4 ms·

Court: Violating T.O.S Is Not a Crime, But Bypassing Technical Barriers Might Be

35 points by jaxc 16y ago

username3 16y ago
Is violating TOS unethical? immoral? considered lying to something you agreed to?
- jpr 16y ago
  Only if the TOS isn't unethical, immoral or lying.
  - TGJ 16y ago
    If you knowingly agree to a TOS it does not matter whether it's unethical or not. When you sign you agree to the ethics contained. You are supposed to be reading the TOS to see whether you agree or not and once you sign you are being unethical if you break the TOS in any other way not specifically allowed in the TOS.
    - ars 16y ago
      You got downmodded because not everyone holds that a TOS is legally binding just because it exists. It's not the same as signing a contact. But even a contract can be invalidated if a court holds it's unconscionable.
      - TGJ 16y ago
        There are two different ideas going on here. There is the legal and the ethical. It doesn't matter whether an agreement is legal or not, in the realm of ethics if you sign willingly you agree. Would you care to explain how you can defend breaking a TOS when you have a choice on whether to sign it or not?
        ars 16y ago
        I've never heard of anyone, ever, signing a TOS. The problem with a TOS is that it's unilateral - I get no chance to negotiate it. In my mind that makes it invalid. Just because the website wants it to be valid doesn't mean it actually is. But the bigger problem is that I did not agree to it. The website tries to impose it on me.
        akeefer 16y ago
        I don't think your argument holds up. Any service is offered under some terms; it's irrational and unreasonable to assume that when you use someone's website or service that there are no terms whatsoever attached to that service. So where do those terms come from? Rationally, one might expect the website to spell out what they expect from you and under what conditions their services are provided. If you don't like those terms, don't use the service. It seems like you're arguing that you should get to determine under what terms the services are offered, or perhaps alternatively that services offered should never have any terms attached whatsoever; both of those positions seem pretty indefensible to me. Just because you don't get a chance to negotiate terms doesn't make them invalid. It's a take-it-or-leave it offer, and you always have the right to leave it. When a restaurant gives you a bill, do you pay less than the amount just because you didn't get to negotiate the price? Do you walk into a restaurant shirtless that explicitly asks you not to do that? Of course not: your ordering the item indicated your willingness to pay the associated charge, and likewise if you don't want to abide by their rules around appropriate dress, you just don't go in. You don't get to make up your own rules and then apply them to someone else's services. It's a different question if the TOS are deliberately obscured such that you don't actually know what you're agreeing to, but the argument that just because you can't negotiate the TOS they're somehow invalid and you're thus justified in still using the service in violation of them is absurd.
        ars 16y ago
        If I put up a sign on the freeway saying: "The sky is blue. By reading this message you agree to ....". Do you think that's a valid TOS? How is a website any different? > So where do those terms come from? State law. That's all. The website can not dictate any terms whatsoever. To your specific points: A restaurant is private property - they can ask me to leave if I don't wear a shirt, but they can NOT compel me to actually wear the shirt. They can't fine me for going there without a shirt, they can't do anything at all, except ask me to leave. If I buy food from a restaurant, that's a purchase and not a contact, and it uses the various state laws that govern that. But the restaurant can NOT add extra conditions. If a restaurant puts up a sign that said "by buying food here you agree to ...." - that sign is meaningless, and has no validity. A purchase order requires the signature of the buyer. Merely stating a term and saying "by doing ...." is meaningless. Those terms you find on the back of a receipt sometimes? Meaningless. They can say what the store will do, and under what conditions, but they can do nothing whatsoever to the purchaser that state law does not provide.
- wjy 16y ago
  I think it's more like breach of contract. It's not necessarily unethical, but if you violate the terms, they no longer are bound to provide the service. EDIT: Although it's unclear whether a contract was really entered into. Real contracts have signatures to indicate both parties know and agree to what's contained. That's often not the case in web services.
  - flogic 16y ago
    I think EULA's are considered signed to some degree. I don't know how or if that reasoning extends to online TOS. I wouldn't be surprised to learn the courts are fairly liberal in what they consider a contract but don't give all contracts the same strength.
- flogic 16y ago
  The inherent power imbalance weakens the TOS's ethical standing. Facebook has lawyers. I'm not a lawyer nor can I hire one for every agreement. Which means, most people interpret the TOS to mean "I agree to no be a dick." Also any agreement which is allowed to change without notice is inherently unethical.
tptacek 16y ago
I'm unclear on how people rationalize blowing past technical TOS enforcement measures on a web app. Where, exactly, do you propose drawing the line? Because I think I speak for everyone in the room that makes a living doing application pentesting: there are very, very few technical countermeasures you will come up with that a consulting-week or two won't blow past.
- Natsu 16y ago
  > Where, exactly, do you propose drawing the line? From TFA: "We welcome the court's rejection of terms of service violations as triggers for criminal liability, but will continue to work to demonstrate to courts that not all technological measures are created equal. If the measure seeks to control access to or use of data, then evasion of it is almost certainly criminal. But if the restriction merely seeks to impose owner preferences or terms of service on otherwise authorized users, bypassing it should not be a crime."
TheAmazingIdiot 16y ago
What I fail to understand is how a website knows if you have "agreed" to the TOS. I mean, a contract is physically signed, sometimes with a notary. FAFSA is "signed" by a multiple step process including a SSN, DOB, receiving mail including a pin#, and entering all of it with "agree" in box to assert information is true. Where, and how can a website claim that an "agree" button is legally enough? Or perhaps, the TOS is just nonexistent(ala 404). Or, what are these "bypassing technical barriers"? Does that count reading the URL and changing it? Greasemonkey? Filtering/data modifying router? Post injection? This suggesting is creating more confusion than it solves.
- wmf 16y ago
  That's not a problem, since almost all sites say that mere usage of the site implies agreement with the TOS. I suppose this is akin to a "no shirt, no shoes, no service" sign; it doesn't matter whether you have read or agreed it — the sign is posted.
  - TheAmazingIdiot 16y ago
    Suppose you say that's true. Ok. Under what "law" can you even load the site to begin with? That's right, they accepted a connection. It's akin to knocking on someones door, and they let you in. The website could always pop back "connection denied", 403, or just not answering at all. At most it's a gentlemens agreement, or in the class of "windshields not our responsibility for our uncovered load". Aside that, we know certain public AP's modify content to add theirs instead (panera bread advert munges). Aside ssl'ing everything, how can they even be sure we agreed to the same TOS, let alone agree at all?

35 points by jaxc 16y ago

username3 16y ago

Is violating TOS unethical? immoral? considered lying to something you agreed to?

jpr 16y ago
Only if the TOS isn't unethical, immoral or lying.
- TGJ 16y ago
  If you knowingly agree to a TOS it does not matter whether it's unethical or not. When you sign you agree to the ethics contained. You are supposed to be reading the TOS to see whether you agree or not and once you sign you are being unethical if you break the TOS in any other way not specifically allowed in the TOS.
  - ars 16y ago
    You got downmodded because not everyone holds that a TOS is legally binding just because it exists. It's not the same as signing a contact. But even a contract can be invalidated if a court holds it's unconscionable.
    - TGJ 16y ago
      There are two different ideas going on here. There is the legal and the ethical. It doesn't matter whether an agreement is legal or not, in the realm of ethics if you sign willingly you agree. Would you care to explain how you can defend breaking a TOS when you have a choice on whether to sign it or not?
      - ars 16y ago
        I've never heard of anyone, ever, signing a TOS. The problem with a TOS is that it's unilateral - I get no chance to negotiate it. In my mind that makes it invalid. Just because the website wants it to be valid doesn't mean it actually is. But the bigger problem is that I did not agree to it. The website tries to impose it on me.
        akeefer 16y ago
        I don't think your argument holds up. Any service is offered under some terms; it's irrational and unreasonable to assume that when you use someone's website or service that there are no terms whatsoever attached to that service. So where do those terms come from? Rationally, one might expect the website to spell out what they expect from you and under what conditions their services are provided. If you don't like those terms, don't use the service. It seems like you're arguing that you should get to determine under what terms the services are offered, or perhaps alternatively that services offered should never have any terms attached whatsoever; both of those positions seem pretty indefensible to me. Just because you don't get a chance to negotiate terms doesn't make them invalid. It's a take-it-or-leave it offer, and you always have the right to leave it. When a restaurant gives you a bill, do you pay less than the amount just because you didn't get to negotiate the price? Do you walk into a restaurant shirtless that explicitly asks you not to do that? Of course not: your ordering the item indicated your willingness to pay the associated charge, and likewise if you don't want to abide by their rules around appropriate dress, you just don't go in. You don't get to make up your own rules and then apply them to someone else's services. It's a different question if the TOS are deliberately obscured such that you don't actually know what you're agreeing to, but the argument that just because you can't negotiate the TOS they're somehow invalid and you're thus justified in still using the service in violation of them is absurd.
        ars 16y ago
        If I put up a sign on the freeway saying: "The sky is blue. By reading this message you agree to ....". Do you think that's a valid TOS? How is a website any different? > So where do those terms come from? State law. That's all. The website can not dictate any terms whatsoever. To your specific points: A restaurant is private property - they can ask me to leave if I don't wear a shirt, but they can NOT compel me to actually wear the shirt. They can't fine me for going there without a shirt, they can't do anything at all, except ask me to leave. If I buy food from a restaurant, that's a purchase and not a contact, and it uses the various state laws that govern that. But the restaurant can NOT add extra conditions. If a restaurant puts up a sign that said "by buying food here you agree to ...." - that sign is meaningless, and has no validity. A purchase order requires the signature of the buyer. Merely stating a term and saying "by doing ...." is meaningless. Those terms you find on the back of a receipt sometimes? Meaningless. They can say what the store will do, and under what conditions, but they can do nothing whatsoever to the purchaser that state law does not provide.
wjy 16y ago
I think it's more like breach of contract. It's not necessarily unethical, but if you violate the terms, they no longer are bound to provide the service. EDIT: Although it's unclear whether a contract was really entered into. Real contracts have signatures to indicate both parties know and agree to what's contained. That's often not the case in web services.
- flogic 16y ago
  I think EULA's are considered signed to some degree. I don't know how or if that reasoning extends to online TOS. I wouldn't be surprised to learn the courts are fairly liberal in what they consider a contract but don't give all contracts the same strength.
flogic 16y ago
The inherent power imbalance weakens the TOS's ethical standing. Facebook has lawyers. I'm not a lawyer nor can I hire one for every agreement. Which means, most people interpret the TOS to mean "I agree to no be a dick." Also any agreement which is allowed to change without notice is inherently unethical.

tptacek 16y ago

I'm unclear on how people rationalize blowing past technical TOS enforcement measures on a web app. Where, exactly, do you propose drawing the line? Because I think I speak for everyone in the room that makes a living doing application pentesting: there are very, very few technical countermeasures you will come up with that a consulting-week or two won't blow past.

Natsu 16y ago
> Where, exactly, do you propose drawing the line? From TFA: "We welcome the court's rejection of terms of service violations as triggers for criminal liability, but will continue to work to demonstrate to courts that not all technological measures are created equal. If the measure seeks to control access to or use of data, then evasion of it is almost certainly criminal. But if the restriction merely seeks to impose owner preferences or terms of service on otherwise authorized users, bypassing it should not be a crime."

TheAmazingIdiot 16y ago

What I fail to understand is how a website knows if you have "agreed" to the TOS. I mean, a contract is physically signed, sometimes with a notary. FAFSA is "signed" by a multiple step process including a SSN, DOB, receiving mail including a pin#, and entering all of it with "agree" in box to assert information is true. Where, and how can a website claim that an "agree" button is legally enough? Or perhaps, the TOS is just nonexistent(ala 404). Or, what are these "bypassing technical barriers"? Does that count reading the URL and changing it? Greasemonkey? Filtering/data modifying router? Post injection? This suggesting is creating more confusion than it solves.

wmf 16y ago
That's not a problem, since almost all sites say that mere usage of the site implies agreement with the TOS. I suppose this is akin to a "no shirt, no shoes, no service" sign; it doesn't matter whether you have read or agreed it — the sign is posted.
- TheAmazingIdiot 16y ago
  Suppose you say that's true. Ok. Under what "law" can you even load the site to begin with? That's right, they accepted a connection. It's akin to knocking on someones door, and they let you in. The website could always pop back "connection denied", 403, or just not answering at all. At most it's a gentlemens agreement, or in the class of "windshields not our responsibility for our uncovered load". Aside that, we know certain public AP's modify content to add theirs instead (panera bread advert munges). Aside ssl'ing everything, how can they even be sure we agreed to the same TOS, let alone agree at all?