
Wi-Fi–Hacking Neighbor From Hell Sentenced to 18 Years - dennisgorelik
http://www.wired.com/threatlevel/2011/07/hacking-neighbor-from-hell/
======
inoop
So let me get this straight, the guy hacked into his neighbour's WiFi and used
it to mess with their MySpace page, e-mail coworkers, post a picture of
'pubescent girl having sex with two young boys' (I'd have gone for tubgirl,
but okay), and threaten Joe Biden. And this gets him eighteen years in prison?
In most countries you get eighteen years for murder.

I'm sure the guy is a creepy douche, and what he did is clearly wrong, but
these look like trumped up charges by a law firm that knows how to play ball.
No-one will come out in defense of this man now that he has been publicly
labeled a pedophile, even though I see no evidence of that in the article. If
he really were into children, would they not have found a stash of pictures or
videos when their confiscated his machine? Instead they found only the one he
posted to myspace. I'm not sure how young the girl in the picture really was,
but anyone looking to shock can easily get such material from say, 4chan.

So really what we have here is a cracked WEP key, some e-mail harassment, a
picture of a young girl having sex, and a death-threat to Joe Biden. Because
of this, and probably because he tried to fuck with a lawyer, his life is now
essentially over and young children get to spend the rest of their youths
without a father. Am I the only one who thinks this is a bit excessive?

Also, you're living in a pretty fucked up society when your neighbours call
the cops because they saw you kissing your kid 'on the lips'. I'm pretty sure
my entire family is a bunch of pedophiles by those standards.

edit: totally got the wording wrong from the article. The guy kissed their
boy, not his own. Mea culpa, must learn to read.

~~~
SeoxyS
I think the sentencing is completely fair. It's not really about the cracking
or emailing threats or any of that. It's about emotional torture. Yes, that's
a thing, and it's a serious offense. I can't think of a more traumatic
experience for a family than what the victims went through.

Somebody who plans and executes psychological torture on his neighbor for
months should spend the rest of his days under some kind of watch. Now, it's
debatable whether prison or a mental health institution is the correct choice
here… but that's besides the point. Fact is, he had some seriously
psychopathic tendencies, and society is much better off with him off its
streets.

~~~
inoop
While I agree that emotional torture is a terrible thing. Still, do you think
eighteen years is really fair?

Now you claim the guy has psychopathic tendencies. I won't argue for or
against this because I'm not a psychologist. But even if he does, this can
never be a reason to lock him up. In western society, people are punished for
crimes they commit, not for having a certain psychological profile.

~~~
ars
Personally I think it's too short. Intent matters a lot, this person did not
just do criminal activity for his own benefit.

No, he did criminal activity in order to make someone else as miserable as
possible. This is a special level of heinous and deserves a much more severe
sentence.

~~~
_delirium
Seems to expose some different assumptions about the purpose of jail time. To
me, it's purely protective: you put violent people in jail to physically
incapacitate them until the threat of them causing more violence diminishes as
they age. That's the reason most Scandinavian countries give sentences of
under 10 years for most crimes, and under 20 years even for murder, because
the risk of older people committing violent crimes is _very_ low. So if your
goal is to protect society from reoffense, the biggest win is to keep people
locked up for their 20s; the 2nd-biggest is people in their 30s; and it gets
increasingly pointless beyond that. In fact, giving supervised release instead
of jailtime is often warranted, because keeping people tied to their
communities / sources of employment is one of the best ways to prevent
recidivism, while a few years in jail tends to turn people into hardened
criminals (with fewer ties to the non-criminal world, and more ties to
criminal gangs).

In this case, 18 years seems pretty clearly excessive from a protective point
of view; it's not even clear any jail time at all is warranted, since some
sort of probation with supervision of internet use would likely suffice to
prevent him from reoffending.

My impression is that many people, especially in the U.S., have a notion of
justice that's either more retributive or deterrent based, though. If
retributive, that's a pure ethical disagreement. If deterrent, then we might
have an empirical disagreement, about which lengths of sentences in fact deter
crimes.

~~~
tptacek
By your logic here, there was little point in locking him up at all; he was
already 45.

Interestingly, if you read the prosecution's sentencing memo, you see that
protection is the core reasoning behind the long sentencing recommendation:

 _Barry Ardolf is a dangerous man. He uses his technical skills both to
inflict harm and to avoid getting caught. Indeed, there is every reason to
believe that the victims identified in this case are not his only victims.
When Barry Ardolf is released from prison at the end of his term of
commitment, he will do something like this again to someone else who has
angered him, only this time he will be even more careful. The only way to
prevent that is to incarcerate him for a very long time._

I'm absolutely inclined to agree with them. The prosecution earlier notes that
even in this case, Ardolf's letter to the judge expresses no remorse for
attempting to frame his neighbor for child pornography at his place of work,
claiming instead that he had been "victimized" by the neighbor. Ardolf sounds
criminally insane to me. I'm glad he was locked up before he did something far
worse.

~~~
Confusion
Solely looking at the protective aspect and ignoring an assessment of the
chance of recidive, the logical conclusion is that a relatively low sentence
is in place. However, I don't think the parent is advocating that _only_ the
protective aspect should be considered. After all, not even the Scandinavian
countries do that.

~~~
tptacek
Everything after my first sentence is a later edit. I originally commented
because the 20's and 30's rule of thumb he suggested didn't ring true to me.
But when I read the sentencing memo, I was reminded of his point that
protection is a key rational purpose of sentencing and moved to amend my
comment.

------
SeoxyS
I'm very impressed that the victim's law firm employer gave him the benefit of
the doubt, and hired a forensics firm to get to the bottom of it. In this day
and age, expectations of loyalty from companies to their employees are very
very low.

~~~
geuis
In part, this might be that people typically spend many years working their
way up the ladder at a law firm. This requires building strong work and
personal relationships with coworkers and a lot of trust.

If a very, very good friend was in a similar situation and being accused of
some very bad crimes, I like to think that I would give them the benefit of
the doubt during the course of the investigation. Given condemning evidence,
of course, that would change the nature of such a friendship in a negative
manner.

------
dkarl
Interesting how many people's first thoughts go to fairness to the defendant,
despite the seriousness of his crimes and the utter certainty that he
committed them. Apparently, because of the means he used, many folks here find
it easier to identify with him than with his victims.

It reminds me of the discussions of local bicycle-car accidents I read when I
was reading through cycling forums looking for commuting tips years ago. You
could put Pol Pot on a bicycle, and suddenly people would see things from his
perspective.

Anyway, I urge people to consider that anxieties about being unfairly treated
and fantasies about satisfying computer-based acts of retribution are pretty
common and have NOTHING to do with this guy's very rare and very dangerous
ability to commit such cruelty, not once on an impulse, not to one family, but
to multiple victims over long periods of time. If he was a little less clever
and/or had a little bit more physical bravery, he might have physically
tortured and killed people instead of just trying to ruin their lives.

~~~
inoop
I wholly agree the guy's a total dick and probably has some serious mental
issues, but come on, just because you troll your neighbours by hacking their
WiFi doesn't mean you're capable of torture and murder. What this guy did is
no different from trying to destroy someone professionally by spreading lies
and rumours in more conventional ways, as has been done in most corporations
pretty much ever since they were invented.

~~~
three14
"What this guy did is no different from trying to destroy someone... in more
conventional ways" is exactly the point. If someone did exactly the same
things in conventional ways, he should still get the same sentence, and he
probably would have.

~~~
inoop
> If someone did exactly the same things in conventional ways, he should still
> get the same sentence, and he probably would have.

Huh? I never said anything to the contrary?

~~~
dkarl
Except you referred to "destroy[ing] someone professionally" which is not the
same thing as what this guy did. He tried to send them to jail.

Going to jail for child porn and threats to kill the Vice President is a
little different from being "ruined" professionally. Planting evidence (which
was illegal for him to possess in the first place) and sending death threats
to the Vice President is a little different from "spreading lies and rumors."

You might disagree, but the justice system in the U.S. is supposed to sentence
people according to the severity of their offense and the danger they pose to
other people, not facile logical equivalences between acts that have vastly
different effects on their victims and vastly different costs for society.

------
jrockway
The lesson is clear: the next time you have a disagreement with your neighbor,
get drunk and run him over with your car. You'll be out of prison sooner than
if you hack his WiFi and send some sleeze-ball emails.

~~~
VladRussian
i think many would prefer to get their bones broken - several month in bed -
than to get charged and, God forbid, be convicted of child porn - whole life
down the drain.

~~~
jrockway
Ideally, one is not convicted of crimes they don't commit. This case is a good
example: the person that tried to frame his victim is now off to prison for 18
years.

------
vectorpush
In terms of justice, 18 years is kind of steep, but on a visceral level I just
can't feel bad for a guy who tried to frame someone as a child pornographer.
You're dunzo buddy.

------
mostly_harmless
What is most shocking to me is that it took him 2 weeks to crack a WEP
password... Was he putting in the characters by hand?!

~~~
davis_m
If the network was used as little as my parents is, and if this guy didn't
have a network card capable of reinjecting packets, I can certainly see it
taking a couple of weeks to get the number of IVs needed to crack a WEP key.

------
nowarninglabel
Well, for anyone still using WEP, this should be a wake up call. Not for
ourselves, but which makes you reach out to relatives/friends and help them to
move to a more secure wireless technology.

~~~
dennisgorelik
Cracking WEP on neighbors' router with malicious intent does not happen often.

It's better to use more secure technology, but most of the time WEP is ok.

Some people actually run wireless routers without encryption at all (and that
was a blessing for me when I just moved into new place and was waiting for few
days until cable company's technician showed up).

~~~
andrewcooke
that's why i run an open wifi. because i have benefited from others doing the
same in the past.

~~~
ultrasaurus
I wish more routers came with a setting to share a small slice of your
bandwidth on port 80 and 443 openly, with the real wifi access secured.

Where I live, open wifi will be saturated by your neighbours' bittorrents
quickly (we pay by the GB).

------
laughinghan
Could someone clarify a technical issue for me? I thought hacking WEP grants
you access to the internet via that Wi-Fi network, which explains how he
created a MySpace page that traced back to their IP address, but how would he
be able to send emails from the lawyer's email account? Even within the poorly
encrypted Wi-Fi network, the lawyer was using Yahoo Mail which surely uses
HTTPS, so how did the neighbor get into the lawyer's email account?

Unless he used a custom mail client to spoof the From field of the email, in
which case the email should be easily provably not sent via Yahoo Mail's
servers.

~~~
davis_m
Yahoo Mail didn't implement HTTPS until after Firesheep came out. With the
length of time that these sorts of trials take, I imagine that Yahoo was still
transmitting usernames and passwords over HTTP in cleartext when this all
happened.

~~~
laughinghan
Oh, wow, in that case.

------
Joakal
Seems like disproportionate punishment for 18 years for constant harassment
and first time offence (?). As a taxpayer, it seems economically cheaper to
rehabilitate him for the non-violent offences and get him contributing back to
the economy rather than spending money incarnating him.

IANAP (I am not a participant) beyond the article. I don't know the full case
details to warrant the punishment.

~~~
tptacek
It was the first time he was convicted of an offense, but there was (a)
evidence of prior offenses turned up by the investigation into this one, and
(b) every indication that the offender was not only remorseless, but saw his
own actions as justified by the persecution he underwent for accosting his
neighbor's 4 year old son. There was, in other words, a very credible case to
be made that the offender was destined to re-offend.

~~~
Tomis
So basically the American justice system admits that it is incapable of
rehabilitation and that its only purpose is punishing and/or isolating
offenders from society. Got it.

------
sgoranson
"In the data surrounding the threatening traffic, they found traffic
containing Ardolf’s name and Comcast account."

What do you suppose this means? Did his decide to check his personal email
while on his neighbor's wifi?

~~~
abalashov
My guess is that maybe he was bright enough to crack the WEP but not bright
enough to send the e-mail through the victim's ISP's SMTP relay, but instead
sent it through his own (Comcast's), possibly authenticated with his own
username and password, if Comcast does user authentication for SMTP instead of
just trusting all of their customer subnets blanketly.

------
pjeide
TRWTF: It took him 2 weeks to crack the WEP..

------
leon_
wow, I'm from europe and 18 years seem to me for what he did just cruel. even
3 years would be hard.

that's why I wouldn't want to live in the US. the criminal system is out of
control. if you "fuck up" a little bit or they just get the wrong guy there's
a chance you will spend a big part of your life behind bars (or worse).

~~~
kahawe
I am from Europe and it seems fair for the reasons listed by the court. Read
the actual PDF and their reasoning; it is very conclusive and clear.

The part that weighs so heavy is the planning, the full intent and showing
absolutely no remorse to the court. The hacking was just a means to an end. He
got sentenced for willingly, cold bloodedly and with full intent trying to
destroy his neighbor's life.

This would not have gone down any different in the EU.

And darn am I sick of fellow Europeans flinging poo towards the USA every
chance they get and 99% of them haven't ever actually worked or lived there.

~~~
leon_
> This would not have gone down any different in the EU.

I dare to bet no EU country would have sentenced someone to 18 years for what
he did.

------
aashay
>“Over months and months, he inflicted unfathomable psychic damage, making the
victims feel vulnerable in their own home, while avoiding detection.”

So he's a hacker AND has psychic powers? Man oh man.

~~~
noonespecial
Yeah, pet peeve. Psychic != psychological. Irregardless, don't make me beg the
question.

~~~
brianleb
Not that I want to be pedantic, but since we're being pedantic...

psy·chic

1\. of or pertaining to the human soul or mind; mental

psy·cho·log·i·cal

2\. pertaining to the mind or to mental phenomena as the subject matter of
psychology.

via our friend dictionary.com

If sarcasm went by my head (and I think it may have, since you said
irregardless), please ignore this post.

~~~
noonespecial
Yes, sarcasm, to both commenters. It was about shifting connotations diluting
original meanings and not so much about pedantry. I stopped fighting "begs the
question" years ago and simply accepted that it means something different now.
We've lost psychic the same way (see great-grandparent post).

------
pyre

      > One of the manuals had Ardolf’s handwriting on it and
      > another had the unique identifying ID for the
      > Kostolniks’ router typed into it
    

So were the manuals physical or digital? If they were physical, then why would
he use a typewriter to enter their router MAC?

~~~
sophacles
Really, your nit against a poor sentence is in the form of a false dilemma?
What about:

* An annotated and later printed PDF.

* A home witten manual where notes and step-by-steps were put in a .doc (or similar) and printed out for later reference.

* A single piece of paper printed and used as a bookmark, or taped into the cover of the book.

And so on. Please at least try to think of alternatives which are more
plausible than your random choice -- it comes off as less disingenuous.

------
pdenya
What the hell?

"With Kostolnik’s permission, they installed a packet sniffer on his network
to try and get to the bottom of the incidents."

They installed a packet logger but didn't bother changing the encryption to
something stronger than WEP!? Crazy.

Edit: They likely already knew who was responsible since it had to be a
neighbor but even if they didn't, the Secret Service had to show up
investigating death threats to Biden for this log to be looked at.

Hind site is 20/20 and all that but I would likely have handled this
differently.

~~~
elithrar
> They installed a packet logger but didn't bother changing the encryption to
> something stronger than WEP!? Crazy.

They likely wanted to find the source of the intrusion and prosecute against
it, not block it out completely. Changing to WPA2 w/ AES would have likely
stopped the attacks, but it wouldn't have helped them find out who initiated
them.

