17 ms·

Courts: Violating a Website’s Terms of Service Is Not a Crime

• prepend 9y ago
  This is positive news. It seems like the more liberal approach taken when protocols were written is being challenged more by young users who grew up under more stable rules that accepted terms of service as very strong. When I was growing up you went by what the protocol allowed. If an http response came back you have access, if it prompted for credentials, then you didn’t have access. The mere idea that a web server gives you info and then you have to check a TOS that you might not even know exists is foreign to me. But when I talked with a young programmer they kind of agreed with Oracle saying “otherwise you could just request everything from every possible address.” They were unfamiliar with war drivers or even how early web crawlers started.
  • justinjlynn 9y ago
    It's not that young people grew up with stable rules. It's that young people grew up under the influence of industrial information warfare tactics and propaganda. As someone that was prevented from distributing Linux at high school because the administrators thought that any copying was piracy (thanks to the Software Publishers Association and the friendly local Microsoft rep), this conditioning to get kids (and less intelligent adults, sadly) to believe in the supremacy of illegitimate authority has been going on for a while now. Now those kids are starting to become adults. So, of course, you're starting to see bullshit like the CFAA1986 (and it's downright laughably broad definition of a 'protected computer') and the DMCA (likewise) starting to be abused like they are. The "don't copy that floppy" music video was the thin edge of a wedge that continues being driven into the heads of kids and adults alike, even today.
    • otakucode 9y ago
      I don't think that it warrants a name so grand-sounding as 'industrial information warfare tactics and propaganda'. I don't even believe it was done entirely intentionally. When I was going to school in the 90s, schools were locking down more and more each year. Eventually, that produced Columbine and several other school shootings, intensifying their efforts (they were blind to the fact that they were the cause). Eventually they reached a fairly steady state of today, where learned helplessness is inflicted either before or early in adolescence, resulting in things like a 40% drop in the number of 16 year olds who have a drivers license between 2005 and 2015, many fewer adolescents having jobs during school, etc. Why try, if you are going to be surveilled and get your hand slapped at the slightest violation, and have every rough spot or sharp corner sanded down off of your personality. If you don't want to get classified as a threat and separated and sent to remediation therapy and special schooling and things like that, that is. In the name of security, the teachers derision for the weird kids was given sharp teeth, eventually perfected. The tunnel vision that develops during schooling, the one that leads kids to kill themselves or each other over simple school problems because they can't even see themselves as human beings with a life outside of the school environment, extends further now, well into college, and perhaps soon far beyond.
      • wutangson1 9y ago
        wow, so if you believe there is systemic 'infliction of learned helplessness' on pre-adolescent children, then it does warrant a 'grand-sounding name'.
    • pwaai 9y ago
      > As someone that was prevented from distributing Linux at high school because the administrators thought that any copying was piracy I remember having this discussion with in HS and also at work with people who were convinced pirating a PSX game is same as stealing, while not realizing there is no evidence that suggests a pirated copy means a lost sale (people can't afford it in places like Brasil where they still play Sega Genesis). The level of brainwashing of my generation is appalling, but I'm glad people like us realize the ridiculousness of claims like downloading an mp3 is stealing from an artist (they clearly have no idea how much the industry leeches off the artist in first place). Also, now that I've monies I ended up buying most of the games I use to play as a kid on a mod chip, and warez sites on Steam and the dreaded Playstation Store. 2018 is off to a good start.
      • jeremy_wiebe 9y ago
        Equating “fair use” of a website to pirating software is a stretch. In the first case the method of access is at issue (not whether you can or not). In the second the company has not given you any _legal_ right to access. I don’t see how affordability (or lack of it) is justification to the game.
        • pwaai 9y ago
          Stealing would mean the loss of property, but there are infinite copies of the digital good. Users for the most part do not read EULA agreements or Terms of Service of a website, the expectation is on the software company's side, it's not a a crime unless there is proof of damage (selling it for profit) from either copying that floppy disk or scraping a public website so hard you interfere with their operations. So basically if you are poor, you deserve not to gain from the same things rich people can, even when no loss of property or damage occurs by having someone who can't afford it in the first place be your loyal fan. This doesn't apply in cases where there is explicit loss of property and damage that occurs as a result. Mozart also got his ass arrested because he transcribed music he liked onto a medium which he was not authorized to do so. But we all know how ridiculous that was.
          • 9y ago
    • busterarm 9y ago
      It might be that... I also like to think that young people just don't really understand the full picture of how all of this actually works...they just think they do and that google/SO/wikipedia contains the answers they they don't have to know. Our abstraction layers are that good. You can write code in a framework, ship and make millions and suddenly you're a tech genius! In fairness to them though, when I was starting out 20 years ago, if you could sling a few lines of HTML and make things appear in a browser, people certainly treated you like one.
      • taneq 9y ago
        It's always been this way (at least, since the start of the 70s, according to my mother). Those who are capable of reading the user manual (or documentation, or stackoverflow, or...) will be regarded with superstitious awe by those who are not.
    • Stranger43 9y ago
      It's not just propaganda it's also an effect of formal vocational training being focused on teaching people procedures for doing a task rather then forcing them to learn by having to recover from failures the way most self taught people were, and lets not forget that doing the boom years practically everyone was self taught in an environment that haven't yet developed teachable procedures yet. I don't think that it's as much a generation thing that is it a consequence of IT having grown to the point where it is no longer it's own semi-anarchic subculture.
    • george3383 9y ago
      >It's that young people grew up under the influence of industrial information warfare tactics and propaganda. Uuuuh that's a dangerous argument. What if we applied it to abortion or homosexuality?
      • pjc50 9y ago
        Young people certainly have grown up with anti-abortion and anti-homosexuality propaganda, gradually shaking it off as it was revealed to be made of fear and nonsense.
  • eugenekolo2 9y ago
    I don't think it has anything to do w/ age. I believe that most people just see rules and laws as very firm, and unquestionable.
  • saurik 9y ago
    I continue to be shocked that Twitter convinced an entire generation of software developers that you need to obtain something called an "API key"--which can somehow be refused or even revoked once granted--in order to write a client for their protocol. "Back in my day", we just reverse engineered the official client and used whatever algorithm it used to talk to the server and called the war won :/.
    • Sniffnoy 9y ago
      Is this system of "API keys" why Pidgin doesn't handle all these new IM protocols, and why there's no other good old-fashioned multi-protocol clients for them (that I'm aware of)?
      • keldaris 9y ago
        Because reverse engineering some IM protocols is far from trivial. Skype, in particular, is a nightmare of obfuscation, as I understand (second hand knowledge from having wanted to replace it with Pidgin in the past, I haven't tried reverse engineering it myself).
        • Sniffnoy 9y ago
          Skype I know is infamously hard, but I'm wondering about the more general case -- are the problems there similar to the problems with Skype, or are they due to something else?
          • keldaris 9y ago
            As far as I know, they're a combination of it being hard work and there just not being enough of a qualified developer community around Pidgin etc. to put in the effort required. I think people generally underestimate the sheer amount of work involved in reverse engineering an IM protocol, even one that's not particularly well obfuscated.
            • jopsen 9y ago
  • lurr 9y ago
    yes, we young people are a completely uniform group. Thanks.
  • deleted 9y ago
    [deleted]
  • matt4077 9y ago
    Or, maybe, this young generation grew up with the internet being a tool with actual power. Where before, it was pure novelty, with no real-world consequences of destructive behaviour. This young generation, based on a study of history, prefers to be governed by agreed-upon rules, rather than "might is right". Note that I, and probably the vast majority of every generation, agree with this court's decision that ToS are not enforceable. But the reason is not the challenge to enforce such ToS through technical means. It is the fundamental unfairness of a process that would allow such one-sided contracts to be drawn. As a counter-example: your philosophy of "I can do whatever I can do" would allow limitless collection, use, and sale of personal information. But I would hope that most people actually do see value in Facebook not being allowed to sell your private images and messages to the highest bidder if they ever choose to.
  • askvictor 9y ago
    What does young/old have anything to do with this? If anything, I'd put it the other way around: I'll bet it's primarily old and conservative people (who don't know how the internet thing operates and want to police digital assets like physical ones) who push for this kind of restriction/law, while so many young people have grown up in an era where they share everything.
  • trisimix 9y ago
    Dude most young people pirate like, everything.
  • joatmon-snoo 9y ago
    > But when I talked with a young programmer they kind of agreed with Oracle saying “otherwise you could just request everything from every possible address.” Generally n = 1 is not a good sample size.
  • Asooka 9y ago
    Maybe web servers should come with a TOS that outlines that you can't control access to content via freeform text, but must do so via the technical access control means supported by the server itself.
• Klathmon 9y ago
  This is fantastic news, and a great step toward a more "sane" set of internet laws. I just hope that this trend can continue and can sufficiently bury the idea that accessing public (as in without any kind of authentication method) information on the internet should not ever be a violation of any laws when done without malicious intent (a DoS attack should still obviously be illegal).
  • sintaxi 9y ago
    This isn't a step toward anything. This is a ruling of laws as they exist today - and an obvious one at that.
    • Klathmon 9y ago
      You say that, but the first time this exact case went to court it was ruled in oracle's favor... The CFAA and DMCA are written so that they can be applied to an extremely wide set of situations, and getting some concrete examples of things that aren't violations can help push back and contain what are.
• DrScump 9y ago
  Note that the decision says that violations are not criminal acts, but that doesn't mean that license violations can't result in civil lawsuits and encumbent financial damages.
  • tinco 9y ago
    If you use the website in a way that they would normally ask money for, like circumventing a paywall, is that something they could claim damages as in missed revenue for? I wonder if this ruling makes it legal to scrape for data processing.
    • DrScump 9y ago
      What's "legal" would be up to a jury. Note, however, that a deep pocket could bankrupt you simply through legal mechansims such as discovery.
      • dragonwriter 9y ago
        Strictly speaking, what is legal is up to a judge, and whether the evidence shows that you've done what is legal may be up to either a jury or a judge depending on whether it's a jury or bench trial.
        • DrScump 9y ago
          Strictly speaking, what evidence is admissible is up to a judge. In a jury trial, what is legal is up to the jury. Juries can still nullify, as was made clear in the Zárate verdicts.
          • dragonwriter 9y ago
            Strictly speaking, even when the jury nullifies, it does so by answering questions of fact, not law (even though some or all of the jurors may be substituting judgements of law for fact.) And, even more strictly speaking, in a civil case (which this subthread is addressing) it's all up to the judge anyway, even in a jury trial, since (unlike in a criminal case, where this can only happen to the benefit of the defendant, as a judgement of acquittal), a decision for either party may be entered, after the jury verdict, as a judgement as a matter of law (aka judgement notwithstanding the verdict.) This makes nullification essentially a dead issue in civil trials.
• aplorbust 9y ago
  "... the bounds of criminal law should not be defined by the preferences of website operators. And private companies shouldn't be using criminal laws meant to target malicious actors as tool to enforce their computer use preferences or to interfere with competitors." If a website operator wants to control if a user can access the website, then there are ways to do this without resorting to criminal prosecution. Through server software, websites can control how fast HTTP requests can be made in succession or how many requests can be made in a single connection. Websites can further control what IP addresses have their HTTP requests fulfilled. But users can still utilize client software to make automated requests and comply with any of these restrictions. The user might just send the requests slowly or from a different IP address. Ultimately, no website can force a user to use a GUI, mice or touchcreens. The same as no website can force a user to use a particular browser. If a website wants to control how a user accesses the website, there is no way to enforce this under the criminal law.
  • otakucode 9y ago
    I am certain that this ruling will be appealed, and we will hopefully see this case before the Supreme Court (assuming they have the time and desire to hear it.. if they don't, then this ruling will stand). Only then will we really be able to speak with the certainty you display. When you say "Ultimately, no website can force a user..." I wonder if you are actually considering the use of force there? A police officer or other agent with a firearm raiding the home or place of business of someone with a court order in hand is generally quite effective at compelling behavior, and that is what Oracle is aiming for. Whether there are technical means to make it easy or practical isn't at issue.
    • jopsen 9y ago
      Maybe politicians and voters in California fix their broken state laws, rather than passing the chip to the Supreme Court.
  • alphaalpha101 9y ago
    >If a website wants to control how a user accesses the website, there is no way to enforce this under the criminal law. Hopefully you are right. You definitely should be right, and in an ideal world you are right, but I hope you also happen to be right in the world we live in. Accessibility demands that you cannot force a user to use a GUI, mice or touchscreens, for a start.
• chrisshroba 9y ago
  Does anybody know how this pertains to data scraping? Like many coders/tinkerers, I've been frustrated that TOS'es often forbid bots from scraping data from many sites. There are lots of ways data can be better visualized or synthesized than is currently done, but terms of service make this impossible (unless you're just doing a small side project you never plan to publish). Does this mean that scraping is acceptable now, even if a site's TOS explicitly forbid it?
  • AnimalMuppet 9y ago
    This case is explicitly about data scraping. If the site's TOS forbids scraping, but allows access, this decision says "scrape away". Note, however, that this is a Ninth Circuit decision. If you don't live within the bounds of the Ninth Circuit, this decision doesn't apply to you.
    • adrianratnapala 9y ago
      No, it doesn't say scrape away. It says the scraping doesn't violate state computer crime statues (and the court has ruled similarly about Federal ones in the past). Oracle could still take actions other than gunning for a criminal prosecution. A simple action they could have taken was to block the scraper, the EFF post makes it looks like they didn't do this. Presumably they asked for the prosecution in order to deter other scrapers, but they could have done that AND ALSO blocked this scraper.
  • tzahola 9y ago
    Just tell them that you’re using mturk.
  • dragonwriter 9y ago
    > Does this mean that scraping is acceptable now, even if a site's TOS explicitly forbid it? That...depends. It was a scraping case, but while the appeals court allowed the automated access that the lower court found violated various anti-hacking laws, it also let stand the copyright violation judgement for the actual use of the scraped content. So, if content is protected by copyright, you don't have a license which covers your use, and no exception to copyright protection applies, that's still going to be a problem for scraping.
• jryan49 9y ago
  I feel like it's premature celebration? This seems like a very specific case, and not just violation of a terms of service in general?
• danans 9y ago
  IANAL, but violation of terms of service seems like a breach of contract, not a crime. For that sort of thing there is always the civil court system if the plaintiff feels like their loss due to the violation is high enough to warrant pursuing the legal case. But maybe the actual loss caused by the automated downloads in this case wasn't high enough and they pushed the criminal angle to make some kind of point.
  • michaelmrose 9y ago
    There was no loss. They are attempting to missuse the law in order to provide an oportunity to destroy a competitor because Oracle is run by bad people.
    • danans 9y ago
      > There was no loss. I suspect that too. I'm just surprised it got as far as a jury ruling in their favor in a criminal case, instead of being thrown out earlier on it's lack of merit.
    • vadimberman 9y ago
      > There was no loss. And that's probably what determined the result. The courts are not run by stupid people, they don't like that the system is exploited.
    • Feniks 9y ago
      There's a loss now. I bet Oracle's legal team was not cheap.
  • lysp 9y ago
    > but violation of terms of service seems like a breach of contract I agree. But also, breach of contract can only occur if there is an actual contract. Speaking generally - if I purchase software then a contract would exist (offer/acceptance/money changing hands) and the terms would come into play. If I was simply a visitor to a website then I think it would be harder to argue a contractual relationship exists.
  • 9y ago
• mattbgates 9y ago
  Does this mean it is also reversed? If a person chooses to not acknowledge the website's terms, does this mean a website doesn't have to abide by its own terms and can make up its own rules as it goes along?
  • michaelmrose 9y ago
    The question is nonsense. If you promise something and fail to deliver on this and some party suffers harm based on your failure you might get sued. This is true both ways. What you can't do is post a sign outside your business saying everyone coming in must do the macarena and accuse anyone not singing of ex post facto breaking and entering under the concept that they should have read the sign.
  • DanBC 9y ago
    The problem is that non-compliance with a contract wasn't being dealt with by contract lawyers, but was being converted into a criminal offence and dealt with by police.
• bactrian 9y ago
  Oracle is downright evil in the most corporate way. No one with other options should be a customer or employee. Oracle needs to die with Comcast and the rest.
  • maze-le 9y ago
    > Oracle needs to die with Comcast and the rest. And what makes you think, that what comes after (there will sureley be a company that fills the void) would be better in any way? The problem is not so much the frivolous lawsuits of oracle and the likes, but the incentives to pursue this behavior.
• merb 9y ago
  they could just implement rate limit and oracle would've been fine. but instead they actually tried to sue -_-
  • john2x 9y ago
    Their lawyers likely didn't know how to implement rate limiting :D
• tzs 9y ago
  > Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts, but Oracle didn’t rescind Rimini’s authorization to access the files outright. Rimini still had authorization from Oracle to access the files, but Oracle wanted them to access them manually—which would have seriously slowed down Rimini’s ability to service customers. So if Oracle had told Rimini outright that they were not allowed to access the files at all, Oracle might have prevailed?
  • dragonwriter 9y ago
    > So if Oracle had told Rimini outright that they were not allowed to access the files at all, Oracle might have prevailed? Rimini was a maintenance vendor acting on behalf of paid Oracle licensees with paid-for rights to access the files (which apparently are legally exercisable through a third-party vendor), and a vendor of maintenance services that competed with Oracle's first-party maintenance services, so doing so could be legally problematic.
• pwaai 9y ago
  YES! This is ecstatic news for those operating under the constant threat of lawsuits from delusional folks who thinks their TOS is the fucking constitution of United States of America. Linkedin and Craigslist will finally get the competition they've been fending off with scary lawsuits. I can't wait to see the look on Craig Newman's face when web scrapers all around the world will do what he feared all this time, bring innovation. This is possibly one of the best things I've read on HN. I'm more curious as who are the people at EFF pulling this off, stroking the legal justice warrior within me....I think this is the part of the law that deeply interests me but I don't know what you call EFF's area of law. Happy Scraping everybody!
• blackflame7000 9y ago
  A website’s TOS is not law so why should the violation of a TOS be treated like a violation of the law? Curious if anyone has any arguments
  • kazagistar 9y ago
    A a GPL license is not law, but violating it means you are violating the law, because violations revoke your permission to access it. I am sure the reasoning being used here is similar.
  • IncRnd 9y ago
    A TOS isn't really legally enforceable. A TOS can determine when a company will push for enforcement.
• rayiner 9y ago
  The EFF write up requires a bit of a caveat. The EFF states: "Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts, but Oracle didn’t rescind Rimini’s authorization to access the files outright." That's true, but it would be incorrect to infer that the Ninth Circuit's holding in this case means that such a cease and desist is ineffective to revoke notice for purposes of the CFAA. To the contrary, the Ninth Circuit has held that where a defendant, "after receiving the cease and desist letter from" the plaintiff, "intentionally accessed [plaintiff's] computers knowing that it was not authorized to do so," the defendant was "liable under the CFAA." Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1069 (9th Cir. 2016). The cease-and-desist letter dropped out of this case, because Rimini was accessing Oracle's website under delegated authority from Oracle customers, who had a contractual right to access the site. Oracle chose not to press the argument that it could limit the delegated authority from the customers by virtue of the cease and desist, I suspect because the wording of the cease and desist did not actually revoke Rimini's authorization to access the files. Oracle thus was stuck arguing that violating the TOS, despite otherwise having authorization to access the data, was enough to violate state-law counterparts to the CFAA. That latter argument was a losing one in light of United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), where the Ninth Circuit held that a terms of service provided insufficient notice to alleged offenders to create liability under the CFAA.
  • IncRnd 9y ago
    It is always a crime to criminally commit a crime.
    • reacweb 9y ago
      Is it a problem to outlaw the fact of being smart ?
      • IncRnd 9y ago
        Only if the legislature doesn't understand the words they read.
      • deleted 9y ago
• ringaroundthetx 9y ago
  People that hear about our software service always ask "hey whats to stop people from doing this illegal thing on your platform" and I say "a sternly worded Terms of Service"
• Feniks 9y ago
  Always amusing when a website disallows adblocker in their ToS. Its my computer dipshits. Besides its not as if they can actually do anything about it. I probably don't even come up in their analytics.
• dakomind 9y ago
  Larry Ellison should be shot for treason. These traitors who want to make up crimes should be shot for treason. They are negative members of society who do negative work. Letting them live is unethical and immoral. Shooting Larry Ellison to death is the right thing to do. Pretending that crimes exist when there are terrorists who want to murder Americans harms the war effort, it means you're helping the terrorists. Larry Ellison is making up crimes and charging Americans with them in order to help terrorists. This is why he must be shot to death.
• seannyg 9y ago
  This is great. However, I didn't see anything about whether it is a civil violation and assume you could still be sued by a third party (you just couldn't be thrown in not jail over it). Please correct me if I am mistaken.
• theBobBob 9y ago
  This might be a somewhat unpopular opinion but I think that there should be some way (definitely not through criminal prosecution) for a website or similar to say "You can use my service for free, but only under the following restrictions". Not sure what the "punishment" should be for breaking these rules.
  • emptybits 9y ago
    If you don't like a user's request then don't service it and tell them why. You owe them nothing. A simple 403 FORBIDDEN probably covers it. Or 429 TOO MANY REQUESTS might be appropriate. More bluntly, 204 NO CONTENT exists to tell your client, "I heard you just fine and I have nothing to say to you." Or there's 509 BANDWIDTH LIMIT EXCEEDED. In any case, the protocols exist to give your client some constructive information in your refusal. e: sp
    • theBobBob 9y ago
      That only deals with types of requests, or the user making the request etc. It doesn't do anything about how the requested data/info etc is used. I suppose it is closer to a licence agreement. I don't think that there can be any technical way to enforce it only some sort of legal way.
      • emptybits 9y ago
        Yes. Technology to restrict usage sounds a lot like DRM, which has many downsides. Enforcement, ultimately, will rely on good old fashioned copyright and licensing (contract) law.
  • sintaxi 9y ago
    That is how it works but punishment under civil law is based on damages so there is no punishment if there are no damages even if found guilty of breaching the TOS.
• jlgaddis 9y ago
  > Rimini, which provides Oracle clients with software support that competes with Oracle’s own services, ... Oh, the irony. (For anyone unclear, I'm thinking of Oracle, which provides Red Hat clients with software support that competes with Red Hat's own services.) In any case, I'm always happy to see Oracle lose a legal suit.
• maze-le 9y ago
  It borders on a joke, that people think accessing a website in breach of TOS is a crime, but storing passwords is plain text isn't.
• HenryBemis 9y ago
  I keep telling friends/colleagues that the order is: 1) Constitution - for countries that have one, 2a) Laws/Regulations, 2b) Other executive orders 3) Contracts ToC is simply a contract. Breach of ToC/Contract is not necessarily a breach of law (unless a law is at the same time violated)