4 ms·

When it comes to web scraping, it feels like what is considered a crime is highly dependent on how eager prosecutors can be to charge you with unauthorized acce

by thamer 6y ago

When it comes to web scraping, it feels like what is considered a crime is highly dependent on how eager prosecutors can be to charge you with unauthorized access. It is common to read tech articles about security vulnerabilities where web pages were left unprotected, the flaw being verified by a journalist or the person reporting the issue. This is what was used against weev[1] when he crawled an AT&T website and dumped subscriber e-mail addresses, to sentence him to 41 months in prison. Don't get me wrong, weev is a terrible person that society should be protected from, but the severity of this sentence felt completely out of place for both the supposed "crime" and the banality of what he did. [1] https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

Grazester 6y ago
He may also want to read this https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-data-scraping-cfaa-lawsuit-ninth-circuit-ruling https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-dat...
colejohnson66 6y ago
Well, to be fair, sharing the exposed data to the public is a pretty jerk thing to do, so I could understand wanting him punished for it. He’s lucky with his sentence, though; 41 months, while disproportionate to the crime, is still better than he could’ve gotten.
auganov 6y ago
Correct me if I'm wrong but it wasn't publicly available in the sense that it was linked to from some publicly facing website. I'm understanding that they found some URL scheme that spit out these records. So quite an edge case. People have been prosecuted for stealing data from unsecured s3 buckets too. If you could reasonably infer that you're not supposed to have access, try to obtain it and then go on to share that data with the media (which only acknowledges you know you're not supposed to have it) then I don't see a huge problem with prosecuting it. Usually by scraping I understand accessing something that's already being accessed by clients and you're merely automating what's already happening. Now if someone inadvertently obtained this kind of data without trying (say part of a bigger scrape) and didn't use or distribute it then obviously I don't want to see that prosecuted. And I doubt it would be.
x86ARMsRace 6y ago
If I recall, weev was released after the conviction was vacated. Looks like the reason is that the violation was revisited and determined to be insufficient for the conviction. I do, however, also recall weev saying how he spent most of his time in prison throwing nazi salutes and singing songs about white pride.

by thamer 6y ago

Grazester 6y ago

He may also want to read this https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-data-scraping-cfaa-lawsuit-ninth-circuit-ruling https://www.theverge.com/2019/9/10/20859399/linkedin-hiq-dat...

colejohnson66 6y ago

Well, to be fair, sharing the exposed data to the public is a pretty jerk thing to do, so I could understand wanting him punished for it. He’s lucky with his sentence, though; 41 months, while disproportionate to the crime, is still better than he could’ve gotten.

auganov 6y ago

Correct me if I'm wrong but it wasn't publicly available in the sense that it was linked to from some publicly facing website. I'm understanding that they found some URL scheme that spit out these records. So quite an edge case. People have been prosecuted for stealing data from unsecured s3 buckets too. If you could reasonably infer that you're not supposed to have access, try to obtain it and then go on to share that data with the media (which only acknowledges you know you're not supposed to have it) then I don't see a huge problem with prosecuting it. Usually by scraping I understand accessing something that's already being accessed by clients and you're merely automating what's already happening. Now if someone inadvertently obtained this kind of data without trying (say part of a bigger scrape) and didn't use or distribute it then obviously I don't want to see that prosecuted. And I doubt it would be.

x86ARMsRace 6y ago

If I recall, weev was released after the conviction was vacated. Looks like the reason is that the violation was revisited and determined to be insufficient for the conviction. I do, however, also recall weev saying how he spent most of his time in prison throwing nazi salutes and singing songs about white pride.