McDanel did contact managment on several occasions prior to sending the emails out. There were weblogs on his system from Tornado staff visiting his page prior to him informing anyone about the problem.

McDanel included a solution to this problem, to not click on links in email, but instead cut and paste the url into a new browser. The problem had to do with HTTP_REFERER information, Tornado claimed that the *name* of a CGI variable that appeared on the location bar as part of the url was a *trade secret* at one point!!! I have a hard time seeing how anything in the url that you can see is in any way secret or confidential.

McDanel sent emails at a rate of 10 wait 1.5 seconds then 10 more.. This works out to about 6.67/second. The system logs prove that the system had no cpu problems until after admins logged in and shut sendmail (as well as pop3, and httpd) down. As soon as they shut sendmail down no amount of sending mail will cause any cpu load. They did this to delete the already delivered emails (in violation of 18 USC 2701). He did not crash the email server, there was even testimony that people read the email first, then made the decision to take the system down to delete the email.

McDanel did a couple of things that were really dumb. The first was crashing his former employer Tornado’s email system by flooding it. This is malicious and he was just lucky that the company didn’t manage to put together a case that by themselves his three flood attacks caused the requisite $5000 in damage.

Second, he wanted to inform the customers about a vulnerability in the Tornado software that might put the customer’s confidential data at risk, a laudable goal. But by its nature, there is no way to distribute that kind of information without also informing the bad guys of the possible exploit. This is a current hot topic in the vulnerability community. The emerging consensus is that the right thing to do is to inform the company that you are going public with the information and give them a reasonable advance notice, of perhaps two to a few weeks. McDanel did not do so, apparently, and although he had tried to get the company to fix its problems while an employee, they had no way to know that once he left he would go public with the data.

Going beyond what is right and wrong here, as a practical matter it was foolish for McDanel to associate his name with his actions by including in his warning email links to a web site he controlled. I would suggest that he should have posted the information anonymously, if he decided it needed to be propagated. This accomplishes his goals and would have protected him against his 16 months in prison.

I should add BTW that based upon personal experience I agree that Jennifer Granick is worth her weight in gold!

Got anything on the FCC’s assault on fair-use rights with the HDTV copy protection bit yet?

X = Tornado Development (from link in original post)

“Kevin Torf founded Tornado Development in 1995″
http://www.wirelessweek.com/index.asp?layout=article&articleid=CA37334

Now let’s have a home phone number

I wouldn’t call that justice at all.

I think all members of the government’s prosecution team should be taken to jail for the same amount of time. They’ll be more careful next time.

If I find a flaw in a program, I get procecuted? So wrong.. So wrong that he lost 16 months of his life.

The reason I ask is that I NEVER see prosecutors back off a conviction. What I see is “Hey, that negative DNA test doesn’t mean he’s innocent. He probably had an accomplice….”

But there’s also truth to Lessig’s post. What should not be overlooked here are the following:

1. Pro bono. This is not a case in which a wealthy defendant hired a high priced attorney, who was able to get the defendant off on some technicality. J. Granick’s and CIS’s work is done pro bono. Anyone who has a worthy case in her field can potentially get representation. Although probably not enough attorneys do pro bono work, thousands across the country do significant pro bono work. Their efforts often go unrecognized and unreported. It’s just wrong to indict the entire system or ignore the hard work and dedication of many great attorneys who work pro bono (not to mention those who work for public interest, legal services, or indigent clients).

2. The government. The aggressive kind of prosecution at the trial level cannot be defended. On appeal, the government has admitted its error. It is truly unfortunate it took this long for the government to realize its position was untenable, and only after the defendant served out his 16 mos. term. It is certainly appropriate to criticize the government for its position and prosecution at trial.

But we also should not forget — and here I take Lessig’s post as sincere — that the government has taken the extraordinary step of admitting error and asking to vacate the conviction. Had they not taken that step, who knows what would have happened on appeal. Our criminal justice system is admittedly not perfect. In fact, here, a huge error was made by the government and the court below. But people should not undervalue the importance of having prosecutors who admit they’ve erred when they realize it. It takes integrity of person to voluntarily admit those mistakes. I know, this time it took at least 16 months too long for the defendant. Better late than never.

How about being ordered to pay restitution? How about probation? How about a stern “Don’t do that again” ?

How about laughing these turkeys out of court because they should have thanked the guy for helping them improve their crappy product?!

I see a massive civil suit in the offing. I also see a serious lack of common sense in our legal system.

I’m sorry but I can see very little reason for “pride” in any aspect of this case or its eventual outcome. My perspective (refreshingly an Australian one, where we possess a British-derived legal system that exhibits at least some separation of powers between the judiciary and the legislature (lawyers and politicians for short) ) is that this whole sorry affair is yet another sad indictment on the nature of the US legal system.

Presumably, experiences such as these are characteristic of the so-called system of “American justice” that President George W. Bush seems so keen of late to export and promote to other parts of the world!

Frankly, over the last few decades, the US has built itself into an incredibly litigious society where obvious errors of law seem par for the course, and only those priveleged few with the means to afford proper legal representation are likely to achieve a just outcome. Does this sound like “justice”? It’s certainly not the kind of system I’d like to see here any time soon, or of which I could comprehend anyone feeling proud.

Basically from what I have read and understood a prima facie case could be made that the federal agents perjured themselves to achieve the original conviction. If the US justice system really is fair and equitable, it would now pursue those responsible for the frivolous original prosecution with the same vigour as that brought upon the now-exonerated defendent (victim?).

Call me when it happens. I won’t hold my breath.

Regards, Dave

I would say that we must ensure that this never happens again, but as the Cigarette Smoking Man said in the X-Files, “it’s done every day.”