4 ms·

"Requesting Results Removal If you would like your host to be excluded from the Censys results, you can block traffic from the following subnets: 141.212.121.0

"Requesting Results Removal If you would like your host to be excluded from the Censys results, you can block traffic from the following subnets: 141.212.121.0/24 and 141.212.122.0/24. However, we would encourage you to consider whether this actually accomplishes what you are intending. Internet-wide scanning is pervasive and others will still find your host even if it's not listed in Censys. We will not censor specific hosts or certificates from the Censys results or historical datasets." If I notify them that they are unauthorized to scan my networks, and they continue to scan them, have they violated the CFAA?

throwawayeo5 9y ago
No, because it’s not against the law to scan servers on the internet. If you don’t want people to scan listening services, don’t let those services listen publicly on the internet. If you were to log into the server, though, that would violate the CFAA.
- greyface- 9y ago
  I know that current caselaw holds that it's not a violation of the CFAA to portscan in the general case[1]. I'm not asking in the general case; I'm asking specifically in the case where the scans are regular and ongoing, and the scanning party has been explicitly given notice that they are unauthorized. [1]: https://nmap.org/book/legal-issues.html https://nmap.org/book/legal-issues.html
  - tokenizerrr 9y ago
    "Stop looking at my house from the public street! It's not authorized!"
  - pfg 9y ago
    The courts recently ruled on a similar case[1] and came to the conclusion that it was not a CFAA violation. That said, there's a difference between a public website such as LinkedIn and a host that just happens to be reachable over the internet, so I'm not sure it would be fully applicable. [1]: https://arstechnica.com/tech-policy/2017/08/court-rejects-linkedin-claim-that-unauthorized-scraping-is-hacking/ https://arstechnica.com/tech-policy/2017/08/court-rejects-li...

throwawayeo5 9y ago

No, because it’s not against the law to scan servers on the internet. If you don’t want people to scan listening services, don’t let those services listen publicly on the internet. If you were to log into the server, though, that would violate the CFAA.

greyface- 9y ago
I know that current caselaw holds that it's not a violation of the CFAA to portscan in the general case[1]. I'm not asking in the general case; I'm asking specifically in the case where the scans are regular and ongoing, and the scanning party has been explicitly given notice that they are unauthorized. [1]: https://nmap.org/book/legal-issues.html https://nmap.org/book/legal-issues.html
- tokenizerrr 9y ago
  "Stop looking at my house from the public street! It's not authorized!"
- pfg 9y ago
  The courts recently ruled on a similar case[1] and came to the conclusion that it was not a CFAA violation. That said, there's a difference between a public website such as LinkedIn and a host that just happens to be reachable over the internet, so I'm not sure it would be fully applicable. [1]: https://arstechnica.com/tech-policy/2017/08/court-rejects-linkedin-claim-that-unauthorized-scraping-is-hacking/ https://arstechnica.com/tech-policy/2017/08/court-rejects-li...