
The Boy Who Stole Half-Life 2 - twidlit
http://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article?page=1
======
jcw
I'm happy to see that, while he did something wrong, because he was honest and
openly remorseful throughout, he ended up not going to prison. The cops even
seemed cordial, they let him get breakfast and a smoke.

I wonder how differently things would have played out if he lived in the US.

~~~
podperson
I think the German police clearly thought he was not going to get justice from
the US (hence the remarks about how lucky he was that they got him before he
got on the plane) and saved him from falling into the FBI's trap.

~~~
atourgates
Considering the rash of "OMG the police barged into my house, shot my goldfish
and raped my star wars collection" type stories I've been hearing, is it safe
to assume that the German police are quite a bit more sensible than their
American counterparts?

The whole experience sounds rather civilized. The police let Gembe get
dressed, eat breakfast and smoke a cigarette before bringing him down to the
station. And when he confessed, his punishment was 2 years in probation.

I somehow doubt his experience with the FBI would have been similar.

~~~
thomasz
> is it safe to assume that the German police are quite a bit more sensible
> than their American counterparts?

It depends. Gun ownership isn't nearly as common in the US, so they can safely
assume that a 17 year old blackhat won't pull a gun on them.

On the other hand, I've seen a ~4.9 feet tall girl getting knocked
unconsciously with a Mp5 during the eviction of a squat. In 2003, a
schizophrenic in custody was beaten to death by officers in Cologne. They were
sentenced from 12 to 18 months in probation. In 2005, Oury Jalloh burned to
death in a holding cell in Dessau while being tied with handcuffs to a fire-
proof mattress at his hands and feet. In 2008, Josef Hoss was beaten to a
bloody pulp by a special unit after his arrest. He is irreparably crippled. He
later recieved 30,000€ for compensation.

~~~
burgerbrain
The difference between Germany and the US? Those types incidents are uncommon
enough that you can remember individual occurrences.

~~~
ars
Oh come on, they are quite rare in the US as well, and the US is a LOT larger
than Germany.

~~~
psykotic
> Oh come on, they are quite rare in the US as well, and the US is a LOT
> larger than Germany.

Yes, if "a LOT larger" means 3.5x larger. Germany has 82 million inhabitants
and is the most populous country in Europe.

~~~
true_religion
A lot larger as in landmass. People pay attention to what goes on in their
geographic area, regardless of its population.

For example, a beating in California isn't going to be as troubling to a
resident in Vermont. They'll simply say "different state, different police
force". On the other hand, a beating in Berlin is going to trouble someone in
_any_ part of Germany.

~~~
noibl
Believe it or not, Germany is also a federal republic with distinct regional
differences. Germany doesn't even have federal policing.

~~~
brazzy
Not true: the former border police (Bundesgrenzschutz, parent organization to
the famous GSG 9) has been officially the Bundespolizeit (federal police)
since 2005, and there has always (well, since the 1951) been a federal
investigation agency (Bundeskriminalamt). Most claims of police violence are
actually against the Bereitschaftspolizei (riot police units, exist both at
state and federal level), which is not surprising since they are deployed (and
trained) mainly for potentially violent situations.

~~~
noibl
To clarify: I know there are federal investigative police (but not as powerful
as the FBI, right?) so I deliberately used the verb, meaning enforcement. I
didn't know there were federal riot police though.

------
chaosmachine
I was in a similar position once, many years ago, in the early days of the
web. I had managed to get parts of the source code to a popular online game
(no real hacking here, they left a tarball in an open directory I stumbled
upon), and being a foolish young kid, I decided to brag about my insider
knowledge of unfinished features on a website. A few weeks later, the company
contacted me with a job offer... they just needed my name and address to start
sending me checks. Fortunately, I wasn't that dumb.

~~~
shadowpwner
Out of all the ways they could have caught you, a job offer? That's hilarious.

------
ztan
I found the story to be quite tragic. This kid really saw the people at Valve
as his heroes. Valve knew this and totally abused of that fact. They tricked
him and was planning to hand him to the FBI, despite the fact he was (still
is) their biggest fan and that the leak was accidental. I would have really
hired him if I was in Gabe's position. He had both passion and skills. I think
he would make an awesome YC applicant if he directed those to creating a web
startup.

~~~
zx76
Once, when riding through a neighbor's land as a shortcut to a far piece of
his own ranch, Theodore Roosevelt and some of his men came across a stray
calf. The rules of the range were that any stray calf would be branded with
the mark of whoever owned the land on which the calf was found, and everyone
carried branding irons of his neighbor's for that purpose. Roosevelt built a
fire, but one of his men put Roosevelt's brand on the calf. Roosevelt fired
him on the spot. The man protested that he had put Roosevelt's brand on the
calf, and Roosevelt replied "Any man who would steal for me would steal from
me."

~~~
ztan
This is a nice story however I don't think the same principal should apply in
this case. You have to look at intention of the behavior to judge ones
character like Roosevelt did. In Roosevelt's case the intention was clear, the
guy took away from another and knowingly disregarded the loss the other guy
suffered. It's this character of hurting others to benefit self that made the
behavior bad and immoral.

In this kid's case, information was copied. The intention was not to take away
sacarce resource for self benfit. He got the source simply because the act of
looking produced a copy. Not because he was trying to seek self gain. You
should not equate the two and pass the same judgement of character simply
because we tend to label both acts as "theft." They are completely different.
I really think there should be another word to distinct between these
different acts.

~~~
Tycho
He took away something so scarce it's irreplaceable: their
secrecy/confidentiality. And if it wasn't for self-gain, who on Earth's gain
was it? He committed a pre-meditated (for months) crime to fulfil his own
whims.

~~~
ztan
I disagree with you if you are saying that he had planned for months with the
intention of taking away Valve's secrecy and confidentiality so he can hurt
them and as a result gain something from it. There is no question that a crime
has been committed. What we are debating about is whether he exhibited the
same immoral character that Roosevelt condemned. I believe that no he did not
exhibit the condemned character of intentionally hurting others for self gain
- at least not through his actions of making a copy of Valve's source code.

One of the reasons I believe that is because the ramifications of making
copies of someone else's information is not very obvious compared to taking
away a physical object from them. When you take something tangible from
someone it is immediately clear that the other person will be suffering a
loss. However the act of looking at files stored in a remote server (and as a
result creating copies) is much less obvious. I think it is very plausible
that the kid was just trying to see the state/progress of the game that he has
been anticipating so long for (4 years) and simply did not think about the
ramification of his actions. This is totally different than the pre-meditation
of a crime with the intention to put another party at harm. He has zero
motivations to harm Valve. He sees them as his heroes and still is a big fan.

~~~
Tycho
If you broke into a safe in a factory office and stole 1) 20 dollars of cash
and 2) documented trade-secrets which you later made public, I'd say you were
guilty of both crimes, both the insignificant one and the catastrophic one
(and also the crime of breaking-in/trespassing). This is essentially the same,
except the safe was a computer drive and both 1) and 2) revolve around the
same object (the source code).

~~~
ztan
You are still not understanding what I'm trying to say. We are talking about
intentions here. Not actions. I'm not saying he's not guilty of those crimes.
I'm just saying he did not exhibit the undesirable character of intentionally
hurting others for self gain. When he committed the crimes he might not have
thought about how much Valve would suffer as a result. This is a very
different mentality than breaking into someone's safe to take away physical
objects. The result of you taking away physical objects is immediately clear -
the other party will suffer a loss of those objects.

~~~
Tycho
What i don't understand is that you keep saying he was not motivated by self
gain, and that you cannot recognise the significance of actions beyond their
_physical_ consequences. Only sadists hurt people for self gain, most cases
including this one people do things for their own satisfaction _disregarding
the damage it causes to the other party._ The only way he could fail to be
aware of the negative repercussions is if he accidentally took the source code
and thought it was something else. He clearly did know what the code was, its
value and why it was protected, so i don't see how what he did was any
different from someone breaking into a factory and stealing secret plans ('
not for self gain, just for the hell of it'), or someone breaking into a house
and setting it on fire to cover their tracks, or any other crime that causes
an obvious side-effect beyond the central goal.

~~~
ztan
_> What i don't understand is that you keep saying he was not motivated by
self gain... people do things for their own satisfaction..._

That's a different kind of self gain than the one I was talking about. There
is no need to point out/talk about the one you mention - every action anyone
does is/can be argued for self satisfaction/gain of some sort - since everyone
does it already. Yes I agree with that one. However, the gain I'm talking
about is taking away a physical object away from someone else for the sake of
gaining possession of it. Again, this is not what motivated the kid to break
in and obtain a copy of the source code. However this type of gain is exactly
what motivated the guy from Roosevelt's story. My original reply was trying to
point out this difference.

 _>...you cannot recognise the significance of actions beyond their physical
consequences._

Yes I can. Not only I can, I am also making a distinction between the actions
with obvious physical consequences and the actions with less/no obvious
physical consequences. It is _you_ who insist on generalizing the two into the
same thing and cannot see the (somewhat subtle) difference.

 _> The only way he could fail to be aware of the negative repercussions is if
he accidentally took the source code and thought it was something else. He
clearly did know what the code was, its value and why it was protected..._

I beg to differ. That is just one extreme way. It is definitely not the _only_
way he could have failed to be aware of the negative ramification. This is
where evaluating his intentions/motivations is helpful. He loves the Valve
company. He wants to play this game that he's been waiting for 4 years to
ship. But the game keeps on getting delayed. He wants know the progress of the
game's development. So then he decides looking at the source code is a good
way to achieve this. I think it's very reasonable to argue that, "Had he known
that by doing what he did would only further delay the game he wants to play
and cause his heroes a lot of trouble, he would not have done it." The
ramifications in this case is not as nearly as straight forward compared to
breaking into a factory for the sake of gaining possession of the factory's
secret plans. I really hope you can see this difference.

 _> so i don't see how what he did was any different from someone breaking
into a factory and stealing secret plans_

I think I've already done the best I can to explain to you the differences. If
you still cannot see it then you are just going to have to figure this one out
on your own/with someone else. <http://en.wikipedia.org/wiki/False_Dichotomy>
That might be a good place to start. I notice coders often tend to engage in
this kind of over generalization/all or nothing thinking.

~~~
Tycho
Look, I'm not saying it wouldn't be worse if a rival company broke in and
stole the plans to give themselves a competitive advantage, but the kid still
knew it was wrong and proceeded for his own sake (not money, but bragging
rights and curiousity). So his crime wasn't grossly malicious, but it _was_
grossly irresponsible considering the damage caused.

Quite simply, he should have known better. I know what a false dichotomy is -
and it's exactly what you are purveying by insisting (so far without
justification) that crimes with physical effects are not comparable to those
without.

------
bluesnowmonkey
Am I the only one who thinks what he did was not only criminal but morally
wrong, and that he deserved to go to prison for a long time?

I realize that everybody likes to call themselves a "hacker" because they can
program a computer, but this is an actual black-hat hacker. There are bad guys
in the world and he's one of them. He wrote malware. He stole source code and
gave it to the world. And this wasn't some evil corporation he was trying to
bring to justice for its crimes. This was Valve. All they do is make cool
games for the world. It's _incredibly_ difficult work and they do a fantastic
job. What kind of asshole do you have to be to shit all over them like this
kid did?

~~~
barrkel
I don't fully buy this concept of "morally wrong". You ask what kind of person
could do X considering consequences Y for victim, but that presumes the person
knows and understands Y, which in this case, they didn't. So no, they are not
_necessarily_ an asshole because of this.

I also think it's deeply immature to divide the world into black and white,
good and bad, and put curious kids on the bad side of the line with the
rapists and murderers. The world isn't black and white. The perspective on the
other side of the line can be quite different; and the people who really are
bad are probably more in need of being locked up for medical reasons than some
biblical, retributive, medieval eye for an eye logic of punishment

~~~
barry-cotter
_I don't fully buy this concept of "morally wrong"._

So you're totally okay with me beating your [underspecified relative] so badly
they're in chronic pain for the rest of their lives then?

~~~
pyre
I think that you're mis-interpreting the statement. He's not stating that he
doesn't believe in morality. He's stating that he doesn't _fully_ buy _this_
concept of "morally wrong." I.e. He's doesn't believe in the same ideas as the
poster he was replying to.

------
jasonjei
Considering that he's been sentenced and assuming he has served the term of
probation, if he were to set foot on the US, could he be tried and sentenced
again, or does Double Jeopardy protect him even if he already had proceeded
through the German court system?

~~~
true_religion
Double Jeopardy doesn't protect you from being tried in multiple
jurisdictions.

An American example is the "D.C. Snipper" who was charged in Maryland,
Virginia, and D.C. to maximize jailtime and possibility of conviction.

~~~
kd0amg
Was that all for a single crime, or did each trial cover separate instances?

~~~
true_religion
They were treated as seperate instances since the crimes were committed
against people in X jurisdiction. That's applicable in this case as well since
the Valve folk are in the US jurisdiction.

~~~
kd0amg
If the instances were partitioned between those three jurisdictions, then it
isn't really an example of avoiding double jeopardy limitations by changing
jurisdiction.

~~~
true_religion
Right, I guess what I'm getting at is that neither case (the one in the
article and the one I mentioned) was about Double Jeopardy because the police
could partition the crimes to different jurisdictions.

Legalistically, its correct but ethically it means that police can try you
multiple times so long as they narrow the jurisdiction on the first attempts.
For instance, a car chase that crosses multi-jurisdictions can result in
multiple trials (and consecutive sentences) even though its really just one
offense.

------
temptemptemp13
I'd really like to hear Gabe's side to this story.

~~~
abossy
Agreed. I remember reading about this years and years ago, and I thought Gabe
Newell said the resolution was that they flew him to the U.S. and arrested him
as he de-boarded his plane.

------
Scaevolus
I liked this quote:

"For some reason they thought there was a connection between me and Sasser,
which I denied. Sasser was big news back then and its author, Sven Jaschan,
was raided the same day as me in a co-ordinated operation, because they
thought I could warn him.

"My bot used the same vulnerability in the LSASS service that his did, except
it didn't crash the host system, so I guess they thought I gave him the
exploit code. Of course I denied this and told them that I never write such
shoddy code."

------
jarin
Glad to see it had a relatively happy ending.

At the risk of repeating a tired Internet cliche, I think the leak may have
helped Half-Life 2.

If the project was already months behind schedule and had a year before a GM
build would be ready, having the source code leaked may have given hardcore
gamers reassurance that the game was actually coming along and would be
finished at some point.

Of course, there's also the newsworthiness and buzz coming from the leak
itself.

~~~
twidlit
Now if someone would only leak Episode 3/Half-Life 3...

~~~
Uchikoma
I have the suspicion - no, deep deep creepy fear that engulfs your heart -
that E3 will become the next Duke Nukem. This might push me into insanity.

~~~
dspillett
I suspect Duke is one of the reasons for the complete lack of E3 related
announcements so far this year. That and their own Portal 2. They'll not want
a "coming next year" annoucement about E3 to be wasted by it being
overshadowed by the big things being released in the next few months.
Hopefully there will be an announcement later in the year, during one of the
release dry spells.

Though you could be right, we've already been waiting for E3 twice as long as
E2.

------
linuxhansl
Unless it is a small project and works without a dataceter the sourcecode
itself is useless. Yet, so many people believe that there is actually any
(usable) value in the source code alone.

I flunked (thank god) an interview with a company once that ended up going
belly up. The capital came from angel investors (mostly lawyers). When they
ran out of money they locked everybody out of the premises (even though all
their stuff was still in the building) for the fear somebody would take the
source. This was 6 or 7 years ago.. To this date these lawyers still sit on
their precious source code.

------
mukyu
In the reddit thread (
[http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_st...](http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_stole_halflife_2_fascinating_article/)
) he* has answered some questions.

* I'm not actually sure it is him, but he is plausible enough.

------
oemera
What I learned from this is: Never trust any of your friends or family when
you have such important things in your hands.

You know in everyone of us is this little devil and if you have something
which is important you can earn something with it (money or even credit in the
community) there is a good chance that people will go the devil way.

I even would consider saying I even DON'T trust myself on such important and
valued things!

------
jrockway
_Automatic weapons were pointing at his head and the words "Get out of bed. Do
not touch the keyboard" were ringing in his ears._

Would they really have shot him in the head if he touched the keyboard? My
guess is no.

~~~
stuhacking
Would you take the chance?

My guess is he'd receive a sharp blow from the butt of the weapon to the back
of the head had he shown any attempt to deviate from their instructions.

------
joelhaasnoot
Story reminds me of the book "Cuckoo's egg" by Clifford Stoll

~~~
cschep
great story!

------
sathyabhat
Site's down, text-only Google cache view

[http://webcache.googleusercontent.com/search?q=cache:T1eI3Z6...](http://webcache.googleusercontent.com/search?q=cache:T1eI3Z60_yMJ:www.eurogamer.net/articles/2011-02-21-the-
boy-who-stole-half-
life-2-article%3Fpage%3D1+http://www.eurogamer.net/articles/2011-02-21-the-
boy-who-stole-half-life-2-article%3Fpage%3D1&hl=en&gl=in&strip=1)

------
Tichy
What I don't get is why the police had to wake them up with a gun pointed to
his head. Is this standard procedure for hackers, or criminals in general? Is
it because some time ago it was decided that hackers are terrorists?

Suppose I cheated on my taxes (which I would of course never do, but I think
many people consider that fair game), would the police also wake me with a gun
pointed at my head?

~~~
RyanHolliday
Well, Mitnick was kept in solitary because they were afraid he could start a
nuclear exchange if given access to a phone. I think a bit of paranoia is
common procedure for hackers because what they do seems like magic to most
people.

As for the taxes, that's entirely dependent on your behavior. There have
definitely been stand-offs between tax protesters and armed law enforcement
personnel.

------
eordano
Oh! So it was real? I remember downloading a file called "HL2 Source
Code.rar", long time ago, from eDonkey network. Never payed enough attention
to it, thinking it was a fake!

------
l0nwlf
I wonder why Valve didn't offered him a job. He was naive but talented and
passionate about gaming.

~~~
T-hawk
Would you hire somebody that already stole something major from your very
company?

~~~
ztan
If the article was 100% accurate, then I would have due to this particularly
unusual circumstance. The kid was too naive and handled the situation poorly.
The leak in fact was purely accidental. I think if he had contacted Valve and
gave them the source code instead of to the guy who leaked it, the whole thing
would have had a very different turn out.

The kid recognized what he did was wrong and regretted it. That was why he
came forward and emailed Gabe. If he really just wanted steal and cause harm,
he would have never been found or caught. You can tell he truly loved the
company and was simply misguided in the way he chose to show it. Yes he made a
mistake, but I would have still given the kid a chance rather than beat him
down. It's this kind of tragic beat downs that often create villains. (in the
worlds of comic books at least. =)

~~~
cookiecaper
He'd probably be a good hire now, but his confession to Gabe was only a few
months after the incident. If you knew it was a naive kid that didn't
understand the boundaries, that alone is enough reason to wait a few years
before you hire him. People who think it's cool to swap your company's
proprietary information with untrustworthy outsiders should be avoided.

------
JacobIrwin
End of page two: "The cat was out of the bag," says Gembe. "You cannot stop
the internet."

------
incently
Great attitude, almost civil-disobediencesque.

------
tkahn6
I'm impressed by the shear amount of knowledge the kid had. Especially at the
age that he did it.

~~~
moe
I also found it hard to not sympathize with him after statements like this:

 _"My bot used the same vulnerability in the LSASS service that his did,
except it didn't crash the host system, so I guess they thought I gave him the
exploit code. Of course I denied this and told them that I never write such
shoddy code."_

He doesn't come across like a criminal mind to me.

Don't blame an 18yr old kid for naively crossing lines he shouldn't. Blame the
million dollar company for not securing their assets against 18yr old kids.

~~~
epo
Yet another know-it-all blaming the victim. There is no magic immunity which
accrues from being 18, the kid knew what he was doing and wilfully committed
criminal acts.

~~~
moe
Thanks for the ad hominem.

It would have been more plausible if you didn't claim to know better than the
know-it-all in the next sentence ("willfully").

If you really want this discussion then perhaps take into consideration the
nature of the crime and try to recall your own youth (you've once been 18,
too, right?).

I'm not saying he doesn't deserve a slap on the wrist. It's however beyond
ridiculous to try and charge him with virtual _9 figure_ damages - potentially
sending him to jail and ruining the rest of his life.

The more interesting question is who was charged for criminal negligence - or
at least fired - at Valve over this?

This is the more interesting question because curious and slightly naive 18yr
olds are a natural law. They will always be around, and there's strong
evidence that deterrence does not work very well against them.

