3 ms·

> The canonical way people know whether they're authorized to do something to a computer system is that it allows them to do it. If you aren't authorized then i

by kej 11y ago

> The canonical way people know whether they're authorized to do something to a computer system is that it allows them to do it. If you aren't authorized then it comes back with "access is denied" and you can't do it. I think you're going astray by looking at this from a computer perspective instead of from a human perspective. The canonical way to know if you're authorized to access x is if the owner of x has given you permission to access it. The fact that the "Employees Only" door isn't locked doesn't imply that everyone is authorized to go back there, and the "Authorized Vehicles Only" driveway doesn't need a roadblock to be meaningful. There are certainly ambiguities and room for this statute to be overused, but there are also situations that are clearly on one side or the other.

AnthonyMouse 11y ago
> The canonical way to know if you're authorized to access x is if the owner of x has given you permission to access it. But that doesn't work here. You will never meet the "owner" of google.com. You send it packets and it sends some back. There is no other relationship or interaction from which to infer authorization. > The fact that the "Employees Only" door isn't locked doesn't imply that everyone is authorized to go back there, and the "Authorized Vehicles Only" driveway doesn't need a roadblock to be meaningful. It is not the common case that a private party can put a sign on a wall saying whatever they want and have anyone charged with a crime for not following it. Moreover, there is no sign and there is no door or driveway. The Internet is not a physical place. The analogy would be if you sent mail to someone's assistant requesting some information and the assistant sent back a letter saying you aren't allowed to have this but here it is anyway. At best you're getting mixed signals and the fault is on the party sending them rather than the party receiving them. > There are certainly ambiguities and room for this statute to be overused, but there are also situations that are clearly on one side or the other. If the best you can say about a law is that unambiguous cases exist, that is not saying very much, and it does nothing for all the cases where clarity is unfindable.
- kej 11y ago
  >But that doesn't work here. You will never meet the "owner" of google.com. You send it packets and it sends some back. There is no other relationship or interaction from which to infer authorization. And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. Just like we'd all agree that we're allowed to drive on the public roads up to the entrance to Google's campus but not allowed to force our way into the server room. >If the best you can say about a law is that unambiguous cases exist, that is not saying very much, and it does nothing for all the cases where clarity is unfindable. When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. Maybe you were sending billions of packets because you misconfigured your network testing code and it was an honest mistake with no harm done, or maybe you sent billions of packets because you wanted to trigger a vulnerability in the server to discover some secret information. The legal system can take that into account. Overly specific laws that don't leave room for that kind of judgement lead to trivial ways to skirt the law.
  - AnthonyMouse 11y ago
    > And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. ...because we see the servers allow us to, and don't allow us to, respectively. Again, there are unambiguous cases. If you have no normal ssh access but you have an ssh 0-day, the 0-day does not by itself "authorize" you. But those are not the objectionable cases. > When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. Which is why we have laws against murder and theft and pollution that specify some details about what the crime entails and let the courts resolve the minutia of specifically what specific parts of the laws mean in a particular context. But the CFAA is not a law against murder or theft or pollution, it's a law against doing what you aren't allowed to do, without actually specifying what you aren't allowed to do. You might as well pass a law that says "don't be evil" and then shrug and hope the courts will figure it out.

by kej 11y ago

AnthonyMouse 11y ago

> The canonical way to know if you're authorized to access x is if the owner of x has given you permission to access it. But that doesn't work here. You will never meet the "owner" of google.com. You send it packets and it sends some back. There is no other relationship or interaction from which to infer authorization. > The fact that the "Employees Only" door isn't locked doesn't imply that everyone is authorized to go back there, and the "Authorized Vehicles Only" driveway doesn't need a roadblock to be meaningful. It is not the common case that a private party can put a sign on a wall saying whatever they want and have anyone charged with a crime for not following it. Moreover, there is no sign and there is no door or driveway. The Internet is not a physical place. The analogy would be if you sent mail to someone's assistant requesting some information and the assistant sent back a letter saying you aren't allowed to have this but here it is anyway. At best you're getting mixed signals and the fault is on the party sending them rather than the party receiving them. > There are certainly ambiguities and room for this statute to be overused, but there are also situations that are clearly on one side or the other. If the best you can say about a law is that unambiguous cases exist, that is not saying very much, and it does nothing for all the cases where clarity is unfindable.

kej 11y ago
>But that doesn't work here. You will never meet the "owner" of google.com. You send it packets and it sends some back. There is no other relationship or interaction from which to infer authorization. And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. Just like we'd all agree that we're allowed to drive on the public roads up to the entrance to Google's campus but not allowed to force our way into the server room. >If the best you can say about a law is that unambiguous cases exist, that is not saying very much, and it does nothing for all the cases where clarity is unfindable. When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. Maybe you were sending billions of packets because you misconfigured your network testing code and it was an honest mistake with no harm done, or maybe you sent billions of packets because you wanted to trigger a vulnerability in the server to discover some secret information. The legal system can take that into account. Overly specific laws that don't leave room for that kind of judgement lead to trivial ways to skirt the law.
- AnthonyMouse 11y ago
  > And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. ...because we see the servers allow us to, and don't allow us to, respectively. Again, there are unambiguous cases. If you have no normal ssh access but you have an ssh 0-day, the 0-day does not by itself "authorize" you. But those are not the objectionable cases. > When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. Which is why we have laws against murder and theft and pollution that specify some details about what the crime entails and let the courts resolve the minutia of specifically what specific parts of the laws mean in a particular context. But the CFAA is not a law against murder or theft or pollution, it's a law against doing what you aren't allowed to do, without actually specifying what you aren't allowed to do. You might as well pass a law that says "don't be evil" and then shrug and hope the courts will figure it out.