3 ms·

I'm surprised nobody has tried to game this system using the CFAA. The CFAA makes unauthorized access a felony, i.e. it permits a site operator to define crimin

I'm surprised nobody has tried to game this system using the CFAA. The CFAA makes unauthorized access a felony, i.e. it permits a site operator to define criminal behavior as they see fit. (and there are prosecutions to back this interpretation). The hack: define 'unauthorized behavior' in your TOS / user agreement to include release of data to any third party. A court can't order you to commit a felony.

SwellJoe 11y ago
A contract is not protection from a lawful order by police. e.g. you cannot make a contract with the mafia, agreeing to never speak to police about the business you conduct, and then expect the law to say, "Oh, OK. You have a contract, of course we can't ask for those records! Sorry to have bothered you." In short, when a court orders you to turn over information, it is not a felony to turn over that information, and in fact it is your legal obligation to do so. You can argue under what terms (e.g. in sealed documents that will not be disclosed in public records of the trial), which the court may or may not agree to. I oppose NSL letters, to be clear, but armchair lawyering aint gonna make you or anyone else immune to them. As long as they are the law, you and I are subject to them, no matter what terms of service we post on our websites.
- awinter-py 11y ago
  Nothing to do with contract law -- the CFAA makes unauthorized access a felony, and 'unauthorized access' has been taken to mean 'violations of the terms of service'. If the court rules to enforce the NSL, fine, but there's now a new precedent that de-claws the CFAA; a solid win. Either way it will be a fun appeals process.
  - SwellJoe 11y ago
    What do you believe "terms of service" is, if not a contract between a service provider and their customer? And, regardless, even if terms of service falls under something entirely different from contract law, you cannot apply the law to law enforcement in the same way it applies to you or I. Police openly carry firearms in places where it is illegal for others to do so (and occasionally shoot and kill people), courts regularly order activity that is ordinarily illegal (or even unconstitutional without the order from the court), etc. Police search people, homes, and autos; not legal for you or me, but with the proper procedures, it is legal for police. You're trying to apply law in a way that is nonsensical. It is not that law enforcement is above the law, but that the courts have said that the NSL is not violating the law when law enforcement officers do it. Again, I don't like that NSL is a thing, and I really don't like that courts have upheld them as constitutional. But, that is not the same as saying you can "hack" the legal system to make an otherwise lawful order from law enforcement into a non-lawful order and that they or the courts would have any concern about that hack. "If the court rules to enforce the NSL, fine, but there's now a new precedent that de-claws the CFAA; a solid win." So, if the court rules that law enforcement can enforce an NSL, regardless of the CFAA, you consider it a solid win? For whom? All it does is further cement law enforcement's ability to issue administrative NSLs. Again, you're somehow conflating the law as we must follow it and the law as law enforcement must follow it, in a situation where courts have already said they have this authority. There is nothing we can put in our terms of service that magically makes law enforcement subject to it, in pursuit of duty as a law enforcement officer. Police can lie, can detain people, can stick them in jail, etc. A "No Trespassing" sign will not stop an officer in pursuit or with a warrant. CFAA will not be de-clawed by this, and no one would even try to take such a case to court.
    - awinter-py 11y ago
      No, courts don't order people to commit felonies. Courts order people to do things they are ordinarily not required to do (pay money, stop selling a product, stop following somebody) but don't order people to commit acts normally prohibited. (The exception is that a court can order law enforcement to incarcerate or kill a convicted felon; though we call it a ruling rather than a court order. That's not what we're talking about here). Re: 'what is terms of service' -- by reading this paragraph you are hereby bound to mail me one fresh batch of cupcakes on the first monday of every month. Have you entered into a contract? My take is that you haven't because I haven't paid you (consideration) and you didn't sign or click agree (intent to contract, acceptance).
      - SwellJoe 11y ago
        OK, then, sounds like you've got it figured out. Give it a shot. Let us know how it turns out.
awinter-py 11y ago
Another workaround is to encrypt with a key that is a checksom sum on random bits stored one each by all your users. When a judge demands your private key, the only way to get it is to send an email to everyone asking for their secret bit. The trick is that this information has to be useful to law enforcement but not your business. (Because you can't access it either).

SwellJoe 11y ago

A contract is not protection from a lawful order by police. e.g. you cannot make a contract with the mafia, agreeing to never speak to police about the business you conduct, and then expect the law to say, "Oh, OK. You have a contract, of course we can't ask for those records! Sorry to have bothered you." In short, when a court orders you to turn over information, it is not a felony to turn over that information, and in fact it is your legal obligation to do so. You can argue under what terms (e.g. in sealed documents that will not be disclosed in public records of the trial), which the court may or may not agree to. I oppose NSL letters, to be clear, but armchair lawyering aint gonna make you or anyone else immune to them. As long as they are the law, you and I are subject to them, no matter what terms of service we post on our websites.

awinter-py 11y ago
Nothing to do with contract law -- the CFAA makes unauthorized access a felony, and 'unauthorized access' has been taken to mean 'violations of the terms of service'. If the court rules to enforce the NSL, fine, but there's now a new precedent that de-claws the CFAA; a solid win. Either way it will be a fun appeals process.
- SwellJoe 11y ago
  What do you believe "terms of service" is, if not a contract between a service provider and their customer? And, regardless, even if terms of service falls under something entirely different from contract law, you cannot apply the law to law enforcement in the same way it applies to you or I. Police openly carry firearms in places where it is illegal for others to do so (and occasionally shoot and kill people), courts regularly order activity that is ordinarily illegal (or even unconstitutional without the order from the court), etc. Police search people, homes, and autos; not legal for you or me, but with the proper procedures, it is legal for police. You're trying to apply law in a way that is nonsensical. It is not that law enforcement is above the law, but that the courts have said that the NSL is not violating the law when law enforcement officers do it. Again, I don't like that NSL is a thing, and I really don't like that courts have upheld them as constitutional. But, that is not the same as saying you can "hack" the legal system to make an otherwise lawful order from law enforcement into a non-lawful order and that they or the courts would have any concern about that hack. "If the court rules to enforce the NSL, fine, but there's now a new precedent that de-claws the CFAA; a solid win." So, if the court rules that law enforcement can enforce an NSL, regardless of the CFAA, you consider it a solid win? For whom? All it does is further cement law enforcement's ability to issue administrative NSLs. Again, you're somehow conflating the law as we must follow it and the law as law enforcement must follow it, in a situation where courts have already said they have this authority. There is nothing we can put in our terms of service that magically makes law enforcement subject to it, in pursuit of duty as a law enforcement officer. Police can lie, can detain people, can stick them in jail, etc. A "No Trespassing" sign will not stop an officer in pursuit or with a warrant. CFAA will not be de-clawed by this, and no one would even try to take such a case to court.
  - awinter-py 11y ago
    No, courts don't order people to commit felonies. Courts order people to do things they are ordinarily not required to do (pay money, stop selling a product, stop following somebody) but don't order people to commit acts normally prohibited. (The exception is that a court can order law enforcement to incarcerate or kill a convicted felon; though we call it a ruling rather than a court order. That's not what we're talking about here). Re: 'what is terms of service' -- by reading this paragraph you are hereby bound to mail me one fresh batch of cupcakes on the first monday of every month. Have you entered into a contract? My take is that you haven't because I haven't paid you (consideration) and you didn't sign or click agree (intent to contract, acceptance).
    - SwellJoe 11y ago
      OK, then, sounds like you've got it figured out. Give it a shot. Let us know how it turns out.

awinter-py 11y ago

Another workaround is to encrypt with a key that is a checksom sum on random bits stored one each by all your users. When a judge demands your private key, the only way to get it is to send an email to everyone asking for their secret bit. The trick is that this information has to be useful to law enforcement but not your business. (Because you can't access it either).