I find it strange to report on a hacker releasing personal information, while building the narrative of the story with all of the personal details like "she’d had three children by the time she was 25, including twins who had been born extremely prematurely in the 1980s, weighing only a few hundred grams each", "crumbling marriage", and suicidal ideations.
I thought the whole point is that they were upset that their personal life was being broadcasted to the internet.
I was 17 at the time :) And FWIW, the whole joke there was that neither me nor the other guy being interviewed had anything at all to do with the attacks on PSN and XBL.
Yes, I'm sure my comments here are just full of terribly damaging stuff.
Not sure what the theory here is. Am I supposed to worry about the judges stalking me online and reading my HN comments professing innocence?
The prosecutors couldn't, and wouldn't even want to use anything I've written here, especially considering the trial is over and they can't just file new evidence.
Someone else leaked a copy of a shared throwaway VM used for hacks. Akin to https://www.thc.org/segfault/, but longer lived and potentially tens of people with access.
The leaked home folder data doesn't really tie that VM to anyone, which is natural given that it seems to have mostly been used to run headless hacking tools and inspect their output.
The idea that I'm linked to this VM comes from the ridiculous idea that lazy hackers would not share SSH key files in order to control access to groups of virtual machines. I.e. if a SSH key fingerprint is at one point tied to me, that key must also still belong to me even when used from a internet connection belonging to another person in another country with a similar track record as me.
In court we had long debates about whether or not hackers could actually be so lazy as to violate best practices by sharing private key material, the lower court rejected such an idea as incredible and found me guilty.
Knowing the timeline of events and the nicknames attributed to him (ryanlol included), some interesting posts can be found. For example, in the period between the CEO starting communication (September 2020) and the clinic's public admission (October 2020) [1], ryanlol replied to a top comment (Oct 3, 2020): "If you’re a hospital or, say, a school district, 'never pay' is simply an unconscionable attitude" [2]. Isn't it a hacker raging at the management that refuses to pay?
No more questions, Your Honor. Forgive my joyful attitude, but it was your choice to participate in this discussion. As you know from your years and thousands of posts, HN threads are often ephemeral and short-lived - and this one is no exception. Or maybe not... because of your active self-defense posting here, I assume for the first time since the arrest. Now dozens of fellow (HN) hackers are querying your nicknames on Google, Algolia, and whatever else they have at hand. I'm not sure they'll find someone who genuinely fights for a more secure world. Or prove me wrong if you wish.
> "Unfortunately, we have to ask you to pay to keep your personal information safe.”
I can't put my finger on why, but the faux "aw shucks, our hands are tied" makes me even more pissed off by the fact that they're leaking people's therapy notes. Just come out and say you're an amoral money seeker.
FYI: Finnish "social security numbers" (really, personal identification number) are not in any way secret. They are not used like U.S. social security numbers.
Finnish personal identification number is your date of birth, a sequence number, and a checksum.
I'm a broken record about this by now, but stories like these keep reminding me how broken the law is for ethical hackers in Germany. If an ethical hacker found something like this in Germany, it would from my knowledge not be clear if entering an empty password counts as "circumventing or breaking a security barrier". "No password barrier" has recently been clarified in courts, but "Static Password" hasn't.
And once you break a security barrier, you're breaking the law. Even GDPR doesn't help you there - that just ensures more people are breaking different laws. And this can get all your devices seized, land you in jail, end your career, cause thousands of Euros of equipment loss, because the new laptop naturally got lost in the return process after 6 - 12 months.
And thus, many people with the skill to find such problems and report them silently to get them closed do ... nothing. Until bad people find these holes and what the article describes happens. And Europe has hacker groups who could turn our cybersecurity upside down in a good way. Very frustrating topic.
> At the end of the trial, however, this had little impact on the verdict. The presiding judge stated for the record that the mere fact that the [publicly available] software had set a password for the connection meant that viewing the raw data of the [publicly available] program and subsequently connecting to the [publicly available] Modern Solution database constituted a criminal offense under the hacker paragraph.
Yes, taking publicly available data verbatim (no ROT13, nothing) and talking to a publicly available server on the internet can in fact be a criminal offense.
Thank you for providing an example that is exactly showing how messed up this is:
> Der Vorsitzende Richter gab zu Protokoll, dass alleine die Tatsache, dass die Software ein Passwort für die Verbindung gesetzt habe, bedeute, dass ein Blick in die Rohdaten des Programms und eine anschließende Datenbankverbindung zu Modern Solution den Straftatbestand des Hackerparagrafen erfülle
> The Judge gave to protocol that just the fact that the software requires a password for the connection, implies that a look at the raw data of the program and a subsequent database connection is considered hacking.
So yes, entering an empty password can cause all of your electronic devices in all your registered residences to be seized as evidence.
Note that the decompilation is on the complexity level of "strings $binary".
Germany is the most contradicdory country I know of, and such a huge warning flag to anywhere else. For decades, half of children's education has been spent on hammering in "Never Again". Surely there are two huge lessons to learn there: 1. Do not judge the value of people based on their biological characteristics they were born with 2. "I was just following orders" is not an excuse, and one needs to instead do what is right regardless of protocol.
There is no European country which does a worse job at both of these. Germany is easily the number one country in the world for "protocol is everything". It doesn't matter how detrimental and damaging the rules are, the rules are the rules, and they must be followed. This case is the millionth example. The rules are interpretable as it being illegal to access data with a publically available password using this password, so we're going to apply them, despite it being patently absurd. For the first point, German's reponse to Gaza (the slowest in all of the West) said everything.
> The rules are interpretable as it being illegal to access data with a publically available password using this password, so we're going to apply them, despite it being patently absurd.
I very much agree. I do think that this kind of ethical hacking should have a legal framework around it, to protect both sides during such an access. But this should be more on the basis of responsibly minimizing access to protected data as well as minimizing foreseeable damage.
For example - running a select on a database may show you private and protected data, but if this is done to validate a problem, fine. Start digging for data on specific persons? Touch something called "Pump Controls"? This would however require technologically competent judges, and those are rare.
As I said, a frustrating topic and it will become very interesting if a hostile state starts pushing on this.
German government and courts are as opportunistic as everywhere else. German government ignores EU laws (ex: water protection), its own courts (ex: air pollution court orders, time record keeping for teachers) and worker protection (ex: false self employment of music teachers).
"the patient records database was accessible via the internet; there was no firewall and, perhaps most egregiously, it was secured with a blank password, so anyone could just press enter and open it"
There _should_ be a bunch of people in jail for that. Including, but not limited to the CEO. It should also include all the people on the org chart between whoever set that database up and the CEO.
Indeed, the CEO was held criminally liable, but the charges were dropped in a higher court just recently. From the article:
"In April 2023, Tapio was found guilty of criminal negligence in his handling of patient data. His conviction was overturned on appeal in December 2025. (He declined my requests to interview him.)"
More specifically, he was charged of a data protection crime (i.e., note that in Finland these GDPR-like things are also in the criminal law). However, based on local news, I suppose there was not enough evidence that it was specifically a responsibility of a CEO or that CEO-level gross negligence occurred.
According to this report [1] the appeal was about specific requirements like encryption, and he claimed he had delegated it. So it is clear that it is hard to actually hold people responsible.
> The appellate court rejected the prosecution's argument and dismissed all charges. In its unanimous decision, the court stated that neither the GDPR nor the applicable Finnish healthcare legislation required encryption or pseudonymisation of patient data at the time in question.
> Prosecutors alleged that Tapio knew about the March 2019 breach and failed to act. They claimed he neglected legal obligations to report and document the incident and did not take sufficient steps to protect the database. Tapio denied the claims, saying he was unaware of the breach until autumn 2020 and had delegated technical oversight to external IT professionals.
> The court found there was no clear legal requirement at the time obliging Tapio, as CEO, to take the specific security measures cited by the prosecution. These included firewall management, password policies, access controls, VPN implementation, and security updates.
> According to the ruling, the failure to adopt such measures did not, in the court’s view, constitute criminal negligence under Finnish law.
> Tapio’s conduct during and after the 2019 breach did not meet the threshold for criminal liability, the court concluded.
It isn’t absolutely everything, it’s for negligence. If you don’t have basics in place, like independent pen-tests, ISO 27001 audits — or some equivalent — when you’re handling clinical data, then that’s negligence.
If a breach happens and you were seen to have followed best practice, you won’t be found criminally negligent.
That is part of being an executive. The buck stops with you — if you’re an executive, you’d better understand your obligations, you get the big bucks for a reason, it isn’t just a fancy job title.
Other people in the organisation can be held accountable for criminal acts, but when it comes to criminal negligence, it’s the executives that are liable, because it’s a systemic failure and you’re deemed to be in-charge of the system.
>if you’re an executive [...] you get the big bucks for a reason
In Finland? Notably wage-compressed Finland?
No comment on the specifics of this case, I agree with you that the executive should be where the buck stops. But you would be surprised how many various execs I have met here over the years who admit behind closed doors they really do treat it as a fancy job title that barely pays above their last position, but comes with 3x the stress, and they do it simply because, well, someone has to. You can't really be surprised that most of the folks here who you might want to be in the C-suite decide it's just not worth it, that remaining a middle manager or even an IC is simply a far better value proposition.
Posting anonymously here. I was on the leadership team of a Nordic public company, reporting to the CEO, presenting to the board and representing the company at the AGM. Total comp a little under $200k.
The compensation really didn’t match what you take on in terms of responsibility and legal liability. The stress was significant too. That said, as you point out, the work needs doing.
Recommended if you have an over-active sense of duty, not otherwise.
But this is not “absolutely everything”. No one is saying CEOs should be accountable for every action of an individual employee.
So if not the CEO, who is accountable when something like this breach happens? The CTO? The PM The DBA? Nobody? Maybe they’ll care developer who wrote the code or botched the configuration should be prosecuted?
CEOs can justify their pay be being accountable for what their company does. They’re the CEO, after all. Maybe they’ll care more when they have some actual skin in the game.
When a bridge fails, it is the professional engineer that signed off on that part. If you want someone to sign off on software or IT you will need to pay them quite a lot.
Yes, I would expect compensation to increase proportionally with accountability. What makes no sense is compensation that increases irrespective of accountability.
Being the CEO of a company that handles risky, sensitive things should be risky for the CEO, personally. And their compensation can reflect that.
That could be outlawed as well as it probably wouldn’t be too difficult to show that person wasn’t actually making any of the decisions. Not that I expect any of this will ever happen.
I wouldn't describe software as most people experience it as more complex.
And civil engineering projects are constantly fixing unforeseen design problems either during construction or afterwards.
I would distinguish the failure modes as different though eg analog vs digital. Real world engineering can absorb an awful lot of minor mistakes through safety factors etc. Failure can be gradual or just a matter of degree or even just interpretation of standards. Software failures are often more digital or only matter when "under attack"
Funny whenever people complain about the GDPR here they're thinking they would be slapped with a €20Mi fine and that EU team 6 is going to parachute in their office and arrest everyone
Well, not for public bodies at least: “ Administrative fines cannot be imposed on public organisations, such as the government or state-owned companies, municipalities and parishes” [1]
But luckily this sort of thing never happens in the public sector. Except for when it does: https://yle.fi/a/74-20094950
That's interesting, because if you go here https://www.enforcementtracker.com/ there are a lot of public institutions being hit with fines (if they are enforced it's another issue) - search for Municipality for example
However I don't see any municipality in Finland getting fines
The law is written such that they could do all that to a small family business that forgot to delete their Apache logs, which isn't good and leaves room for abuse even if they pinkie swear it's only meant for big violations.
Only after informing you, giving you the opportunity to fix things and many many other steps. The harshness is directly related to the size of the company and the companies willingness to fix any issues. They want companies to comply.
Yes it was. The company was fined 20M EUR on standard GDPR-basis and went bankrupt (but unlikely due to the fine alone). Please re-read the above discussion.
>Exactly, was it a burglary when your front door is open
Legally speaking, yes in every place I've ever lived if all those things are the case it's still a burglary, although the cops may call the victim an idiot.
"Breaking and entering" it's a criminal offence, and walking through an unlocked front door back door doesn't count. If you are on someone's land but didn't have to break in then that's trespass, which is just a civil offense.
Theft is a crime in any case (indeed even if you're not on their land e.g. snatching a phone off the street).
> "Breaking and entering" it's a criminal offence, and walking through an unlocked front door back door doesn't count.
No breaking and entering is known as burglary. Also if you walk through the front door with the intent to commit a crime it is still burglary. The important part is trespassing with the intent to commit a crime.
OK, I probably should specify closer, but while the other commenter has noted there is "burglary" in the UK, I was using burglary in the vernacular, meaning you entered someone's house without their knowledge and stole some shit. I was perhaps unclear with this and in fact in some places what entering someone's house that is not locked and stealing some shit may be a different crime than when it is locked both variations are still generally described, in common usage, as a burglary and are both illegal according to every legal code of every place I've lived, which I've lived in a lot of Western Civ type places.
I am English. It took me all of like 30 seconds to look up the relevant law using Google. Most of Anglosphere has a definition of Burglary that is essentially the same and I suspect it is the same in Europe.
> Exactly, was it a burglary when your front door is open, lights on, spotlights on your wall safe, with the keys still inserted?
The thing isn't just the discovery of the "open door", though. Thousands of people were extorted in a pretty heinous way. Even if we say breaking in took little sophistication or effort, what was done with the data also matters.
Yes. Similarly, If I leave my car unlocked with the keys in the ignition, and someone takes it is still a crime. It might be unwise to do that (depending on where you are), but nonetheless it is still crime.
It's an odd position to take, that a crime was not committed or the offense isn't as bad if the difficulties of committing the crime have been removed or reduced.
Yes, it’s still wrong to take things but the guy should get like community service teaching white hat techniques or something. The CEO should be charged with gross negligence, fraud, and any HIPPA/Medical records laws he violated - per capita. Meaning he should face 1M+ counts of …
What does "the crime is less egregious" even mean?
Morally, you burglarized a home.
Legally, at least in CA, the charge and sentencing are equivalent.
If someone also commits a murder while burglarizing you could argue the crime is more severe, but my response would be that they've committed two crimes, and the severity of the burglary in isolation is equivalent.
Now, how do we apply that to today’s current events?
Is it still a crime if the roadblocks to commit the crime are removed? Even applauded by some? What happens when the chief of police is telling you to go out and commit said crimes?
Law and order is dictated by the ruling party. What was a crime yesterday may not be a crime today.
So if all you did was turn a key and now you’re a burglar going to prison, when the CEO of the house spent months setting up the perfect crime scene, shouldn’t the CEO at least get an accomplice charge? Insurance fraud starts the same way…
It's a common attitude with people from low-trust societies. "I'm not a scammer - I'm clever. If you don't want us to scam your system why do you make it so easy?"
The Internet is the ultimate low-trust society. Your virtual doorstep is right next to ~8 billion other peoples' doorsteps. And attributing attacks and enforcing consequences is extremely difficult and rather unusual.
When people from high-trust societies move to a low-trust society, they either adapt to their new environment and take an appropriately defensive posture or they will get robbed, scammed, etc.
Those naïfs from high-trust societies may not be morally at fault, but they must be blamed, because they aren't just putting themselves at risk. They must make at least reasonable efforts to secure the data in their custody.
It's been like this for decades. It's time to let go of our attachment to heaping all the culpability on attackers. Entities holding user data in custody must take the blame when they don't adequately secure that data, because that incentivizes an improved security posture.
And an improved security posture is the only credible path to a future with fewer and smaller data breaches.
We can start by stopping the use of posture like you’re squirming in your seat. I’ve heard that term for the last 10 years and never has it been useful. Policy yes, Practice if you must, Mandate absolutely, Governance required.
Using posture is a kin to modeling or showing off clothes, the likes of which will never see the streets. Let’s all start agreeing that the term is a rug cover for whatever security wants it to be. Without checks and balances.
If your posture is having your rear end exposed and up in public then…
It's a generic, albeit somewhat euphemistic term. I agree we could do with some better messaging. Dirty and direct is usually more effective. How about this framing?
The Internet is a dark street in rural India and your dumbass company is a pretty young white woman walking around naked and alone at 2AM. It's not your fault morally if someone rapes you, but objectively you're an idiot if you do not expect it. Now, you getting raped doesn't just hurt you; it primarily hurts people your company stores data about. Those rapists aren't going away, so we need you to take basic precautions against getting raped and we're gonna hold you accountable for doing dumb shit that predictably leads you to getting raped.
> If your posture is having your rear end exposed and up in public then…
Right, that is most companies' current security posture: Naked butt waving in the air. "Improving your security posture" is just a euphemism for "pull your pants up and put your butt down".
> Using posture is a kin to modeling or showing off clothes, the likes of which will never see the streets. Let’s all start agreeing that the term is a rug cover for whatever security wants it to be. Without checks and balances.
No, I will not agree with that; that's ridiculous. "Improve [y]our security posture" is not some magic talisman used to seize unchecked power within an organization. It's basically just the Obama Doctrine brought to computer security: "Don't do stupid shit".
“Improve [y]our security posture” absolutely is without a definition of posture. Does that mean more monitoring? More security team members?
Posture is no replacement for a plan.
Originally it was “how we follow our plan” but that has since been thrown out the window. Now, posture is code word for cover.
I don’t mean to vent it’s just tiring having to deal with varying degrees of posturing where everyone is just haphazardly laying on a couch watching TV.
Someone presented a hypothetical scenario: What if a hacker would write a virus, which breached a totally unprotected database after the hacker has passed away. It's clear that the therapy provider is at least partially responsible.
I'm not well versed in Finnish law - but in the USA simply the act of accessing a computer without authorization, even if it not secured, can be a crime under the CFAA. So the company is still a victim, and obviously the patients as well, even if they are incompetent. For the same reason that a person that gets burgled because they left their door unlocked when they left the house is still a victim.
But if you attest that your computer system is not accessible by any passersby in order to pass compliance, is that not also a crime? If it is indeed accessible to just anyone? HIPAA law violations and all that
I’m not arguing the person who stole didn’t commit a crime - just a lesser one than actually breaking in, cracking a safe, and making off with the jewels. I think the CEO and executive staff are culpable.
Yup, I heard of an ERP full of microservices and many endpoints dont check authorization at all and the auth mechanism doesnt check valid user credentials. Seems like they are very common.
Still reading the story but just hit that line and came here to snarkily post, “another MongoDB success story”. I should probably talk to my therapist about this desire to be seen as funny.
Unfortunately that relies on Joe Tidy as the source.
I tend to refrain from being overly critical of journalists who write about me, but Joe Tidy is a special kind of idiot who wrote an entire book about me based mostly around interviews of people who aren't actually the people they claim to be.
I am indeed the guy in the article. My side of the story is fairly boring, didn't do crime but got blamed for it anyway by desperate cops. The whole investigation has been bizarre, for example, no-one has ever searched my homes, or even attempted to seize my personal devices.
Should find out within the next couple of months if the appeals court decides to acquit.
The cryptocurrency analysis in this case reaches absurd conclusions and doesn't stand up to the slightest scrutiny. At best their analysis establishes a low-confidence link between me and the hacker, as it's impossible to tell what if any transactions took place between us. Just that an unknown amount of money may have traveled between our wallets.
One thing is certain though, the relevant sum in this case was 0.1 BTC paid by the police. Their analysis shows me receiving significantly more than that, with no explanation as to where the rest of the money originated. Coincidentally, the other person who was later charged in this case received pretty much exactly the 0.1 BTC according to the police report.
He’s done less than seven years of time, shows no remorse and even denies doing it in the first place. You dropped the ball on this Finland, don’t be surprised when he does it again. What a disgusting human being.
I'd bet good money that this dude has some sort of antisocial personality disorder, and really can't be "cured", so to speak.
Something tells me he'll try to sneak out of Finland (which is easy due to Schengen), purchase a new passport, and leave Europe.
I guess a silver lining here is the possibility that he'll commit crimes in countries with far harsher penalties than Finland.
I've lived in Finland myself, and currently live in Norway. Lax punishments for the sake of rehabilitation is the standard, and I'm fine with that. But some people, like this one, simply can't be rehabilitated.
Being a psychopath is a mental illness. And yes everyone who is a criminal is stupid- career criminals all spend years of their lives in jail and many of them get shot.
I will never forget that story about a big drug dealer who retired and was assassinated in Thailand by a few kids on a motorped.
In some circumstances it has a registration wall. I recently ran into it on one of my computers, and it prevented me from reading some articles until I removed the modals with browser devtools. Stupid and pointless, and just pushes people away or towards workarounds like archive.is. I've given The Guardian money in the past but I don't have or want an account.
Just because you immediately clicked "yeah sure sell all my data so I don't have to pay" doesn't mean it's not paywalled, please be a little more discerning.
As per (AFAIK) this hacker's rant on some Tor-based image board, he gloated the login credentials to the Vastaamo's systems were admin:admin. So much for 'hacker god'. This is a Hackers (1995) tier vulnerability. Also, it's sickening that YOLOing security to this extent is even possible in 2020s.
This isn't a great solution, but it has helped me forgive myself, maybe it can be a trend in the future: You didn't pick your DNA, you didn't pick your environment. (Determinism in a nutshell)
The bad things that happened to you, and the bad thing you did, should be seen as somewhat outside our control.
I think of my worst google searches (nsfw stuff) and think: "Well, I'm just a chemical reaction."
But then again, I read the book A Billion Wicked Thoughts and found I'm pretty vanilla, we just don't talk about these things out loud.
Maybe my life is tame, but even when I hear from other people, everything seems pretty reasonable.
I know this is an 'after the fact' fix, but its a tool for our toolbox. We could look at people who criticize us as people who are ignorant of Determinism. (But we still need mechanisms to deter bad behavior)
Any insurance covered therapy in the US. And assume any private practice that does not explicitly state they do not electronically store session notes.
Apart from therapy, I expect a lot of sensitive and private information to be hacked and released in the next 10 years. Most importantly, all non securely encrypted text based communications.
Which begs the question why this all has to be put in electronic form.
Using your face or fingerprint to unlock things, which anyone can steal. Many people even have their retinal scans stored in their opticians' databases which won't be secure either as biometric ID.
to be fair - kind of yeah. I do have a bank card, but minimize its usage for privacy reasons, mainly using cash. As for electronics - I do keep most of my data local and use OSes that don't upload them on their own.
And yeah, as the previous commenter said - those are not quite comparable.
Ethically speaking it seems like you should not be accessing commercial news sites if you're not willing to pay in some way for the work of the people writing the articles.
Show context-based ads instead of spying on people would be a good start. That should be the only form of legal advertising. It is for sure the only form of potentially ethical advertising.
I also pay to get past paywalls when a site has content I want to read, rather than try to sneak past using some dodgy mirror.
"Jazz police are looking through my folders. Jazz police are talking to my niece. Jazz police have got their final orders. Jazzer, drop your axe, it's jazz police!"
Julius Kivimäki was released pending the outcome of his appeal. https://www.bankinfosecurity.com/finnish-vastaamo-hacker-fre...
The article cites "Ryan" as one of his aliases, so the id ryanlol commenting in this thread could plausibly be Kivimäki.
Could plausibly be, but there are many people using the name 'Ryan'. Maybe this one saw an opportunity to troll everyone.
https://news.ycombinator.com/item?id=40214049
I find it strange to report on a hacker releasing personal information, while building the narrative of the story with all of the personal details like "she’d had three children by the time she was 25, including twins who had been born extremely prematurely in the 1980s, weighing only a few hundred grams each", "crumbling marriage", and suicidal ideations.
I thought the whole point is that they were upset that their personal life was being broadcasted to the internet.
Maybe they agreed to those details being published.
probably because the secrets released were much more confidential and serious than that?
Also consent.
Wait for the other person to do so willingly seems kinda good advice in many areas.
Wasn't he the guy that used tar for the leaked folder of data, but the tar included his user folder which contained his legal name?
Yes, the tar command claims another victim. Tested while inside /var/www/html/vastaamo and then stuffed it in the crontab.
For reference:It's in the article. Not sure it had his name, but certainly his family name since he looked for records concerning his relatives.
The queries appear to have been looking for me specifically, filtering by date of birth. That wouldn't be a good way to find my relatives.
Damn, some other group trying to cause trouble for you?
I doubt it. I think it's just cops doing shitty work under pressure and then trying to cover it up.
Automating the upload of a home folder to the darkweb in the middle of an extortion attempt would be pretty weak for a "legendary" hacker.
whoopsie :D
Ah yes-- I first heard of this via an entertaining video about it, "One Drunken Mistake Destroyed Finland's Scummiest Hacker", see below.
https://www.youtube.com/watch?v=pyCcvPfT_jU
The big problem with this video is that it's basically entirely based on google translated tabloid articles.
The results are what you might expect if you decided to just use dailymail.co.uk as a source, similar to the creator of malicious trojan virus Python being arrested https://www.dailymail.co.uk/news/article-2124114/Computer-ha...
>Pearson coded trojan viruses, called Zeus, SpyEye and Python, to automatically scour the internet in search of personal details.
It’s really not a good idea to be posting about your case when it hasn’t even been resolved yet.
I do have access to excellent legal advice, strive to live by it.
> I do have access to excellent legal advice, strive to live by it.
Says the guy that went on a news broadcast (unmasked) to brag about hacking Sony.
https://www.youtube.com/watch?v=fPX8yCBdIZ8
I was 17 at the time :) And FWIW, the whole joke there was that neither me nor the other guy being interviewed had anything at all to do with the attacks on PSN and XBL.
Just wanted to say hi, I was pretty young at the time but I remember the whole thing with the PSN shit and the Keemstar interviews :DDdddd
good times man.
But the thing about not having any devices seized, is that real?
Some people I know have had run-ins with the NBI, and the first thing they do is seize your computers for like a year+?
If that's true then that's really weird...
>But the thing about not having any devices seized, is that real?
It's real and just as bizarre as it sounds. You'd think that'd be the #1 thing you'd want in any serious investigation.
Well, judging by this thread, it doesn’t seem like it.
Yes, I'm sure my comments here are just full of terribly damaging stuff.
Not sure what the theory here is. Am I supposed to worry about the judges stalking me online and reading my HN comments professing innocence?
The prosecutors couldn't, and wouldn't even want to use anything I've written here, especially considering the trial is over and they can't just file new evidence.
No, that did not actually happen.
What did happen, then?
Someone else leaked a copy of a shared throwaway VM used for hacks. Akin to https://www.thc.org/segfault/, but longer lived and potentially tens of people with access.
The leaked home folder data doesn't really tie that VM to anyone, which is natural given that it seems to have mostly been used to run headless hacking tools and inspect their output.
The idea that I'm linked to this VM comes from the ridiculous idea that lazy hackers would not share SSH key files in order to control access to groups of virtual machines. I.e. if a SSH key fingerprint is at one point tied to me, that key must also still belong to me even when used from a internet connection belonging to another person in another country with a similar track record as me.
In court we had long debates about whether or not hackers could actually be so lazy as to violate best practices by sharing private key material, the lower court rejected such an idea as incredible and found me guilty.
Knowing the timeline of events and the nicknames attributed to him (ryanlol included), some interesting posts can be found. For example, in the period between the CEO starting communication (September 2020) and the clinic's public admission (October 2020) [1], ryanlol replied to a top comment (Oct 3, 2020): "If you’re a hospital or, say, a school district, 'never pay' is simply an unconscionable attitude" [2]. Isn't it a hacker raging at the management that refuses to pay?
[1] https://en.wikipedia.org/wiki/Vastaamo_data_breach#Backgroun...
[2] https://news.ycombinator.com/item?id=24672687
>Isn't it a hacker raging at the management that refuses to pay?
Nope
No more questions, Your Honor. Forgive my joyful attitude, but it was your choice to participate in this discussion. As you know from your years and thousands of posts, HN threads are often ephemeral and short-lived - and this one is no exception. Or maybe not... because of your active self-defense posting here, I assume for the first time since the arrest. Now dozens of fellow (HN) hackers are querying your nicknames on Google, Algolia, and whatever else they have at hand. I'm not sure they'll find someone who genuinely fights for a more secure world. Or prove me wrong if you wish.
[dead]
> "Unfortunately, we have to ask you to pay to keep your personal information safe.”
I can't put my finger on why, but the faux "aw shucks, our hands are tied" makes me even more pissed off by the fact that they're leaking people's therapy notes. Just come out and say you're an amoral money seeker.
FYI: Finnish "social security numbers" (really, personal identification number) are not in any way secret. They are not used like U.S. social security numbers.
Finnish personal identification number is your date of birth, a sequence number, and a checksum.
I'm a broken record about this by now, but stories like these keep reminding me how broken the law is for ethical hackers in Germany. If an ethical hacker found something like this in Germany, it would from my knowledge not be clear if entering an empty password counts as "circumventing or breaking a security barrier". "No password barrier" has recently been clarified in courts, but "Static Password" hasn't.
And once you break a security barrier, you're breaking the law. Even GDPR doesn't help you there - that just ensures more people are breaking different laws. And this can get all your devices seized, land you in jail, end your career, cause thousands of Euros of equipment loss, because the new laptop naturally got lost in the return process after 6 - 12 months.
And thus, many people with the skill to find such problems and report them silently to get them closed do ... nothing. Until bad people find these holes and what the article describes happens. And Europe has hacker groups who could turn our cybersecurity upside down in a good way. Very frustrating topic.
Hard-coded, publicly available credentials are criminal to circumvent in germany. See https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal... which is now settled, since the appeal was rejected. https://www.heise.de/en/news/Federal-Constitutional-Court-re...
> At the end of the trial, however, this had little impact on the verdict. The presiding judge stated for the record that the mere fact that the [publicly available] software had set a password for the connection meant that viewing the raw data of the [publicly available] program and subsequently connecting to the [publicly available] Modern Solution database constituted a criminal offense under the hacker paragraph.
Yes, taking publicly available data verbatim (no ROT13, nothing) and talking to a publicly available server on the internet can in fact be a criminal offense.
Thank you for providing an example that is exactly showing how messed up this is:
> Der Vorsitzende Richter gab zu Protokoll, dass alleine die Tatsache, dass die Software ein Passwort für die Verbindung gesetzt habe, bedeute, dass ein Blick in die Rohdaten des Programms und eine anschließende Datenbankverbindung zu Modern Solution den Straftatbestand des Hackerparagrafen erfülle
> The Judge gave to protocol that just the fact that the software requires a password for the connection, implies that a look at the raw data of the program and a subsequent database connection is considered hacking.
So yes, entering an empty password can cause all of your electronic devices in all your registered residences to be seized as evidence.
Note that the decompilation is on the complexity level of "strings $binary".
Germany is the most contradicdory country I know of, and such a huge warning flag to anywhere else. For decades, half of children's education has been spent on hammering in "Never Again". Surely there are two huge lessons to learn there: 1. Do not judge the value of people based on their biological characteristics they were born with 2. "I was just following orders" is not an excuse, and one needs to instead do what is right regardless of protocol.
There is no European country which does a worse job at both of these. Germany is easily the number one country in the world for "protocol is everything". It doesn't matter how detrimental and damaging the rules are, the rules are the rules, and they must be followed. This case is the millionth example. The rules are interpretable as it being illegal to access data with a publically available password using this password, so we're going to apply them, despite it being patently absurd. For the first point, German's reponse to Gaza (the slowest in all of the West) said everything.
> The rules are interpretable as it being illegal to access data with a publically available password using this password, so we're going to apply them, despite it being patently absurd.
I very much agree. I do think that this kind of ethical hacking should have a legal framework around it, to protect both sides during such an access. But this should be more on the basis of responsibly minimizing access to protected data as well as minimizing foreseeable damage.
For example - running a select on a database may show you private and protected data, but if this is done to validate a problem, fine. Start digging for data on specific persons? Touch something called "Pump Controls"? This would however require technologically competent judges, and those are rare.
As I said, a frustrating topic and it will become very interesting if a hostile state starts pushing on this.
German government and courts are as opportunistic as everywhere else. German government ignores EU laws (ex: water protection), its own courts (ex: air pollution court orders, time record keeping for teachers) and worker protection (ex: false self employment of music teachers).
"the patient records database was accessible via the internet; there was no firewall and, perhaps most egregiously, it was secured with a blank password, so anyone could just press enter and open it"
There _should_ be a bunch of people in jail for that. Including, but not limited to the CEO. It should also include all the people on the org chart between whoever set that database up and the CEO.
Indeed, the CEO was held criminally liable, but the charges were dropped in a higher court just recently. From the article:
"In April 2023, Tapio was found guilty of criminal negligence in his handling of patient data. His conviction was overturned on appeal in December 2025. (He declined my requests to interview him.)"
More specifically, he was charged of a data protection crime (i.e., note that in Finland these GDPR-like things are also in the criminal law). However, based on local news, I suppose there was not enough evidence that it was specifically a responsibility of a CEO or that CEO-level gross negligence occurred.
According to this report [1] the appeal was about specific requirements like encryption, and he claimed he had delegated it. So it is clear that it is hard to actually hold people responsible.
> The appellate court rejected the prosecution's argument and dismissed all charges. In its unanimous decision, the court stated that neither the GDPR nor the applicable Finnish healthcare legislation required encryption or pseudonymisation of patient data at the time in question.
> Prosecutors alleged that Tapio knew about the March 2019 breach and failed to act. They claimed he neglected legal obligations to report and document the incident and did not take sufficient steps to protect the database. Tapio denied the claims, saying he was unaware of the breach until autumn 2020 and had delegated technical oversight to external IT professionals.
> The court found there was no clear legal requirement at the time obliging Tapio, as CEO, to take the specific security measures cited by the prosecution. These included firewall management, password policies, access controls, VPN implementation, and security updates.
> According to the ruling, the failure to adopt such measures did not, in the court’s view, constitute criminal negligence under Finnish law.
> Tapio’s conduct during and after the 2019 breach did not meet the threshold for criminal liability, the court concluded.
[1] https://www.helsinkitimes.fi/finland/finland-news/domestic/2...
No, it’s just that it’s crazy to hold the CEO liable for absolutely everything that can go wrong.
> “absolutely everything”
It isn’t absolutely everything, it’s for negligence. If you don’t have basics in place, like independent pen-tests, ISO 27001 audits — or some equivalent — when you’re handling clinical data, then that’s negligence.
If a breach happens and you were seen to have followed best practice, you won’t be found criminally negligent.
That is part of being an executive. The buck stops with you — if you’re an executive, you’d better understand your obligations, you get the big bucks for a reason, it isn’t just a fancy job title.
Other people in the organisation can be held accountable for criminal acts, but when it comes to criminal negligence, it’s the executives that are liable, because it’s a systemic failure and you’re deemed to be in-charge of the system.
>if you’re an executive [...] you get the big bucks for a reason
In Finland? Notably wage-compressed Finland?
No comment on the specifics of this case, I agree with you that the executive should be where the buck stops. But you would be surprised how many various execs I have met here over the years who admit behind closed doors they really do treat it as a fancy job title that barely pays above their last position, but comes with 3x the stress, and they do it simply because, well, someone has to. You can't really be surprised that most of the folks here who you might want to be in the C-suite decide it's just not worth it, that remaining a middle manager or even an IC is simply a far better value proposition.
Posting anonymously here. I was on the leadership team of a Nordic public company, reporting to the CEO, presenting to the board and representing the company at the AGM. Total comp a little under $200k.
The compensation really didn’t match what you take on in terms of responsibility and legal liability. The stress was significant too. That said, as you point out, the work needs doing.
Recommended if you have an over-active sense of duty, not otherwise.
> In Finland? Notably wage-compressed Finland?
It's all relative.
But this is not “absolutely everything”. No one is saying CEOs should be accountable for every action of an individual employee.
So if not the CEO, who is accountable when something like this breach happens? The CTO? The PM The DBA? Nobody? Maybe they’ll care developer who wrote the code or botched the configuration should be prosecuted?
CEOs can justify their pay be being accountable for what their company does. They’re the CEO, after all. Maybe they’ll care more when they have some actual skin in the game.
When a bridge fails, it is the professional engineer that signed off on that part. If you want someone to sign off on software or IT you will need to pay them quite a lot.
Yes, I would expect compensation to increase proportionally with accountability. What makes no sense is compensation that increases irrespective of accountability.
Being the CEO of a company that handles risky, sensitive things should be risky for the CEO, personally. And their compensation can reflect that.
In other words, they need to hire people whose job it is to “please”.
Provide Legal Exculpation and Sign Everything
https://how-i-met-your-mother.fandom.com/wiki/Provide_Legal_...
That could be outlawed as well as it probably wouldn’t be too difficult to show that person wasn’t actually making any of the decisions. Not that I expect any of this will ever happen.
In my experience civil engineers get paid less than software developers of equivalent experience or responsibility.
Yes, but they are good at what they do. Software is more conplex and has a culture of fix it in production that would make it far more risky to sign.
I wouldn't describe software as most people experience it as more complex.
And civil engineering projects are constantly fixing unforeseen design problems either during construction or afterwards.
I would distinguish the failure modes as different though eg analog vs digital. Real world engineering can absorb an awful lot of minor mistakes through safety factors etc. Failure can be gradual or just a matter of degree or even just interpretation of standards. Software failures are often more digital or only matter when "under attack"
Is it sane to reward them for almost absolutely everything that goes right? Because that's the status quo for this position.
Privatize the gains and socialize the losses. egh?
The CEO is responsible for ensuring that there is a routine for security.
If that is not created -> CEO responsibility.
If that is not followed -> top level mgmt responsibility.
And so on, further down the chain.
Well this is why they get paid so much isn't it? Because they carry the responsibility.
It's normally the company directors that are personally liable.
So who?
Funny whenever people complain about the GDPR here they're thinking they would be slapped with a €20Mi fine and that EU team 6 is going to parachute in their office and arrest everyone
So they're saying this is not the case?
Well, not for public bodies at least: “ Administrative fines cannot be imposed on public organisations, such as the government or state-owned companies, municipalities and parishes” [1]
But luckily this sort of thing never happens in the public sector. Except for when it does: https://yle.fi/a/74-20094950
[1] https://tietosuoja.fi/en/corrective-powers
That's interesting, because if you go here https://www.enforcementtracker.com/ there are a lot of public institutions being hit with fines (if they are enforced it's another issue) - search for Municipality for example
However I don't see any municipality in Finland getting fines
Indeed, but 'the EU' isn't the one enforcing it or leveraging fines - it's up to national bodies/governments and law enforcement.
From that link we can see that the UK fined its own Ministry of Defence 400,000 EUR.
However it appears that Finish public bodies are deemed above reproach by their government.
The law is written such that they could do all that to a small family business that forgot to delete their Apache logs, which isn't good and leaves room for abuse even if they pinkie swear it's only meant for big violations.
Only after informing you, giving you the opportunity to fix things and many many other steps. The harshness is directly related to the size of the company and the companies willingness to fix any issues. They want companies to comply.
Reading the words and interpreting the law in its wider legal context are two different things
> So they're saying this is not the case?
Yes it was. The company was fined 20M EUR on standard GDPR-basis and went bankrupt (but unlikely due to the fine alone). Please re-read the above discussion.
The GDPR fine was 608k https://www.edpb.europa.eu/news/national-news/2022/administr...
I stand corrected.
Exactly, was it a burglary when your front door is open, lights on, spotlights on your wall safe, with the keys still inserted?
The CEO should be in prison.
>Exactly, was it a burglary when your front door is open
Legally speaking, yes in every place I've ever lived if all those things are the case it's still a burglary, although the cops may call the victim an idiot.
Also the insurance company doesn't pay out if they can prove you did not lock the doors.
In the UK, there is no crime "burglary".
"Breaking and entering" it's a criminal offence, and walking through an unlocked front door back door doesn't count. If you are on someone's land but didn't have to break in then that's trespass, which is just a civil offense.
Theft is a crime in any case (indeed even if you're not on their land e.g. snatching a phone off the street).
> In the UK, there is no crime "burglary".
Yes there is:
https://www.legislation.gov.uk/ukpga/1968/60/section/9
https://www.college.police.uk/guidance/residential-burglary/...
> "Breaking and entering" it's a criminal offence, and walking through an unlocked front door back door doesn't count.
No breaking and entering is known as burglary. Also if you walk through the front door with the intent to commit a crime it is still burglary. The important part is trespassing with the intent to commit a crime.
Well, I was wrong, sorry for claiming assertively when clearly I didn't know what I was talking about. Thanks for the correction.
That is false. Burglary is a crime in the UK.
See https://www.legislation.gov.uk/ukpga/1968/60/section/9 and https://www.cps.gov.uk/prosecution-guidance/theft-act-offenc...
OK, I probably should specify closer, but while the other commenter has noted there is "burglary" in the UK, I was using burglary in the vernacular, meaning you entered someone's house without their knowledge and stole some shit. I was perhaps unclear with this and in fact in some places what entering someone's house that is not locked and stealing some shit may be a different crime than when it is locked both variations are still generally described, in common usage, as a burglary and are both illegal according to every legal code of every place I've lived, which I've lived in a lot of Western Civ type places.
The comment you are replying to has no idea what they are talking about.
Burglary is defined in the Theft Act 1968:
https://www.legislation.gov.uk/ukpga/1968/60/section/9
The door can be wide open. The important parts are you are trespassing with the intent to commit a crime.
Literally invented the term ”cat burglar” lol! Commenter above is British too so it’s hilarious he thinks burglary isn’t a thing.
I am English. It took me all of like 30 seconds to look up the relevant law using Google. Most of Anglosphere has a definition of Burglary that is essentially the same and I suspect it is the same in Europe.
Yeah I was referring to higher up the stack. You’re spot on for citing the U.K. law.
> The CEO should be in prison.
Yes.
> Exactly, was it a burglary when your front door is open, lights on, spotlights on your wall safe, with the keys still inserted?
The thing isn't just the discovery of the "open door", though. Thousands of people were extorted in a pretty heinous way. Even if we say breaking in took little sophistication or effort, what was done with the data also matters.
Yes. Similarly, If I leave my car unlocked with the keys in the ignition, and someone takes it is still a crime. It might be unwise to do that (depending on where you are), but nonetheless it is still crime.
Technically, yes it is still burglary.
It's an odd position to take, that a crime was not committed or the offense isn't as bad if the difficulties of committing the crime have been removed or reduced.
> odd position [...] offense isn't as bad if the difficulties of committing the crime have been removed or reduced
Not really, intent is a part of the crime. If the barrier for crime is extremely small, the crime itself is less egregious.
Planning a robbery is not the same as picking up a wallet on the sidewalk. This is a feature, not a bug.
This. 1000x this.
Yes, it’s still wrong to take things but the guy should get like community service teaching white hat techniques or something. The CEO should be charged with gross negligence, fraud, and any HIPPA/Medical records laws he violated - per capita. Meaning he should face 1M+ counts of …
What does "the crime is less egregious" even mean?
Morally, you burglarized a home.
Legally, at least in CA, the charge and sentencing are equivalent.
If someone also commits a murder while burglarizing you could argue the crime is more severe, but my response would be that they've committed two crimes, and the severity of the burglary in isolation is equivalent.
Now, how do we apply that to today’s current events?
Is it still a crime if the roadblocks to commit the crime are removed? Even applauded by some? What happens when the chief of police is telling you to go out and commit said crimes?
Law and order is dictated by the ruling party. What was a crime yesterday may not be a crime today.
So if all you did was turn a key and now you’re a burglar going to prison, when the CEO of the house spent months setting up the perfect crime scene, shouldn’t the CEO at least get an accomplice charge? Insurance fraud starts the same way…
It's a common attitude with people from low-trust societies. "I'm not a scammer - I'm clever. If you don't want us to scam your system why do you make it so easy?"
The Internet is the ultimate low-trust society. Your virtual doorstep is right next to ~8 billion other peoples' doorsteps. And attributing attacks and enforcing consequences is extremely difficult and rather unusual.
When people from high-trust societies move to a low-trust society, they either adapt to their new environment and take an appropriately defensive posture or they will get robbed, scammed, etc.
Those naïfs from high-trust societies may not be morally at fault, but they must be blamed, because they aren't just putting themselves at risk. They must make at least reasonable efforts to secure the data in their custody.
It's been like this for decades. It's time to let go of our attachment to heaping all the culpability on attackers. Entities holding user data in custody must take the blame when they don't adequately secure that data, because that incentivizes an improved security posture.
And an improved security posture is the only credible path to a future with fewer and smaller data breaches.
See also: https://news.ycombinator.com/item?id=25574200
We can start by stopping the use of posture like you’re squirming in your seat. I’ve heard that term for the last 10 years and never has it been useful. Policy yes, Practice if you must, Mandate absolutely, Governance required.
Using posture is a kin to modeling or showing off clothes, the likes of which will never see the streets. Let’s all start agreeing that the term is a rug cover for whatever security wants it to be. Without checks and balances.
If your posture is having your rear end exposed and up in public then…
It's a generic, albeit somewhat euphemistic term. I agree we could do with some better messaging. Dirty and direct is usually more effective. How about this framing?
The Internet is a dark street in rural India and your dumbass company is a pretty young white woman walking around naked and alone at 2AM. It's not your fault morally if someone rapes you, but objectively you're an idiot if you do not expect it. Now, you getting raped doesn't just hurt you; it primarily hurts people your company stores data about. Those rapists aren't going away, so we need you to take basic precautions against getting raped and we're gonna hold you accountable for doing dumb shit that predictably leads you to getting raped.
> If your posture is having your rear end exposed and up in public then…
Right, that is most companies' current security posture: Naked butt waving in the air. "Improving your security posture" is just a euphemism for "pull your pants up and put your butt down".
> Using posture is a kin to modeling or showing off clothes, the likes of which will never see the streets. Let’s all start agreeing that the term is a rug cover for whatever security wants it to be. Without checks and balances.
No, I will not agree with that; that's ridiculous. "Improve [y]our security posture" is not some magic talisman used to seize unchecked power within an organization. It's basically just the Obama Doctrine brought to computer security: "Don't do stupid shit".
“Improve [y]our security posture” absolutely is without a definition of posture. Does that mean more monitoring? More security team members?
Posture is no replacement for a plan.
Originally it was “how we follow our plan” but that has since been thrown out the window. Now, posture is code word for cover.
I don’t mean to vent it’s just tiring having to deal with varying degrees of posturing where everyone is just haphazardly laying on a couch watching TV.
Welcome to America
Powerful.
Someone presented a hypothetical scenario: What if a hacker would write a virus, which breached a totally unprotected database after the hacker has passed away. It's clear that the therapy provider is at least partially responsible.
Posthumous crime is the ultimate because the legal system is all about punishing the living until they are dead.
In a retributive just culture, yes.
https://www.patientsafety.com/en/blog/human-error-retributiv...
If only human beings were good at learning from past mistakes. It requires multiple tries before we realize, fire bad, unless good, if controlled.
Is it still assault if the guy is just standing there, within punching distance, without even wearing a helmet?
Does he have a flag?
Yes it absolutely is still a burglary. Classic victim blaming.
Who’s the victim? The CEO? I think the patients are the victims here.
I'm not well versed in Finnish law - but in the USA simply the act of accessing a computer without authorization, even if it not secured, can be a crime under the CFAA. So the company is still a victim, and obviously the patients as well, even if they are incompetent. For the same reason that a person that gets burgled because they left their door unlocked when they left the house is still a victim.
But if you attest that your computer system is not accessible by any passersby in order to pass compliance, is that not also a crime? If it is indeed accessible to just anyone? HIPAA law violations and all that
I’m not arguing the person who stole didn’t commit a crime - just a lesser one than actually breaking in, cracking a safe, and making off with the jewels. I think the CEO and executive staff are culpable.
Yup, I heard of an ERP full of microservices and many endpoints dont check authorization at all and the auth mechanism doesnt check valid user credentials. Seems like they are very common.
Still reading the story but just hit that line and came here to snarkily post, “another MongoDB success story”. I should probably talk to my therapist about this desire to be seen as funny.
Having now read it, the CEO did get convicted.
There's a nice episode from darknetdiaries about it https://darknetdiaries.com/episode/159/
Unfortunately that relies on Joe Tidy as the source.
I tend to refrain from being overly critical of journalists who write about me, but Joe Tidy is a special kind of idiot who wrote an entire book about me based mostly around interviews of people who aren't actually the people they claim to be.
Is there a perspective or analysis that you've read that does a good job, in your opinion?
I doubt such a thing exists, it's a difficult world for outsiders to penetrate.
I don't think we'll ever get to see it, these stories get less and less relevant as time passes.
Do we really only catch the laziest hackers? The opsec is shocking.
>The opsec is shocking
If you choose to blindly believe what the prosecution claims, sure.
You're the guy in the article? Could you elaborate and share more of your side of the story?
I am indeed the guy in the article. My side of the story is fairly boring, didn't do crime but got blamed for it anyway by desperate cops. The whole investigation has been bizarre, for example, no-one has ever searched my homes, or even attempted to seize my personal devices.
Should find out within the next couple of months if the appeals court decides to acquit.
Wow. That's why I love HN. :)
But you were strongly linked to the crime. Thus your opsec is terrible.
For sure, just goes to show how important it is to really carefully consider your threat model.
This is worse than the SBF denial, do better, post a full on substack about how they didn't link you to a bitcoin address.
A LLM chatbot trained to deliver and debate the denials might be more on trend?
Your position is that none of your banking information was linked to this investigation?
Two different things:
Linked to this investigation? Of course it was.
Linked to the crime? No, not really.
The cryptocurrency analysis in this case reaches absurd conclusions and doesn't stand up to the slightest scrutiny. At best their analysis establishes a low-confidence link between me and the hacker, as it's impossible to tell what if any transactions took place between us. Just that an unknown amount of money may have traveled between our wallets.
One thing is certain though, the relevant sum in this case was 0.1 BTC paid by the police. Their analysis shows me receiving significantly more than that, with no explanation as to where the rest of the money originated. Coincidentally, the other person who was later charged in this case received pretty much exactly the 0.1 BTC according to the police report.
Yes
He’s done less than seven years of time, shows no remorse and even denies doing it in the first place. You dropped the ball on this Finland, don’t be surprised when he does it again. What a disgusting human being.
I'd bet good money that this dude has some sort of antisocial personality disorder, and really can't be "cured", so to speak.
Something tells me he'll try to sneak out of Finland (which is easy due to Schengen), purchase a new passport, and leave Europe.
I guess a silver lining here is the possibility that he'll commit crimes in countries with far harsher penalties than Finland.
I've lived in Finland myself, and currently live in Norway. Lax punishments for the sake of rehabilitation is the standard, and I'm fine with that. But some people, like this one, simply can't be rehabilitated.
>I'd bet good money that this dude has some sort of antisocial personality disorder, and really can't be "cured", so to speak.
I'm happy to take you up on this, but I feel like the stakes will need to be pretty high to justify all the effort involved.
>Something tells me he'll try to sneak out of Finland (which is easy due to Schengen), purchase a new passport, and leave Europe.
Why would I do that? I hold a valid Finnish passport, haven't had any trouble entering or exciting Schengen zone lately.
Harsh punishment doesn't change anything. Criminals are just stupid, mentally ill or in the most sad cases kids.
In my country they actually do put away people for life and yet we still have crime.
Some criminals are neither stupid nor mentally ill. I suspect this man is neither although he could be a psychopath.
Watch some of his interviews.
In order to do this, he must have had some degree of intelligence albeit misapplied.
Being a psychopath is a mental illness. And yes everyone who is a criminal is stupid- career criminals all spend years of their lives in jail and many of them get shot.
I will never forget that story about a big drug dealer who retired and was assassinated in Thailand by a few kids on a motorped.
Yeah they shouldn't be surprised if someone solves this outside the legal system
Well, we keep hearing that the Nordic Countries are the happiest on Earth. (Which I don't buy even if they do get some things right.)
[dead]
So, would it be better if I feigned remorse for a crime I didn't even commit in the first place?
> he had not only accidentally uploaded all of the therapy notes, but also his entire home folder
Lol. At least it's a good reminder about bad opsec.
Is this the same ryanlol that hacked Linode and had beef with them over some bitcoins that Linode stole from him?
https://archive.is/7uCnb
https://archive.is/7uCnb
The Guardian doesn’t have a paywall
In some circumstances it has a registration wall. I recently ran into it on one of my computers, and it prevented me from reading some articles until I removed the modals with browser devtools. Stupid and pointless, and just pushes people away or towards workarounds like archive.is. I've given The Guardian money in the past but I don't have or want an account.
Just because you immediately clicked "yeah sure sell all my data so I don't have to pay" doesn't mean it's not paywalled, please be a little more discerning.
There's no button that says that.
It does. I pay with money (eg I'm forced to pay for a subscription) or ads (I'm forced to pay with resources)
As per (AFAIK) this hacker's rant on some Tor-based image board, he gloated the login credentials to the Vastaamo's systems were admin:admin. So much for 'hacker god'. This is a Hackers (1995) tier vulnerability. Also, it's sickening that YOLOing security to this extent is even possible in 2020s.
Wild that the CEO got acquitted on appeal.
I've said it before, but these types of malicious hackers should face draconian punishment. Decades behind bars.
I have seen therapists in the past, but never over video calls, and the notes have been kept on paper. Sometimes in person is much better.
This rush to put everything online will destroy everyone's privacy even though privacy is the thing we all need.
This isn't a great solution, but it has helped me forgive myself, maybe it can be a trend in the future: You didn't pick your DNA, you didn't pick your environment. (Determinism in a nutshell)
The bad things that happened to you, and the bad thing you did, should be seen as somewhat outside our control.
I think of my worst google searches (nsfw stuff) and think: "Well, I'm just a chemical reaction."
But then again, I read the book A Billion Wicked Thoughts and found I'm pretty vanilla, we just don't talk about these things out loud.
Maybe my life is tame, but even when I hear from other people, everything seems pretty reasonable.
I know this is an 'after the fact' fix, but its a tool for our toolbox. We could look at people who criticize us as people who are ignorant of Determinism. (But we still need mechanisms to deter bad behavior)
[dead]
[dead]
This is why you should not go to a therapist who uses electronic records. This will happen to you at some point.
Or: this is why you strictly regulate the storage of confidential/private/sensitive information.
There were multiple failures here, but a single step could've prevented the entire hack: industry-standard encryption of the sensitive information.
If someone can access it remotely, a sophisticated bad actor can too.
You could use a fake name/address? That would make it hard to trace back the records to you should they leak.
I think most people are not seeking therapy and even fewer are seeking therapy under hostile conditions.
Basically the whole model of Better Help.
Any insurance covered therapy in the US. And assume any private practice that does not explicitly state they do not electronically store session notes.
Apart from therapy, I expect a lot of sensitive and private information to be hacked and released in the next 10 years. Most importantly, all non securely encrypted text based communications.
Which begs the question why this all has to be put in electronic form.
Using your face or fingerprint to unlock things, which anyone can steal. Many people even have their retinal scans stored in their opticians' databases which won't be secure either as biometric ID.
I thought the model of Better Help was hiring people who are completely unqualified to be therapists and then selling them as therapists.
Well, there's that too.
i guess you should never use banks that use “electronics” either, right? just cash and paper records?
Your bank transactions reveal a lot less than your inner thoughts that you told someone in confidence.
to be fair - kind of yeah. I do have a bank card, but minimize its usage for privacy reasons, mainly using cash. As for electronics - I do keep most of my data local and use OSes that don't upload them on their own.
And yeah, as the previous commenter said - those are not quite comparable.
[dead]
[dead]
[flagged]
Ethically speaking it seems like you should not be accessing commercial news sites if you're not willing to pay in some way for the work of the people writing the articles.
What do you propose they do?
Source some ethical advertising.
Show context-based ads instead of spying on people would be a good start. That should be the only form of legal advertising. It is for sure the only form of potentially ethical advertising.
I also pay to get past paywalls when a site has content I want to read, rather than try to sneak past using some dodgy mirror.
Like most hacktivists, he is selfish asshole that cares more about self gratification than the consequencesbof their actions.
He's not a hacktivist at all, just a common extortionist.
"Jazz police are looking through my folders. Jazz police are talking to my niece. Jazz police have got their final orders. Jazzer, drop your axe, it's jazz police!"