'Good Sam' Hacker 'Fesses Up

[Keefe]

'Good Sam' Hacker 'Fesses Up
By Declan McCullagh

7:10 a.m. Sep. 27, 2001 PDT  
WASHINGTON -- It seemed like such a straightforward example of prosecutorial overeagerness: An Oklahoma "Good Samaritan" was being investigated by the Justice Department for helping a newspaper fix a website security hole.

The outcry among the geek community last month began with a story on LinuxFreak.org entitled "Cyber Citizen Lands Felony Charges?" Sites such as Slashdot soon picked up the tale of 24-year-old Brian K. West as evidence of out-of-control, tech-clueless government lawyers, and urged sympathizers to e-mail the U.S. Attorney in charge of the prosecution.

Making the story even more appealing to the open-source community was the Microsoft angle: West was said to have reported to the Poteau (Oklahoma) Daily News and Sun a security flaw in Microsoft NT 4.0 IIS and Microsoft FrontPage.

But a guilty plea that West signed tells a far different story -- and shows how easily a well-meaning community of programmers and system administrators can be led astray.

It turns out that West did tip off the newspaper -- but that's not all. The plea agreement, accepted Wednesday by a federal magistrate judge, says that before phoning the paper's editor, West downloaded proprietary program and password files and used those to force his way into private areas of the Poteau Daily News and Sun's site.

West admitted he intended to modify the newspaper's Web applications -- written in the Perl language -- and modify them and market his own versions.

Sheldon Sperling, the U.S. Attorney in Muskogee, Oklahoma who is overseeing the prosecution, seemed glad that his brief experience with Net wrath was over. He said in an interview Thursday that he received many hundreds of e-mail nastygrams, some "not too charitable."

"It's not uncommon for us to take shots on the chin during the investigative stage because we are obligated not to respond regarding the facts on the case," Sperling said.

"It's an unfortunate fact of life that often investigators and prosecutors are like relief pitchers," Sperling said. "We're as good as our last outing. We're often branded by events beyond our control."

In a statement he sent to reporters, Sperling was more blunt: "The defendant rewrote the files he downloaded, planned to distribute his rewrite, added another page to the website, modified the password file, and misled sympathizers and others as to both the character and scope of what he had done."

In an apparent response to the e-mail campaign, Sperling's direct phone number and contact information disappeared from a University of Tulsa law school alumni site.

On Wednesday, U.S. Magistrate Judge James Payne accepted West's plea admitting a misdemeanor charge of intentionally accessing and obtaining information from a computer without authorization in violation of 18 USC 1030. The charge carries penalties of a fine and "imprisonment for not more than one year."

Payne ordered a pre-sentence investigation report and said West would be released without bail. No sentencing date has been set.

Cherie Chappell, a lawyer in Edmond, Oklahoma, who is representing West, refused to comment. "The case is still pending. I cannot talk about it at all because of that," Chappel said.

A website that West set up with his claims of malicious prosecution, bkw.org, is now offline.

But Chappell said there is no gag order in place.

In a bizarre twist, Chappell had sent out a "defense press release" last month that said Microsoft might be criminally negligent for such buggy software: "Mr. Sperling or the Federal Bureau of Investigation may be wise to investigate Microsoft as a possible co-defendant or party in this case." (Microsoft, for the record, has not been charged.)

West's plea agreement says that he told the editor of the Poteau Daily News and Sun of his intrusion and called it accidental. But the newspaper investigated further and called the FBI, which then obtained a warrant to search the CWIS Internet Services office in Stigler, Oklahoma, where West worked.

The plea says the FBI's Computer Analysis Response Team found West had created a "/home/PDNS" directory with the newspaper's Perl scripts and was in the process of rewriting them.

[Keefe]

wow...i got slashdotted!

http://slashdot.org/comments.pl?sid=22026&cid=2362439

[Keefe]

thanks for the link!