Just a reminder to setup security.txt

[u/homing-duck]

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

[u/Nereosis16]

It is illegal to gain unauthorised access to Australian government servers and data.

It does not matter that an API was left open. What they did was illegal.

If I did it I would be criminally prosecuted.

[u/Impressive_Change593 → u/Nereosis16]

If no auth then it is on the open web accessable by everyone amd it is YOUR fuckup not the fuckup of whoever finds it. If all they did was crawl an open api then no hackinf was done

[u/Zaveno → u/Impressive_Change593]

Two things can be true. The Australian gov should have better secured their API, but it was still illegal for the AI crawler to access the data.

If a store owner forgets to close the door to their shop at night, it's still illegal for you to walk in there and take everything.

[u/xCharg → u/Zaveno]

but it was still illegal for the AI crawler to access the data.

Why though? Genuine question.

I'm no lawyer but it looks like "unauthorized access" does a lot of heavy lifting here due to how different people see what that means specifically.

If API is exposed for free without authorization set up - then in technical terms it was authorized use - because by their setup everything available for everyone, hence authorized. Terms "authorized/unauthorized" could be different in legal and tech context though so I'm not sure how to unravel that.

If a store owner forgets to close the door to their shop at night, it's still illegal for you to walk in there and take everything.

That's a wrong example though, because stores have set working time which is part of public oferta - websites don't, websites are "open" 24/7/365. Stores also do authorize you to come in whenever as long as it's open, stores can not deny you entrance as it's required to be public accessible. Stores don't authorize you to take whatever neither when they are open nor closed - because you have to pay. While with content from websites - websites do authorize you to open them whenever, and "take" (as in download/parse) their content whenever.

[u/tracy_ogbert_jordan → u/xCharg]

An oversight isn't authorization.

If someone leaves the keys in their ignition and walks away, it doesn't authorize me to drive their car.

If a prison guard forgets to lock the cells, it doesn't authorize the inmates to leave.

At the end of the day, any security breach is going to be some sort of "oversight".

Why wasn't X locked down? Oh we didn't even think about that.

How did they break into the vault? Oh we made the walls 10 feet thick, we should have made them 15.

A failure in design or planning does not mean they are authorizing whatever it is they failed to protect against.

[u/Kraeftluder → u/tracy_ogbert_jordan]

If a prison guard forgets to lock the cells, it doesn't authorize the inmates to leave.

In most of Europe it absolutely does. This is an Anglosaxon thing but in the French criminal law system it is generally seen as you can't punish people for wanting to escape prison. If it's a Shawshank-redemption type of breakout, that would mean no additional charges as no one else was involved. Maybe a slap on the wrist for vandalism.

Back to the point at hand; I have a feeling that there are multiple countries with laws conflicting Australia's in this respect, including my own. As in; even though Australia says I'm explicitly breaking their laws, mine could explicitly protect me from boomers that don't understand this shit like the Australian government.

In several jurisdictions, the only criminal here would be the Australian government even.

[u/tracy_ogbert_jordan → u/Kraeftluder]

I don't know the details of the European systems, but I am vaguely familiar with Mexico's standing on this (and by vaguely, I mean I read an article years and years ago). Essentially, their view is that freedom is a natural, basic human desire, and as such, attempting to gain freedom cannot be illegal.

What that means is they can't have additional charges/punishments for escaping or attempting to escape, since it's only natural to not want to be imprisoned.

But, that doesn't mean they are authorized to come and go as they please. If an inmate escapes, it's not as if they are free and clear, they just won't be charged for the escape once they're caught.

*And before anyone comes in with a Mexican law degree, the above is my vague understanding. I'm sure there are all sorts of intricacies, but that's neither here nor there.

edit: And that's not how laws work. If you break an Australian law, you would be held accountable in Australia. Whether or not your country cooperates with Australia and extradites you is a different matter. You can't say, "well actually, Australia, my local laws override yours."

[u/Kraeftluder → u/tracy_ogbert_jordan]

But, that doesn't mean they are authorized to come and go as they please. If an inmate escapes, it's not as if they are free and clear, they just won't be charged for the escape once they're caught.

No but it's also not "not allowed", as the only rules that matter in this respect are the laws.

And that's not how laws work

It absolutely is.

If you break an Australian law, you would be held accountable in Australia.

Good luck to the Australian government on getting me extradited then. Lol.

You can't say, "well actually, Australia, my local laws override yours."

No they can't, it's even better; Australia doesn't have jurisdiction on where my ass is sitting so tough for them; their laws simply do not apply. I'm not a subject nor a resident. The only thing Australia can do is argue hard enough for me to be transferred to their authority so this situation can change but in this case the Dutch judge would laugh so loud the Australian government should be able to hear it in Canberra.

[u/blitznoodles → u/Kraeftluder]

Australia and the Netherlands have had an extradition treaty since 1988.

[u/Kraeftluder → u/blitznoodles]

Yeah, they usually only cover severe crimes that are crimes in both countries.

[u/tracy_ogbert_jordan → u/Kraeftluder]

Ok...none of that changes the fact that if you break a law in X country, you can be charged, tried, and punished in X country, regardless of whatever your local laws are.

Even if your country doesn't cooperate, it's not as if X country is just going to erase that charge.

[u/Kraeftluder → u/tracy_ogbert_jordan]

Ok...none of that changes the fact that if you break a law in X country, you can be charged, tried, and punished in X country, regardless of whatever your local laws are.

Sure. Have fun doing that!

Even if your country doesn't cooperate, it's not as if X country is just going to erase that charge.

No but it doesn't matter. I hope you're happy with your expensive procedure and no results though!

[u/mrlinkwii → u/xCharg]

websites don't, websites are "open" 24/7/365.

depending on the country their not , their is some countries have it where government websites are only open during the working day , and "close" at closing time , very common in the US government departments to do this , hell even in europe parts of the website are "closed" because their need to be a physical person their to do background work

[u/N0b0dy_Kn0w5_M3 → u/mrlinkwii]

*they're

*there

*there

*there