His life is in someone else's hands now, and will be for as long as the government wants. He might be fully reabilitated and regret his actions and they can still write him off as completely nuts with a simple signature in a document - and no one will put the doctor's statement through scrutiny.
Stuff like this is why I’m glad Ken Kessey’s “one flew over the cuckoos nest” become popular and helped remove government mental hospitals from being a serious consideration in the USA.
This kid needs to be cultivated, not institutionalized.
(Edit: never mind, seems he IS a menace to society)
Most people respond with patience, because they understand deescalation is their best move. This person has Autism. I think it's not a leap to conclude that he simply doesn't understand that deescalation is the right move. He may not even realize or totally comprehend that deescalation is an option!
If you want to convince me this person is a menace to society, then talk about his behavior before being arrested. What did he do then? Oh, that's right, he shared video of an unreleased game... Why should I, or any other person feel threatened?
Can society understand how to behave around him? Has society even tried?
I'm not working to give up that easily. This is a person with the rest of his life ahead of him; and that life has been locked in a room, and declared his responsibility.
All you're doing, in this interaction, is questioning endlessly. You don't have any proposals.
How do you propose, exactly, that society handle a person that openly admits that they'll do whatever they see fit and decide for themselves what rules they'll follow? And we're not talking about minor rules and infractions, we're talking about major ones like 'don't be violent' and 'don't stalk and terrorize women' and 'don't run a doxxing website' and 'don't extort and steal'
Answer me this: _why_ does society need to 'understand how to behave around him' ?
What's the benefit to society?
The guy stands up in court and basically says 'yeah I don't have any remorse and I'm gonna keep doing it because I don't think it's wrong' - why do we need to try and understand that more?
The only evidence for this is heresay by the prosecutors.
> 'don't stalk and terrorize women'
As has been pointed out by others in this thread, that was a different person. Go read the article again.
> 'don't run a doxxing website'
You've got me there. But I don't think that comes even close to justifying an indefinite sentance.
> 'don't extort and steal'
Yeah, he shouldn't have done that. But as I said before, it does not at all justify an indefinite sentance.
> The guy stands up in court and basically says 'yeah I don't have any remorse and I'm gonna keep doing it because I don't think it's wrong' - why do we need to try and understand that more?
That is completely false. He is never quoted as saying anything to that effect. Rather, this is the closest thing we get:
> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."
Perhaps the question should be what about cyber-crime he is motivated by. There is no indication that the motivation is anything malicious. It may be thrill that he is motivated by. If that's the case, it should be treated as an struggle with addiction, not evil.
I just sense we're never going to reach an agreement here.
My opinion, in short, is that people exist who simply thrive on chaos and drama. If you've met a person like that or have one of them as a member of your family, you understand. You understand that the power to destroy and create drama gives them a thrill that literally nothing else will ever come close to. You can't treat it, it's very hard to redirect (literally the _exact same activities_ will bore them if the outcome is positive rather than negative) and you can't reliably use them as part of a 'red team' because the first thing they'll destroy is the team cohesion.
If you have any teachers in your family ask them 'do you think that some kids are just born wrong' and they'll tell you all about it. They've seen it.
> How do you propose, exactly, that society handle a person that openly admits that they'll do whatever they see fit and decide for themselves what rules they'll follow?
Here's one method: We simply remove that person from the society, because society is made of rules, not people. In a word: fascism.
Here's an alternative method: We better involve that person in the rule-structuring process. We do our best - through education, therapy, and socialization - to expand our common ground into shared goals; because society is made of people, not rules. If the person is unwilling to participate, then we give them judicious punishment. As a last resort, if the person is a threat to the safety of other people, we remove them from society. In a word: democracy.
The benefit to society is the recognition that both rules and people are living and changing. We can recognize that society is a system, and empower people to be in control of that system, rather than allow the system be in control of us.
> If you want to convince me this person is a menace to society, then talk about his behavior before being arrested. What did he do then?
He's part of a hacker group who steals data and extorts companies for money. And he talks about how he can't wait to do more crime when he gets out of lockup. It's all there in the article.
I know, crime against big companies isn't "real crime" as far as many are concerned, but these companies employ real people, and when they take a big financial hit due to cyber crime like this, it can affect peoples' jobs and livelihood. Because the companies will choose to keep paying the CEO a ridiculous sum while laying off lower-level employees to even out the cost of the ransom (if it's paid) or the financial loss caused from the data leakage (difficult to estimate, but a material loss nonetheless that the bean counters will have to account for).
The article also mentioned how they stole from individuals' crypto wallets.
Did you miss the part about assaulting staff and property destruction.
What about the part where he continued hacking after being busted the first time and released on bail.
Its pretty clear that the kid poses a danger and doesn't understand that he needs to stop.
This isn't a youthful prank/indiscretion that went too far. This kid was on trial for causing millions in damages, and then did it again while on trial.
Yeah, institutionalizing people has a horrendous history, but this kid is incredibly destructive, and has proven that cannot control himself or will go out of his way to do the wrong thing. The only viable alternative to a supervised medical setting is jail for him.
He was ordered to remain under supervised medical care until a doctor determines that he is mentally fit to stop causing harm. This is as a result of both his hacking, his assaults on caretakers and destruction of physical property.
He also told the court that if he was released he would go right back to doing crimes.
Just because a company chooses to spend millions of dollars to "repair" damage does not mean that the damage itself should be valued the same. We are talking about companies with tens or hundreds of billions of dollars at their disposal. An executive could choose to spend $5 million on anything: that doesn't make the thing that valuable.
His actions have physically injured people, destroyed property, and caused hundreds or thousands of people to spend otherwise productive time on fixing things.
This wasn’t some hacker poking around because he could. He was stealing assets and then trying to ransom them back. He also just straight up stole crypto.
> This wasn’t some hacker poking around because he could. He was stealing assets and then trying to ransom them back.
If he managed to do that using nothing more than a TV and an Android device, I have absolutely zero sympathy with his victims. In the end, I'd even classify that as a public service, getting these companies to up their security game at least to some standard.
> He also just straight up stole crypto.
And here I have even less sympathy. I have grown to hate anything crypto-currency with a passion, simply because it's even more enticing to criminals than a locked safe room full of diamonds.
Don't get me wrong: It's still not correct what he did. Lock him up in prison like every other random criminal. But it's not "lock him up for life"-worthy, not by any means.
Saying that you have no sympathy for their assets being stolen just because they chose to use a form of store of value you disapprove of, shows a great lack of empathy.
What does it matter what form your wealth takes? Whether it's in a bank, in cash, in gold, or in cryptocurrency is an unimportant detail. What matters is that you have every right to keep possession of it.
Kurtaj has been charged with three counts of blackmail, two counts of fraud, and six breaches of the Computer Misuse Act.
You keep saying that he was given a life sentence. He has not. He has been ordered to live in a hospital until he is deemed by a professional to no longer be a danger to himself.
Hundreds of thousands of man hours have been spent at the companies he hacked and in the justice system on his behalf. If you were the one whose crypto account he cleared out, or one of the people responsible for cleaning up after him, or even one of the lawyers trying to defend some idiot who tells the court he plans on committing more crimes as soon as he is released you might feel different.
Do you think any of these people wanted to spend their time on this, that otherwise important things weren't delayed and sidelined? Do you think that the people he stole crypto enjoy having to work extra hours to make up for what he stole?
His crimes weren't victimless, and plenty of real people were impacted in serious ways. This wasn't some kid who pushed his computer skills a little too far and went somewhere he shouldn't. He engaged in an international conspiracy to extort millions using stolen data.
There are kids that age who commit murder and other serious crimes, and they should face consequences just like he is. But the grand majority of kids that age get through life without committing any serious crime at all.
He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults.
On the scale of things, what you describe is not "incredibly destructive". Many, many people have done worse (many legally). It's a crime (I never said otherwise) but not a big deal relative to very many other crimes - Rockstar didn't face any material danger; the justice system has lots and lots of cases going through it. I'd be more concerned if he was committing serious violent felonies.
> He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults.
Granted. I was speaking more to the general frustration of defense lawyers who have clients that say things when they should have said nothing.
> Hundreds of thousands of man hours - What is that based on?
A guess from years of working for large tech corporations. A company level crisis of this magnitude sucks in a lot of people from a lot of departments. Add in all the other time spent by investigators and the courts, and I don't think I'm overestimating at all. Now multiply that times the 11 major breaches he was part of.
> international conspiracy - All the hyperbole undermines your point, imho.
Arrests were made in Brazil and the UK. Organizations from at least six countries were attacked. They attempted to extort millions from multiple companies. Personal data from 300k people in Argentina was released. They took down the site for COVID vaccination records in Brazil. Rockstar was the 11th attack and one of the less harmful ones, I'm not sure why people are so focused on that one. What about the leaked personal info, what about the impacts to Brazilian health ministry and Brazilian citizens? These weren't explorers just getting in to see if they could. They got in, pillaged data, and followed up with more crimes. They certainly conspired, and it was certainly international.
I'm not saying that this is the most heinous crime an 18 year old can commit, and I never did. I am simply saying that this was more harmful than a lot of people think, and if it was mental illness that caused him to do it, then it is pretty reasonable for the court to say that he wont be criminally liable, but that he is required to get help before he is trusted to be out in the world again.
From an IT security perspective this sounds detached from reality to me. If one kid can do this to your organization, someone isnt doing their job. Given economic competitors, hostile nation state actors and the possible stock market impacts, this isnt a matter of people having had better things to do. They had this to do and they didnt. The resulting extra cost is how you get your company to fix these things. Yes its hard, no it doesnt mean you get to ignore it because police will handle it.
Not a moral argument but a very practical one. If somebody like that manages to find a hole in your process big enough to exploit yet dumb enough to get caught you should feel really lucky that nothing worse happened (that you know of) with the hole you just got notified you had all along.
It wasn’t one kid. It was an international group of at least three people (known so far), and likely more.
Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
>It was an international group of at least three people (known so far), and likely more.
I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers.
>But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable.
While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that.
Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.
You see all those homeless people? The tent cities? That's because they have nowhere to go anymore. A ton of those people are mentally ill.
Yes, those mental hospitals were terribly run. But we need to create a safe place for these people. We can't just give up because of mistakes made in the past.
all those homeless is incredibly generalizing, there's many reasons to be homeless. but the top ones are drugs and mental illness.
many are drug addicted, they would have somewhere to go but they opted out of society (well, they aren't in the forest so not full opt-out)
but yes a combination of state run rehab / mental hospitals seems to be the only solution, but is it done by force?
if it's not forced you'll have a hell of a time getting people to go. if it is, you are now rounding up potentially unwilling people and shipping them to a facility.
Yes, of course. Do you really think most of these people even in the care of their own family would have complete agency over their lives? No, they'd be declared unfit and their Power of Attorney would be delegated to someone else.
The mental hospitals were closed. Now the mentally ill are largely homeless or in prison.
They closed something bad and brought no alternative because it’s easy for a politician to score points by appearing to solve problems in the short term but providing no long term solutions.
> Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.
> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack.
>Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.
This sounds too fantastical to be true.
This guy is obviously brilliant, disappointing that he squandered his opportunities.
It really doesn’t sound that crazy. Like, almost everyone on this forum is capable of doing this from a technical perspective, right? Almost none of us would have the desire to do this, but we could figure it out if we did…
I suspect this is being brought up in an attempt to demonize and pump up this guy's hacking skills to reduce the embarrassment of targeted companies but also of police. He presumably was in police custody at the time and they were meant to deny him internet access, but weren't competent enough to understand that these devices can be rooted & turned into a general-purpose computer. Therefore, rather than admitting this (obvious) mistake, they're trying to make it sound like installing a chrooted Linux environment or RDP/SSH client on such a device is some advanced hacking skill.
It's tough though, how do you know that they won't use those skills against you? The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can.
Would be great to have them on the "good" side, but would probably take a lot of energy and resources as well.
Hopefully this story will have a somewhat happy ending, because it seems to not end yet.
He'd need a dedicated handler, and even then judging from the article's portrayal he seems like a hopelessly unmanageable type. He'd fit in with a modern-day A-team, come to think of it.
Could set him to work on hacking official state enemies, but you'd have to expect that he'd still engage in side-projects against whoever pissed him off or he had contempt for.
> The individual seems relatively unstable and violent, even saying during a sentencing hearing that they'll continue to do illegal breaches whenever they can.
Admitting you will continue to fight evil is not evil.
That wouldn't work, you could never trust him at all, as he's expressed zero remorse and actually intent to continue to do crime, and is apparently very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable as a white hat hacker
> very strongly autistic & doesn't understand the complex nuances of what is acceptable and what is not acceptable
This is a popular framing of autistic people but this assumes the problem is complex nuances. Most of the time it's not very nuanced at all. The problem is that autistic people are less likely to follow rules they don't agree with or see as arbitrary - in the positive this is sometimes described as a "strong sense of justice" but that phrase ignores that the perception of what is or isn't just or unjust can vary.
Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.
>>> The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.
This is exactly what I was referring to. We agree.
> Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.
Having seen that play out in real life before, I don't think he'd be as much of an asset as a liability. The problem with white hats is they need to have an interest in following some set of rules. With this guy it sounds more like his rule set is defined by whatever he finds interesting with little concern for legality or what others might find acceptable.
It's similar to the problem with the asshole genius programmer. You can keep him around because he's a genius but being an asshole in a position of authority over others (by virtue of being a genius) will result in people not wanting to work for you and this can easily mean you're missing out in individuals or teams that would vastly outmatch the asshole genius.
Maybe the only thing more dangerous than holding someone in a "hospital" as a sentence is to allow an employer to decide if they should be allowed out or sent back to serve their life sentence. It's just as bad as H-1 visas, or allowing illegal aliens into the USA with babies who are not given US citizenship. (I am not taking sides on whether we should give US citizenship to those people, deport them, or what. I am pointing out that making someone the slave of their employer is bad for society.)
You might as well say "He has psoriasis, he might also be an axe murderer." No, one fact doesn't preclude the existence of other facts, very good. That doesn't mean that making stigmatising connections is reasonable.
He's a kid that "found" some pictures of an upcoming game, using dodgy means. But these pictures were publicly accessible, he didn't deceive an actual human to get them. Making them hidden, but public was a mistake by the company.
The real reason this happens is that the police doesn't understand, wants to punish the kid ... and youth services has lobbied so that locking up minors DOES NOT REQUIRE PROOF at trial, does not even require an actual accusation of a crime, in fact the kid gets none of the normal legal protections (because this is a 6 month prison sentence, in that the kid gets locked up, and could be an 18 month prison sentence)
During this time, the kid will be denied school, denied access to internet, books, friends, most of his family, he will be physically locked up (sometimes in solitary, although they get regularly accused of locking up autistic individuals for weeks/months). Oh and there is CONSTANT violence in these places.
But fundamentally this happens because there's no fair trial for minors. Why not? Youth "protection" keeps complaining that with the actual legal rights they can't do their job (or arguably even human rights, schooling, not being locked up unless convicted with full legal rights (not the case here), not locking up long times in solitary unless absolutely unavoidable (ie. NOT because of lack of funds and therefore no personnel for supervision), ...)
A fair trial against this kid would have failed since he was caught by illegal means (the police committed a crime to lure him into a trap, which is NOT legal, and frankly totally immoral).
I hope if you do security related work, remember this case. If you expose a security vulnerability, and get offered a job, there's now many examples of that job being an excuse to get you thrown into prison for years. Oh, and DESPITE this being totally illegal for the police to do.
Youth services can't do their job with normal legal rights for minors, because minors talk, and are aware with youth services offers (getting locked up without school, without friends/family, with constant punishment, and then at the end of it getting kicked into the street without any help). Although Youth Services lies about this to kids, it tends to be well known in the cities and "results in a lack of cooperation" (translation: kids, correctly, reason that they're better off abused than helped by Youth services). Oh and it doesn't help. Especially because the "kicked to the street" part, especially kids that don't have parental support for some reason, immediately turn to crime. And, of course, after a place like this, they don't want to be helped by anyone and hate the police.
The overall treatment of children, especially teenagers, in society is absolutely shocking. Literally they are like slaves. As a child, the family can be the single most tyrannical thing we will ever experience in our lifetimes. It can be a mini totalitarian dictatorship if you are unlucky to have bad parents.
In 100-200 years time from now people will be talking about this, just as we look back to barbaric times in the past now.
I don't know about you, but if I said someone doesn't have empathy I would think that I'm the one lacking it, since I can't possibly imagine understanding that person or their feelings.
Autism doesn't preclude empathy at all. In fact, I would say it augments it once the other person's feelings are understood. What's generally lacking is realising the other is feeling in a certain way until it's explained to them or they have otherwise rationalised that feeling. Which, relatively ironically, will never be enough to make a neurotypical person feel empathy.
He may have emotions but certainly he doesn't care about those of others and the damage he can provoke. He actually wants to continue to be a criminal.
FTA:
A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."
The guy needs help because he's autistic, and watched closely because he's also a sociopath.
Ah, the classic debate of whether biologically a clump of cells constitute an entire person or "victim", or is it something we are made to believe due to our teachings/religious beliefs. Out of the biggest global religions, 2 out of the 3 Abrahamic religions allow abortions, when necessary and if the mother is at risk. By that logic, abortion is allowed and should be done whenever necessary for the health of the mother. Allowing women to apply their rights to their own health does not make our society a majority of sociopaths.
I am not saying to use abortion for irresponsible actions, but abortion in it's self, is not a sociopathic activity.
> allow abortions, when necessary and if the mother is at risk
I would like to know if there is a case where the baby is viable where it's necessary to kill the baby and remove the dead baby rather than removing a living baby?
I am concerned that if you give me a problem to solve (a sick pregnant woman) I might remove one complicating factor (the baby) to simplify my work load.
I know in Texas, during the era of Roe v. Wade, if a doctor recommended an abortion saying the baby was non-viable and was wrong, there was no liability on the doctor. If the doctor recommended against abortion, and the baby was in the least bit deformed, the doctor could be held liable for millions of dollars. This lead to a lot of pro-kill-the-baby bias.
"empathy impairment" is a fundamental feature of autism. It's not stigma. It'a not universal, but it is a major part of why it's a disorder in the first place.
As someone with autism, I lack empathy for (most) fake situations. Once I realized therapists and their ilk were lying about sad stories, I stopped having empathy for those sad situations.
Ditto for fake news stories.
Only mentally unfit people can pass a therapist's tests and be empathetic for people they know do not exist.
Let's flip this around: think about what you just said.
you seem to be implying that feeling empathy for characters in work of fiction is clearly "normal" if somebody doesn't think that way it should give them pause. What you said may be construed as "hey you freak, if you only think for a moment you'll obviously notice that it's perfectly normal to feel empathy for fictional people, after all story telling is such a fundamental human feature that if you're not feeling that way there must be something wrong with you or at the very least it's you're fault because you're not thinking hard enough about that".
Of course, I'm not saying you actually believe that or accuse GP of that, but words and tone matters and can hurt. Think about that
Ummm feeling empathy for fictional characters is something that should be considered normal. If you find yourself not able to do that, you should understand that you may not be neurotypical and should get a diagnosis to understand what other blindspots you have in life that you should be aware of.
And that's fine. Does it make anyone less empathetic if they don't though? At least where it matters - where someone else's feelings are involved vs. literally no one else's (since they don't actually exist).
I should have added: I also dislike being manipulated. I fail silly tests at work because I find them demeaning. If you want to know what I do on the job, drop by and watch.
This is relevant to psychological evaluations because the tests are so silly and contrived, and go on for so long, that I lose patience with them.
TL;DR: that's an outdated idea with an ever-growing body of research refuting it
Autistic and neurotypical people can empathize with others like them, but have trouble between the groups [1]. This is called the "double-empathy problem" by the paper which proposed the idea [2]. More recent papers explore subjects such as information transfer accuracy [3] with the same results: autistic participants understand each other perfectly well when allowed to use their preferred means of communication, as do neurotypicals. However, the two groups have trouble understanding each other. Further work extends this to a generalized model with extremely unsurprising results: people tend to be closer with people who think like them [4].
Personally, I think that a skilled exploiter is the one who finds such an easy loophole and exploits it efficiently and first; not the one who writes the most impressive code or finds the deepest algorithmic backdoor. I respect social engineering as much as anything when it comes to this domain.
shouldn't they at least try to use this kid for good instead of locking him up ?
but then who know maybe a 3 letter gov agency will take him to a bunker somewhere
"Use" implies control / coercion, given that this guy doesn't seem to respect authority, that's not going to work. You can't make anyone work for you or "do good".
Is it? I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?
The fact this is even mentioned really smells like they're trying to make this guy sound more skilled and evil than he really is, potentially also to cover up for the fact that the police made an oversight in letting him be around internet-connected devices even though their instructions was to not provide him internet/computer access.
I'm not downplaying the GTA hack (although I would still bet good money it was typical phishing/social engineering rather than anything more advanced), but I'm disagreeing that him doing so from a rooted TV stick or phone makes him any more of a monster than doing so from a typical computer.
This is a really great angle and perspective to add in - I agree a noted habit / trend / short-hand in “severity” sometimes with technical subjects. I read through and also have heard some similar routine prep stories. Unusual? Absolutely!
Then again, it’s also unusual for a Dodge dealership in North Texas to have 7 Hellcat vehicles stolen in one night, but here we are.
So, I pick up that maybe the tech stack isn’t the most priority point - it’s the determination. The desire to continue through any avenue. Add that in with, reportedly a physical violence time in life, the persistent threat maybe can heal out of it?
The statement in the article would sound to a non-technical audience like this guy is some sort of hacking magician, and I'm sure nobody minds this perception for the reason I mentioned above.
I'm just providing a counterpoint as well as a reason why there's an incentive to make this guy sound more skilled & evil than he really is.
> I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?
Installing it is nothing: 2 touches away.
But using this crappy Android experience (where the on screen keyboard obscures half of your terminal) shows talent and dedication.
I imagine this is where the Firestick and TV came in - screencast termux or ConnectBot to the TV so you can use the phone in horizontal mode as a larger keyboard.
> I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device
Installing a Linux environment or SSH client on a Fire Stick in a hotel without access to a laptop?
Not familiar with Firesticks- is there an app in their App Store for SSH?
This is typical writing from people who aren't familiar with technology. Could this kid be a genius? Maybe. It's more likely he found exploits like the ones we're seeing on the front page today[0]. It's not super impressive or surprising, to me at least.
Life in prison for non-violent crime clearly sounds like revenge and sour grapes. The big guys clearly don't appreciate having their insecurity being exposed this way (keep in mind none of these hacks required any significant technical skills), and too many people would lose face. Something had to be done, so here it is.
The disparity of this punishment compared to what is usually given out for similar crimes (in the vast majority nothing as it doesn't even get investigated) suggests there is definitely some "saving face" motivation behind this sentence.
He’s being confined to a mental institution due to severe autism. It’s unlikely that he can be rehabilitated and would remain a cyber security threat to society if released in the future.
This guy is as much of a "cyber security threat" as your typical socially-awkward gamer teenager, of which we have plenty of. Every internet-connected server out there constantly gets probed by bots/tools often operated by similar people and nothing is ever done about it.
This guy's crime wasn't that he was hacking/phishing/stalking or the general obnoxious behavior that often comes with this kind of person - this is effectively decriminalized in the UK anyway, as long as the victim isn't a big, culturally-relevant company. Financially-motivated scammers and crime rings take advantage of this.
This guy's crime is that he embarrassed the establishment, so he has to be painted a much scarier monster than he really is and made an example of, since the truth that most technically-inclined, socially-awkward teenagers would be equally capable of such hacking would be hard to accept and put into question the competence of the affected companies.
It doesn't take any skill to install a chrooted Linux environment or RDP/SSH client on a Fire Stick or Android phone, and said skill is orthogonal to hacking skills that could be deemed dangerous to society at large.
The fact that this is explicitly brought up smells like they're trying to make this guy sound much more dangerous & evil than he really is. After all, had he discovered/used zero-days or developed exploits, that would be a real talking point, but if the only thing they've got is "he managed to get a shell on an android device" this smells of clutching at straws.
All that means is that he used his phone and another android device (the fire stick) + the TV as a monitor, to access whatever remote machine he has via SSH, not exactly rocket science
And that's the point, the propaganda machine is working overtime to paint the kid as some horrifically dangerous criminal because he exposed the clowns in power that easily could've pdevented all this.
I don't see how the grand-scale theft and extortion run by Lapsus$ is remotely comparable to the behavior of a "typical socially awkward gamer teenager", even a particularly unethical one.
I don't think this is fair. Another underage person found guilty of the same hacks got an 18-month rehabilitation order. This basically means severe restrictions on going out and computer use together with involvement and monitoring by social workers. This seems perfectly appropriate. They're not having decades of their life taken away from them, and they're not locked up with hardened criminals who would either victimise them or teach them to be much worse.
The indefinite order is because the kid committed multiple assaults and other violent acts while under observation in a mental hospital. Doctors don't believe he can be released in the foreseeable future.
If you were arrested for unpaid parking tickets and then demonstrated threatening, violent and out-of-control behaviour while in police custody, then in a secure unit, you might get a similar indefinite order.
In what world do you live in where getting too many parking tickets and causing violence gets you life in prison until an unknown paid state employee decides you took all non-necessary meds and drank the kool-aid? If someone was killed they would get out a certain date. The judge should have to suffer the same fate before he can order this.
> If someone was killed they would get out a certain date.
No, there are lots of people (in the United States) doing life without the possibility of parole. There are many people who will never be released from solitary confinement. Some of these people were incarcerated for fairly trivial crimes and all subsequent punishment was for acts committed while in prison.
What do you think happens to people who repeatedly cause injury to corrections officers, attempt to sexually assault them or infect them with HIV, etc? They are eventually put in solitary for life.
Some people will never be released from prison because of single acts which they have never repeated, but also are not willing to ever show (real or simulated) remorse for.
The system for people with severe mental health problems who commit repeated acts of violence works differently but is similar in its effects. Some of those people never get out, and they knew with decades of life left that they would never get out. In the UK, there are many quite high bars before a criminal convict can be incarcerated forever without chance of release. But it's much easier to block release forever from someone who is insane and considered dangerous.
The system for sex offenders works in a very similar way in some places. Some sex offenders, not the worst offenders, can be in a situation where they will never be allowed out, or being allowed out is so unlikely that it will never be worth it to them to spend years complying in order to attempt to be released.
Most jurisdictions have some method by which a person who a) did something to get them within the system, b) committed repeated assaults or threats while within the system and c) did not show that they had radically changed their attitude, will never get out. The details vary but they always exist.
My suspicion is that in most places, people in this situation vary from almost harmless: suffered bad luck and a lack of comprehension from decision makers to extremely dangerous: very hard to imagine how they could ever not be an extreme threat to innocent people outside of incarceration.
How much would that get someone on the street committing the same crimes? Maybe probation or a couple years of jail at most? That's what I'm comparing it to.
If we were routinely jailing people that had trouble controlling their emotions and had propensity for violent outbursts we'd have a lot more people in jail, so I don't believe this alleged violence was really what got him this sentence.
Similarly, how much would someone get for scamming/hacking/social engineering a small company or individual? Well that one is easy to answer: nothing - this behavior has effectively been decriminalized in the UK.
How they define "violent", "injury", and "property damage" is very much important though. It could be as light as knocking a mug off a desk and breaking it or them accidentally tripping someone and causing them to get a minor bruise, or it could be to the extreme of assaulting someone or arson.
Curious to know what their definitions and their examples of this behavior are regarding this person.
I don't see violent crimes as necessarily the worst. Crimes that steal from large numbers of people are arguably worse than many types of violent crime due to the sheer magnitude of lives that got destroyed. If you destroy 10,000 regular lives through fraud you deserve the worst punishment in line with murderers. Although this guy's long sentence isn't only because of what he stole from Rockstar, my commentary is not only about him, it's more of a broader point.
Definitely not. But I would say scamming thousands of poor people out of their life savings (e.g. FTX) is worse than violently assaulting someone. Violence isn't a necessary condition for a crime to be among the most damaging to victims.
Seems reasonable to me. Glad there aren't any comments yet saying "oh gosh it was just a video game company, those are a scourge anyway on family morals!"
Not to me, it's a slippery slope. Want to give someone a life sentence? Cool, all you need to do is to stamp the autism label on them and put them in a secure hospital and convict them for a crime that would get like 5 years in prison.
The point is not the details (I'm obviously not a laywer or anything remotely related to that), the point is that it seems to be a slippery slope.
> Cool, all you need to do is to stamp the autism label on them and put them in a secure hospital and convict them for a crime that would get like 5 years in prison.
> He will remain at a secure hospital for life unless doctors deem him no longer a danger.
So he's confined for life. Confinement is confinement, whether it's a prison or hospital.
This definitely seems like a case where the government found a "backdoor" to allow them to get away with confining someone for life, even though they probably couldn't do through the normal criminal justice system because the punishment doesn't suit the crime.
Yep, this is my issue with it. Also, it’s autism for now. What if it slowly spreads to other diagnoses? It could slowly lead to a more authoritarian punishment environment. Things like this can grow slowly but 50 years down the line and voila: a new repressive state is born.
Obviously, that doesn’t need to happen. The fact that it could scares me
I am not sure the consensus here would ever consider relative moral value of attacking a 'bad guy'. I am personally saddened that a clearly brilliant mind will waste away. I, for one, do not doubt that his skill could be put to good use. Not to search, I remember being a kid and saying all sorts of things that would get me in trouble today.
For anyone who skips the article and comes straight to the comments, this is not because of the hacking. This is because of (alleged) violence and expressed eagerness to return to cybercrime.
> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.
> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cybercrime as soon as possible. He is highly motivated."
...
The details are absolutely wild too. I mean...
> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack. Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.
Holy shit, dude. This is the sort of thing they make movies about. I wonder how much of it is true.
He was apparently shown to be a member of a cyber "gang", and expressed zero remorse. In this case, a judge basically has to do something.
> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cybercrime as soon as possible. He is highly motivated."
The guy was already on bail for another hack:
> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack.
> He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four million dollar ransom, which was not paid.
> They also stole directly from individuals through their cryptocurrency wallets.
So:
> He will remain at a secure hospital for life unless doctors deem him no longer a danger.
Hospital b/c of his severe autism. Ostensibly, what has to be done is rehabilitation. If he can even lie convincingly, he'll be out tomorrow.
The title of this post is manifestly wrong. Being locked up for an indefinite period is not the same as being locked up for life since he can be released at any time.
But having said that, being locked up "at His Majesty's pleasure" as this is called is s scary sentence, since you can indeed end up in prison for you whole life if you do not have the support of the relevant doctors.
The conspiracy theorists here should remember he was convicted by a jury and can appeal his sentence like anyone else. If that's insufficient come up with a better system.
Yes, I read the article. It's full of expectations.
There is the expectation that someone should be punished severely for hacking a multi-billion dollar corporation.
There is the expectation that that punishment will result in them just never hacking again.
There is the expectation that a person who is arrested and threatened will respond with patience, and not with their own violence.
There is the expectation that the well-known symptoms of Autism will just magically disappear whenever they conflict with the above expectations. If not, it's the fault of the person with Autism, not whoever set impossible expectations.
---
All of these expectations have a common theme: they are leveled at this one person. He's a teenager with Autism! It doesn't matter: we have expectations, and they have to be met.
Fuck that. I have expectations of my own.
I expect that a justice system will actually try to meet people at their own level.
I expect that a justice system will attempt to resolve mental health with treatment instead of violence.
I expect that a multi-billion dollar company will respond to hacks with the only effective method there is: strengthening their own security. Anything else is just a waste of breath.
My expectations are not being met. There's not a damn thing I can do about it, either: I'm not the one with billions of dollars at my disposal.
He is being met with treatment instead of punishment.
He stole and extorted, assaulted people, and destroyed property and was convicted of actual crimes. They did try to meet him at his level. They released him pending bail and he committed more crimes. He told the court that if they released him he would continue committing crimes. They aren’t sending him to prison though, because he isn’t mentally fit. They are sending him for medical treatment, at no cost to him, until he is determined to no longer be a threat to himself or others.
This seems far more humane than sending a mentally unwell teenager to prison where he certainly wouldn’t get the level of care that he will now.
The primary crimes we are talking about are not the violent ones. They are hacking.
You are welcome to disagree with me, but I don't believe hacking Rockstar to get a peek under the curtain should be a crime. So what if we took that part out of the story? What would change? Everything. The whole story would be completely different.
---
Call it treatment all you want. The goal has already been laid out, and it's not rehabilitation.
Have you ever been in a mental hospital? They do important work, but that doesn't change the reality of what they are. It's a prison with carpets. Trained guards are prepared, not only to detain you, but even to sedate you.
Yes, they exist for treatment, but that doesn't make them a good fit for everyone. We can, and should try other avenues first. I'm not content to throw up my hands and give up on this person. I'm not content to accept this system as the best our society can provide.
> He is being met with treatment instead of punishment.
Treatment? From the article:
> He will remain at a secure hospital for life unless doctors deem him no longer a danger.
That sounds like punishment. For indefinitely long. Without even a trial.
If this were about treatment, we'd have details about how he'll be treated and for how long and the chances of success. Instead, we hear only about his punishment and vague scare-mongering about why it's necessary.
The Rockstar breach was just one instance of criminal behavior. This individual is clearly dangerous and should not be allowed back into society. There is a pattern of blatant disregard of the law, it's not like he's a grey-hat or even black-hat security researcher.
The law is unjust to begin with. I don't blame anyone for breaking it twice. Would I recommend it? No. That doesn't mean I have to judge them for it.
The scary behavior here is his violence; but that violence was clearly a reaction to the violence he was confronted with: being arrested and threatened. I'm not convinced that he is a threat to society.
Sure, I can agree that it was wrong for him to react with violence. But what else could I reasonably expect from someone with Autism being punished for technically-illegal behavior?
Have you ever spent more than 10 minutes with someone who has severe Autism? If you have, then you know not to expect them to be great at following arbitrary rules. That doesn't mean they have to be institutionalized!
The solution to this problem is well-known: treatment. It's clear that that is not the goal in this case.
OK, so prosecute him for fraud. I would totally support that.
My criticism is that we aren't talking about fraud: we are talking about hacking. We are talking about legally-enforced secrets.
We are talking about a violent reaction to being prosecuted for hacking. What if was about the fraud instead? Would his reaction be the violent then? We can never know.
I'm supposed to be afraid to live in a society where this person participates. Afraid enough to sacrifice the rest of his life. I'm not convinced.
It's my computer, or rockstar's computer, or whatever. You have no right to access any of it. Whether it's a stupid game or something serious doesn't matter; that's for me to decide, not you.
The only exception here is good-faith intrusion testing and the like, but fundamentally: my property, none of your business, misusing my property is a crime.
This is a view shared by literally zero people. It is so lacking in basic reasoning and logic that it's almost frightening to see it on a normally more rational site like Hacker News.
Let's change the wording around a bit. What makes hacking a "game company" exempt from normal ethics into breaking and entering?
What if the "game company" consists of only a single employee who uses their personal laptop? Totally fine to break into their computer and steal their data right?
Why stop at "game companies"? How about all companies? How about you? Why just computers? Remember that one time when you accidentally left your apartment window open, and then a "hacker" waltzed in and took pictures of all your personnel effects?
So you make a claim, and to try and pass that claim off as believable you change literally every parameter you can possibly change.
GP said:
> Hacking a game company just so you can show people what is being worked on should not be a crime.
They didn’t say anything about hacking someone’s personal laptop to steal someone’s personal data. They didn’t say anything about hacking all companies, they didn’t say anything about themselves being hacked, they didn’t say anything about someone entering their home and stealing their shit.
They said:
> Hacking a game company just so you can show people what is being worked on should not be a crime.
And just to prove you wrong, you can add me to the tally.
I would be inclined to agree, but I'm reminded of passages from Edwin Black's book [1] depicting the capriciousness of medical providers. E.g. a board of doctors was typically responsible for sterilization decisions in America when eugenics was mainstream during the early 1900s. It seems reasonable that doctors should be final arbiters of medical decisions, as in releasing this aforementioned hacker from a mental hospital. But the book revealed how these doctors would often inconsistently apply their sterilization standards to favor prominent local families whilst punishing the usual victims, i.e. minorities and poor whites.
In this regard, I find this case deeply disturbing, and would prefer if he simply got a definite sentence.
Given the magnitude of his continuous hacks, and his verbally expressed desire to do it again and complete lack of remorse, the alternative is prison, either now, or on repeat offenses.
The chance of a more rehabilitation-oriented stay is probably worth it.
Technical brilliance doesn't mean they're worth the risk and danger. Someone who's documented as physically violent is simply a liability to all other employees they're around. Even without the physical danger he presents intelligence orgs don't want people with broken moral compasses, they want people with unwavering moral compasses that align with their missions. If someone's just in it for fame or money some adversary is always going to be able to offer more of both.
Life in prison for up to $10m in damages? At first I thought the number must be off by a factor of 10. I couldn’t help but see Dr Evil for a moment.
These are at best property crimes, and while the sums are non trivial, sentencing children to indefinite imprisonment for a nonviolent crime against a megacorp is unconscionable.
That's the only reason he's punished. A lot more than 10M gets stolen regularly across various online scams but nothing gets done about those since they primarily target the common man and not a large, culturally-relevant company (I'd argue his targeting of BT/EE has a lot of influence in the outcome).
Seem to me like the prosecution is irrationally scared of something they don't understand. When personal data is leaked, no one gives a shit. I got downvoted to smithereens for commenting on HN that I thought the post about Steve Wozniac being in the hospital was perverted. But if you leak something from a business, then life in prison?
"indefinite detention" as well, meaning the duration is not defined, but it's "infinite detention".
However, the article was definitely updated at some point, as others in the thread have pointed out. I read it earlier today and it did state life in detention.
That is certainly not helping the discussion out, unfortunately.
Though we don't consider it such, because we accept that police are needed to maintain some level of order and it's not good when people resist arrest, the violence was more or less in self-defense.
I think there's a huge difference between someone (especially someone with "severe autism") lashing out when getting more or less abducted and removed from a familiar environment by force (even if we'd prefer they stay calm) and someone attacking someone else out of the blue.
What do you want to bet they didn't follow best practices for arresting an autistic person?
At least state side resisting arrest can be stopping an officers fist with your head, or putting your hands up to block being hit. The bar is so low and the penalties can be absurdly high, including felony charges in many states. It’s basically a way of enhancing charges or creating charges where there’s not enough evidence to produce other charges, and almost always used as a plea bargain cudgel.
There is an expectation here that this person will react to being arrested and imprisoned with patience; yet patience is not expected from literally anyone else involved.
It's abundantly clear that he is not being punished for harming people. He is being punished for not playing along. "Refusing to play along" is one of the most well known symptoms of Autism. This person is being punished for neurodivergence. I'm not even remotely OK with that.
I still don't know what any of that means. Then what is patience about? Who is "they"? What does it matter if people can guess at an outcome based on prior experience?
I still don't know what you mean by "patience" and I still don't know what relevance it has here.
By "they", I mean everyone in this story except the defendant. I mean the justice system itself. "They" should be held to a high standard of expectations.
Neurodivergence isn't a free pass to commit all the crimes you want. Lots of shooters are neurodivergent. That doesn't mean that society has to let them kill all they want.
Neurodivergence is a reality. Our justice system can do better than be ignorant of it. Our justice system can do better than to escalate its symptoms. As a participant in democracy, I will accept no lower standard for justice.
This person wasn't killing people. He was looking at secrets. There are people who don't understand that murder is wrong, and those people need to be institutionalized for the safety of everyone else. He isn't one of them.
>You are reading my comments with the most uncharitable perspective possible.
Im sorry if thats the case and I am trying. unfortunately, I didnt get that from your prior posts and this response as a complete nonquitter.
Maybe it stems from a different understanding of the underlying facts. The perp was not sentenced to life in any way, just custody until they stop claiming they will commit more crimes upon release.
In general, I agree a life sentence would be unreasonably harsh for hacking or reading secrets in isolation.
Charges and conditions of release can be unrelated. You may be placed into custody for hacking, but not release if you say you will commit a more serious crime immediately after.
The editorialized reframing of the headline is a bit subtle but still incredibly dishonest. An indefinite psychiatric order is simply not the same as a life sentence.
Wow - I checked the Internet Archive and you are correct, the "sentenced to life in hospital prison" headline was used when the article was originally published. I stopped reading BBC a while ago because of their sloppy standards but this is unusually bad.
FWIW in this case I would suppose the BBC online editor was careless and fixed their mistake, versus "A/B testing for clicks" generally. If it was A/B testing, the "A" headline went too far: there's a fine line between clickbait and outright lying.
It is still pretty bad. When you look up old famous crimes, they're usually in there basically for life. Leaving aside cases like the 'I don't like Mondays' girl (44 years and still in there; temporal lobe lesion, possible sociopathy) or the pre-Columbine shooting you probably don't remember recently profiled in NYer (paranoid schizophrenia; https://www.newyorker.com/magazine/2023/12/04/what-happens-t... ) where they had regular guilty pleas, even someone like Reagan's shooter only just got out a few years ago after his family lobbied & paid a fortune for decades. As my old professor liked to say, you had to be crazy to do an insanity defense, because usually you'd be worse off if you won that defense than if you lost another defense.
Even the BBC headline is sensational. It implies that the indefinite detention is for a GTA 6 hack, and many people in these comments jumped to that conclusion. "GTA 6 hacker" is used in the headline to identify the person, not to explain the detention.
I would say he's not in trouble for gaining access to systems, it's for extortion:
> He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four million dollar ransom, which was not paid.
It doesn't look like any of these even tried opsec - which isn't surprising because such crimes committed against individuals or small companies effectively became decriminalized in the UK so opsec would just be a waste of time.
Their mistake was to think that embarrassing the establishment by breaching high-profile (Nvidia, etc), culturally-relevant companies (BT/EE) would be met with similar inaction.
Also, with regards to skill, keep in mind that the establishment has a huge interest in making the hacks sound much more advanced than they really were to minimize the embarrassment of the affected companies. It would look really bad if it was widely known that these companies were pwned with nothing more than basic phishing, bribery and social engineering, something anyone can do.
Why not just restrict him from electronic devices like what happened to ZeroCool? Surely there are better solutions that putting him in a psych ward for life or until he is 'cured'.
RTFA. They tried restricting him, and he used a fire stick and a a phone to commit another major breach while out on bail. Then he told the court that he planned to keep hacking if he was released again.
He wasn’t sentenced as such. He was determined to be mentally unfit, and put under confined treatment until he no longer poses a threat.
> RTFA. They tried restricting him, and he used a fire stick and a a phone to commit another major breach while out on bail. Then he told the court that he planned to keep hacking if he was released again.
I did RTFA. I'm saying he could have been denied access to any electronic devices without supervision, which I think would be a better alternative.
What about credit cards? aTMs? Self-service checkouts? PIN pads (the things Europeans have to use in stores to pay by card)? Ticket machines and turnstiles? cars? radios? TVS?
All of these sound pretty harmless and are necessary to have a life these days, but he did demonstrate that he can use a TV for hacking.
That requires voluntary compliance from the offender. He was already released on bail with that condition, and that's when he hacked Rockstar. He has also told the court that he would continue hacking if released.
> That requires voluntary compliance from the offender.
Not it doesn't, it just requires more supervision from his probation officer or whatever. Put him on house arrest with an ankle bracelet, it's still better than being in a psych ward.
I'd really like to hear more about the type of exploits here. Like, what level- Are we saying this kid is so brilliant he is writing zero-days for getting into corporate networks or if this a case of a guy in a good script-kiddie type group running phishing deals where they fire off 100000 emails a day and wait for someone to give up their logic credentials.
Because if it is the former it's really hard for me to understand how that is still even possible in this day and age. Autism, brilliance, or whatever... a 17 year old breaking into systems like they are as exploitable as early 90's systems sounds just insane to me.
It says "He broke into the company's internal Slack messaging system ".
It does seem likely their approach is something along the lines of phishing or, given some of the other notes in the article, a combination of social engineering or stalking and blackmail...
I have a feeling a lot of these hacker groups that are heard about do very little code exploitation. I think a lot of it is: find info on employees of a company, maybe find their old social media accounts, maybe find some stuff they might not want their coworkers to ever know about or their spouses etc. And then harass and blackmail the employees for a way in.
If the news agencies were better at reporting, I think a lot of people would see these type of 'hackers' as less 'ooooh brilliant genius child like in the movies' and more 'straight up criminal harasser with no more skill than any normal software developer'.
The problem is that reporting the truth - "socially-awkward teens hacked their way into large companies by manipulating their idiot employees and exploiting lax security policies" would force many powerful people into answering uncomfortable questions and expose incompetence at many levels.
Keep in mind that at least one of the hacked companies (BT - British Telecom) is culturally relevant in the UK and sadly it is mostly considered as trusted and competent by the general non-technical population. Hell, they've even got a cybersecurity arm: https://www.globalservices.bt.com/en/solutions/security
It would be really inconvenient if it became common knowledge that all this perceived trust & competence was nothing more than smoke & mirrors and that some kids can blow right through it.
Therefore, there's a vested interest all the way up from the government to make the hack more sophisticated than it really is and the hacker a meaner monster than he is. That's also the reason behind the disproportionate sentence, despite similar phishing/social engineering/stalking crimes against the layman not being prosecuted at all.
A no doubt gifted person who was probably put through torture (as they would experience it) in a prison, now locked away for life because they lashed out.
Big clap for all the big brains there who failed this guy.
Absolutely monumental waste of talent. Reminds me of how I got expelled from high school for "hacking" into their terrible infrastructure (without causing any damage whatsoever, other than to their pride). They threw the book at me. Threatened felonies. Were going on and on about how I will never vote, never be able to work as a postal worker etc.
Get this kid into the right environment and he would probably be able to do great things.
Eh, this is not outside the realm of expectations for an autistic teenager. Anyone locked in a cage will lash out, especially if they have neurological issues.
> There is a way to harness this energy regardless.
Yeah, it is called prison. I don't care if someone is "autistic" or "shit-head asshole". If you are a violent son of a bitch, I have a concrete cage with bars to house you in.
You do realize that this is the "correctional system" right? With the goal to fix/correct/reintegrate people into society? What if you can do that before locking them up and throwing away the key? You have zero empathy, friend.
Also - this individual is clearly a brilliant hacker and if that energy could be directed towards the white hat space, defensive posture, that would be invaluable.
Guaranteed Mi6 will be trying to snag this kid for offensive hacking. He'd have been hired already by NSA if he was in the US.
I disagree in most cases of 18-year-olds specifically, but even if I didn't, I think you should amend your original post to make your point more specific. It's hard to read it as not excusing his violence to some degree based on the comment you were replying to, even with a generous reading.
Only just an adult. A few years, the hormones might calm down and, well, if we gave up on all 18 year old adults there wouldn't be too many of us left.
This, indeed, rather than label an 18 year old - whether he's legally an adult or not - as violent and unable to learn, and throw them in a cage for the rest of their lives.
This is the "I bet you're one of those people who <construct hypocritical position tangential to the topic>" fallacy. It is the height of pettiness, and one of the most egregious tropes of low quality internet arguing.
He has (from what it sounds like) moderate autism. He's not just a misguided curious little fella that needs to be set on the right path. He needs a lot of help and to be kept far away from bad influences and temptation.
“this kid” calls the company and spins webs of lies until someone gives him access to internal systems; a.k.a social engineering. Nothing of value has been lost.
If you have a phone, you can break into Rockstar. All you need is persistence and a disregard for your own future. I cannot over-stress how unimpressive, social engineering hacks are.
360 comments
[ 3.7 ms ] story [ 286 ms ] threaddoes this actually mean life?
"He will remain at a secure hospital for life unless doctors deem him no longer a danger."
This kid needs to be cultivated, not institutionalized.
(Edit: never mind, seems he IS a menace to society)
Most people respond with patience, because they understand deescalation is their best move. This person has Autism. I think it's not a leap to conclude that he simply doesn't understand that deescalation is the right move. He may not even realize or totally comprehend that deescalation is an option!
If you want to convince me this person is a menace to society, then talk about his behavior before being arrested. What did he do then? Oh, that's right, he shared video of an unreleased game... Why should I, or any other person feel threatened?
I'm not working to give up that easily. This is a person with the rest of his life ahead of him; and that life has been locked in a room, and declared his responsibility.
How do you propose, exactly, that society handle a person that openly admits that they'll do whatever they see fit and decide for themselves what rules they'll follow? And we're not talking about minor rules and infractions, we're talking about major ones like 'don't be violent' and 'don't stalk and terrorize women' and 'don't run a doxxing website' and 'don't extort and steal'
Answer me this: _why_ does society need to 'understand how to behave around him' ?
What's the benefit to society?
The guy stands up in court and basically says 'yeah I don't have any remorse and I'm gonna keep doing it because I don't think it's wrong' - why do we need to try and understand that more?
The only evidence for this is heresay by the prosecutors.
> 'don't stalk and terrorize women'
As has been pointed out by others in this thread, that was a different person. Go read the article again.
> 'don't run a doxxing website'
You've got me there. But I don't think that comes even close to justifying an indefinite sentance.
> 'don't extort and steal'
Yeah, he shouldn't have done that. But as I said before, it does not at all justify an indefinite sentance.
> The guy stands up in court and basically says 'yeah I don't have any remorse and I'm gonna keep doing it because I don't think it's wrong' - why do we need to try and understand that more?
That is completely false. He is never quoted as saying anything to that effect. Rather, this is the closest thing we get:
> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."
Perhaps the question should be what about cyber-crime he is motivated by. There is no indication that the motivation is anything malicious. It may be thrill that he is motivated by. If that's the case, it should be treated as an struggle with addiction, not evil.
My opinion, in short, is that people exist who simply thrive on chaos and drama. If you've met a person like that or have one of them as a member of your family, you understand. You understand that the power to destroy and create drama gives them a thrill that literally nothing else will ever come close to. You can't treat it, it's very hard to redirect (literally the _exact same activities_ will bore them if the outcome is positive rather than negative) and you can't reliably use them as part of a 'red team' because the first thing they'll destroy is the team cohesion.
If you have any teachers in your family ask them 'do you think that some kids are just born wrong' and they'll tell you all about it. They've seen it.
Here's one method: We simply remove that person from the society, because society is made of rules, not people. In a word: fascism.
Here's an alternative method: We better involve that person in the rule-structuring process. We do our best - through education, therapy, and socialization - to expand our common ground into shared goals; because society is made of people, not rules. If the person is unwilling to participate, then we give them judicious punishment. As a last resort, if the person is a threat to the safety of other people, we remove them from society. In a word: democracy.
The benefit to society is the recognition that both rules and people are living and changing. We can recognize that society is a system, and empower people to be in control of that system, rather than allow the system be in control of us.
He's part of a hacker group who steals data and extorts companies for money. And he talks about how he can't wait to do more crime when he gets out of lockup. It's all there in the article.
I know, crime against big companies isn't "real crime" as far as many are concerned, but these companies employ real people, and when they take a big financial hit due to cyber crime like this, it can affect peoples' jobs and livelihood. Because the companies will choose to keep paying the CEO a ridiculous sum while laying off lower-level employees to even out the cost of the ransom (if it's paid) or the financial loss caused from the data leakage (difficult to estimate, but a material loss nonetheless that the bean counters will have to account for).
The article also mentioned how they stole from individuals' crypto wallets.
What about the part where he continued hacking after being busted the first time and released on bail.
Its pretty clear that the kid poses a danger and doesn't understand that he needs to stop.
This isn't a youthful prank/indiscretion that went too far. This kid was on trial for causing millions in damages, and then did it again while on trial.
Yeah, institutionalizing people has a horrendous history, but this kid is incredibly destructive, and has proven that cannot control himself or will go out of his way to do the wrong thing. The only viable alternative to a supervised medical setting is jail for him.
He was ordered to remain under supervised medical care until a doctor determines that he is mentally fit to stop causing harm. This is as a result of both his hacking, his assaults on caretakers and destruction of physical property.
He also told the court that if he was released he would go right back to doing crimes.
What if his moral code is correct, and the court's moral code is wrong? (maybe it should be called the cult's moral code?)
His actions have physically injured people, destroyed property, and caused hundreds or thousands of people to spend otherwise productive time on fixing things.
This wasn’t some hacker poking around because he could. He was stealing assets and then trying to ransom them back. He also just straight up stole crypto.
If he managed to do that using nothing more than a TV and an Android device, I have absolutely zero sympathy with his victims. In the end, I'd even classify that as a public service, getting these companies to up their security game at least to some standard.
> He also just straight up stole crypto.
And here I have even less sympathy. I have grown to hate anything crypto-currency with a passion, simply because it's even more enticing to criminals than a locked safe room full of diamonds.
Don't get me wrong: It's still not correct what he did. Lock him up in prison like every other random criminal. But it's not "lock him up for life"-worthy, not by any means.
What does it matter what form your wealth takes? Whether it's in a bank, in cash, in gold, or in cryptocurrency is an unimportant detail. What matters is that you have every right to keep possession of it.
Don't give him a life sentence for sharing secrets. Don't ask me to pretend that isn't what this is about.
You keep saying that he was given a life sentence. He has not. He has been ordered to live in a hospital until he is deemed by a professional to no longer be a danger to himself.
Incredibly? There are many kids that age who murder and commit other serious felonies.
Do you think any of these people wanted to spend their time on this, that otherwise important things weren't delayed and sidelined? Do you think that the people he stole crypto enjoy having to work extra hours to make up for what he stole?
His crimes weren't victimless, and plenty of real people were impacted in serious ways. This wasn't some kid who pushed his computer skills a little too far and went somewhere he shouldn't. He engaged in an international conspiracy to extort millions using stolen data.
There are kids that age who commit murder and other serious crimes, and they should face consequences just like he is. But the grand majority of kids that age get through life without committing any serious crime at all.
> some idiot
He's a kid with a very serious mental illness. Perhaps we don't need to sink to these insults.
On the scale of things, what you describe is not "incredibly destructive". Many, many people have done worse (many legally). It's a crime (I never said otherwise) but not a big deal relative to very many other crimes - Rockstar didn't face any material danger; the justice system has lots and lots of cases going through it. I'd be more concerned if he was committing serious violent felonies.
> you might feel different
I'm pretty confident I'd feel exactly the same.
> Hundreds of thousands of man hours
What is that based on?
> international conspiracy
All the hyperbole undermines your point, imho.
Granted. I was speaking more to the general frustration of defense lawyers who have clients that say things when they should have said nothing.
> Hundreds of thousands of man hours - What is that based on?
A guess from years of working for large tech corporations. A company level crisis of this magnitude sucks in a lot of people from a lot of departments. Add in all the other time spent by investigators and the courts, and I don't think I'm overestimating at all. Now multiply that times the 11 major breaches he was part of.
> international conspiracy - All the hyperbole undermines your point, imho.
Arrests were made in Brazil and the UK. Organizations from at least six countries were attacked. They attempted to extort millions from multiple companies. Personal data from 300k people in Argentina was released. They took down the site for COVID vaccination records in Brazil. Rockstar was the 11th attack and one of the less harmful ones, I'm not sure why people are so focused on that one. What about the leaked personal info, what about the impacts to Brazilian health ministry and Brazilian citizens? These weren't explorers just getting in to see if they could. They got in, pillaged data, and followed up with more crimes. They certainly conspired, and it was certainly international.
I'm not saying that this is the most heinous crime an 18 year old can commit, and I never did. I am simply saying that this was more harmful than a lot of people think, and if it was mental illness that caused him to do it, then it is pretty reasonable for the court to say that he wont be criminally liable, but that he is required to get help before he is trusted to be out in the world again.
Not a moral argument but a very practical one. If somebody like that manages to find a hole in your process big enough to exploit yet dumb enough to get caught you should feel really lucky that nothing worse happened (that you know of) with the hole you just got notified you had all along.
Yeah. If you keep your gold in a glass box, don’t be surprised when someone with a hammer steals it. But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
I dont think this is changing the argument in terms of competence and dedication of the attacker to a meaningful degree. We are still talking about a small group of people without a sensible monetization angle involving somebody who couldnt keep his mouth shut long enough to not get put into a mental ward indefinitely. Its very much the bottom of the barrel in terms of attackers.
>But also, stealing things just because they aren’t locked up, and blaming the victim is no way to run a society.
I would also reiterate that you are making a moral argument about how society ought to be on a human level. Whether or not this is appropriate for human interaction, its really detrimental to running companies. I am making a practical argument on an economical level, companies need the negative incentive to run efficiently. Without they are unable to allocate resources to keep running, they fundamentally lack foresight without incentives. Management needs such cases to justify investment into security they need against determined competent attackers that are otherwise hard to visualize. And you cant get rid of attackers through law enforcement for the geopolitical reasons alone. You just make the risk invisible and companies more vunerable.
While his behavior might be antisocial if it had happened on a human level, it was beneficial and of vital importance to the company (and economic sector) he attacked. Its just that asscovering by the people responsible made it hard to acknowledge that.
Not saying he is a great guy, his personal behavior towards his fellow humans seems to have quite a bit of room for improvement. But dealing with him above that seems to be petty, counter productive asscovering.
Yes, those mental hospitals were terribly run. But we need to create a safe place for these people. We can't just give up because of mistakes made in the past.
https://www.civilbeat.org/2018/06/health-beat-bring-back-the...
many are drug addicted, they would have somewhere to go but they opted out of society (well, they aren't in the forest so not full opt-out)
but yes a combination of state run rehab / mental hospitals seems to be the only solution, but is it done by force?
if it's not forced you'll have a hell of a time getting people to go. if it is, you are now rounding up potentially unwilling people and shipping them to a facility.
Yes, of course. Do you really think most of these people even in the care of their own family would have complete agency over their lives? No, they'd be declared unfit and their Power of Attorney would be delegated to someone else.
Do you know that? In the US, I read (several years ago) that the top reason was losing your home to medical bills.
They closed something bad and brought no alternative because it’s easy for a politician to score points by appearing to solve problems in the short term but providing no long term solutions.
Damn! Approaching https://xkcd.com/378/ ...
If this is an Android phone with a rooted system (or even just a locked phone with Termux), you can even skip the SSH server.
Not saying this is unimpressive though.
>Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.
This sounds too fantastical to be true.
This guy is obviously brilliant, disappointing that he squandered his opportunities.
Use Firestick as RDP/VNC client, use mobile phone for internet, obtain keyboard from Amazon Shopping, remote into a VM, proceed as usual?
That being said, if this were an episode of CSI, I would be rolling my eyes.
So there's this wonderful program called wget.
It's fucked up what they did to him publicly.
That's quite a feat.
> Rockstar Games alone told the court that the hack cost it $5m to recover from plus thousands of hours of staff time.
Either the kid is a genius or Rockstar really don't value their security much. Or maybe a bit of both?
Would be great to have them on the "good" side, but would probably take a lot of energy and resources as well.
Hopefully this story will have a somewhat happy ending, because it seems to not end yet.
Admitting you will continue to fight evil is not evil.
This is a popular framing of autistic people but this assumes the problem is complex nuances. Most of the time it's not very nuanced at all. The problem is that autistic people are less likely to follow rules they don't agree with or see as arbitrary - in the positive this is sometimes described as a "strong sense of justice" but that phrase ignores that the perception of what is or isn't just or unjust can vary.
Studies have actually shown what is dismissively described as "moral rigidity", i.e. autistic people are more likely to follow ethical rules they profess even when they believe they can get away with breaking them and when nobody would find out. The problem is that "normal" people are much more "morally flexible" and thus share an implicit understanding of what rules are important (i.e. actual rules) and which ones you're supposed to say you follow but aren't expected to.
This is exactly what I was referring to. We agree.
Very true.
It's similar to the problem with the asshole genius programmer. You can keep him around because he's a genius but being an asshole in a position of authority over others (by virtue of being a genius) will result in people not wanting to work for you and this can easily mean you're missing out in individuals or teams that would vastly outmatch the asshole genius.
Trust is more important than ability.
The real reason this happens is that the police doesn't understand, wants to punish the kid ... and youth services has lobbied so that locking up minors DOES NOT REQUIRE PROOF at trial, does not even require an actual accusation of a crime, in fact the kid gets none of the normal legal protections (because this is a 6 month prison sentence, in that the kid gets locked up, and could be an 18 month prison sentence)
During this time, the kid will be denied school, denied access to internet, books, friends, most of his family, he will be physically locked up (sometimes in solitary, although they get regularly accused of locking up autistic individuals for weeks/months). Oh and there is CONSTANT violence in these places.
But fundamentally this happens because there's no fair trial for minors. Why not? Youth "protection" keeps complaining that with the actual legal rights they can't do their job (or arguably even human rights, schooling, not being locked up unless convicted with full legal rights (not the case here), not locking up long times in solitary unless absolutely unavoidable (ie. NOT because of lack of funds and therefore no personnel for supervision), ...)
A fair trial against this kid would have failed since he was caught by illegal means (the police committed a crime to lure him into a trap, which is NOT legal, and frankly totally immoral).
I hope if you do security related work, remember this case. If you expose a security vulnerability, and get offered a job, there's now many examples of that job being an excuse to get you thrown into prison for years. Oh, and DESPITE this being totally illegal for the police to do.
Youth services can't do their job with normal legal rights for minors, because minors talk, and are aware with youth services offers (getting locked up without school, without friends/family, with constant punishment, and then at the end of it getting kicked into the street without any help). Although Youth Services lies about this to kids, it tends to be well known in the cities and "results in a lack of cooperation" (translation: kids, correctly, reason that they're better off abused than helped by Youth services). Oh and it doesn't help. Especially because the "kicked to the street" part, especially kids that don't have parental support for some reason, immediately turn to crime. And, of course, after a place like this, they don't want to be helped by anyone and hate the police.
In 100-200 years time from now people will be talking about this, just as we look back to barbaric times in the past now.
Empathy: the ability to understand and share the feelings of another.
FTA: A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated."
The guy needs help because he's autistic, and watched closely because he's also a sociopath.
I would like to know if there is a case where the baby is viable where it's necessary to kill the baby and remove the dead baby rather than removing a living baby?
I am concerned that if you give me a problem to solve (a sick pregnant woman) I might remove one complicating factor (the baby) to simplify my work load.
I know in Texas, during the era of Roe v. Wade, if a doctor recommended an abortion saying the baby was non-viable and was wrong, there was no liability on the doctor. If the doctor recommended against abortion, and the baby was in the least bit deformed, the doctor could be held liable for millions of dollars. This lead to a lot of pro-kill-the-baby bias.
Ditto for fake news stories.
Only mentally unfit people can pass a therapist's tests and be empathetic for people they know do not exist.
you seem to be implying that feeling empathy for characters in work of fiction is clearly "normal" if somebody doesn't think that way it should give them pause. What you said may be construed as "hey you freak, if you only think for a moment you'll obviously notice that it's perfectly normal to feel empathy for fictional people, after all story telling is such a fundamental human feature that if you're not feeling that way there must be something wrong with you or at the very least it's you're fault because you're not thinking hard enough about that".
Of course, I'm not saying you actually believe that or accuse GP of that, but words and tone matters and can hurt. Think about that
I should have added: I also dislike being manipulated. I fail silly tests at work because I find them demeaning. If you want to know what I do on the job, drop by and watch.
This is relevant to psychological evaluations because the tests are so silly and contrived, and go on for so long, that I lose patience with them.
Autistic and neurotypical people can empathize with others like them, but have trouble between the groups [1]. This is called the "double-empathy problem" by the paper which proposed the idea [2]. More recent papers explore subjects such as information transfer accuracy [3] with the same results: autistic participants understand each other perfectly well when allowed to use their preferred means of communication, as do neurotypicals. However, the two groups have trouble understanding each other. Further work extends this to a generalized model with extremely unsurprising results: people tend to be closer with people who think like them [4].
[1] https://link.springer.com/article/10.1007/s10803-015-2662-8
[2] https://kar.kent.ac.uk/62639/
[3] https://journals.sagepub.com/doi/10.1177/1362361320919286
[4] https://academic.oup.com/scan/article/16/1-2/222/5940490
> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.
The TLA aren't hurting for talent these days either.
Is it? I don't see what the big deal is in installing a chrooted Linux environment (or SSH/RDP client to remote into an external machine) in an Android device?
The fact this is even mentioned really smells like they're trying to make this guy sound more skilled and evil than he really is, potentially also to cover up for the fact that the police made an oversight in letting him be around internet-connected devices even though their instructions was to not provide him internet/computer access.
I'm not downplaying the GTA hack (although I would still bet good money it was typical phishing/social engineering rather than anything more advanced), but I'm disagreeing that him doing so from a rooted TV stick or phone makes him any more of a monster than doing so from a typical computer.
Then again, it’s also unusual for a Dodge dealership in North Texas to have 7 Hellcat vehicles stolen in one night, but here we are.
So, I pick up that maybe the tech stack isn’t the most priority point - it’s the determination. The desire to continue through any avenue. Add that in with, reportedly a physical violence time in life, the persistent threat maybe can heal out of it?
Throwing an autistic person into prison will do that. The child abuse that autistic people often receive in their childhood will do that
> the persistent threat maybe can heal out of it?
Or maybe just give them a job instead of throwing them in a padded cell for life?
> makes him any more of a monster
You're attacking a straw man.
Saying something is "a feat" is a long way from saying they're a monster.
I'm just providing a counterpoint as well as a reason why there's an incentive to make this guy sound more skilled & evil than he really is.
Installing it is nothing: 2 touches away. But using this crappy Android experience (where the on screen keyboard obscures half of your terminal) shows talent and dedication.
Installing a Linux environment or SSH client on a Fire Stick in a hotel without access to a laptop?
Not familiar with Firesticks- is there an app in their App Store for SSH?
This would at least give you the ability to install an SSH or RDP client since those don't even require root.
There is no physical evidence: DNA, fingerprints.
To me, that sounds more like they were not well-defended ...
[0]: https://news.ycombinator.com/item?id=38720544
I'd rather have him out than live in an absolute zero trust environment
The disparity of this punishment compared to what is usually given out for similar crimes (in the vast majority nothing as it doesn't even get investigated) suggests there is definitely some "saving face" motivation behind this sentence.
He’s being confined to a mental institution due to severe autism. It’s unlikely that he can be rehabilitated and would remain a cyber security threat to society if released in the future.
This is hardly revenge.
This guy's crime wasn't that he was hacking/phishing/stalking or the general obnoxious behavior that often comes with this kind of person - this is effectively decriminalized in the UK anyway, as long as the victim isn't a big, culturally-relevant company. Financially-motivated scammers and crime rings take advantage of this.
This guy's crime is that he embarrassed the establishment, so he has to be painted a much scarier monster than he really is and made an example of, since the truth that most technically-inclined, socially-awkward teenagers would be equally capable of such hacking would be hard to accept and put into question the competence of the affected companies.
The following quote seems to indicate that the skills of this individual is much sharper than "typical socially-awkward gamer teenager":
> Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone
The fact that this is explicitly brought up smells like they're trying to make this guy sound much more dangerous & evil than he really is. After all, had he discovered/used zero-days or developed exploits, that would be a real talking point, but if the only thing they've got is "he managed to get a shell on an android device" this smells of clutching at straws.
And that's the point, the propaganda machine is working overtime to paint the kid as some horrifically dangerous criminal because he exposed the clowns in power that easily could've pdevented all this.
To me, that presents an issue with the system, not its participants.
The indefinite order is because the kid committed multiple assaults and other violent acts while under observation in a mental hospital. Doctors don't believe he can be released in the foreseeable future.
If you were arrested for unpaid parking tickets and then demonstrated threatening, violent and out-of-control behaviour while in police custody, then in a secure unit, you might get a similar indefinite order.
It is pretty rare that the convinced don't at least lie about intentions to commit more crime
No, there are lots of people (in the United States) doing life without the possibility of parole. There are many people who will never be released from solitary confinement. Some of these people were incarcerated for fairly trivial crimes and all subsequent punishment was for acts committed while in prison.
What do you think happens to people who repeatedly cause injury to corrections officers, attempt to sexually assault them or infect them with HIV, etc? They are eventually put in solitary for life.
Some people will never be released from prison because of single acts which they have never repeated, but also are not willing to ever show (real or simulated) remorse for.
The system for people with severe mental health problems who commit repeated acts of violence works differently but is similar in its effects. Some of those people never get out, and they knew with decades of life left that they would never get out. In the UK, there are many quite high bars before a criminal convict can be incarcerated forever without chance of release. But it's much easier to block release forever from someone who is insane and considered dangerous.
The system for sex offenders works in a very similar way in some places. Some sex offenders, not the worst offenders, can be in a situation where they will never be allowed out, or being allowed out is so unlikely that it will never be worth it to them to spend years complying in order to attempt to be released.
Most jurisdictions have some method by which a person who a) did something to get them within the system, b) committed repeated assaults or threats while within the system and c) did not show that they had radically changed their attitude, will never get out. The details vary but they always exist.
My suspicion is that in most places, people in this situation vary from almost harmless: suffered bad luck and a lack of comprehension from decision makers to extremely dangerous: very hard to imagine how they could ever not be an extreme threat to innocent people outside of incarceration.
> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.
If we were routinely jailing people that had trouble controlling their emotions and had propensity for violent outbursts we'd have a lot more people in jail, so I don't believe this alleged violence was really what got him this sentence.
Similarly, how much would someone get for scamming/hacking/social engineering a small company or individual? Well that one is easy to answer: nothing - this behavior has effectively been decriminalized in the UK.
So neither his crimes add up to such a sentence.
Curious to know what their definitions and their examples of this behavior are regarding this person.
The point is not the details (I'm obviously not a laywer or anything remotely related to that), the point is that it seems to be a slippery slope.
Good thing that’s not what happened then I guess.
> He will remain at a secure hospital for life unless doctors deem him no longer a danger.
So he's confined for life. Confinement is confinement, whether it's a prison or hospital.
This definitely seems like a case where the government found a "backdoor" to allow them to get away with confining someone for life, even though they probably couldn't do through the normal criminal justice system because the punishment doesn't suit the crime.
> unless doctors deem him no longer a danger
It's down to him and whether the institution he's in can do anything for him.
No, it's up to the doctors.
If he changes nothing and docs say "we think he's no threat now," he could be freed.
If he completely reforms and appears harmless and the docs don't give him the thumbs-up, he stays locked up for life.
Obviously, that doesn’t need to happen. The fact that it could scares me
Hacking Rockstar using FireTV stick, lol.
> The court heard that Kurtaj had been violent while in custody with dozens of reports of injury or property damage.
> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cybercrime as soon as possible. He is highly motivated."
...
The details are absolutely wild too. I mean...
> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack. Despite having his laptop confiscated, Kurtaj managed to breach Rockstar, the company behind GTA, using an Amazon Firestick, his hotel TV and a mobile phone.
Holy shit, dude. This is the sort of thing they make movies about. I wonder how much of it is true.
He was apparently shown to be a member of a cyber "gang", and expressed zero remorse. In this case, a judge basically has to do something.
> A mental health assessment used as part of the sentencing hearing said he "continued to express the intent to return to cybercrime as soon as possible. He is highly motivated."
The guy was already on bail for another hack:
> The jury was told that while he was on bail for hacking Nvidia and BT/EE and in police protection at a Travelodge hotel, he continued hacking and carried out his most infamous hack.
> He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four million dollar ransom, which was not paid.
> They also stole directly from individuals through their cryptocurrency wallets.
So:
> He will remain at a secure hospital for life unless doctors deem him no longer a danger.
Hospital b/c of his severe autism. Ostensibly, what has to be done is rehabilitation. If he can even lie convincingly, he'll be out tomorrow.
Give the mental health pros a little credit. Getting out of a psych ward isn't as simple as saying you aren't going to do it again.
But having said that, being locked up "at His Majesty's pleasure" as this is called is s scary sentence, since you can indeed end up in prison for you whole life if you do not have the support of the relevant doctors.
The conspiracy theorists here should remember he was convicted by a jury and can appeal his sentence like anyone else. If that's insufficient come up with a better system.
There is the expectation that someone should be punished severely for hacking a multi-billion dollar corporation.
There is the expectation that that punishment will result in them just never hacking again.
There is the expectation that a person who is arrested and threatened will respond with patience, and not with their own violence.
There is the expectation that the well-known symptoms of Autism will just magically disappear whenever they conflict with the above expectations. If not, it's the fault of the person with Autism, not whoever set impossible expectations.
---
All of these expectations have a common theme: they are leveled at this one person. He's a teenager with Autism! It doesn't matter: we have expectations, and they have to be met.
Fuck that. I have expectations of my own.
I expect that a justice system will actually try to meet people at their own level.
I expect that a justice system will attempt to resolve mental health with treatment instead of violence.
I expect that a multi-billion dollar company will respond to hacks with the only effective method there is: strengthening their own security. Anything else is just a waste of breath.
My expectations are not being met. There's not a damn thing I can do about it, either: I'm not the one with billions of dollars at my disposal.
He stole and extorted, assaulted people, and destroyed property and was convicted of actual crimes. They did try to meet him at his level. They released him pending bail and he committed more crimes. He told the court that if they released him he would continue committing crimes. They aren’t sending him to prison though, because he isn’t mentally fit. They are sending him for medical treatment, at no cost to him, until he is determined to no longer be a threat to himself or others.
This seems far more humane than sending a mentally unwell teenager to prison where he certainly wouldn’t get the level of care that he will now.
You are welcome to disagree with me, but I don't believe hacking Rockstar to get a peek under the curtain should be a crime. So what if we took that part out of the story? What would change? Everything. The whole story would be completely different.
---
Call it treatment all you want. The goal has already been laid out, and it's not rehabilitation.
Have you ever been in a mental hospital? They do important work, but that doesn't change the reality of what they are. It's a prison with carpets. Trained guards are prepared, not only to detain you, but even to sedate you.
Yes, they exist for treatment, but that doesn't make them a good fit for everyone. We can, and should try other avenues first. I'm not content to throw up my hands and give up on this person. I'm not content to accept this system as the best our society can provide.
Treatment? From the article:
> He will remain at a secure hospital for life unless doctors deem him no longer a danger.
That sounds like punishment. For indefinitely long. Without even a trial.
If this were about treatment, we'd have details about how he'll be treated and for how long and the chances of success. Instead, we hear only about his punishment and vague scare-mongering about why it's necessary.
Hacking a game company just so you can show people what is being worked on should not be a crime.
The law is unjust to begin with. I don't blame anyone for breaking it twice. Would I recommend it? No. That doesn't mean I have to judge them for it.
The scary behavior here is his violence; but that violence was clearly a reaction to the violence he was confronted with: being arrested and threatened. I'm not convinced that he is a threat to society.
Sure, I can agree that it was wrong for him to react with violence. But what else could I reasonably expect from someone with Autism being punished for technically-illegal behavior?
Have you ever spent more than 10 minutes with someone who has severe Autism? If you have, then you know not to expect them to be great at following arbitrary rules. That doesn't mean they have to be institutionalized!
The solution to this problem is well-known: treatment. It's clear that that is not the goal in this case.
Plus other hacks in the article.
My criticism is that we aren't talking about fraud: we are talking about hacking. We are talking about legally-enforced secrets.
We are talking about a violent reaction to being prosecuted for hacking. What if was about the fraud instead? Would his reaction be the violent then? We can never know.
I'm supposed to be afraid to live in a society where this person participates. Afraid enough to sacrifice the rest of his life. I'm not convinced.
Beyond that, I don't agree with any of this. If a company wants to keep secrets, then they are welcome to try. Let that be their responsibility.
The only exception here is good-faith intrusion testing and the like, but fundamentally: my property, none of your business, misusing my property is a crime.
Let's change the wording around a bit. What makes hacking a "game company" exempt from normal ethics into breaking and entering?
What if the "game company" consists of only a single employee who uses their personal laptop? Totally fine to break into their computer and steal their data right?
Why stop at "game companies"? How about all companies? How about you? Why just computers? Remember that one time when you accidentally left your apartment window open, and then a "hacker" waltzed in and took pictures of all your personnel effects?
So you make a claim, and to try and pass that claim off as believable you change literally every parameter you can possibly change.
GP said:
> Hacking a game company just so you can show people what is being worked on should not be a crime.
They didn’t say anything about hacking someone’s personal laptop to steal someone’s personal data. They didn’t say anything about hacking all companies, they didn’t say anything about themselves being hacked, they didn’t say anything about someone entering their home and stealing their shit.
They said:
> Hacking a game company just so you can show people what is being worked on should not be a crime.
And just to prove you wrong, you can add me to the tally.
Now it’s a view shared by at least two people.
In this regard, I find this case deeply disturbing, and would prefer if he simply got a definite sentence.
[1] - https://en.wikipedia.org/wiki/War_Against_the_Weak
The chance of a more rehabilitation-oriented stay is probably worth it.
These are at best property crimes, and while the sums are non trivial, sentencing children to indefinite imprisonment for a nonviolent crime against a megacorp is unconscionable.
That's the only reason he's punished. A lot more than 10M gets stolen regularly across various online scams but nothing gets done about those since they primarily target the common man and not a large, culturally-relevant company (I'd argue his targeting of BT/EE has a lot of influence in the outcome).
People value their life at about $10m. There's a video I found interesting on a YT channel called practical engineering. https://www.youtube.com/watch?v=xQbaVdge7kU.
> dozens of reports of injury or property damage
However, the article was definitely updated at some point, as others in the thread have pointed out. I read it earlier today and it did state life in detention.
That is certainly not helping the discussion out, unfortunately.
I think there's a huge difference between someone (especially someone with "severe autism") lashing out when getting more or less abducted and removed from a familiar environment by force (even if we'd prefer they stay calm) and someone attacking someone else out of the blue.
What do you want to bet they didn't follow best practices for arresting an autistic person?
> judge described as "unpleasant and frightening pattern of stalking and harassment" of two young women
If a person causes $10M in damages to a company, they go to jail for life.
It's almost as if the justice system is less focused on being "just" and more focused on serving a class of people.
It's abundantly clear that he is not being punished for harming people. He is being punished for not playing along. "Refusing to play along" is one of the most well known symptoms of Autism. This person is being punished for neurodivergence. I'm not even remotely OK with that.
Can you explain? The whole process has seemed pretty patient on all sides. This wasn't some overnight decision.
I truly don't understand what you're trying to say, or how "patience" is relevant here at all.
Sure they were willing to wait, but what were they waiting for? The result was pretty clear from the beginning.
I still don't know what you mean by "patience" and I still don't know what relevance it has here.
OK, and the justice system is. It's full of professionals, processes, training, exams, appeals processes, etc. They are held to very high standards.
Why do you say we don't expect patience from them, and why is that relevant?
Legal professionals like lawyers and judges seem incredibly patient, as the processes they deal with generally take months and even years.
Neurodivergence is not a "free pass to commit crimes," but an excuse to be locked up by the authorities.
Sure, not committing crimes is part of "playing the game", but it is a game you must play to go free.
If someone can't avoid sufficiently severe crime, that is a completely valid reason to lock someone up. It doesn't matter if they can help it or not
Neurodivergence is a reality. Our justice system can do better than be ignorant of it. Our justice system can do better than to escalate its symptoms. As a participant in democracy, I will accept no lower standard for justice.
This person wasn't killing people. He was looking at secrets. There are people who don't understand that murder is wrong, and those people need to be institutionalized for the safety of everyone else. He isn't one of them.
The justice system serves to prevent these actions, and should do so no matter what the mental state of the criminal is.
Is your honest solution just to let them continue doing that as an accommodation for their disability?
I don't advocate that we legalize blackmail or theft. I also don't advocate that we punish either with a life sentence.
My point here is that he wasn't even charged for the theft or the blackmail. He was charged for the hacking.
My criticism is directed at the justice system itself. Reading secrets should not carry a life sentence. Ever.
Im sorry if thats the case and I am trying. unfortunately, I didnt get that from your prior posts and this response as a complete nonquitter.
Maybe it stems from a different understanding of the underlying facts. The perp was not sentenced to life in any way, just custody until they stop claiming they will commit more crimes upon release.
In general, I agree a life sentence would be unreasonably harsh for hacking or reading secrets in isolation.
Charges and conditions of release can be unrelated. You may be placed into custody for hacking, but not release if you say you will commit a more serious crime immediately after.
The editorialized reframing of the headline is a bit subtle but still incredibly dishonest. An indefinite psychiatric order is simply not the same as a life sentence.
FWIW in this case I would suppose the BBC online editor was careless and fixed their mistake, versus "A/B testing for clicks" generally. If it was A/B testing, the "A" headline went too far: there's a fine line between clickbait and outright lying.
https://en.wikipedia.org/wiki/Economical_with_the_truth
> He worked with Kurtaj and other members of Lapsus$ to hack tech giant Nvidia and phone company BT/EE and steal data before demanding a four million dollar ransom, which was not paid.
He's not a "grey hat", he was actively extorting those orgs
Their mistake was to think that embarrassing the establishment by breaching high-profile (Nvidia, etc), culturally-relevant companies (BT/EE) would be met with similar inaction.
Also, with regards to skill, keep in mind that the establishment has a huge interest in making the hacks sound much more advanced than they really were to minimize the embarrassment of the affected companies. It would look really bad if it was widely known that these companies were pwned with nothing more than basic phishing, bribery and social engineering, something anyone can do.
Why not just restrict him from electronic devices like what happened to ZeroCool? Surely there are better solutions that putting him in a psych ward for life or until he is 'cured'.
He wasn’t sentenced as such. He was determined to be mentally unfit, and put under confined treatment until he no longer poses a threat.
I did RTFA. I'm saying he could have been denied access to any electronic devices without supervision, which I think would be a better alternative.
What about credit cards? aTMs? Self-service checkouts? PIN pads (the things Europeans have to use in stores to pay by card)? Ticket machines and turnstiles? cars? radios? TVS?
All of these sound pretty harmless and are necessary to have a life these days, but he did demonstrate that he can use a TV for hacking.
Smartphones and computers, anything with a keyboard and internet connection, and sufficient freedom to go anywhere eon the internet from the device.
> (the things Europeans have to use in stores to pay by card
I mean those are in every country. PINs are not always needed for credit card purchases but they are for debit card purchases.
> but he did demonstrate that he can use a TV for hacking.
A smart TV in conjunction with a phone and a firestick.
No reason he couldn't have a dumb TV.
Not it doesn't, it just requires more supervision from his probation officer or whatever. Put him on house arrest with an ankle bracelet, it's still better than being in a psych ward.
Because if it is the former it's really hard for me to understand how that is still even possible in this day and age. Autism, brilliance, or whatever... a 17 year old breaking into systems like they are as exploitable as early 90's systems sounds just insane to me.
A skill in itself but not 0day or anything.
It does seem likely their approach is something along the lines of phishing or, given some of the other notes in the article, a combination of social engineering or stalking and blackmail...
I have a feeling a lot of these hacker groups that are heard about do very little code exploitation. I think a lot of it is: find info on employees of a company, maybe find their old social media accounts, maybe find some stuff they might not want their coworkers to ever know about or their spouses etc. And then harass and blackmail the employees for a way in.
If the news agencies were better at reporting, I think a lot of people would see these type of 'hackers' as less 'ooooh brilliant genius child like in the movies' and more 'straight up criminal harasser with no more skill than any normal software developer'.
The problem is that reporting the truth - "socially-awkward teens hacked their way into large companies by manipulating their idiot employees and exploiting lax security policies" would force many powerful people into answering uncomfortable questions and expose incompetence at many levels.
Keep in mind that at least one of the hacked companies (BT - British Telecom) is culturally relevant in the UK and sadly it is mostly considered as trusted and competent by the general non-technical population. Hell, they've even got a cybersecurity arm: https://www.globalservices.bt.com/en/solutions/security
It would be really inconvenient if it became common knowledge that all this perceived trust & competence was nothing more than smoke & mirrors and that some kids can blow right through it.
Therefore, there's a vested interest all the way up from the government to make the hack more sophisticated than it really is and the hacker a meaner monster than he is. That's also the reason behind the disproportionate sentence, despite similar phishing/social engineering/stalking crimes against the layman not being prosecuted at all.
A no doubt gifted person who was probably put through torture (as they would experience it) in a prison, now locked away for life because they lashed out.
Big clap for all the big brains there who failed this guy.
Get this kid into the right environment and he would probably be able to do great things.
Eh, this is not outside the realm of expectations for an autistic teenager. Anyone locked in a cage will lash out, especially if they have neurological issues.
There is a way to harness this energy regardless.
Yeah, it is called prison. I don't care if someone is "autistic" or "shit-head asshole". If you are a violent son of a bitch, I have a concrete cage with bars to house you in.
Also - this individual is clearly a brilliant hacker and if that energy could be directed towards the white hat space, defensive posture, that would be invaluable.
Guaranteed Mi6 will be trying to snag this kid for offensive hacking. He'd have been hired already by NSA if he was in the US.
That's very dismissive of people with ASD.
There are plenty of people with ASD all over the spectrum, but most of them aren't violent.
That in itself is enough of a reason for Kurtaj to be in medical holding, especially given his track record for stalking and harassing women.
Being neurodiverse doesn't mean you get a free pass on sexual harassment or violent behavior.
Plenty of neurodiverse people don't harass women or violently attack people.
Source: https://www.nature.com/articles/s41467-023-42540-8
And don't use autism as an excuse - my mother teaches autistic teenagers and none of them have committed amoral stuff such as violence and harassment.
Also, an 18 year old is an adult.
Don't judge the future, create the future.
Boys will be boys /s
I cannot believe I saw someone give this kind of a statement on HN.
I recall being quite cognizant of adult thoughts & adult responsibility at age 14.
At age 20 I created something with friends that has led to multiple tens of millions of research funding for college students.
Many highly intelligent high school students compete in science & engineering competitions beyond levels of college & graduate level students.
How many people have made mistakes and learned/grew from them.
He's a child give him time.
This is the "I bet you're one of those people who <construct hypocritical position tangential to the topic>" fallacy. It is the height of pettiness, and one of the most egregious tropes of low quality internet arguing.
everyone, everywhere, is a misguided curious little fella.