4 ms·

Imagine I have a friend who is a cop. They give me their login that lets me run background checks on people. I use it to stalk my ex, check out my neighbors and

Imagine I have a friend who is a cop. They give me their login that lets me run background checks on people. I use it to stalk my ex, check out my neighbors and generally behave creepily. I later get caught. I absolutely should be charged with unauthorized access, because the person who gave me access had no right to give me that access and I knowingly used a protected computer system against the wishes of the owner, for my own aims. Replace the above with "medical records" or "banking information" or whatever you wish. Just because someone gave me a password, doesn't mean I'm allowed to use it, even if THEY were allowed to use it.

danShumway 7y ago
Three problems with your analogy: First, the cop who gave you access didn't have the right to use it in the way they offered. They don't own the data. The "right" they're delegating to you isn't a lawful right they actually have to delegate. This is a really big difference -- the problem in the scenario you propose isn't that a police company got hacked (in fact, I would argue it didn't). The problem is the police department illegally abused information and distributed that information to other people, and you willingly participated in that crime. In contrast, all of the data access that was delegated to Power Ventures and all of the stuff that Power Ventures did with that data was stuff that users had the right to do. Second problem, this would be illegal because of privacy laws around how the police are allowed to use your data, not because a company declared it so. I'm not saying you should have carte blanch privileges to violate any law just because another person violated that law first, I'm saying companies shouldn't have carte blanch privileges to make new laws. To re-emphasize the point above, the problem in this scenario isn't that the police department got hacked. The problem is that people were performing illegal background checks. If the police officer didn't give you a password, and instead just did whatever background checks you wanted on their own without you ever touching the system, this would still be a crime. The system access isn't the important part. Third, in the scenario you propose, both you and the cop would get in trouble. Hopefully, the cop would get in even more trouble than you. So when Facebook brings every user who "illegally" shared their password into court, then I'll entertain the notion that they think this is a real hacking case. Otherwise, why are we comfortable letting off all these willing accomplices to an unlawful entry case?

danShumway 7y ago

Three problems with your analogy: First, the cop who gave you access didn't have the right to use it in the way they offered. They don't own the data. The "right" they're delegating to you isn't a lawful right they actually have to delegate. This is a really big difference -- the problem in the scenario you propose isn't that a police company got hacked (in fact, I would argue it didn't). The problem is the police department illegally abused information and distributed that information to other people, and you willingly participated in that crime. In contrast, all of the data access that was delegated to Power Ventures and all of the stuff that Power Ventures did with that data was stuff that users had the right to do. Second problem, this would be illegal because of privacy laws around how the police are allowed to use your data, not because a company declared it so. I'm not saying you should have carte blanch privileges to violate any law just because another person violated that law first, I'm saying companies shouldn't have carte blanch privileges to make new laws. To re-emphasize the point above, the problem in this scenario isn't that the police department got hacked. The problem is that people were performing illegal background checks. If the police officer didn't give you a password, and instead just did whatever background checks you wanted on their own without you ever touching the system, this would still be a crime. The system access isn't the important part. Third, in the scenario you propose, both you and the cop would get in trouble. Hopefully, the cop would get in even more trouble than you. So when Facebook brings every user who "illegally" shared their password into court, then I'll entertain the notion that they think this is a real hacking case. Otherwise, why are we comfortable letting off all these willing accomplices to an unlawful entry case?