4 ms·
But according to recently tried cases, something as mundane as incrementing a URL can be construed as a violation of CFAA.
by forgotpwtomain 11y ago
But according to recently tried cases, something as mundane as incrementing a URL can be construed as a violation of CFAA.
- tptacek 11y agoSo? Your criminal liability for incrementing the URL is totally situational. If you're reading a catalog and you tick the URL to see what the next product is, you aren't going to be liable. If you see a URL used for XHR in the frontend for your bank and you increment it to see other people's bank accounts, you will be. We don't have a law against "hacking" in the US; we have a law against "unauthorized access", particularly when that access has consequences. According to one recently tried case, by the way, and one where the sentence was ultimately vacated. And finally: CISA has almost nothing to do with criminal law (it defines no new offenses does not change CFAA or its sentencing). If you want to have a discussion about how totally broken CFAA's sentencing is, I'm right there with you.
- forgotpwtomain 11y agoAll I'm suggesting is that since CFAA has a history of been construed to be applicable in extremely broad-terms by prosecution and (although I have not done a close reading of the entire act it contains provisions such as the following in it's definition of CYBER THREAT INDICATOR): > (D) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability; That OP's second concern: > and I don't want my geolocation, etc. perpetually in the hands of anyone with a security clearance. Regarding being under surveillance for what they may consider to be their normal or otherwise professional activities is quite valid.