7 ms·

I believe the salient issue is whether or not there were effective access controls, not whether or not a page could be reasonably interpreted as intended to be

by Kalium 7y ago

I believe the salient issue is whether or not there were effective access controls, not whether or not a page could be reasonably interpreted as intended to be non-public.

henryfjordan 7y ago
The real issue here is somewhere between both you and GP. What is required to trigger the CFAA? Does accessing a page the site owner doesn't want you to violate the CFAA or do you need to hack through access controls?
- akersten 7y ago
  And does robots.txt count as an access control? What about a humans.txt that says "please don't scrape this site"?
  - blackflame7000 7y ago
    Sounds more like an access suggestion than control to me
  - tempestn 7y ago
    According to the ruling, a cease and desist letter directly demanding that they not scrape the site didn't count as access control, so one would assume that humans.txt wouldn't either. It needs to be a technical prevention like a password, access token, etc.
- txcwpalpha 7y ago
  As a real-world analogue: you can indeed be guilty of trespassing on someone's property even if you don't have to jump over any fences or pick any locks to get there. In some places, they don't even have to have a "no trespassing" sign. Simply being present on someone else's property without an invitation from them is illegal, and no, an open door does not count as an invitation.
  - LyndsySimon 7y ago
    You generally can’t be charged with trespass unless you refuse to leave when told to do so. An open door to a home is different, but unfenced property is 100% not trespass until you refuse to leave.
    - txcwpalpha 7y ago
      That's not true at all. If you are aware that the property you are accessing is not meant for your use, you can be charged with trespassing regardless of if you have specifically been asked to leave or not. It's even possible to be guilty of trespass even if you weren't aware that you weren't allowed on the land. This is negligent trespassing.
      - admax88q 7y ago
        Negligence only applies I'm situations where a reasonable person should have known. You're only able to be charged with trespassing whilst being unaware if you were to so ridiculously unaware of your surroundings that any reasonable person in the same situation _would_ have known that they were trespassing. If a public park blends into somebodies private lawn you can't be charged with tresspassing for stepping over the line.
    - jcranmer 7y ago
      Trespass in criminal law usually requires notice that trespassing is prohibited, but this is usually satisfied by posting a "no trespassing" sign in a prominent area. For example, my state's law (emphasis added): > Whoever, without right enters or remains in or upon the dwelling house, buildings, boats or improved or enclosed land, wharf, or pier of another, or enters or remains in a school bus, as defined in section 1 of chapter 90, after having been forbidden so to do by the person who has lawful control of said premises, whether directly or by notice posted thereon, ... The federal version of trespass (which I think applies to Indian reservations) considers merely fencing off the area to be sufficient notice that trespassing is prohibited.
  - codedokode 7y ago
rayiner 7y ago
There is no requirement to have "effective access controls." What matters is what a reasonable person would believe about whether they were allowed to access the data. The access controls are relevant only insofar as that they convey a message that access is not permitted. The effectiveness of the access control is utterly irrelevant.
momokoko 7y ago
That is false. What effective access controls do, legally speaking, is help determine if a person could reasonably conclude that the information was non-public. For example, if a door is locked, but easily defeated, there is an implied assumption that what lies behind it is only available to someone with the key. Another example is an unlocked door with a sign that states "No access without authorization". Or an unmarked and unlocked door that is on private property in a place where it would be very unlikely for someone to reasonably conclude that the access was intended to be public.

by Kalium 7y ago

I believe the salient issue is whether or not there were effective access controls, not whether or not a page could be reasonably interpreted as intended to be non-public.

henryfjordan 7y ago

The real issue here is somewhere between both you and GP. What is required to trigger the CFAA? Does accessing a page the site owner doesn't want you to violate the CFAA or do you need to hack through access controls?

akersten 7y ago
And does robots.txt count as an access control? What about a humans.txt that says "please don't scrape this site"?
- blackflame7000 7y ago
  Sounds more like an access suggestion than control to me
- tempestn 7y ago
  According to the ruling, a cease and desist letter directly demanding that they not scrape the site didn't count as access control, so one would assume that humans.txt wouldn't either. It needs to be a technical prevention like a password, access token, etc.
txcwpalpha 7y ago
As a real-world analogue: you can indeed be guilty of trespassing on someone's property even if you don't have to jump over any fences or pick any locks to get there. In some places, they don't even have to have a "no trespassing" sign. Simply being present on someone else's property without an invitation from them is illegal, and no, an open door does not count as an invitation.
- LyndsySimon 7y ago
  You generally can’t be charged with trespass unless you refuse to leave when told to do so. An open door to a home is different, but unfenced property is 100% not trespass until you refuse to leave.
  - txcwpalpha 7y ago
    That's not true at all. If you are aware that the property you are accessing is not meant for your use, you can be charged with trespassing regardless of if you have specifically been asked to leave or not. It's even possible to be guilty of trespass even if you weren't aware that you weren't allowed on the land. This is negligent trespassing.
    - admax88q 7y ago
      Negligence only applies I'm situations where a reasonable person should have known. You're only able to be charged with trespassing whilst being unaware if you were to so ridiculously unaware of your surroundings that any reasonable person in the same situation _would_ have known that they were trespassing. If a public park blends into somebodies private lawn you can't be charged with tresspassing for stepping over the line.
  - jcranmer 7y ago
    Trespass in criminal law usually requires notice that trespassing is prohibited, but this is usually satisfied by posting a "no trespassing" sign in a prominent area. For example, my state's law (emphasis added): > Whoever, without right enters or remains in or upon the dwelling house, buildings, boats or improved or enclosed land, wharf, or pier of another, or enters or remains in a school bus, as defined in section 1 of chapter 90, after having been forbidden so to do by the person who has lawful control of said premises, whether directly or by notice posted thereon, ... The federal version of trespass (which I think applies to Indian reservations) considers merely fencing off the area to be sufficient notice that trespassing is prohibited.
- codedokode 7y ago

rayiner 7y ago

There is no requirement to have "effective access controls." What matters is what a reasonable person would believe about whether they were allowed to access the data. The access controls are relevant only insofar as that they convey a message that access is not permitted. The effectiveness of the access control is utterly irrelevant.

momokoko 7y ago

That is false. What effective access controls do, legally speaking, is help determine if a person could reasonably conclude that the information was non-public. For example, if a door is locked, but easily defeated, there is an implied assumption that what lies behind it is only available to someone with the key. Another example is an unlocked door with a sign that states "No access without authorization". Or an unmarked and unlocked door that is on private property in a place where it would be very unlikely for someone to reasonably conclude that the access was intended to be public.