5 ms·

>But that doesn't work here. You will never meet the "owner" of google.com. You send it packets and it sends some back. There is no other relationship or intera

by kej 11y ago

>But that doesn't work here. You will never meet the "owner" of google.com. You send it packets and it sends some back. There is no other relationship or interaction from which to infer authorization. And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. Just like we'd all agree that we're allowed to drive on the public roads up to the entrance to Google's campus but not allowed to force our way into the server room. >If the best you can say about a law is that unambiguous cases exist, that is not saying very much, and it does nothing for all the cases where clarity is unfindable. When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. Maybe you were sending billions of packets because you misconfigured your network testing code and it was an honest mistake with no harm done, or maybe you sent billions of packets because you wanted to trigger a vulnerability in the server to discover some secret information. The legal system can take that into account. Overly specific laws that don't leave room for that kind of judgement lead to trivial ways to skirt the law.

AnthonyMouse 11y ago
> And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. ...because we see the servers allow us to, and don't allow us to, respectively. Again, there are unambiguous cases. If you have no normal ssh access but you have an ssh 0-day, the 0-day does not by itself "authorize" you. But those are not the objectionable cases. > When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. Which is why we have laws against murder and theft and pollution that specify some details about what the crime entails and let the courts resolve the minutia of specifically what specific parts of the laws mean in a particular context. But the CFAA is not a law against murder or theft or pollution, it's a law against doing what you aren't allowed to do, without actually specifying what you aren't allowed to do. You might as well pass a law that says "don't be evil" and then shrug and hope the courts will figure it out.
- kej 11y ago
  >...because we see the servers allow us to, and don't allow us to, respectively. Did you really have to attempt "ssh root@google.com" and be denied to know you weren't allowed to do that? If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? >You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It allows for judgement based on the facts of the situation, instead of having to specify every possible variable in statute. More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful?
  - AnthonyMouse 11y ago
    > If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? So this is a great example. Suppose you type "ssh root@google.com" on a lark and it unexpectedly lets you in. Your reaction is, of course, WTF. Something is wrong and you start trying to figure out what it is. DNS record point to the real google.com? Some malware or network attacker doing a MITM on all your ssh connections? What does the remote side think its network configuration is? This "wait, what?"-type reaction is completely innocuous. But the CFAA says you're already going to jail. Now if you get root@google.com and start reading everybody's gmail and stealing credit cards from Google Play, you deserve to go to jail. But there are like fifteen separate other laws against that stuff. > Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? Is it the front door to a store? Because yes. If the door is locked you expect that the store is closed, if not you expect it to be open for business. And that is the context we have in computer networks. The expectation is that things you shouldn't have access to don't allow you to access them and most everything actually works that way most of the time. > It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It is, it's just that in some cases the reasonable person standard is completely clear. The problem is the rest of the time it's as clear as mud and the outcome is a coin flip -- or 80% in your favor but the consequences are so severe you can't take the chance. > More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful? What I would suggest is that the CFAA ought to be entirely redundant for cases like this. Charge the man with misappropriating trade secrets and so on. What does it have anything to do with whether he used a computer or not?

by kej 11y ago

AnthonyMouse 11y ago

> And yet even without a phone call from Larry Page, we all know that we're authorized to point our web browsers at google.com, and not authorized to ssh into Google's internal networks. ...because we see the servers allow us to, and don't allow us to, respectively. Again, there are unambiguous cases. If you have no normal ssh access but you have an ssh 0-day, the 0-day does not by itself "authorize" you. But those are not the objectionable cases. > When there are grey areas, the legal system will look at the whole situation and consider what a reasonable person would conclude. You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. Which is why we have laws against murder and theft and pollution that specify some details about what the crime entails and let the courts resolve the minutia of specifically what specific parts of the laws mean in a particular context. But the CFAA is not a law against murder or theft or pollution, it's a law against doing what you aren't allowed to do, without actually specifying what you aren't allowed to do. You might as well pass a law that says "don't be evil" and then shrug and hope the courts will figure it out.

kej 11y ago
>...because we see the servers allow us to, and don't allow us to, respectively. Did you really have to attempt "ssh root@google.com" and be denied to know you weren't allowed to do that? If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? >You can't run a legal system exclusively on what a reasonable person would do. People have to have some idea of what that means so they can have some idea ahead of time whether the thing they want to do is legal or not. It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It allows for judgement based on the facts of the situation, instead of having to specify every possible variable in statute. More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful?
- AnthonyMouse 11y ago
  > If you had been allowed in and it was obviously something internal, would you really just assume that Google intended for you to have access? So this is a great example. Suppose you type "ssh root@google.com" on a lark and it unexpectedly lets you in. Your reaction is, of course, WTF. Something is wrong and you start trying to figure out what it is. DNS record point to the real google.com? Some malware or network attacker doing a MITM on all your ssh connections? What does the remote side think its network configuration is? This "wait, what?"-type reaction is completely innocuous. But the CFAA says you're already going to jail. Now if you get root@google.com and start reading everybody's gmail and stealing credit cards from Google Play, you deserve to go to jail. But there are like fifteen separate other laws against that stuff. > Literally all of your objections would apply identically to trespassing laws. Do you have to check the lock on every door before you know whether or not you're allowed on the other side? Is it the front door to a store? Because yes. If the door is locked you expect that the store is closed, if not you expect it to be open for business. And that is the context we have in computer networks. The expectation is that things you shouldn't have access to don't allow you to access them and most everything actually works that way most of the time. > It's not exclusively based on the reasonable person standard, that's just what it falls back to when the situation isn't completely clear. It is, it's just that in some cases the reasonable person standard is completely clear. The problem is the rest of the time it's as clear as mud and the outcome is a coin flip -- or 80% in your favor but the consequences are so severe you can't take the chance. > More to the point, this case is about a guy who started a new company to compete with his previous employer, and then accessed the computers at the old company. Are you really suggesting that the question of whether he was authorized should depend on whether he was successful? What I would suggest is that the CFAA ought to be entirely redundant for cases like this. Charge the man with misappropriating trade secrets and so on. What does it have anything to do with whether he used a computer or not?