12 ms·
Court: Violating a site’s terms of service isn’t criminal hacking
- 101404 7y ago"US court"
- LinuxBender 7y agoupdated title
- LinuxBender 7y agoIt was changed back to the original title.
- dang 7y agoIt's a well-known US publication. Readers are smart enough to figure these things out, and it's best not to get too punctilious.
- LinuxBender 7y agoCompletely understand. Ty Dang.
- ipnon 7y agoThis really begs the question: what is?
- duxup 7y agoSome sort of civil court conflict type situation... at most ... and maybe not even that? I moderated plenty busy forums that had rules and ToS, but I didn't think of violations as anything more than something that might lead to me terminating an account. Now one greifer did have a habit of mass producing accounts quite cleverly and the parent company actually sued him in civil court, but that was unique and actually disrupted the entire site with griefing and such. They even got the ear of a local prosecutor who thought that disrupting the site might count as a criminal act. The griefer went away after that and nothing came of it other than filing a civil case and I belive some contact with the local prosecutor... dude agreed to go away forever. But of course in the example they are talking about just creating a fake account and speaking more generally about ToS violations.
- ipnon 7y agoSeems to be a duck violation. If it looks like a crime and sounds like a crime ... admittedly not the best metric for equitable justice.
- goda90 7y agoBreaking past security systems. So like scraping publicly facing data might violate TOS, but you can't call it hacking. Using exploits to get the password hashes would be criminal hacking.
- ds 7y agoIts really not that clear and we will need to wait for the courts to figure out what means what. For instance this: https://www.theguardian.com/technology/2013/mar/18/at-and-t-hacker-jailed-ipad-email https://www.theguardian.com/technology/2013/mar/18/at-and-t-... All they did was "scrape publicly facing data"
- v0tary 7y agoYea, it also only talks about bypassing/breaking passwords, what if the user has a sticky note at their desk and the password is readily exposed. Is that considered hacking? Should be. Unauthorized access regardless of how irresponsible the owner of that account is. At the same time you do not need a ToS or banner saying that. (it still remains illegal to break/trespass into someone's home without a notice saying so!) Slippery slope. I'd gander a guess this will continue to be a case-by-case call.
- lidHanteyk 7y agoWelcome to the central failure of the CFAA: Hacking attempts should be treated as a normal part of life, and systems should be designed to resist hacking, but the law gets this exactly backwards. In a saner legislative setting, hacking would be like harmful radio wave interference, something which is both punishable in a court of law but also which devices are designed to consider in the course of normal operation.
- google234123 7y agoHacking attempts are treated as a normal part of life and systems are designed to resist hacking. Fortunately, we also have to law acting as an additional form of deterrent.
- dependenttypes 7y ago> hacking would be like harmful radio wave interference DoS attacks specifically. I would argue that any other form of hacking should not be punishable and it should only be up to the devices to protect against them.
- dependenttypes 7y agoHopefully nothing and laws like CFAA get trashed.
- gowld 7y agohttp://begthequestion.info/ http://begthequestion.info/
- microdrum 7y agoThe right decision. And why would it be? Why should private actors be able to invent new criminal liabilities simply by publishing various terms of service? Spotify: "If you listen to The Jackson 5 on our streaming service from a location in Ohio on a Tuesday, that is a violation of our Terms of Service." Federal judge: "You heard the man. Off to jail!"
- duxup 7y agoDistantly reminds me of the "annoy" website (I forget the exact URL) that was created as a sort of protest of some legislation in the early days of the internet that referenced "annoying" someone (I forget the exact language).
- ds 7y agoFeels like this is going to create some headaches for prosecuting CFAA cases if the verdict stands. I suspect the definition of 'unauthorized access' will need to be more clearly defined since I know many cases in the past relied around users doing shit that was unauthorized by the TOS.
- bosswipe 7y agoGood.
- threatofrain 7y agoDo technical communities have a consensus on how to classify these behaviors or scenarios? Then what anchor do we have?
- CiPHPerCoder 7y agoThe onus should be on the service operators to clearly define what's authorized and what isn't; and if they miss something, the liability should be borne by the service operator, not the person who found their gap.
- deleted 7y ago[deleted]
- gowld 7y agoDefine via ToS, or technical countermeasures? In the meatspace world, we use ToS and expectations (like don't ransack my house even if he door is unlocked).
- CiPHPerCoder 7y agoTechnical countermeasures. My proposal would require companies to actually take security very seriously. https://www.troyhunt.com/we-take-security-seriously-otherwise/ https://www.troyhunt.com/we-take-security-seriously-otherwis...
- 7y ago
- sprite 7y agoHow does this correlate to for example accessing a 3rd party API that has some sort of protection, for example an API key or request signature algorithm. Would those be considered a 'password'?
- cl0rkster 7y agoTOS is too vague a term and too broad to cover the complexities that proper legislation in the matter would require. Not to mention, I can write anything I want in my TOS, but you can't enforce illegal terms. People know bad action like they know porn when they see it.
- phkahler 7y ago"Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote. IMO that is the most important part of the ruling. You cant have criminal penalties and then delegate the definition of the crime to each website. Lying or breaking TOS is different than hacking. You are granted access by the site, and it's no different than the access they grant every other user.
- distances 7y ago> Lying or breaking TOS is different than hacking. I think this is a good analogy: I accepted the terms, but I was lying. Sue me for lying then. TOS are not contracts for sure, as nobody is expected to actually read them and they aren't negotiatable.
- abnry 7y agoGenuine question: if it isn't a contract, what legal purpose does a terms of service serve then? I assume any website serving a non-paying user has the right to terminate any services at any point, no reason given. A ToS might establish credibility among users as an open display of policy, but I don't see a legal purpose.
- danmg 7y agoOutside of limiting their own legal liability, it's a cargo cult.
- abnry 7y agoAh, so legal liability is to protect the company from prosecution? It is not clear to me that a company needs to say they don't support illegal behavior by the users. It also isn't clear to me that a non-paying user can ever prosecute a website for refusing a service on the basis of the companies terms of service. If the company is already doing something illegal, then it is based on the current legal statutes that they can be prosecuted. I probably don't understand legal liability here.
- UweSchmidt 7y agoWho is really reading a site's terms of service, or EULAs etc.? We mandate food companies to clearly label items with standardized, readable and compact information, but software companies can confront users with text that could only ever be interpreted by bored lawyers. The idea that this could be 'binding', let alone leading to a 'crime', is silly to me.
- orthecreedence 7y ago> Who is really reading a site's terms of service, or EULAs etc.? I do. I make a point to take the first five to six hours of every working day reviewing the ToS for each website I'm projected to visit that day. I diff the text against known past versions and if there are significant enough changes to any particular ToS, I stop using that site until I can sit down in-person with my $550/hr lawyer (usually I only do this once or twice a week) and review the changes to make sure I'm clear of all liabilities for my projected use-cases. Once I get the go-ahead, I resume access to that website. Overall the process only takes on average 30 hours a week, and the costs are around $2000/week. It's worth it though, I wouldn't want to break any rules set by private land owners (whether virtual or not).
- vbezhenar 7y agoWill your lawyer be accountable if you would break some rule because of his error? Did you sign any papers about his accountability? Were those papers reviewed by independent lawyers?
- kingbirdy 7y agoWorth noting this is only a district court ruling, and as the article notes there are a number of conflicting circuit court rulings on the issue. Until a case makes it to the Supreme Court, it's not safe to take this as a given nationally.
- tyiworld 7y agoYikes
- peter_d_sherman 7y agoHere's an interesting legal question: If you use the public internet to go to a public website's landing page, by doing that, do you automatically accept a website's Terms Of Service (contract)? I would argue no, because the social custom is that public-facing websites are intended to be accessed by the public, and until and unless they explicitly accept a contract (such as a Terms Of Service agreement), there is no contract... Now... I could be wrong. In fact, lawyers could argue that there is a social contract, an implied contract (they do this with Negligence claims) even before there is a written contract... So, I'd be interested in arguments, both for and against, with respect to the presence or absence of a contract, either express or implied... (We can all agree that if a website creates a pop-up or page which says "By using this site, you accept the terms of service", and if you click "Agree", you agreed (well, unless you do not have the capacity to do so, or other factors apply... <g>)... that's not what I'm soliciting arguments for here...)
- Spivak 7y agoAt minimum I think most people would agree that the "default ToS" probably would cover malicious actions and unintended access in both directions.
- peter_d_sherman 7y agoMy question is not about what the default ToS covers or doesn't cover, my question is about when/where/how/if -- someone on the Internet accepts a ToS... And it's not really a question. It's a solicitation of opinions. To understand what I'm asking for, you must have an understanding of Contract Law. That is, what is a contract, when are they accepted, how are they accepted, etc. OK, now given those understandings, apply that to a public website. How does/would someone in the public accept a public website's ToS, other than clicking "I agree", when presented by a page or requester saying "Do you agree to accept this website's ToS?". Does it happen? If so, why so? If not, why not? I'm looking for compelling arguments, both for and against, both pro and con...
- jdmichal 7y agoIANAL. I would start with consideration. What's the consideration from the site that would form a contract? Access that is freely granted to the public anyway? Could I write a contract in which the only consideration I give is access to a public park? The counter argument would be that internet sites are private. Something more akin to a store than a public park. I would also include meeting of the minds. At someplace like a gym, you sign your contract and exchange consideration before being granted access. In other words, in order to gain the consideration of access, you must agree with the gym's offer. Sites with required login to gain access work like that, but not "public" websites. They're more like stores than gyms -- anyone can walk in and access is not restricted. [0] So where is the meeting of the minds when I type in a URL and the page loads? [0] Access can be revoked, since it's still private property, but then your crime is in not leaving or reentering after revocation -- entering in the first place was legal.