On Tue, 30 Sep 2008 20:47:42 CDT, Miller Grey said: > Legally, is there any precedence that private systems owned by the > government are public domain? At least in the US, systems owned by the federal government are considered "protected" under the Computer Fraud and Abuse Act of 1986 (18 USC 1030 has most of the legalese for this: http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html For this scenario, the interesting words are in 18 USC 1030 (a)(2)(C): (C) information from any protected computer if the conduct involved an interstate or foreign communication; "protected computer" is defined in 180 USC 1030(e)(2): (2) the term "protected computer: means a computer: (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; or (B) which is used in interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; Yes folks - that means that laptop is protected if it's used for eBay or Amazon or even Yahoo Messenger, and if you hack it from across the state or country line, you're in violation... > Furthermore, has there ever been any legal > precedent that any private system, if left unsecured, is in the public > domain? In the US, there have been a number of successful prosecutions in cases where people used an unsecured wireless access point to launch attacks. You'd probably need to show *all* of the following: 1) That it was unsecured. 2) That it was *intentionally* unsecured. 3) That the security was set up for the explicit purpose of allowing free guest access, and people were actively invited. In other words - if the sign at the coffeeshop says "Free Wifi", it's fair game. If the login banner says "Free guest shell access - no password needed", it's fair game. However, if you happen to find an unsecured WAP while wardriving, or an account that accidentally has a null password, things are a *lot* stickier for you...
Attachment:
pgpztRnKCvmq_.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/