4 ms·

When I see access to private API's like this, I wonder how judges would interpret these actions as they relate to the CFAA. By accessing "private" API's like th

by dfxm12 7y ago

When I see access to private API's like this, I wonder how judges would interpret these actions as they relate to the CFAA. By accessing "private" API's like this, are you knowingly accessing a computer without authorization? Are you exceeding your authorized access? The fact that Aaron's Law never went through has disturbed me...

dewey 7y ago
I know you are just playing devil's advocate but why "without authorization"? You are using your account and your cookies so it should be fair game?
- maerF0x0 7y ago
  +1 you're only doing things you're already authorized to do, just with a different client.
  - LocalH 7y ago
    Many sites view that as "unauthorized" because they like that top-down control
    - taftster 7y ago
      It's not any individual site's view that matters to me. It's the view of the courts that's the most concerning/pressing.
- dfxm12 7y ago
  The US Gov't has tried to apply CFAA to someone they claimed was breaking a website's TOS[0]. The EFF filed an amicus brief in support of the defendant about this[1]. Who knows what the TOS is for grabbing coupons? Sure, the judge who heard this case said this would be an "overly broad" interpretation of the law at the time, but the question has come up in subsequent criminal cases as well. I'd feel better if that was actually codified and not left up for interpretation by other judges or courts. 0 - https://en.wikipedia.org/wiki/United_States_v._Drew#Indictment https://en.wikipedia.org/wiki/United_States_v._Drew#Indictme... 1 - https://www.eff.org/cases/united-states-v-drew https://www.eff.org/cases/united-states-v-drew
punnerud 7y ago
In EU you are allowed to automate everything you legally can do manually, even if they have a large sign on their page saying that automation is not allowed. The only thing that is limiting you from selling is copyright, but by-products from ordinary business is always legal.
- lucasverra 7y ago
  any reliable legal source for that ? thanks
  - punnerud 7y ago
    This is the best summery from the “horse racing case”: https://eur-lex.europa.eu/legal-content/GA/TXT/?uri=CELEX:62002CJ0203 https://eur-lex.europa.eu/legal-content/GA/TXT/?uri=CELEX:62... There was also a review of the database directive last year that summarize all the precedence on this: http://data.consilium.europa.eu/doc/document/ST-8466-2018-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-8466-2018-IN...
henryfjordan 7y ago
Probably not... There's an ongoing case Linkedin v HiQ where Linkedin said HiQ was scraping publicly available linkedin profiles but there was a robots.txt that told them not to. HiQ kept doing it until Linkedin threatened them under the CFAA. HiQ just won a preliminary injunction to get to continue where the court said it was unlikely that they were violating the CFAA but they might change their minds as the case progresses: https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-linkedin-protects-scraping-public-data https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-l...
- meritt 7y ago
  The Safeway API in question requires a user to be logged-in, authorized, and have explicitly agreed to a TOS (clickwrap). The HiQ v. LinkedIn case was centered around publicly accessible content which did not require the user to be authenticated nor have explicitly agreed to a TOS (browsewrap is not enforceable). I'd argue the above case does not apply here.
  - henryfjordan 7y ago
    ahhh, yeah that is certainly quite distinct. Thanks for pointing that out. HiQ v Linkedin kind of hinges on the implicit authorization given by making an API public. Here Safeway gave explicit authorization so I suppose it might come down to the TOS. Then again all Safeway has to do is revoke your account and you're gone, so I don't really know why anyone would be to worried about them coming after you with the CFAA. Cant be worth the effort.

by dfxm12 7y ago

dewey 7y ago

I know you are just playing devil's advocate but why "without authorization"? You are using your account and your cookies so it should be fair game?

maerF0x0 7y ago
+1 you're only doing things you're already authorized to do, just with a different client.
- LocalH 7y ago
  Many sites view that as "unauthorized" because they like that top-down control
  - taftster 7y ago
    It's not any individual site's view that matters to me. It's the view of the courts that's the most concerning/pressing.
dfxm12 7y ago
The US Gov't has tried to apply CFAA to someone they claimed was breaking a website's TOS[0]. The EFF filed an amicus brief in support of the defendant about this[1]. Who knows what the TOS is for grabbing coupons? Sure, the judge who heard this case said this would be an "overly broad" interpretation of the law at the time, but the question has come up in subsequent criminal cases as well. I'd feel better if that was actually codified and not left up for interpretation by other judges or courts. 0 - https://en.wikipedia.org/wiki/United_States_v._Drew#Indictment https://en.wikipedia.org/wiki/United_States_v._Drew#Indictme... 1 - https://www.eff.org/cases/united-states-v-drew https://www.eff.org/cases/united-states-v-drew

punnerud 7y ago

In EU you are allowed to automate everything you legally can do manually, even if they have a large sign on their page saying that automation is not allowed. The only thing that is limiting you from selling is copyright, but by-products from ordinary business is always legal.

lucasverra 7y ago
any reliable legal source for that ? thanks
- punnerud 7y ago
  This is the best summery from the “horse racing case”: https://eur-lex.europa.eu/legal-content/GA/TXT/?uri=CELEX:62002CJ0203 https://eur-lex.europa.eu/legal-content/GA/TXT/?uri=CELEX:62... There was also a review of the database directive last year that summarize all the precedence on this: http://data.consilium.europa.eu/doc/document/ST-8466-2018-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-8466-2018-IN...

henryfjordan 7y ago

Probably not... There's an ongoing case Linkedin v HiQ where Linkedin said HiQ was scraping publicly available linkedin profiles but there was a robots.txt that told them not to. HiQ kept doing it until Linkedin threatened them under the CFAA. HiQ just won a preliminary injunction to get to continue where the court said it was unlikely that they were violating the CFAA but they might change their minds as the case progresses: https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-linkedin-protects-scraping-public-data https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-l...

meritt 7y ago
The Safeway API in question requires a user to be logged-in, authorized, and have explicitly agreed to a TOS (clickwrap). The HiQ v. LinkedIn case was centered around publicly accessible content which did not require the user to be authenticated nor have explicitly agreed to a TOS (browsewrap is not enforceable). I'd argue the above case does not apply here.
- henryfjordan 7y ago
  ahhh, yeah that is certainly quite distinct. Thanks for pointing that out. HiQ v Linkedin kind of hinges on the implicit authorization given by making an API public. Here Safeway gave explicit authorization so I suppose it might come down to the TOS. Then again all Safeway has to do is revoke your account and you're gone, so I don't really know why anyone would be to worried about them coming after you with the CFAA. Cant be worth the effort.