3 ms·

Wow. I can see why Uber did not want this document to come out. It appears that Uber was operating their own intelligence agency with bribes, surveillance, brea

Wow. I can see why Uber did not want this document to come out. It appears that Uber was operating their own intelligence agency with bribes, surveillance, breach of systems, impersonation, etc. I can see it opening further lawsuits from many other angles. From competitors like Lyft: >"Uber had successfully obtained trade secrets with the complete download of its driver database ... It contained approximately 35,000 taxi driver records" >"Uber used driver and customer impersonation to steal competitor trade secrets. This conduct not only violated the trade secrets law discussed above but also wire fraud law" From regulators: > "In January 2017, contacted Jacobs on Wickr and advised they had a bug in a meeting with transport regulators and that they needed help cleaning up the audio." > "Jacobs heard about the practice of bribing foreign government officials. Based on his knowledge of targeting foreign officials to identify those with influential power, and the rapid insights into new markets"

willstrafach 9y ago
Regarding this: “Uber had successfully obtained trade secrets with the complete download of its driver database” If you look at how that is described in the document it appears that such data was actually obtained just by using the API and perhaps some scraping. Not so sure this actually has any legal issues. The API requests being spread over a 2 month timeframe also makes it hard to accuse them of causing any sort of burdensome load on the server.
- toomuchtodo 9y ago
  This is a violation of the CFAA, a criminal offense, if the API owner did not authorize Uber to access it. https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
  - willstrafach 9y ago
    There is no indication that they accessed the API improperly. That link to the CFAA page on Wikipedia does not substantiate your claim.
    - toomuchtodo 9y ago
      The statute I referenced specifically prohibits the unauthorized access of servers and access which exceeds authorization. It is not difficult to argue that Uber’s activities fall under “unauthorized access” or “exceeding authorization”. “Uber accessed a protected computer database to lure drivers away to work for the company even though "the database was protected by 'Captcha' to prevent the sort of automated downloading that Uber's MA team intended to carry out. MA was ultimately successful in hacking the system and obtaining the driver database. Because Uber knowingly accessed a protected computer in order to fraudulently capture its valuable contents to gain a competitive advantage, the hack violates the [Computer Fraud and Abuse Act], as well as California Penal Code Section 502."” The CFAA is broad by design unfortunately. We’ve jailed people for enumerating customer data by incrementing a query parameter. https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/ https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/

willstrafach 9y ago

Regarding this: “Uber had successfully obtained trade secrets with the complete download of its driver database” If you look at how that is described in the document it appears that such data was actually obtained just by using the API and perhaps some scraping. Not so sure this actually has any legal issues. The API requests being spread over a 2 month timeframe also makes it hard to accuse them of causing any sort of burdensome load on the server.

toomuchtodo 9y ago
This is a violation of the CFAA, a criminal offense, if the API owner did not authorize Uber to access it. https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- willstrafach 9y ago
  There is no indication that they accessed the API improperly. That link to the CFAA page on Wikipedia does not substantiate your claim.
  - toomuchtodo 9y ago
    The statute I referenced specifically prohibits the unauthorized access of servers and access which exceeds authorization. It is not difficult to argue that Uber’s activities fall under “unauthorized access” or “exceeding authorization”. “Uber accessed a protected computer database to lure drivers away to work for the company even though "the database was protected by 'Captcha' to prevent the sort of automated downloading that Uber's MA team intended to carry out. MA was ultimately successful in hacking the system and obtaining the driver database. Because Uber knowingly accessed a protected computer in order to fraudulently capture its valuable contents to gain a competitive advantage, the hack violates the [Computer Fraud and Abuse Act], as well as California Penal Code Section 502."” The CFAA is broad by design unfortunately. We’ve jailed people for enumerating customer data by incrementing a query parameter. https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/ https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/