Topic: The Philippines' first "hacker" conviction

This issue is a potential hornet's nest of opinions. I'd like to hear what you guys think anyway. Yes, I'd much rather listen to BSD peoples' opinions over any other group...

Here's the issue:
We've just had the first conviction under the Philiipines' E-Commerce Act, oficially designated as Republic Act 8792.

Now, this particular piece of legislation, in it's Sec. 33(a), sets forth thus:

SEC. 33. Penalties. - The following Acts shall be penalized by fine and/or imprisonment, as follows:

      (a) Hacking or cracking which refers to unauthorized access into or interference in a computer system/server or information and communication system; or any access in order to corrupt, alter, steal, or destroy using a computer or other similar information and communication devices, without the knowledge and consent of the owner of the computer or information and communications system, including theintroduction of computer viruses and the like, resulting in the corruption,destruction, alteration, theft or loss of electronic data messages or electronic document shall be punished by a minimum fine of one hundredthousand pesos (P100,000.00) and a maximum commensurate to the damage incurred and a mandatory imprisonment of six (6) months to three (3) years;

This was the particular law and particular provision under which the defendant was prosecuted, allegedly for breaking into the computer network of the National Economic Development Authority (NEDA, http://www.neda.gov.ph). The defendant alleged in his trial that he was acting out of the purest of motives (ok, suspend the laughter), in short, that he was being a whitehat and all that, only doing so in an honest desire to inform the admins about the vulnerabilities in their system in the hope that they will patch those holes, and after which the sun will shine on Philippine cyberspace, music from some godforsaken broadway musical will filter through, and everyone will be smiling, heralding the advent of a period of peace and digital harmony (damn my cynicism gets the better of me a LOT of times).

Ok so that's the deal. Guy gets nailed, goes on trial, gets royally reamed and convicted.

Issue: The prosecution used the argument that the defendan't motives were immaterial, the crime contemplated under Sec. 33(a) being "Mala Prohibita." (That's legalese for "We don't care what your intent was, the act itself is illegal, regardless of intent")

The news item that I can readly point to regarding this trial and subsequent conviction is this:
http://news.inq7.net/infotech/index.php … y_id=52070

Now please don't mind the opinions there, those are of politicians and whatnot, and would rate zero on if we were to consider a rational reckoning of the issues presented, raised, and deliberated upon in the trials. I merely point to it in order to show how grandstanding traditional politicians, and even some "new blood" political young turks are crowing about the isue, without really shedding light on the validity of the arguements raised in an arguably important test case.

The following link, however, is important, inasmuch as the author/blogger is one of the prime movers behind the enactment of RA 8792. He is Prof. JJ Disini of the University of the Philippines College of Law, a professor I had the pleasure of studying the law under. (The type who interrupts a long class session with "This is getting boring, let's order some pizza"... that type..and why people love him.) and whose opinion I'd listen to more than those of conviction-hungry prosecutors or worse, publicity-grabbing politicians. In two particular blogs/posts, he raises some questions about how the law was applied to this particular "test case."
http://disini.i.ph/blogs/disini/index.p … log=disini

Thoughts?

Re: The Philippines' first "hacker" conviction

I think it's a good thing. It sends the right message, ie that on the internet too, you need to respect both other people's property as well as other people's will. I'm sure the analogy is already being used a lot, but oh well: I keep my house unlocked most of the time, hell, I usually leave my car unlocked too. This is clearly very insecure, but still I would not at all be happy and appreciative of some random unknown person entering either my house or my car just to show me that it's easily possible. I expect other people to respect my property, and if they don't, I'll try to take action against them within the constraints of my country's law.

As for Giner: white hat hacker or not, he clearly did not respect other people's property when he broke into those servers. His intentions may be good, but then the road to hell is paved with good intentions. In history, there have been lots of people who've brought about desaster with good intentions and a slightly warped perception of reality and ethics.

Also, I have to applaud the Philipini judges: they didn't convict Giner to some draconian punishment just to make their point. I think they were very sensible in basically letting him go free (ok, on probation - but that surely won't be a problem for him, right? If he's a white hat, he'll be able to stay within the law), so it's not like his intentions remained unnoticed. I wish judgements would be as sensible elsewhere too.

Re: The Philippines' first "hacker" conviction

Don't do the crime if you can't do the time, thats my HO.

http://www.0x743.com/vee (the program formerly known as vii)

Re: The Philippines' first "hacker" conviction

I have to agree with perlfan....

If you want to crack someone's system you should be prepared for the backlash if you get caught. I think the "white hat" hacker defense is bull. I would think if he was doing this to show the government it's weakness he should have contacted someone before hand. Hell, if I was to hack my network at work and not tell anyone before hand I'd be in some shit.

"An educator never says what he himself thinks, but only that which he thinks it is good for those whom he is educating to hear."
-Nietzsche

Re: The Philippines' first "hacker" conviction

Stealing someones private information is wrong, but I agree with RMS that technically useful information should be free.

smash the state in '08!

Re: The Philippines' first "hacker" conviction

Thanks for the opinions, all.

For my part, I don't really buy the whitehat defense too, and agree that a prerequisite for any such adventure is to inform the target network's administrators about what you plan to do and get their consent. Lacking that consent, I would have to agree that a person has no business being a digital brown-noser.

My beef, or so it appears to me at this late hour, is the Philippine Department of Justice's "mala prohibita" tack on the whole thing. I believe such a legal approach, if ever it ossifies into "settled jurisprudence," has great potential for creating a lot of questionable verdicts.

Consider: And this is not at all original: If they say that intent is immaterial just because RA 8792 is a "special law" (one that doesnt spring from a jurisdiction's Penal Code), how will the law look upon the owners of trojaned computers? Will it be as simple as "Your computer launched a program which infected another computer in another city, state, country, continent... we don't care that you weren't aware of the fact. The facts as alleged by the prosecution constitute "hacking" per Sec 33(a) and thus you will have to do your time."

And defendant through counsel goes: "If it please the court, the defense would just like to inquire of the prosecution: "What the hell are you smoking?"

This is just one scenario that muddles the whole thing, and which glaringly puts forth the fact that the law as interpreted is far from ideal. I'll have to brush the dust off some books to come up with others, but for now I guess you get the point.

Lousy legislation? Maybe.
Even lousier interpretation? Apparently.
Superior court guidance lacking? Most definitely.

Edit: Grammer, Spelingg

Last edited by mish (2005-11-02 23:11:23)

Re: The Philippines' first "hacker" conviction

mish wrote:

My beef, or so it appears to me at this late hour, is the Philippine Department of Justice's "mala prohibita" tack on the whole thing. I believe such a legal approach, if ever it ossifies into "settled jurisprudence," has great potential for creating a lot of questionable verdicts.

Consider: And this is not at all original: If they say that intent is immaterial just because RA 8792 is a "special law" (one that doesnt spring from a jurisdiction's Penal Code), how will the law look upon the owners of trojaned computers? Will it be as simple as "Your computer launched a program which infected another computer in another city, state, country, continent... we don't care that you weren't aware of the fact. The facts as alleged by the prosecution constitute "hacking" per Sec 33(a) and thus you will have to do your time."

Ianal, far from it, but doesn't this "mala prohibita" depend on action then, if not intent? If your computer is infected by a trojan which causes an attack, it clearly is the controller of that trojan who acts against the target, not the owner of the computer, right? Of course, charging the owner with negligence and thus facilitation of an attack might be an option (and to be honest, I'm not sure I'd really mind - either keep your computers clean or get the hell off the net).

Re: The Philippines' first "hacker" conviction

God I hate these people:
http://technews-isaw.blogspot.com/

Maxlor: Look at this site and you have "good intentions (really now?) gone bad" in the digital flesh.
Note too the glowing/fawning responses to "successful vulnerability tests." It's nothing but a Romanian script kiddie site morphed into Filipinos begging for attention.

If I had more time on my hands I'd like the whole Philippine book on cybercrime thrown at these freaks. Bad thing is they think they're on some goddamn "mission." Yeah. Right.