I found the story to be quite tragic. This kid really saw the people at Valve as his heroes. Valve knew this and totally abused of that fact. They tricked him and was planning to hand him to the FBI, despite the fact he was (still is) their biggest fan and that the leak was accidental. I would have really hired him if I was in Gabe's position. He had both passion and skills. I think he would make an awesome YC applicant if he directed those to creating a web startup.
Once, when riding through a neighbor's land as a shortcut to a far piece of his own ranch, Theodore Roosevelt and some of his men came across a stray calf. The rules of the range were that any stray calf would be branded with the mark of whoever owned the land on which the calf was found, and everyone carried branding irons of his neighbor's for that purpose. Roosevelt built a fire, but one of his men put Roosevelt's brand on the calf. Roosevelt fired him on the spot. The man protested that he had put Roosevelt's brand on the calf, and Roosevelt replied "Any man who would steal for me would steal from me."
This is a nice story however I don't think the same principal should apply in this case. You have to look at intention of the behavior to judge ones character like Roosevelt did. In Roosevelt's case the intention was clear, the guy took away from another and knowingly disregarded the loss the other guy suffered. It's this character of hurting others to benefit self that made the behavior bad and immoral.
In this kid's case, information was copied. The intention was not to take away sacarce resource for self benfit. He got the source simply because the act of looking produced a copy. Not because he was trying to seek self gain. You should not equate the two and pass the same judgement of character simply because we tend to label both acts as "theft." They are completely different. I really think there should be another word to distinct between these different acts.
He took away something so scarce it's irreplaceable: their secrecy/confidentiality. And if it wasn't for self-gain, who on Earth's gain was it? He committed a pre-meditated (for months) crime to fulfil his own whims.
I disagree with you if you are saying that he had planned for months with the intention of taking away Valve's secrecy and confidentiality so he can hurt them and as a result gain something from it. There is no question that a crime has been committed. What we are debating about is whether he exhibited the same immoral character that Roosevelt condemned. I believe that no he did not exhibit the condemned character of intentionally hurting others for self gain - at least not through his actions of making a copy of Valve's source code.
One of the reasons I believe that is because the ramifications of making copies of someone else's information is not very obvious compared to taking away a physical object from them. When you take something tangible from someone it is immediately clear that the other person will be suffering a loss. However the act of looking at files stored in a remote server (and as a result creating copies) is much less obvious. I think it is very plausible that the kid was just trying to see the state/progress of the game that he has been anticipating so long for (4 years) and simply did not think about the ramification of his actions. This is totally different than the pre-meditation of a crime with the intention to put another party at harm. He has zero motivations to harm Valve. He sees them as his heroes and still is a big fan.
If you broke into a safe in a factory office and stole 1) 20 dollars of cash and 2) documented trade-secrets which you later made public, I'd say you were guilty of both crimes, both the insignificant one and the catastrophic one (and also the crime of breaking-in/trespassing). This is essentially the same, except the safe was a computer drive and both 1) and 2) revolve around the same object (the source code).
You are still not understanding what I'm trying to say. We are talking about intentions here. Not actions. I'm not saying he's not guilty of those crimes. I'm just saying he did not exhibit the undesirable character of intentionally hurting others for self gain. When he committed the crimes he might not have thought about how much Valve would suffer as a result. This is a very different mentality than breaking into someone's safe to take away physical objects. The result of you taking away physical objects is immediately clear - the other party will suffer a loss of those objects.
What i don't understand is that you keep saying he was not motivated by self gain, and that you cannot recognise the significance of actions beyond their physical consequences. Only sadists hurt people for self gain, most cases including this one people do things for their own satisfaction disregarding the damage it causes to the other party. The only way he could fail to be aware of the negative repercussions is if he accidentally took the source code and thought it was something else. He clearly did know what the code was, its value and why it was protected, so i don't see how what he did was any different from someone breaking into a factory and stealing secret plans (' not for self gain, just for the hell of it'), or someone breaking into a house and setting it on fire to cover their tracks, or any other crime that causes an obvious side-effect beyond the central goal.
>What i don't understand is that you keep saying he was not motivated by self gain... people do things for their own satisfaction...
That's a different kind of self gain than the one I was talking about. There is no need to point out/talk about the one you mention - every action anyone does is/can be argued for self satisfaction/gain of some sort - since everyone does it already. Yes I agree with that one. However, the gain I'm talking about is taking away a physical object away from someone else for the sake of gaining possession of it. Again, this is not what motivated the kid to break in and obtain a copy of the source code. However this type of gain is exactly what motivated the guy from Roosevelt's story. My original reply was trying to point out this difference.
>...you cannot recognise the significance of actions beyond their physical consequences.
Yes I can. Not only I can, I am also making a distinction between the actions with obvious physical consequences and the actions with less/no obvious physical consequences. It is you who insist on generalizing the two into the same thing and cannot see the (somewhat subtle) difference.
>The only way he could fail to be aware of the negative repercussions is if he accidentally took the source code and thought it was something else. He clearly did know what the code was, its value and why it was protected...
I beg to differ. That is just one extreme way. It is definitely not the only way he could have failed to be aware of the negative ramification. This is where evaluating his intentions/motivations is helpful. He loves the Valve company. He wants to play this game that he's been waiting for 4 years to ship. But the game keeps on getting delayed. He wants know the progress of the game's development. So then he decides looking at the source code is a good way to achieve this. I think it's very reasonable to argue that, "Had he known that by doing what he did would only further delay the game he wants to play and cause his heroes a lot of trouble, he would not have done it." The ramifications in this case is not as nearly as straight forward compared to breaking into a factory for the sake of gaining possession of the factory's secret plans. I really hope you can see this difference.
>so i don't see how what he did was any different from someone breaking into a factory and stealing secret plans
I think I've already done the best I can to explain to you the differences. If you still cannot see it then you are just going to have to figure this one out on your own/with someone else. http://en.wikipedia.org/wiki/False_Dichotomy
That might be a good place to start. I notice coders often tend to engage in this kind of over generalization/all or nothing thinking.
Look, I'm not saying it wouldn't be worse if a rival company broke in and stole the plans to give themselves a competitive advantage, but the kid still knew it was wrong and proceeded for his own sake (not money, but bragging rights and curiousity). So his crime wasn't grossly malicious, but it was grossly irresponsible considering the damage caused.
Quite simply, he should have known better. I know what a false dichotomy is - and it's exactly what you are purveying by insisting (so far without justification) that crimes with physical effects are not comparable to those without.
As far as I know he was the only one who have succeeded in not only hacking in, but also not being traced back despite all of Valves efforts. (They even got the FBI involved.) How many of the "hackpplicants" can you say the same about? The only reason Valve even knew who did it was because he came forward to them. He admired Gabe and his team so much that his dream is to join them. All of this indicate to me that he would make an awesome employee. I have little doubt that he would have poured his heart and soul into the company had he been given the chance. In fact that is the main reason why I found the story to be so tragic.
My point is it would encourage more people to apply by trying to hack into the company's networks instead of just creating impressive mods, Valve is a game dev/platform company after all not a network security one.
Ahh, I see. Point taken. I would still hire this passionate kid and put him on the network security team. I would then make a public announcement about how the job you get depends on what skill you demonstrate. Which should be the way it works anyways. If you want to join us as a game developer then you need to demonstrate your game developing passion and skills. Either through creating mods with our SDK/platform or writing/creating your own from scratch. However if you want to join us as a network security expert then you got to beat this kid we just hired! =P
If any time you were hacked, you fired the previous network security engineer and hired the guy who just broke in, you'd have a network unusuable by legitimate users and still probably vulnerable to skilled attackers.
Who said anything about firing? How does hiring one guy on to join the team == firing of all of the previous guys? Is there a one man network security team rule at Valve that I'm suppose to know about?
If you hire somebody to your security team every time your network is compromised, and never fire anybody, your network security team will outnumber the rest of your company.
I agree with your point, but we shouldn't forget that this article is clearly sympathetic to the kid. Maybe he isn't quite as cute and cuddly as they make out.
I know he was young and didn't think about it but what he should have done is get into Valve network, watch it for 2 weeks, copy some source code to proof it AND after that say:
"Hey Gabe, you know what I love Valve and I love all of you guys. You are all my biggest heroes BUT you know your security systems aren't good. I hacked your system and it was quite easy. For two weeks no-one even noticed it. I DIDN'T steal anything but if you give me a job I will do my best to pretend such security issues and make your system as secure as I can. Would consider giving me a job?
I attached some source code of Half-Life 2 to proof my abilities.
I hope you all best and hope to hear from you back.
Eight years later, it's easy to read an article and empathize with him. But if someone sent me an email that said, "I kinda stole your multi-million dollar source code, but really do like you and want to be friends." I would not be very trusting.
I think it highly depends on the delivery. I've mentioned this in another comment lower in the thread. Basically, had he contacted Valve and informed them about security the flaws and then shared the source code with Valve to show/prove the potential danger (instead of the guy who leaked it,) I don't think it's totally unreasonable for Valve to hire him on to the security team after he truly demonstrates skill and passion for the company.
