17 ms·
In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030. Specifically,
by PaulAJ 7y ago
In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030. Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years.
(Some might argue that it was authorised because the computer let him do it. However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear.)
- Hitton 7y agoNot a lawyer, but you could argue that he wasn't really accessing the router, he was accessing his own server at home.
- PaulAJ 7y agoHe was accessing the router by sending packets through it. Authorisation to do this was only granted in return for payment, and he hadn't paid.
- shawnz 7y agoFrom your link: > the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; The information they were accessing didn't come from the computer. And this doesn't say anything about using a computer service in an unauthorized way, which is what it sounds like you're describing here
- PaulAJ 7y agoThe output buffer on the Internet side of the router is information in the computer. It was modified without authorization when packets were sent through it.
- gsich 7y agoNot really. If the plane has open Wlan or a well-known password (ie in the info stuff) then all you need to is connect. No further authorization needed. There is simply no need to open a browser.
- ryanmarsh 7y agoIMHE Judges don't have much of an appreciation for clever circumvention of the law.
- iamnotacrook 7y agoHow about a plausible interpretation of the law?
- dvtrn 7y agoI think some refer to this as 'case law' </legal_humor>
- dehrmann 7y agoThese sorts of technicalities don't play well with juries, but neither do large airlines or ~phone companies charging $15 for two hours of 1Mbps internet.
- tomxor 7y ago> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.
- kemitche 7y agoIt's not nuts when compared to non-tech laws. It's illegal to come into my house and take my stuff even if I forget to lock my back door. If we want to protect security professionals, we should write laws that do so.
- cabaalis 7y ago> It's illegal to come into my house and take my stuff even if I forget to lock my back door. For some reason, on HN when I've made this argument before, the resulting comments have been that the internet is somehow different, and that real-world analogies don't exist. Using equipment that you don't own in a way the owners don't intend is apparently well-accepted.
- ht85 7y agoProbably because this is a victimless crime... What he did would be more akin to someone entering your property, having their lunch in your garden and cleaning up before leaving.
- judge2020 7y agoGranted that's still a crime. You probably won't use the video recording of that guy to file a police report (unless you suspect he did something else on your property, which would be like the author also running aggressive nmap scans) just as viasat is probably not going to file a lawsuit.
- 420codebro 7y ago
- anticensor 7y agoIt is computer abuse as he continued doing it repeatedly and looked up for different workarounds, after getting an unauthorised way to access. A more severe offense than simple unauthorised access.
- bobcostas55 7y agoHow does this not apply to stuff like trackers bypassing anti-fingerprinting browser protections?
- pmorici 7y agoBecause a prosecutor hasn't tried to use it in that way.
- mindslight 7y agoWhich highlights a fundamental truth to law - it's only enforced to backstop the status quo. Routing around a wifi paywall rocks the boat, performing invasive surveillance on website visitors doesn't. So practically yes, let's be aware that the author could indeed be persecuted under the CFAA. But let's not grandstand and pretend that following that law is some sort of moral imperative that benefits everyone. The common individual will be the target of the same attacks with or without that law.
- tidepod12 7y agoFollowing the law may not be a moral imperative, but let's not pretend like the author did anything moral here. He knowingly and with intent stole services from the airline. It not only was illegal, it's blatantly immoral.
- SomeOldThrow 7y agoIt’s also immoral to force bad pricing down customer throats. And yet that is the definition of the inflight wifi business. EDIT: I’m fairly sure at current prices a single flight could pay for a month’s service for a single plane, probably several times over. The profit margins (& I imagine some the cut to the airline) must be enormous, & there is no pretense of fair terms at sale time because a single corporation can entirely monopolize your attention.
- nordsieck 7y ago
- ttul 7y agoAlso, it’s plainly fraud.
- ozi 7y agowouldn't this also constitute wire fraud?
- deleted 7y ago[deleted]
- ErikAugust 7y agoThe guy is in high school. They should offer him an internship, not throw the stupid book at him.
- debatem1 7y agoCriminally charging someone under the CFAA for what is essentially a TOS violation has come under fire before, and frankly I don't think many prosecutors want to be the one to get that legal theory thrown out.
- morpheuskafka 7y agoWouldn't this be excluded anyway since the only thing "fraudulently obtained" was "use of the computer or system" worth less than $1,000 per year? Even if that language weren't in 18 USC 1030(a)(4), the guidelines sentence assuming no priors would look to be 0-6 months and $250-$5000 fine, assuming you couldn't plea out to something less. I doubt the federal authorities are even going to waste their time looking at $12 of "fraudulent access" that will likely lead to almost no jail time.
- PaulAJ 7y agoIt depends on whether someone wants to make something of it. The costs taken into account by the CFAA include the costs of investigating the incident and repairing any damage, and courts in the past have tended to accept pretty much any assertions about these costs. They probably wouldn't blink if the entire cost of fixing the exploit were attributed to the OP.
- fulldecent2 7y agoUnderstood. Also, I bet every sibling comment to this one will be terribly low quality and fail to convince anyone of anything.