Polish teen derails tram after hacking train network (2008)

He's 14 years old. His brains might have developed enough to outsmart really horrible engineering, but no psychologist would argue most 14 year olds have fully developed understanding of consequences (much less, empathy) at that age. The problem is not with the boy.

Transport command and control systems are commonly designed by engineers with little exposure or knowledge about security using commodity electronics and a little native wit

This is the real problem. Whoever approves this kind of engineering into practice is directly responsible for whatever damage was done.

The youth, described by his teachers as an electronics buff and exemplary student, faces charges at a special juvenile court of endangering public safety

I don't think he realized he was endangering public safety, and certainly can't comprehend what that means in a way adults do.

patio112• 17 years ago

[N]o psychologist would argue most 14 year olds have fully developed understanding of consequences (much less, empathy) at that age.

The problem is not with the boy.

What. The. Heck.

How old do you have to be to understand "If a train derails, people die. People dying is a bad thing. Trains are big and complicated and are operated by professionals or at least people trained to use them, like, you know, cars." ?!?!

For several thousand years of human history we expected 14 year olds to go off to war, die gallantly, and come back and raise children if they survived. They proved up to the challenge. Now they're infantilized to the point where they cannot be reliably expected to show empathy for people who die as a result of their actions.

What. The. Heck. Words fail me.

[Edit: Gah, the more I think about this the more livid I get. GAAAAAAAAAH. I used to be a teacher and my child developmental psychology is a little rusty, but I also used to be a Boy Scout and can remember what we were doing when we were eight. It included practicing for emergencies such as What To Do If Someone Falls In The River. Answer: don't enter the river, because they are panicking and will drown you, instead, throw them a rope or flotation device. We did not have to explain to eight year olds that people drowning in the river is a bad thing or that the predictable consequence of pushing someone off a bridge into a river is that they will die, this is a bad thing, accordingly don't push someone off a bridge into the river even if you think he will look really funny falling into it.]

Confusion2• 17 years ago

How old do you have to be to understand "If a train derails, people die.

The fact is that even many adults tend to make bad judgment calls. The same goes for 14 year olds and they sometimes consistently make calls that seem ridiculous to older people. That it seems ridiculous to you doesn't make it ridiculous to some 14 year olds.

Your examples both fail to take into account that say 10% of youngsters may not act like you would expect them to. Many did not survive wars; many would still dive into the river in an emergency. You can repeat how stupid something is until you throat goes soar: that doesn't mean the person under discussion was capable of understanding that.

I think you should read up on your developmental psychology: the ethical calls of 8 or 14 year olds tend to be pretty different from those of adults. Especially the regular outliers are fascinating.

A kid with a knack for electrical engineering... hmmm, might he just be a little behind in his understanding of social phenomena? Of the value we adhere to other people's wellbeing?

I still have the capacity to reason about things without any concern for the people involved. People ask: how can you even consider that, given the consequences to the people involved. The seem paralized to even consider some options, as they immediately think it would be bad for humans. My answer: like any other factor, you can perfectly exclude 'people' for simplicity, to take that factor into account later. Sometimes that make the previous exercize a waste; sometimes it brings a valuable perspective, because the cost to humans turns out to be avoidable in some way. Think 'nuclear energy' in the 80's. Many people were incapable of any sound reasoning about that, because of perceived costs to human lives.

Perhaps only one person should have said to this boy "ehmm, do you realize how dangerous this is? What if your mother was in that tram? She might get hurt. You may only want to change the way a tram goes, but they can't just change the next interchange to fix that, if their system is solid enough to notice the change at all." With some people, you really need to drive a point home, before they understand.

cduan• 17 years ago

A lot of HN readers appear to place the blame on the system engineers rather than the kid. Some go so far as to say that the kid did a good thing in teaching the engineers a lesson. The implicit principle seems to be that unwanted intrusions are acceptable--even applaudable--actions in the face of systems unsecured against them.

I would ask of you whether you would apply this principle in other systems. Shall we call it a "good lesson" if the kid went around shooting people in the train, as a lesson that the trains need to be bulletproofed?

Folks, the criminal law exists to punish certain undesirable actions, so that the general public can save itself the cost of self-protection. I don't walk around wearing a bulletproof vest all the time, because I believe that the law and its enforcement will sufficiently deter others from deciding to intrude upon my body with a bullet.

So should it be with technological intrusions as well as physical. Certainly it is feasible to build secure systems. So is it feasible for me to wear a bulletproof vest all the time. But secure systems, like bulletproof vests, are costly things--they require hiring good engineers, spending time to evaluate security risks, testing systems for robustness, and so on. And if these costs are sufficiently high, then it would be economically inefficient to impose them on systems engineers by allowing hacking like this to go unpunished.

I'm not saying that anyone should be lax in building secure systems. I am, however, saying that intrusive behavior like this kid's should not be applauded. It should be recognized for what it is: a societally detrimental act, for which he should be held accountable as any other societally detrimental act is held under the law.

HalcyonMuse• 17 years ago

Nonsense. There are people out there who have the goal "kill large numbers of people." Their motive is sometimes political, sometimes simply sociopathic... but the motive is irrelevant. If a fourteen year old boy can hack the train system and cause some minor damage (i.e. expensive train derailments) what could a motivated, fully grown adult do if they had that remote control instead? I suspect the answer is hundreds dead - maybe thousands with sufficient coordination and vulnerable systems.

A security hole like this is extremely dangerous due to the magnitude of its ignorance. Systems like mass transit should HAVE good engineers that spend time evaluating security risks and testing systems for robustness et cetera.

I doubt the hole would have been patched if someone called up their local Mass Transit Authority and said "Hey, uh, I've got this 0-day..." A 14 year old boy exploiting it, on the other hand, is probably going to draw some attention to it, and that attention will likely get the hole fixed, potentially saving hundreds of lives in the future.

If GM built a car that killed its inhabitants when a radio station played a certain song, GM would be to blame, not the radio station.

imajes2• 17 years ago

IANAL, however-

The age of reason- The age at which a child is considered capable of acting responsibly.

Under Common Law, seven was the age of reason. Children under the age of seven were conclusively presumed incapable of committing a crime because they did not possess the reasoning ability to understand that their conduct violated the standards of acceptable community behavior. Those between the ages of seven and fourteen were presumed incapable of committing a crime, but this presumption could be overcome by evidence, such as the child having possession of the gun immediately after the shooting. The rebuttable presumption for this age group was based on the assumption that, as the child grew older, he or she learned to differentiate between right and wrong. A child over the age of fourteen was considered to be fully responsible for his or her actions. Many states have modified the age of criminal responsibility by statute.

All states have enacted legislation creating juvenile courts to handle the adjudication of young persons, usually under eighteen, for criminal conduct rather than have them face criminal prosecution as an adult. However, a child of thirteen who commits a violent crime may be tried as an adult in many jurisdictions.

Now, it'll be easy enough for anyone to argue that the teen is responsible given the typical age of reason argument. Defence might argue that he has social development issues and therefore is emotionally younger. Prosecution may argue that given he researched, developed and then executed his 'attack', the level of premeditation and appropriate amount of time taken to complete would show presumptive responsibility.

In other words, dude. wth?

Yes, the engineers built a cheap system however many years ago (i'd say decades). They didn't have any idea of what they needed to do for security. And for what it's worth, it'd be pretty easy to hack SF's Muni - there are plenty of spots where all you need is a welding torch and a crow bar to cause damage and risk lives.

But the reality is, the kid did something wrong and will find it pretty hard to argue that he's not responsible. Hopefully however, the judge will have the foresight to set a sunset clause on his sentence which will expunge it from his record when he turns into an adult -- or the hope of him ever getting a visa to come and hack out here will be pretty slim. :)

michaelkeenan• 17 years ago

> no psychologist would argue most 14 year olds have fully developed understanding of consequences (much less, empathy) at that age.

Robert Epstein is a psychologist who argues that teens are/can be as competent as adults:

"Dumas and I worked out what makes an adult an adult. We came up with 14 areas of competency—such as interpersonal skills, handling responsibility, leadership—and administered tests to adults and teens in several cities around the country. We found that teens were as competent or nearly as competent as adults in all 14 areas. But when adults estimate how teens will score, their estimates are dramatically below what the teens actually score.

...

Studies show that we reach the highest levels of moral reasoning while we're still in our teens. Those capabilities parallel higher-order cognitive reasoning abilities, which peak fairly early. Across the board, teens are far more capable than we think they are."

From http://www.psychologytoday.com/articles/200703/trashing-teen...

gaius• 17 years ago

In most cultures throughout most of human history, a 14 year old would be to all intents and purposes an adult.

Locke1689• 17 years ago

In most cultures throughout most of human history, people thought illness was caused by evil spirits and worshiped a harvest god. Our understanding of human psychology and biology in general has expanded far more since then. I will not pretend to be qualified to judge this topic (unlike most of Hacker News, it seems) and will instead defer psychological judgment to a trained professional who has interacted with the subject directly.

Polish teen derails tram after hacking train network (2008)

Related Stories