LFields

‡ Beware of Experts Who Stray Outside of Their Lanes The author of the linked piece, Peter Fornatale, admits to being a friend of the accused, Marshall Gramm. He also claims to be attempting to remain objective in his writing about the scandal. From what I can gather, he's struggling, if not failing in that attempt. In the linked article, he recounts the views of an expert who he claims is "someone with real technical knowledge and no stake in any of this", Justin Cappos, a computer science professor at NYU and a cybersecurity expert, who "had never heard of any of the people involved." I don't doubt Cappos' expertise, but let's take a look at some of what he said (in italics), and my responses (in bold): "On how the records were reachable in the first place, Cappos was unequivocal. “The system’s poorly designed,” he said. “If you’re just able to go and make a very minor change — like, for instance, it gives you a record number, and it’s a sequential number, and I can go and move the number up and down and see other people’s records — they’ve clearly designed their system very, very poorly.” HISA deserves harsh criticism for its failure to secure the system better than it did, no doubt. There is no legitimate excuse for what various experts seem to agree was shockingly poor security. But the rest of Cappos' comments frankly make it difficult to believe that he was being objective. And on whose fault that is: “It’s not the user who goes into the URL bar and types in a different number. It’s not their fault. Anyone who so poorly protects their systems is just leaving the front door open.” It’s not the fault of user who goes into the URL bar and types in a different number? Really? Suggesting that HISA was somehow responsible for Gramm changing the URLs in an effort to access unauthorized material is as ridiculous as suggesting that a woman who wears provocative clothing is responsible for a sexual assault. Of course it isn't the user's fault that security was lax, but Gramm chose to repeatedly walk through that slightly ajar, not "open" front door, and steal – yes steal – data that he most certainly understood was privileged, and that he was unauthorized to access. Then he offered an analogy that really resonates, and it cuts both ways. Imagine a house in the middle of downtown with all the doors and windows open, a band playing, no fence, food and drinks lying around, no security of any kind. But of course there was security of some kind, so why would Cappos choose to make such an obviously poor analogy? But this really takes the cake: But about the organization that threw the party, he was blunt. “There’s ineptitude on the side of the organization trying to protect the data.” He went further, and I want to quote him exactly: the setup “almost served as a honey pot for someone,” and “without intentionally being entrapment,” it is “about as close as you would come to something like entrapment.” "about as close as you would come to something like entrapment"? Say what?! Using Cappos' own dubious analogy, a homeowner happens to leave their front door unlocked, someone walks in, surveys the belongings, repeatedly steals things over a period of weeks, yet the legal culpability of the intruder should somehow be mitigated because leaving the door open was close to something like entrapment? Please. *** There is much more to the article, and I agree with some of Fornatale's other points, including criticisms of some inconsistencies relating to HISA's version of the events. But from what I can gather from the opinions of Cappos, he sounds as if he was lobbying to be included as an "expert" witness for Gramm's defense team.