5 ms·

Regarding this: “Uber had successfully obtained trade secrets with the complete download of its driver database” If you look at how that is described in the do

Regarding this: “Uber had successfully obtained trade secrets with the complete download of its driver database” If you look at how that is described in the document it appears that such data was actually obtained just by using the API and perhaps some scraping. Not so sure this actually has any legal issues. The API requests being spread over a 2 month timeframe also makes it hard to accuse them of causing any sort of burdensome load on the server.

toomuchtodo 9y ago
This is a violation of the CFAA, a criminal offense, if the API owner did not authorize Uber to access it. https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- willstrafach 9y ago
  There is no indication that they accessed the API improperly. That link to the CFAA page on Wikipedia does not substantiate your claim.
  - toomuchtodo 9y ago
    The statute I referenced specifically prohibits the unauthorized access of servers and access which exceeds authorization. It is not difficult to argue that Uber’s activities fall under “unauthorized access” or “exceeding authorization”. “Uber accessed a protected computer database to lure drivers away to work for the company even though "the database was protected by 'Captcha' to prevent the sort of automated downloading that Uber's MA team intended to carry out. MA was ultimately successful in hacking the system and obtaining the driver database. Because Uber knowingly accessed a protected computer in order to fraudulently capture its valuable contents to gain a competitive advantage, the hack violates the [Computer Fraud and Abuse Act], as well as California Penal Code Section 502."” The CFAA is broad by design unfortunately. We’ve jailed people for enumerating customer data by incrementing a query parameter. https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/ https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/

toomuchtodo 9y ago

This is a violation of the CFAA, a criminal offense, if the API owner did not authorize Uber to access it. https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

willstrafach 9y ago
There is no indication that they accessed the API improperly. That link to the CFAA page on Wikipedia does not substantiate your claim.
- toomuchtodo 9y ago
  The statute I referenced specifically prohibits the unauthorized access of servers and access which exceeds authorization. It is not difficult to argue that Uber’s activities fall under “unauthorized access” or “exceeding authorization”. “Uber accessed a protected computer database to lure drivers away to work for the company even though "the database was protected by 'Captcha' to prevent the sort of automated downloading that Uber's MA team intended to carry out. MA was ultimately successful in hacking the system and obtaining the driver database. Because Uber knowingly accessed a protected computer in order to fraudulently capture its valuable contents to gain a competitive advantage, the hack violates the [Computer Fraud and Abuse Act], as well as California Penal Code Section 502."” The CFAA is broad by design unfortunately. We’ve jailed people for enumerating customer data by incrementing a query parameter. https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/ https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/