5 ms·

So accessing a web site is illegal? I rarely see explicit "you are allowed to access the HTML files on this server" anywhere.

• kube-system 6y ago
  It can be if it was not intended to be public. It's really not much different than walking around outside. You can walk in an unlocked retail store and it's okay, but if you walk into your neighbors bedroom it's not okay.
  • da_chicken 6y ago
    Yes, and opening an unlocked door will still qualify as breaking and entering if you don't have permission to enter it. Just like taking something that isn't yours is still theft even if you find it in a public space. The crime isn't circumventing the locks. It's accessing what you don't have the right to access.
  • tptacek 6y ago
    People on message boards really want to believe there's a black -letter rule about what you can and can't do, but that's not how our criminal codes work. These cases will come down to the state of mind of the person accessing the website, as well as an argument about what a reasonable person would conclude upon reading what's on that website.
    • eloff 6y ago
      I think programmers especially like to view law through the lens of rules they could implement in code. Often they think it can be hacked by violating the spirit of the law while upholding the letter. Law in reality is a much more human thing that takes into account intention on the party of both legislators making the law and the people it is being applied to. Good thing too. Is this that makes me think attempts to codify law on some blockchain is a doomed exercise most of the time.
      • derefr 6y ago
        I think some programmers try to think in the mindset of what laws would/wouldn't be violated if you could somehow fuzz-test a particular aspect of the court system. I.e., if instead of an individual case, you could generate a million people who all tried to do every potential variation of breaking the law in that way, then what would the curve of the resulting judgements look like?
      • c22 6y ago
        This can be a Good Thing, but it depends a lot on the courts not being lazy and taking shortcuts. When I was in front of a judge there was no disagreement as to the material facts of the case, but my guilt and my sentence were decided based on the Court's determination of my intent. The only evidence the court had regarding my intent was my own testimony and the differing hypothesis provided by the police officers I'd had a verbal disagreement with at the scene. Guess whose story they went with.
  • derefr 6y ago
    What determines what's a retail store and what's a house? Zoning? What if a place is zoned multipurpose commercial/residential, where there are both public offices and private apartments occupying undifferentiated sibling units of the same building? I would assume there would have to be some common-sense or explicit claim being made that a place is private property.
    • kube-system 6y ago
      It doesn't really work that way. The entirety of the situation is taken into account. What matters is what you knew, what you should have known, what you could be expected to know, what you were told, what you observed, what you were thinking, what actions you took, and why you did it, etc.... and how all of these things line up with your local laws which will vary to a degree. If you walked into the place confused because it wasn't clear what was a home and what was a business, that might be a valid way to demonstrate a lack of intent. But it wouldn't be because of zoning, it would be because of it way it appeared to you.
      • derefr 6y ago
        Sure, that's what's important after-the-fact if someone's getting mad at you. But that's very murky territory—the kind individuals constantly wander into because of conflicting motivations, but which corporations tend to stay well clear of. Let's instead talk about legal liability, and how corporations seek to discharge it in their delivery of products/services. If I'm programming a political auto-dialer, there are rules about which numbers it's legally allowed to call, and which numbers it legally cannot. It can't call people's cell-phones, for example. If I don't want to get the people who buy one of these things in trouble (and then get sued by them), I have to program this device to follow these rules. In such a case, it's not a matter of resolving the mens rea from committing such an act anyway; it's a question of how to avoid getting into a situation where my motivations (or the motivations of the purchaser) could ever possibly come into question. I don't want to come into court with a defense; I want to be bulletproof from being brought into court. So, now, an analogy: if I'm programming a lifelogging-drone-as-a-service that people pay to follow them around all the time they're in "public space"—which, from what I recall, includes commercial spaces without access restrictions, e.g. retail shops, but does not include private residences—then what rules must I program this drone to follow about "what constitutes a public space", to avoid me (or a customer) ever being brought into court on charges of surveilling private property? (It's okay if such rules are next-to-impossible to resolve from the limited sensory data + local regulatory databases the drone has access to. The point isn't to construct such a drone; just to speak of more cut-and-dry case replacement for a human actor.)
• eqdw 6y ago
  Yes. This is why weev went to prison. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach tldr: AT&T has an account status page that, for mobile devices, did not require any authorization. Something like /status?phone=8367492738 and you see the account data for that phone. It was guarded by a password if you navigated to it on a desktop/laptop, but it was unsecured if you navigated to it with a mobile device. He spoofed the user agent string to make his laptop say it was a phone (this is extremely common, there is a button in your browser to do this in one click, and the spec that defines UA string specifically says not to use it for authorization for this exact reason), and dumped the account details from every url. Despite these being pages publicly accessible on the open internet, he went to jail for years for unauthorized access under the CFAA Well, I mean, that and (I'm sure) the fact that he was a notorious asshole and the authorities would rather make an example out of him than out of a more sympathetic defendant
• firethief 6y ago
  Law is not really "rule-based" in the sense engineers tend to expect it to be