what parts they really need to leave alone. Right now, it's too haphazard for anything but more confusion and conflict down the road. As a community, IT does have interest in this not going awry more than it already has, so it's time to reach out to lawmakers and tell them what is and what isn't acceptable within computing.

And thus we can't afford to confuse the issue by using one word that means anything from the most admirable inventing to the worst possible criminal damage. At a bare minimum we need to draw a line and give it a name. Lo and behold, we already have such a term: When it's punishable it's cracking, not hacking.

Dear el reg hacks, pray too take note.

Adapting old methods

At the time, Queensland Police justified the confiscation by stating they believed it contained evidence of an alleged offence. However, Heinrich – who committed the alleged offence – has yet to be questioned.

Plods sit the iPad in a chair and shine a light at its screen: "Well, are you going to talk? I've got all day!". Technically, you could have an iPad or laptop voice activated and install speech synthesis on it. Which would be a bad move as it could then snitch on you.

decided to "target another researcher, Chris Gatford, with whom he has a long-running feud."

And in that title lies the argument.

Expose security problems all day long, that's a good thing. any work which can be done to secure systems and data is great.

However, as soon as you demonstrate security issues by targetting an individual who has not given you their permission to do so, you are on dodgy ground.

By all means demo the flaw by setting up a facebook account in your name, or an alias, but do not hack someone else's details.

That's akin to saying you have found a flaw in your local banks security, and you are going to demonstrate the problem by robbing an associates secure deposit box.

So to recap. Exposing security flaws = good. Targetting a competitor with said flaw = bad.

Ah! Here's the bit I missed from the original article:

ongoing public feud between hackee and hacker. That puts things in a bit of a different light.

Unless the hackee has agreed to allow his account to be used for the demonstration, he has been hacked, and the journalist is in possession of evidence of the crime. After that things get murky very quickly and I'd want a full team of lawyers to advise me before confiscating or returning the equipment. And one of the key questions there is unanswered in the article: is the hackee pressing the complaint.

I also think there's a good bit of confusion introduced by the changes in terminology for taking someone in for questioning.

From original article on the story

The sequence of events seem to have been:

Hacker demos security flaw by hacking fellow hackers Facebook and gaining access to photo of said hackers wife.

OUCH! This is done in front of an audience. Much hilarity ensues, aren't we clever, ha ha.

Complaint is made to the police. "Hey, this guy has hacked my account and popped a photo of my wife up on the big screen. Please beat him forthwith"

Police investigate, and find that a nice journo has documented the whole deal.

Now, this bit is speculation but:

Copper: "Hey there nice journo, we are investigating this complaint, and we hear you might have evidence documenting what went on"

Journo :"Yeah, what about it."

Copper: "Can we see what you have"

Journo: "No. BTW, this is starting to look like a good story for me"

Copper: "Come on. play ball. Let us see the info so we can get this cleared up"

Journo: "No. You ain't got nuffin on me copper"

Copper: "Your coming in for questioning sun shine. Your nicked"

Journo: "get IN! This is a much better story for me than this pesky conference"

Meanwhile, photo of hackers wife is still doing the rounds. And Hacker number 1 has jumped on a plane.

I think many commenters have missed the point of the original complaint.

Room for some nuance

Yeah - we used to have that - the nuance was called intent and it used to appear in all good laws.

Problem is zero-tolerance makes for better sound-bites while completely failing to address the actual problems.

And as we all know - no-one gets elected these days by prioritising substance over style.

What's the problem?

If you're a plod, then the first thing you need to do is secure **potential** evidence. Any **potential** evidence on a computer is easy to wipe out or change, so the only way to secure it is to impound said device.

The plods need to secure the evidence early, before any suspects, or even what the hell is going on, are established. As such, they cops might not have questions etc. As a clearer picture emerges of what has happened they might then decide that such **potential** evidence is low quality or not evidence at all.

This is a media beat-up non-story fanned by a numptie trying to get 15 minutes of stardom.