As you probably know, it's everything that happened after they incremented that HTTP request that formed the basis for his charges. Message board discussions tend to want to distill "hacking" CFAA cases down to the specific shell script that ran, but these cases are almost always heavily situational and fact dependent.

Interestingly, Rockenhaus's isn't --- it's more or less exactly the circumstance foreseen by the authors of CFAA, who believed that even though existing law covered most hacking-type scenarios, they didn't form a clear basis for felony charges for purely destructive computer abuse.

This case has far more than the CFAA violation, though. There were multiple parole violations after the first incident, multiple attempts to evade the parole restrictions on Internet use, discovery of a pedophilia relate search query on his computer, a history of intentional damage to a company’s infrastructure to disrupt their operations, and more.

Being angry at the CFAA is one thing, but this case has no relation to modifying a simple GET request.

> We also know from prosecutions in other statutes that the government will often prosecute a a broad crime with many separate sub-definitions of the various way you can break it, then refuse to tell you under which sub-definition you're being charged, meaning you have no way to know if the jury even were unanimously convicting for the same thing and no way to know what you're even defending against.

Could you give some examples of this?

Would the evidence in the Auernheimer case support a CFAA conviction today, after Van Buren (USSC) and HiQ (9th Circuit)

The CFAA claim was never decided in HiQ. The chances of success on that claim did not look good and Microsoft settled

Even in 2014, 3rd Cir. COA seemed doubtful there was a valid CFAA claim

"5 We also note that in order to be guilty of accessing without authorization, or in excess of authorization under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code- or password-based barrier to access. See State v. Riley, 988 A.2d 1252, 1267 (N.J. Super. Ct. Law Div. 2009). Although we need not resolve whether Auernheimers conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published."

https://web.archive.org/web/20140513205343if_/http://cdn.ars...

In this case you have the evidence of what he did and it does in fact look pretty serious.

> his overturned conviction only for wrong jurisdiction

What are you getting at?

If an appeals court says “wrong jurisdiction”, that’s an “rm -rf” on the whole entire case. There’s nothing left to argue about.

What does "incrementing a GET request" mean?

The CFAA isn't super complicated. It basically boils down to:

Don't fuck with other people's shit if they don't want you to.

As far as i can discern, the warrants aren't fraudulent.

Warrants (in the US anyway) require reasonable belief that the crimes listed were committed.

They don't have to be right, mind you (after all, that's what trial is for), they just need reasonable belief.

They also can't recklessly disregard the truth (IE deliberately write lies they know are wrong).

Again, it's okay for them to be wrong about their belief. It's just not okay to know they are wrong and write it anyway.

Here, reading the warrant, etc, there is nothing obviously fraudulent here.

Perhaps it is, of course, but i read everything i could find and it's completely non-obvious which part of the warrant is supposed to be fraudulent.

Even the sort of retaliation claim made here is strange - Arresting you when you appear to actually hvae broken the law is generally only considered retaliation if (among other things) the enforcement of the law is uneven - IE targeted at you and nobody else.

Given the arrest was for a parole violation and they arrest parole violations like this all the time, ....

Like if you are at a traffic stop becuase you ran a red light, call a cop an asshole, and they arrest you because you have 50kg of cocaine bricks in your back seat, it's not retaliation.

Retaliation would be if you call a cop an asshole on facebook, and they come arrest you for violation of an 1825 law that hasn't been used against anyone in 200 years.

Same all around for me. I have a couple of longstanding accounts on local businesses I help out, but it’s all via VPNs that send the owner an email when I connect. I also refuse to do any work unless they ask me in writing. Text is OK, and I screenshot it. “Why did you give such-and-such rights to that employee?” “I have it in writing where the owner asked me to, Your Honor.”

This has never come up before, but it’s easy enough to be diligent about it.

Also: I keep a little paper notebook where I log the work I do for everyone, and occasionally have someone else sign and date it. It’s basically a cheap blockchain IRL. “How do you know you did this before you stopped doing work for them?” “Because the owner signed and dated the logbook after I did the work but before they hired the new IT person.”

I’m suuuuuper nitpicky about diligence in all this, for the protection of everyone involved, and especially me.

For sure, and I’m often the one who makes the list, and one with root. But the big thing is to do it quickly, like within the hour, and diligently. Don’t say, oh, I’ll give him a chance to access his email and download stuff, or whatever. No! Like, cut me off completely right now.

Then, if something breaks down the road, there’s no temptation for them to wonder if I had anything to do with that weird failure.

(And obviously, don’t freaking hack your ex employers! But also don’t even leave the impression that you could.)

Yeah. That’s actually a favor in disguise. Now they can’t accuse you of stealing or destroying stuff on your way out.

BTW, last time I posted stuff like this, someone thought I was treating this like an alibi: “ah ha! Now I can run amok and not get blamed for it!” No. Don’t do that, lest ye end up with a felony and permanent unemployability. I just mean that when things inevitably break due to natural entropy, the first question is often of who had access, and you don’t ever want your name to be on that list.

Having seen the system up close, I hesitate to draw conclusions from cases that don't go to trial. Doesn't really sound like they have the means to afford trial, or at least a chance at a fair one.

This is why in some corners of the internet we adhere to the "not your personal army" mantra.

I think that's why I enjoy using HN most of all. People generally dive into the article and don't make judgmental or charged comments, not mention then curious discussion to be found every day.

This may be overly cynical. I suspect that she's getting her biased account from the only person she knows who is technically savvy: her husband. She accepts this uncritically, and that some very large fraction of the spin originates with him. Some stuff (like ignoring that the drug use violates probation) might be hers, but the rest probably isn't.

This is why Reddit has become a cesspool. Looking at some of the Reddit comments: “fascist, thank trump” without doing any bit of research on the story. Reddit harbors anger and frankly dangerous thoughts from the habitually outraged and poorly informed on details.

Your second case was in the WD of Texas which is where he was arrested - it's just minutia to have him 'removed' to the ED of Texas to face charges where he was indicted - this is the main case there:

https://www.courtlistener.com/docket/16517474/united-states-...

Here's his plea: https://storage.courtlistener.com/recap/gov.uscourts.txed.19...

My recap is acting up a bit so I'll just copy/paste in case it doesn't grab docket entry 158 - the 'factual basis' for the plea:

1. That the defendant, Conrad Rockenhaus, who is entering a plea of guilty, is the same person charged in the Indictment;

2. That the defendant worked as a as a developer services manager, and later an infrastructure architect, for an online company providing travel booking and vacation services to customers (hereinafter, Victim Company );

3. That the defendant had access to and could control computer code located on Victim Company s servers throughout the country, including computer code that controlled business functions such as marketing, scheduling, and payment processing;

4. That on or about November 11, 2014, the defendant remotely accessed, without authorization, the Victim Company s servers from his residence in the Eastern District of Texas;

5. That on or about November 11, 2014, the defendant executed a computer code or command that shut down one of Victim Company s servers, which in turn caused several other Victim Company servers to crash;

6. That the defendant was retained by Victim Company to assist with the restoration of Victim Company’s servers;

7. That during the remediation efforts, the defendant, without authorization, disconnected Victim Company’s servers in Plano, Texas, in the Eastern District of Texas, causing further business disruption;

8. That the defendant’s actions cost Victim Company at least $242,775 in lost revenue and at least $321,858 in recovery and remediation costs.