5 ms·

We had a bad user who we kept banning for harassing other users. He would come back over and over again, using different pictures, IPs, even throwaway phone num

by tdrp 6y ago

We had a bad user who we kept banning for harassing other users. He would come back over and over again, using different pictures, IPs, even throwaway phone numbers or FB accounts etc. We ended up stopping him by involving a lawyer who drafted a letter invoking the CFAA. But it revolved around him violating our terms of service (eg no harassment, banned users are banned forever etc.) Anybody know: Would CFAA still apply here if EFF wins this case? Or are there any other laws which would cover this kind of unauthorized access? Thanks!

yummypaint 6y ago
They can probably be prosecuted for the Harassment, which is a crime. IANAL but if you offer free automated signups with any email address it seems like invoking the CFAA is a stretch, as you aren't really taking steps to secure the system in the first place. The CFAA would be more appropriate if they are cracking admin accounts and getting into the back-end.
- tdrp 6y ago
  It seems like any harassment complaint would have to be raised by the victims directly rather than by us, the service provider. In practice they just leave the site and never come back. So what would the recourse be in this case for a bad actor? How about for one who generates dozens of accounts every day and spams others?
tuxxy 6y ago
> Would CFAA still apply here if EFF wins this case? I hope not! What you described here is a great example of why EFF should win this case. Violating ToS is not and _should not_ be cause for civil or criminal action. If you don't want this user on your service, then remove them. If they continually violate your ToS and it results in damages or losses, then perhaps you have a more reasonable civil case than one invoking CFAA, but IANAL.
- tdrp 6y ago
  Thanks - I feel like there should be something to legally strong-arm banned users into staying away. CFAA is one of the most direct: “I have banned you from my site and you keep coming back so I will take you to court to make you stop”. For those users we don’t really want to get damages from them as much as we just really want to never have to deal with them again. I’d even be fine with a restraining order Against the person using the site kind of thing as the maximal punishment. If it were a physical store and you kicked someone out for bad behavior and then they kept coming back by wearing different wigs or something, it would still be illegal.
phkahler 6y ago
>> Or are there any other laws which would cover this kind of unauthorized access? Here's the thing. Violating terms of service and unauthorized access are two different things. Your site apparently is publically accessible and anyone can create a fake user profile. You are not vetting anyone or granting any specific person access.
- tdrp 6y ago
  I mean they would log in with FB, through a VPN, then verify a phone number which was usually some throwaway. I am not sure how we could be more strict short of asking all of our users for pictures of their IDs. We were explicit with the user that they were banned and not allowed on the site anymore. I wonder how we would have made sure that user never returned.
  - rmrfstar 6y ago
    If you were a local corner store and you had a disruptive customer who returned repeatedly, your recourse would be calling the cops for trespass. CFAA violations come with 5-10 year prison sentences per violation. A little extreme for a trespasser whose conduct is otherwise non-criminal, don't you think?
    - tdrp 6y ago
      Definitely extreme - ideally I would want something like a "restraining order" against the disruptive user that legally compels them to no longer use the website. If they still break that, then probably fines+damages of some kind. But you know, something. The other extreme which some people are advocating "let the users do whatever the hell they want and it's your own fault if they keep spoofing fb accounts/phone numbers and creating new accounts" I find pretty bad and tone-deaf; it gives carte blanche to bad behavior. Any malicious user who is set on messing with you becomes a full-time job to deal with. Most people who run some kind of B2C website have run into this and once you hit 1M+ users you are bound to be dealing with a handful of those at any one time.
jfengel 6y ago
I wish FB would report when an account was established. I could ask for access to the user's postings and try to get dates on those, but that seems too intrusive. I would just like to be able to say, "Thanks for trying to sign up, but you've only had this account for 15 minutes and I don't trust you. Come back in a year when you look less like a troll." That's hardly a perfect filter, of course, but I think there's a use case for communities that err on the side of stability over the broadest audience.
- tdrp 6y ago
  Thanks I agree. We thought the same and nowadays we look through the photo upload dates to get an estimate of when it was created. It was somewhat helpful.

by tdrp 6y ago

yummypaint 6y ago

They can probably be prosecuted for the Harassment, which is a crime. IANAL but if you offer free automated signups with any email address it seems like invoking the CFAA is a stretch, as you aren't really taking steps to secure the system in the first place. The CFAA would be more appropriate if they are cracking admin accounts and getting into the back-end.

tdrp 6y ago
It seems like any harassment complaint would have to be raised by the victims directly rather than by us, the service provider. In practice they just leave the site and never come back. So what would the recourse be in this case for a bad actor? How about for one who generates dozens of accounts every day and spams others?

tuxxy 6y ago

> Would CFAA still apply here if EFF wins this case? I hope not! What you described here is a great example of why EFF should win this case. Violating ToS is not and _should not_ be cause for civil or criminal action. If you don't want this user on your service, then remove them. If they continually violate your ToS and it results in damages or losses, then perhaps you have a more reasonable civil case than one invoking CFAA, but IANAL.

tdrp 6y ago
Thanks - I feel like there should be something to legally strong-arm banned users into staying away. CFAA is one of the most direct: “I have banned you from my site and you keep coming back so I will take you to court to make you stop”. For those users we don’t really want to get damages from them as much as we just really want to never have to deal with them again. I’d even be fine with a restraining order Against the person using the site kind of thing as the maximal punishment. If it were a physical store and you kicked someone out for bad behavior and then they kept coming back by wearing different wigs or something, it would still be illegal.

phkahler 6y ago

>> Or are there any other laws which would cover this kind of unauthorized access? Here's the thing. Violating terms of service and unauthorized access are two different things. Your site apparently is publically accessible and anyone can create a fake user profile. You are not vetting anyone or granting any specific person access.

tdrp 6y ago
I mean they would log in with FB, through a VPN, then verify a phone number which was usually some throwaway. I am not sure how we could be more strict short of asking all of our users for pictures of their IDs. We were explicit with the user that they were banned and not allowed on the site anymore. I wonder how we would have made sure that user never returned.
- rmrfstar 6y ago
  If you were a local corner store and you had a disruptive customer who returned repeatedly, your recourse would be calling the cops for trespass. CFAA violations come with 5-10 year prison sentences per violation. A little extreme for a trespasser whose conduct is otherwise non-criminal, don't you think?
  - tdrp 6y ago
    Definitely extreme - ideally I would want something like a "restraining order" against the disruptive user that legally compels them to no longer use the website. If they still break that, then probably fines+damages of some kind. But you know, something. The other extreme which some people are advocating "let the users do whatever the hell they want and it's your own fault if they keep spoofing fb accounts/phone numbers and creating new accounts" I find pretty bad and tone-deaf; it gives carte blanche to bad behavior. Any malicious user who is set on messing with you becomes a full-time job to deal with. Most people who run some kind of B2C website have run into this and once you hit 1M+ users you are bound to be dealing with a handful of those at any one time.

jfengel 6y ago

I wish FB would report when an account was established. I could ask for access to the user's postings and try to get dates on those, but that seems too intrusive. I would just like to be able to say, "Thanks for trying to sign up, but you've only had this account for 15 minutes and I don't trust you. Come back in a year when you look less like a troll." That's hardly a perfect filter, of course, but I think there's a use case for communities that err on the side of stability over the broadest audience.

tdrp 6y ago
Thanks I agree. We thought the same and nowadays we look through the photo upload dates to get an estimate of when it was created. It was somewhat helpful.