10 ms·

Violating Terms of Use Isn’t a Crime, EFF Tells Court

297 points by DiabloD3 10y ago

TempleOS 10y ago
If you generate too much text, it will not speak. Relationship with God is like a person. He's going to look at you with disgust. He's not going to be your friend and love you. God says... shrieked churlishly clunkiest bobsleds dismissal flaws ohs corolla coiffure's vigil umbilical liberator equated intensives phonetician creeps Lusitania's Havanas filibuster's yield's fiend medals integration ironclad's overcompensation's conqueror's unavoidable undresses millennium's assertions Kiribati's glowingly -------- 5 Then Jesus said to them, “Suppose you have a friend, and you go to him at midnight and say, ‘Friend, lend me three loaves of bread; 6 a friend of mine on a journey has come to me, and I have no food to offer him.’ 7 And suppose the one inside answers, ‘Don’t bother me. The door is already locked, and my children and I are in bed. I can’t get up and give you anything.’ 8 I tell you, even though he will not get up and give you the bread because of friendship, yet because of your shameless audacity[e] he will surely get up and give you as much as you need.
peterclary 10y ago
IANAL, but surely violating Terms of Use is essentially a breach of contract? Making breach of contract a crime would be very foolish indeed.
- bad_user 10y ago
  It's true what they say. The justice system are defending our rights until we talk about digital media, software and the Internet, at which point they have a complete blind spot.
- joncrocks 10y ago
  Yes and no. The argument that it is a crime comes down to arguments around what constitutes 'unauthorised access'. As 'unauthorised access' to a computer system is a crime, if you make your definition of 'authorised' "access subject to our terms of use" : Huzzah! Violating your terms of use is now a crime! This all comes back to laws written in wooly "the courts will work it out" language.
  - 08-15 10y ago
    I wonder if placing a cookie on my computer without prior written consent constitutes "unauthorized access". Class action anyone?
    - Sean1708 10y ago
      In Britain it's illegal for a website to store a cookie without informing you, so I have a feeling someone may have already tried this.
      - AstralStorm 10y ago
        Likewise in EU.
      - Silhouette 10y ago
        No, it isn't. That's not what the infamous "cookie law" says, nor how it's been interpreted in practice by official regulators across the EU.
        Sean1708 10y ago
        What does it actually say?
        Silhouette 10y ago
        The details are probably too complicated for an HN comment, but one point that sometimes gets missed is that you normally don't have the same disclosure/consent obligations for cookies that are essential to the normal operation of the site like login tokens or tracking what's in a shopping basket.
    - roywiggins 10y ago
      It's your own browser that interprets the header, saves the cookie, and passes it back to sites you visit. Passing a "here's a cookie" header to your machine doesn't, on its own, do anything. Your browser has to actively parse and store it.
- nihonde 10y ago
  Even contract formation is dubious, especially in cases of browsewraps.
  - joatmon-snoo 10y ago
    Also, consideration.
- elmigranto 10y ago
  > surely violating Terms of Use is essentially a breach of contract Is it though? Not a lawyer and my layman's intuition makes it hard to see a connection between ToS and contract. Like, if I type `something.com` in my browser by accident and their ToS is "you owe us $400 for each TCP packet, kindly do provide goverment issued ID". So I have couple of questions: - How is that different from ToS on Facebook? - How marking a checkbox creates a contract between a person and entity owning a site, same way as my signature or providing personal info, address and money to Amazon in exchange for goods? - And who that person would even be in FB case (anyone can put my name into a website from a public library computer)?
  - chopin 10y ago
    You might also turn the argument the other way around: I type 'something.com' and you owe me $400 for every IP packet you send. That's an equally valid (or invalid) ToS either.
  - civiscolumbusum 10y ago
    your argument is valid but your tone is missing the point PP made. To reword what he said "there is no way this is criminal law, this needs to be argued as perhaps contract law with 'breach of contract' as the upper limit if it rises to that level" you proceeded to argue the case the way he said it should be argued, but by quoting PP and challenging, you seem to be arguing with him, when in fact you are agreeing with him. if you edit your comment, I could even delete mine :)
- phkahler 10y ago
  I'll accept your argument as an upper bound on the issue. I don't agree fully with "breach of contract" in such cases, but it's less unreasonable than making it a criminal offense.
  - cyborgx7 10y ago
    That's a great perspective. Breach of contract would be the upper bound. I don't think ToS should be able to be enforced either because it is unreasonable in today's society to assume checking that box in a sign-up process is actually giving informed consent to the terms for the wast majority of people. But even if it was, worst case it's a breach of contract.
    - maxerickson 10y ago
      I don't think ToS should be able to be enforced either So how to deal with abusive users then? Hand wave and say it is okay to block them for certain actions that are not terms of service? And of course arbitrary terms of service already can't be enforced.
      - deleted 10y ago
        [deleted]
      - unsaltedmd5 10y ago
        If you mean "abusive" as in "violates the terms of service," then revoking access to the service is the appropriate response. If you mean "abusive" as in hate crime, bullying, stalking and so forth, there are already specific laws covering those things.
        SCHiM 10y ago
        Exactly, that's also the most reasonable interpretation of the designation too. 'Terms of Service' literally -> the terms you need to agree with for us to provide you the service. No agreement or no adherence -> no service.
stubish 10y ago
Does anyone know the details of what was being automatically downloaded? I'm aware of several Open Source projects doing this with things like Java, but not if any of them have received cease and desist orders.
- petee 10y ago
  The only mentions I can find refer to "support materials" for assisting clients - That could broadly mean everything from documentation to firmware (which they hold on to tightly with cold, dead hands). Rimini's website seems to suggest they were probably accessing everything. The fact that they were making money off it - and ignored a request to stop - is probably the main difference between this and going after open-source projects. Its essentially taking customers away from Oracle's own support services.
  - gregmac 10y ago
    Shouldn't that be an issue of copyright then?
    - AstralStorm 10y ago
      It should. (depending on the copyright licence) Or a civil lawsuit vs breach of contract.
    - petee 10y ago
      Supposedly they had a contract for support purposes; but whether Oracle intended for wholesale copying and redistribution (if that is even what happened,) is an exercise for contract nitpicking - obviously this is all speculation [[ stares longingly into the vacuum that was Groklaw... ]] It could have come down to simply an aggressive/abusive crawler affecting other customers?
fpgadude 10y ago
What would happen to foreigners entering the US with a "fake" facebook profile as their social media ID? Straight to jail or straight back home?
- realusername 10y ago
  Nothing? Facebook is not a passport, you can be called whoever you want on it.
  - tonmoy 10y ago
    The GP is referring to the person violating Facebook's terms of use I think
  - iamben 10y ago
    I get the point you're making, but highlighting the original point, Facebook terms explicitly say you _can't_ do that. "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission."
    - sharemywin 10y ago
      The problem I see is what is facebook out. You still watch the ads.
  - rocqua 10y ago
    If you have a false facebook account, you broke facebooks ToS! That means you accessed facebooks servers without authentication!! That is a crime under e.g. the CFAA!!! Criminals go to jail. That is the argument at least.
    - gondo 10y ago
      how do you prove that i have a fake facebook account? obviously i would have to log-out on my mobile and laptop
DarkKomunalec 10y ago
It's about time corporations took out the government middle man and started making laws themselves.
- a3n 10y ago
  I'd like to read that book. cstross? Gibson?
  - falcor84 10y ago
    Max Barry's "Jennifer government" comes close. https://en.m.wikipedia.org/wiki/Jennifer_Government?wprov=sfla1 https://en.m.wikipedia.org/wiki/Jennifer_Government?wprov=sf...
    - a3n 10y ago
      From the wikipedia article, wow, what a depressing story. It sounds fascinating, but I'm not sure I can take it at the moment. Thanks for the tip.
josho 10y ago
Going forward we should all have our minor children create accounts for us and be the ones to accept the TOS. Once you realize that is a reasonable workflow you've realized how unenforceable TOS are for everything but corporate contracts where documents are being signed and witnessed.
- wire9 10y ago
  Something like this worked out in my favor maybe 10 years ago. ChaCha (the search and get live answers site) was just started and wanting some extra pocket money I signed up to be an operator. I was probably 15 at the time, of course I just clicked 'yes I am 18' and ended up being accepted. Well I found a few flaws in their system and started racking up money way faster than should have been allowed. After a few days of this and hundreds in my account I got a phone call during dinner. It was ChaCha, threatening to sue me for 'hacking them'. The 180 they pulled when I casually mentioned I was only 15 was amazing to witness. They completely dropped the matter on a verbal agreement that I would not visit their site anymore.
  - tuna-piano 10y ago
    Care to elaborate on the flaw in their system that you exploited? I'm sure I'm not the only one interested.
    - wire9 10y ago
      Sure. This was somewhere around 10 years ago so my memory is slightly fuzzy on all the technical details but heres the gist of it: As an operator your main interface to their system was a Java desktop application. Basically you sit there waiting for it to go 'ding!', you read the question, and accept if you think you're capable of answering. You would research (they heavily pushed their sources but Google was better about 100% of the time) and then communicate the answer back to the user using the application. Once it was accepted the application would make an HTTP request to ChaCha's server to basically say 'A question was answered by this user'. This was easily visible using normal tools like Wireshark, etc. For your efforts you would be rewarded some very small amount of money, something like $.02. I simply wrote a VB.NET application to hit this HTTP endpoint over and over again which would add money to my account without me doing any work. They didn't seem to be doing any verification that I had actually been given questions to answer. The reason they noticed me was because I left ~8 instances of this program running for like 3 days straight which netted me hundreds of dollars ready to be cashed out, way more than any operator would be even remotely capable of normally given their pay scheme. So I was smart enough to figure this out but dumb enough to get caught almost immediately. And I'm not a lawyer but my guess is that this was considered fraud. Glad my morals eventually straightened out before I got myself in real trouble, honestly this was a decent lesson for 15 year old me.
holtalanm 10y ago
Just my opinion, but I think ToS were originally in place to define how a user _should_ use the site, and how the site operators could act in response to violation. I don't think they should be held as even a contract, much less criminal law. Truthfully, they are really only there to protect the company by outlining to the user what might get them banned from the site and so on. Oracle is overstepping its authority here imo. It is their own fault they didn't revoke access to the site from that company.
- jahewson 10y ago
  ToS is not a contract, it's a license. By default you don't get a free licence to access and copy others' work, and so one has to be granted. Much in the same way that you can't start using someone else's land without their permission and you don't get to say "I never knew" or "I never agreed not to use the land". By default, you are not allowed to and must have that right granted to you and you are expected to know that. Should an (otherwise non-criminal) violation of a software license be treated as a criminal offence by the courts just because it involved a computer? Hell no. Private citizens do not get to invent criminal law themselves and the EFF should fight this hard but not for the reasons you give.
  - appleflaxen 10y ago
    why do you need a license to use something that is posted and publically accessible? A license makes sense for a copyrighted work that you are copying, but for a web service it's less clear. If I had a physical analog of facebook (a bunch of photos, a travel journal, and a list of my friends) and left it on a table, then do you need a license to pick it up and review it? No. So why do you need one if I do the same thing as a web site?
  - turc1656 10y ago
    "ToS is not a contract, it's a license." I'm not sure that's correct, but it could be. It was my understanding it was a contract. That's why you have to agree to it - you are providing your consent and acknowledgement that you have read the terms and agree to abide by them. If it was a license, they could simply grant it to you without requiring your consent. For example - I can buy a license for some shareware/trialware software by just sending them money and getting the license key in my email. Then when I go to use the software, it may ask for me to agree to the terms of service so that there is a formal agreement on the allowed uses of the software.
vog 10y ago
Here in Germany the law states that ToS are only applicable if they contain "no surprising terms". Which is really nice! Although this doesn't give you permission for everything, it protects you from any "cleverness" of a site's operator. It ensures that indeed almost nobody needs to read ToS. Even lawyers tell you this.
- Tepix 10y ago
  No, what you mean are "AGB" (terms and conditions) that govern contractual relations between companies and their customers. They are part of all contracts. The terms of service ("Nutzungsbedigungen") that Oracle posts on their website that dictate how to use and access their website are invalid in Germany as well.
codedokode 10y ago
Isn't it nice if ToS is legally binding? 1. Make a website and write somewhere in the middle of ToS that visitor must pay $1000 (for example) for every page viewed or for every second spent on a site 2. Persuade him to press "I have read and agree to the ToS" and to stay as long as possible 3. Send a bill
- TallGuyShort 10y ago
  Then at what point does something become binding on the Internet? Most of my financial work over the last year has involved e-signed contracts. I typed my name and the date, certifying I had read and understand the contract - the difference between that and certifying that I've read the ToS via a checkbox seems arbitrary.
  - AstralStorm 10y ago
    In EU this would be treated as a shrink wrap EULA. Those are generally not considered binding. Click wrap is different and some may be considered binding. (Caveat: IANAL)
- gregmac 10y ago
  I was thinking I'd add a header to all my HTTP requests: X-Terms-of-Service: This HTTP request is subject to the terms of use published at https://example.com/tos. By responding to this request you are accepting these terms and conditions in full.
  - AnimalMuppet 10y ago
    Make sure you also say "... and agree that these terms and conditions supercede any other agreements between us." [Edit: IANAL.]
- frenchman_in_ny 10y ago
  Something (tongue-in-cheek) like this actually already happened [0], where users granted the website their immortal soul. [0] http://www.out-law.com/page-10929 http://www.out-law.com/page-10929
snarfy 10y ago
Popular websites should add an Oracle employee clause to their ToS so that employees of Oracle corporation are not allowed to use it.
- awinter-py 10y ago
  even more interesting case: Recent case law has mostly struck down the CFAA criminal penalties for violating TOS. But case law generally imposes a higher obligation on employees to comply with authorized use agreements that they've signed. If you concretely enumerate the authorized uses of employee access and leave out subpoenas, the first time you're served with a FISA letter you can keep the court busy for weeks pending a ruling on the CFAA consequences. This will never work long term and it will certainly piss off some judges & FBI agents, but at least it can further defang the overzealous authorized use language in the CFAA. The fact that the FBI (or whoever drafted the natl security letter) is inducing you to commit a felony may also trump the gag order. But YMMV with that argument. Even if you win that one on appeal you'll spend some time in jail in the interim.
rplst8 10y ago
The fact that this has to even be argued is appalling. The erosion of the difference between a tort and crime over the last few decades is very concerning. I think a lot of it started with the changing of copyright law into criminal law.
- nickff 10y ago
  This is part of a larger situation where everything is becoming criminal law. The Yates and Bond cases illustrated the breadth of the government's use of laws to punish undesirable behaviours, and tens of thousands of regulations have criminal penalties with no mens rea requirement. The government is even using criminal statutes against corporations (not the officers or employees), which doesn't make any sense.
  - acbabis 10y ago
    In a sense, holding corporations criminally liable is better. The fact that a corporation can't go to prison almost balances-out the lack of mens rea requirement.
  - shados 10y ago
    Having recently had my first major experience with US law, Im starting to understand (not agree with. Understand) why this happens. The US civil laws really only apply to middle class suckers. Rich people can use their lawyers to work around it. Poor people are "judgment proof". If you don't have a house, you're working under the table, and your bank account is empty, there's fuck all people can do against you. With criminal law on the other hand... There's only so many times you can hit someone who's judgement proof before you start wishing you could get them tossed in jail. I recently had someone who screwed me over from about a very large amount of money. He was laughing at me in the face making sure I remembered that even if I won a lawsuit against him, I'd never be able to collect. He was unfortunately quite right.
turc1656 10y ago
"But last year, a federal district court in Nevada found a defendant guilty under both the California and Nevada state computer crime statutes for nothing more than that—violating Oracle’s website’s terms of use." That's insane. The terms of service is essentially a contract that you are agreeing to to use the website/software/service. Failure to adhere to it is a breach of contract, not a violation of law. If you break an NDA, for example, you don't wind up in jail or have a criminal history. The other party takes you to court to enforce the penalty listed out in the contract for the breach.
- jahewson 10y ago
  It's not a contract, it's a license. A license grants you rights to something which is exclusively someone else's and that by default you have no rights to. But agreed that violation is not a crime, see my reply to @holtalanm below.
  - dragonwriter 10y ago
    > It's not a contract, it's a license. License and contract are overlapping, not mutually exclusive (a license can either be a gratuitous license or a license contract.) Website ToS may be (a component of) either sort of license arrangement. (On a site where your access is undisputably part of an exchange-for-value, like a pay site, you have a contract relationship and the ToS are almost certainly a part of that contract, probably by reference.)
- bonyt 10y ago
  Actually, breaking an NDA might be theft of trade secrets, which in certain cases may be prosecuted as a crime. See, e.g., 18 U.S.C. § 1832[1]. (But, agreed that a ToS violation shouldn't ever be a crime by itself - that reading of the CFAA would give, for example, website operators the power to write criminal law). [1]: https://www.law.cornell.edu/uscode/text/18/1832 https://www.law.cornell.edu/uscode/text/18/1832
  - turc1656 10y ago
    True, it could be theft of trade secrets or something else. But that would depend on what you did with the information. Just breaking the NDA by blabbing to someone isn't a crime in of itself, but it is a breach of contract, which is what I was trying to get at.
pflats 10y ago
"Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts. It did not, however, rescind Rimini’s authorization to access the files outright. Rimini continued to use automated scripts, and Oracle sued. The jury found Rimini guilty under both the California and Nevada computer crime statues, and the judge upheld that verdict—concluding that, under both statutes, violating a website’s terms of service counts as using a computer without authorization or permission." I'm a little confused here. I'm with the EFF that violating the TOS shouldn't be criminal. But if you're given a C&D that says "stop using automated scripts" and you continue using automated scripts, why is the TOS relevant at all? Isn't Rimini clearly exceeding their authorized access (left available for manual downloads) based on the C&D?
- new299 10y ago
  Interesting, and it sucks because this kind of feels like selective application of a law. Google probably violates this all the time with automated crawling (I've no doubt that there are sites without robots.txt, but with a written ToS that prohibits use of "automated scripts".
- wahern 10y ago
  The federal law at issue here isn't contingent on the owner delivering a Cease & Desist letter or even taking any affirmative steps whatsoever. No court is going to read that into the law. At best a C&D is evidence of the rescission of authorization, but all the statute cares about is whether authorization existed or not. Importantly, Oracle didn't actually lock their account. And even more importantly, AFAIU this guy was an employee. For these and some other technical reasons (I haven't read the case but likely part of it may be related to the jury instructions), the question to be answered by the court really comes down to whether violation of Terms of Service alone suffices to meet the "without authorization" prong of the criminal statute. If the answer is no then the case goes back to trial. The defendant doesn't get a free pass, it's just that the prosecution will have a slightly higher burden to overcome in showing lack of authorization. Higher in the sense that the burden involves taking into consideration other factors than merely boilerplate policies and notices. Another way to look at it is, say your boss tells you that you must leave the office at 5PM sharp, and that nobody is allowed to log into corporate accounts after 5PM. This policy is also displayed from /etc/motd everytime you login. You occasionally stay at work late some evenings, accessing the corporate accounts in a typical fashion. One day you're accused of doing something nefarious--maybe you were, maybe you weren't. Is your working after 5PM a prima facie showing that your access was unauthorized? That is, do all they have to show is that corporate policy was not to login at 5PM? Is it rebuttal? Does it matter whether your boss communicated this to you personally? The way these legal tests work, at least in common law countries, is that you break the law down into predicates. For the law to apply, you must show that each predicate holds. Each predicate is it's own little universe. You don't take other predicates into account; there's often a separate predicate for intent and other overarching context. The predicate here is "without authorization". What does that mean? It's a tricker question than you'd think. And it can't merely mean whatever your boss intended--it has to be an objective standard that doesn't lead to absurd outcomes in the real world. Especially in criminal law, a crime can't turn on someone's subjective intent, except for the intent of the accused. Similarly, specifically in regards "without authorization" not even the accused's intent matters.
rayiner 10y ago
The EFF is right, but the relevance of the TOS violation is more subtle than the EFF's explanation makes it out to be. Using someone's property without their consent is, of course, a crime. When that property is ordinarily available for public use, consent is presumed, but can be revoked. It's can be criminal trespass to remain in a store after you're kicked out (although usually it's just civil trespass). Here, "Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts. It did not, however, rescind Rimini’s authorization to access the files outright." So the question is, was the implied consent to use Oracle's servers effectively revoked? Arguably not. A public mall can get you kicked off the property for any reason, and can press charges for criminal trespass if you don't leave. But it can't press charges for criminal trespass for violating the sign on the door that says "no hats." And it probably can't press charges for criminal trespass if it sees you wearing a hat and tells you to take it off, but doesn't kick you off the property.
peeters 10y ago
I think in a democracy there should be some group of state attorneys who are not just allowed, but mandated to prosecute the law to the fullest extent possible. For example, if Congress has a law making ToU violations crimes, then there should be a select few DAs who are required to go out and prosecute people who enable AdBlock and visit a certain site. And it should always start with legislators if possible. See how fast stupid laws go away.
- sportanova 10y ago
  It should be only for legislators. Turn the tables and make them live in fear of what they do to other people

297 points by DiabloD3 10y ago

If you generate too much text, it will not speak. Relationship with God is like a person. He's going to look at you with disgust. He's not going to be your friend and love you. God says... shrieked churlishly clunkiest bobsleds dismissal flaws ohs corolla coiffure's vigil umbilical liberator equated intensives phonetician creeps Lusitania's Havanas filibuster's yield's fiend medals integration ironclad's overcompensation's conqueror's unavoidable undresses millennium's assertions Kiribati's glowingly -------- 5 Then Jesus said to them, “Suppose you have a friend, and you go to him at midnight and say, ‘Friend, lend me three loaves of bread; 6 a friend of mine on a journey has come to me, and I have no food to offer him.’ 7 And suppose the one inside answers, ‘Don’t bother me. The door is already locked, and my children and I are in bed. I can’t get up and give you anything.’ 8 I tell you, even though he will not get up and give you the bread because of friendship, yet because of your shameless audacity[e] he will surely get up and give you as much as you need.

peterclary 10y ago

IANAL, but surely violating Terms of Use is essentially a breach of contract? Making breach of contract a crime would be very foolish indeed.

bad_user 10y ago
It's true what they say. The justice system are defending our rights until we talk about digital media, software and the Internet, at which point they have a complete blind spot.
joncrocks 10y ago
Yes and no. The argument that it is a crime comes down to arguments around what constitutes 'unauthorised access'. As 'unauthorised access' to a computer system is a crime, if you make your definition of 'authorised' "access subject to our terms of use" : Huzzah! Violating your terms of use is now a crime! This all comes back to laws written in wooly "the courts will work it out" language.
- 08-15 10y ago
  I wonder if placing a cookie on my computer without prior written consent constitutes "unauthorized access". Class action anyone?
  - Sean1708 10y ago
    In Britain it's illegal for a website to store a cookie without informing you, so I have a feeling someone may have already tried this.
    - AstralStorm 10y ago
      Likewise in EU.
    - Silhouette 10y ago
      No, it isn't. That's not what the infamous "cookie law" says, nor how it's been interpreted in practice by official regulators across the EU.
      - Sean1708 10y ago
        What does it actually say?
        Silhouette 10y ago
        The details are probably too complicated for an HN comment, but one point that sometimes gets missed is that you normally don't have the same disclosure/consent obligations for cookies that are essential to the normal operation of the site like login tokens or tracking what's in a shopping basket.
  - roywiggins 10y ago
    It's your own browser that interprets the header, saves the cookie, and passes it back to sites you visit. Passing a "here's a cookie" header to your machine doesn't, on its own, do anything. Your browser has to actively parse and store it.
nihonde 10y ago
Even contract formation is dubious, especially in cases of browsewraps.
- joatmon-snoo 10y ago
  Also, consideration.
elmigranto 10y ago
> surely violating Terms of Use is essentially a breach of contract Is it though? Not a lawyer and my layman's intuition makes it hard to see a connection between ToS and contract. Like, if I type `something.com` in my browser by accident and their ToS is "you owe us $400 for each TCP packet, kindly do provide goverment issued ID". So I have couple of questions: - How is that different from ToS on Facebook? - How marking a checkbox creates a contract between a person and entity owning a site, same way as my signature or providing personal info, address and money to Amazon in exchange for goods? - And who that person would even be in FB case (anyone can put my name into a website from a public library computer)?
- chopin 10y ago
  You might also turn the argument the other way around: I type 'something.com' and you owe me $400 for every IP packet you send. That's an equally valid (or invalid) ToS either.
- civiscolumbusum 10y ago
  your argument is valid but your tone is missing the point PP made. To reword what he said "there is no way this is criminal law, this needs to be argued as perhaps contract law with 'breach of contract' as the upper limit if it rises to that level" you proceeded to argue the case the way he said it should be argued, but by quoting PP and challenging, you seem to be arguing with him, when in fact you are agreeing with him. if you edit your comment, I could even delete mine :)
phkahler 10y ago
I'll accept your argument as an upper bound on the issue. I don't agree fully with "breach of contract" in such cases, but it's less unreasonable than making it a criminal offense.
- cyborgx7 10y ago
  That's a great perspective. Breach of contract would be the upper bound. I don't think ToS should be able to be enforced either because it is unreasonable in today's society to assume checking that box in a sign-up process is actually giving informed consent to the terms for the wast majority of people. But even if it was, worst case it's a breach of contract.
  - maxerickson 10y ago
    I don't think ToS should be able to be enforced either So how to deal with abusive users then? Hand wave and say it is okay to block them for certain actions that are not terms of service? And of course arbitrary terms of service already can't be enforced.
    - deleted 10y ago
      [deleted]
    - unsaltedmd5 10y ago
      If you mean "abusive" as in "violates the terms of service," then revoking access to the service is the appropriate response. If you mean "abusive" as in hate crime, bullying, stalking and so forth, there are already specific laws covering those things.
      - SCHiM 10y ago
        Exactly, that's also the most reasonable interpretation of the designation too. 'Terms of Service' literally -> the terms you need to agree with for us to provide you the service. No agreement or no adherence -> no service.

stubish 10y ago

Does anyone know the details of what was being automatically downloaded? I'm aware of several Open Source projects doing this with things like Java, but not if any of them have received cease and desist orders.

petee 10y ago
The only mentions I can find refer to "support materials" for assisting clients - That could broadly mean everything from documentation to firmware (which they hold on to tightly with cold, dead hands). Rimini's website seems to suggest they were probably accessing everything. The fact that they were making money off it - and ignored a request to stop - is probably the main difference between this and going after open-source projects. Its essentially taking customers away from Oracle's own support services.
- gregmac 10y ago
  Shouldn't that be an issue of copyright then?
  - AstralStorm 10y ago
    It should. (depending on the copyright licence) Or a civil lawsuit vs breach of contract.
  - petee 10y ago
    Supposedly they had a contract for support purposes; but whether Oracle intended for wholesale copying and redistribution (if that is even what happened,) is an exercise for contract nitpicking - obviously this is all speculation [[ stares longingly into the vacuum that was Groklaw... ]] It could have come down to simply an aggressive/abusive crawler affecting other customers?

fpgadude 10y ago

What would happen to foreigners entering the US with a "fake" facebook profile as their social media ID? Straight to jail or straight back home?

realusername 10y ago
Nothing? Facebook is not a passport, you can be called whoever you want on it.
- tonmoy 10y ago
  The GP is referring to the person violating Facebook's terms of use I think
- iamben 10y ago
  I get the point you're making, but highlighting the original point, Facebook terms explicitly say you _can't_ do that. "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission."
  - sharemywin 10y ago
    The problem I see is what is facebook out. You still watch the ads.
- rocqua 10y ago
  If you have a false facebook account, you broke facebooks ToS! That means you accessed facebooks servers without authentication!! That is a crime under e.g. the CFAA!!! Criminals go to jail. That is the argument at least.
  - gondo 10y ago
    how do you prove that i have a fake facebook account? obviously i would have to log-out on my mobile and laptop

DarkKomunalec 10y ago

It's about time corporations took out the government middle man and started making laws themselves.

a3n 10y ago
I'd like to read that book. cstross? Gibson?
- falcor84 10y ago
  Max Barry's "Jennifer government" comes close. https://en.m.wikipedia.org/wiki/Jennifer_Government?wprov=sfla1 https://en.m.wikipedia.org/wiki/Jennifer_Government?wprov=sf...
  - a3n 10y ago
    From the wikipedia article, wow, what a depressing story. It sounds fascinating, but I'm not sure I can take it at the moment. Thanks for the tip.

josho 10y ago

Going forward we should all have our minor children create accounts for us and be the ones to accept the TOS. Once you realize that is a reasonable workflow you've realized how unenforceable TOS are for everything but corporate contracts where documents are being signed and witnessed.

wire9 10y ago
Something like this worked out in my favor maybe 10 years ago. ChaCha (the search and get live answers site) was just started and wanting some extra pocket money I signed up to be an operator. I was probably 15 at the time, of course I just clicked 'yes I am 18' and ended up being accepted. Well I found a few flaws in their system and started racking up money way faster than should have been allowed. After a few days of this and hundreds in my account I got a phone call during dinner. It was ChaCha, threatening to sue me for 'hacking them'. The 180 they pulled when I casually mentioned I was only 15 was amazing to witness. They completely dropped the matter on a verbal agreement that I would not visit their site anymore.
- tuna-piano 10y ago
  Care to elaborate on the flaw in their system that you exploited? I'm sure I'm not the only one interested.
  - wire9 10y ago
    Sure. This was somewhere around 10 years ago so my memory is slightly fuzzy on all the technical details but heres the gist of it: As an operator your main interface to their system was a Java desktop application. Basically you sit there waiting for it to go 'ding!', you read the question, and accept if you think you're capable of answering. You would research (they heavily pushed their sources but Google was better about 100% of the time) and then communicate the answer back to the user using the application. Once it was accepted the application would make an HTTP request to ChaCha's server to basically say 'A question was answered by this user'. This was easily visible using normal tools like Wireshark, etc. For your efforts you would be rewarded some very small amount of money, something like $.02. I simply wrote a VB.NET application to hit this HTTP endpoint over and over again which would add money to my account without me doing any work. They didn't seem to be doing any verification that I had actually been given questions to answer. The reason they noticed me was because I left ~8 instances of this program running for like 3 days straight which netted me hundreds of dollars ready to be cashed out, way more than any operator would be even remotely capable of normally given their pay scheme. So I was smart enough to figure this out but dumb enough to get caught almost immediately. And I'm not a lawyer but my guess is that this was considered fraud. Glad my morals eventually straightened out before I got myself in real trouble, honestly this was a decent lesson for 15 year old me.

holtalanm 10y ago

Just my opinion, but I think ToS were originally in place to define how a user _should_ use the site, and how the site operators could act in response to violation. I don't think they should be held as even a contract, much less criminal law. Truthfully, they are really only there to protect the company by outlining to the user what might get them banned from the site and so on. Oracle is overstepping its authority here imo. It is their own fault they didn't revoke access to the site from that company.

jahewson 10y ago
ToS is not a contract, it's a license. By default you don't get a free licence to access and copy others' work, and so one has to be granted. Much in the same way that you can't start using someone else's land without their permission and you don't get to say "I never knew" or "I never agreed not to use the land". By default, you are not allowed to and must have that right granted to you and you are expected to know that. Should an (otherwise non-criminal) violation of a software license be treated as a criminal offence by the courts just because it involved a computer? Hell no. Private citizens do not get to invent criminal law themselves and the EFF should fight this hard but not for the reasons you give.
- appleflaxen 10y ago
  why do you need a license to use something that is posted and publically accessible? A license makes sense for a copyrighted work that you are copying, but for a web service it's less clear. If I had a physical analog of facebook (a bunch of photos, a travel journal, and a list of my friends) and left it on a table, then do you need a license to pick it up and review it? No. So why do you need one if I do the same thing as a web site?
- turc1656 10y ago
  "ToS is not a contract, it's a license." I'm not sure that's correct, but it could be. It was my understanding it was a contract. That's why you have to agree to it - you are providing your consent and acknowledgement that you have read the terms and agree to abide by them. If it was a license, they could simply grant it to you without requiring your consent. For example - I can buy a license for some shareware/trialware software by just sending them money and getting the license key in my email. Then when I go to use the software, it may ask for me to agree to the terms of service so that there is a formal agreement on the allowed uses of the software.

vog 10y ago

Here in Germany the law states that ToS are only applicable if they contain "no surprising terms". Which is really nice! Although this doesn't give you permission for everything, it protects you from any "cleverness" of a site's operator. It ensures that indeed almost nobody needs to read ToS. Even lawyers tell you this.

Tepix 10y ago
No, what you mean are "AGB" (terms and conditions) that govern contractual relations between companies and their customers. They are part of all contracts. The terms of service ("Nutzungsbedigungen") that Oracle posts on their website that dictate how to use and access their website are invalid in Germany as well.

codedokode 10y ago

Isn't it nice if ToS is legally binding? 1. Make a website and write somewhere in the middle of ToS that visitor must pay $1000 (for example) for every page viewed or for every second spent on a site 2. Persuade him to press "I have read and agree to the ToS" and to stay as long as possible 3. Send a bill

TallGuyShort 10y ago
Then at what point does something become binding on the Internet? Most of my financial work over the last year has involved e-signed contracts. I typed my name and the date, certifying I had read and understand the contract - the difference between that and certifying that I've read the ToS via a checkbox seems arbitrary.
- AstralStorm 10y ago
  In EU this would be treated as a shrink wrap EULA. Those are generally not considered binding. Click wrap is different and some may be considered binding. (Caveat: IANAL)
gregmac 10y ago
I was thinking I'd add a header to all my HTTP requests: X-Terms-of-Service: This HTTP request is subject to the terms of use published at https://example.com/tos. By responding to this request you are accepting these terms and conditions in full.
- AnimalMuppet 10y ago
  Make sure you also say "... and agree that these terms and conditions supercede any other agreements between us." [Edit: IANAL.]
frenchman_in_ny 10y ago
Something (tongue-in-cheek) like this actually already happened [0], where users granted the website their immortal soul. [0] http://www.out-law.com/page-10929 http://www.out-law.com/page-10929

snarfy 10y ago

Popular websites should add an Oracle employee clause to their ToS so that employees of Oracle corporation are not allowed to use it.

awinter-py 10y ago
even more interesting case: Recent case law has mostly struck down the CFAA criminal penalties for violating TOS. But case law generally imposes a higher obligation on employees to comply with authorized use agreements that they've signed. If you concretely enumerate the authorized uses of employee access and leave out subpoenas, the first time you're served with a FISA letter you can keep the court busy for weeks pending a ruling on the CFAA consequences. This will never work long term and it will certainly piss off some judges & FBI agents, but at least it can further defang the overzealous authorized use language in the CFAA. The fact that the FBI (or whoever drafted the natl security letter) is inducing you to commit a felony may also trump the gag order. But YMMV with that argument. Even if you win that one on appeal you'll spend some time in jail in the interim.

rplst8 10y ago

The fact that this has to even be argued is appalling. The erosion of the difference between a tort and crime over the last few decades is very concerning. I think a lot of it started with the changing of copyright law into criminal law.

nickff 10y ago
This is part of a larger situation where everything is becoming criminal law. The Yates and Bond cases illustrated the breadth of the government's use of laws to punish undesirable behaviours, and tens of thousands of regulations have criminal penalties with no mens rea requirement. The government is even using criminal statutes against corporations (not the officers or employees), which doesn't make any sense.
- acbabis 10y ago
  In a sense, holding corporations criminally liable is better. The fact that a corporation can't go to prison almost balances-out the lack of mens rea requirement.
- shados 10y ago
  Having recently had my first major experience with US law, Im starting to understand (not agree with. Understand) why this happens. The US civil laws really only apply to middle class suckers. Rich people can use their lawyers to work around it. Poor people are "judgment proof". If you don't have a house, you're working under the table, and your bank account is empty, there's fuck all people can do against you. With criminal law on the other hand... There's only so many times you can hit someone who's judgement proof before you start wishing you could get them tossed in jail. I recently had someone who screwed me over from about a very large amount of money. He was laughing at me in the face making sure I remembered that even if I won a lawsuit against him, I'd never be able to collect. He was unfortunately quite right.

turc1656 10y ago

"But last year, a federal district court in Nevada found a defendant guilty under both the California and Nevada state computer crime statutes for nothing more than that—violating Oracle’s website’s terms of use." That's insane. The terms of service is essentially a contract that you are agreeing to to use the website/software/service. Failure to adhere to it is a breach of contract, not a violation of law. If you break an NDA, for example, you don't wind up in jail or have a criminal history. The other party takes you to court to enforce the penalty listed out in the contract for the breach.

jahewson 10y ago
It's not a contract, it's a license. A license grants you rights to something which is exclusively someone else's and that by default you have no rights to. But agreed that violation is not a crime, see my reply to @holtalanm below.
- dragonwriter 10y ago
  > It's not a contract, it's a license. License and contract are overlapping, not mutually exclusive (a license can either be a gratuitous license or a license contract.) Website ToS may be (a component of) either sort of license arrangement. (On a site where your access is undisputably part of an exchange-for-value, like a pay site, you have a contract relationship and the ToS are almost certainly a part of that contract, probably by reference.)
bonyt 10y ago
Actually, breaking an NDA might be theft of trade secrets, which in certain cases may be prosecuted as a crime. See, e.g., 18 U.S.C. § 1832[1]. (But, agreed that a ToS violation shouldn't ever be a crime by itself - that reading of the CFAA would give, for example, website operators the power to write criminal law). [1]: https://www.law.cornell.edu/uscode/text/18/1832 https://www.law.cornell.edu/uscode/text/18/1832
- turc1656 10y ago
  True, it could be theft of trade secrets or something else. But that would depend on what you did with the information. Just breaking the NDA by blabbing to someone isn't a crime in of itself, but it is a breach of contract, which is what I was trying to get at.

pflats 10y ago

"Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts. It did not, however, rescind Rimini’s authorization to access the files outright. Rimini continued to use automated scripts, and Oracle sued. The jury found Rimini guilty under both the California and Nevada computer crime statues, and the judge upheld that verdict—concluding that, under both statutes, violating a website’s terms of service counts as using a computer without authorization or permission." I'm a little confused here. I'm with the EFF that violating the TOS shouldn't be criminal. But if you're given a C&D that says "stop using automated scripts" and you continue using automated scripts, why is the TOS relevant at all? Isn't Rimini clearly exceeding their authorized access (left available for manual downloads) based on the C&D?

new299 10y ago
Interesting, and it sucks because this kind of feels like selective application of a law. Google probably violates this all the time with automated crawling (I've no doubt that there are sites without robots.txt, but with a written ToS that prohibits use of "automated scripts".
wahern 10y ago
The federal law at issue here isn't contingent on the owner delivering a Cease & Desist letter or even taking any affirmative steps whatsoever. No court is going to read that into the law. At best a C&D is evidence of the rescission of authorization, but all the statute cares about is whether authorization existed or not. Importantly, Oracle didn't actually lock their account. And even more importantly, AFAIU this guy was an employee. For these and some other technical reasons (I haven't read the case but likely part of it may be related to the jury instructions), the question to be answered by the court really comes down to whether violation of Terms of Service alone suffices to meet the "without authorization" prong of the criminal statute. If the answer is no then the case goes back to trial. The defendant doesn't get a free pass, it's just that the prosecution will have a slightly higher burden to overcome in showing lack of authorization. Higher in the sense that the burden involves taking into consideration other factors than merely boilerplate policies and notices. Another way to look at it is, say your boss tells you that you must leave the office at 5PM sharp, and that nobody is allowed to log into corporate accounts after 5PM. This policy is also displayed from /etc/motd everytime you login. You occasionally stay at work late some evenings, accessing the corporate accounts in a typical fashion. One day you're accused of doing something nefarious--maybe you were, maybe you weren't. Is your working after 5PM a prima facie showing that your access was unauthorized? That is, do all they have to show is that corporate policy was not to login at 5PM? Is it rebuttal? Does it matter whether your boss communicated this to you personally? The way these legal tests work, at least in common law countries, is that you break the law down into predicates. For the law to apply, you must show that each predicate holds. Each predicate is it's own little universe. You don't take other predicates into account; there's often a separate predicate for intent and other overarching context. The predicate here is "without authorization". What does that mean? It's a tricker question than you'd think. And it can't merely mean whatever your boss intended--it has to be an objective standard that doesn't lead to absurd outcomes in the real world. Especially in criminal law, a crime can't turn on someone's subjective intent, except for the intent of the accused. Similarly, specifically in regards "without authorization" not even the accused's intent matters.

rayiner 10y ago

The EFF is right, but the relevance of the TOS violation is more subtle than the EFF's explanation makes it out to be. Using someone's property without their consent is, of course, a crime. When that property is ordinarily available for public use, consent is presumed, but can be revoked. It's can be criminal trespass to remain in a store after you're kicked out (although usually it's just civil trespass). Here, "Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts. It did not, however, rescind Rimini’s authorization to access the files outright." So the question is, was the implied consent to use Oracle's servers effectively revoked? Arguably not. A public mall can get you kicked off the property for any reason, and can press charges for criminal trespass if you don't leave. But it can't press charges for criminal trespass for violating the sign on the door that says "no hats." And it probably can't press charges for criminal trespass if it sees you wearing a hat and tells you to take it off, but doesn't kick you off the property.

peeters 10y ago

I think in a democracy there should be some group of state attorneys who are not just allowed, but mandated to prosecute the law to the fullest extent possible. For example, if Congress has a law making ToU violations crimes, then there should be a select few DAs who are required to go out and prosecute people who enable AdBlock and visit a certain site. And it should always start with legislators if possible. See how fast stupid laws go away.

sportanova 10y ago
It should be only for legislators. Turn the tables and make them live in fear of what they do to other people