6 ms·

Appeals Court: No Hacking Required to Be Prosecuted as a Hacker

42 points by ssclafani 16y ago

alok-g 16y ago
>> unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period Going from $4999.99 to $5000.00 turns it from nothing to a federal crime! If we engineers were making such stupid algorithms, nothing these law-makers use in their daily lives would work!
- pyre 16y ago
  On the other hand, you would be complaining that the law was 'too broad' if it only defined it as a 'significant amount' or something equally as nebulous.
  - alok-g 16y ago
    "Make everything as simple as possible, but not simpler." - Albert Einstein There are more options besides making it over-simple, or leaving it incomplete (nebulous).
- icegreentea 16y ago
  Uh huh. And all it takes is a few seconds for kiddy porn to become normal porn, and underage drinking to be normal drinking, and voting from some future possibility to a choice you actually have to make (..or ignore i guess...). Arbitrary hard delineations suck (even the law makers know that). They're just necessary at times.
hga 16y ago
Volokh conspirator Orin Kerr has some good commentary on this: http://volokh.com/2011/04/28/ninth-circuit-holds-that-violating-any-employer-restriction-on-computer-use-exceeds-authorized-access-making-it-a-federal-crime/ http://volokh.com/2011/04/28/ninth-circuit-holds-that-violat...
lotharbot 16y ago
There's a lot wrong with this law and certain interpretations thereof, and a lot of room to debate its appropriate reach, constitutionality, etc. But this particular objection -- that you don't need to "hack" to be prosecuted as a "hacker" -- seems strange to me, seeing as the law never uses the word hack [0]. It's not a "hacking" law, but a "fraud and related activity" law. It refers repeatedly to situations wherein a person "accesses a computer without authorization or exceeds authorized access"; the law doesn't care if that access was gained through technically impressive means (sophisticated cracks based on zero-day exploits) or mundane means (an employee misusing access). [0] http://www.law.cornell.edu/uscode/18/1030.html http://www.law.cornell.edu/uscode/18/1030.html , ctrl-f hack. It's not there.
- pyre 16y ago
  From the article: The case against Drew hinged on the government’s novel argument that violating MySpace’s terms of service was the legal equivalent of computer hacking and a violation of the CFAA. This could mean that websites that have Terms of Service agreements preventing linking to their site could constitute a Federal crime with mandatory jail time? That doesn't seem right to me.
  - dangrossman 16y ago
    Linking to a site does not involve accessing any other computer. The terms of service can show that certain access is unauthorized, they can't make unrelated activities into computer access.
  - fleitz 16y ago
    Install a greasemonkey script that modifies the text of the TOS to something more suitable to you. Ensure you document your modifications to the TOS, since no one submits the TOS to check it it would be an interesting legal point to argue as to whether the computer is an agent of the company as it's allowed to bind the company to a non-modified TOS.
- jeza 16y ago
  Just because a computer is involved, does it really make it computer fraud? Surely if you've been entrusted with information on a computer system, it should be treated in the same way as if you'd been entrusted with information on paper. They should find some other legislation more relevant to general fraud or pursue it as breach of contract if its clearly a civil matter. Computer fraud laws should be left for cases were people were never authorised to access information at all.
fleitz 16y ago
This is why I never sign those stupid HR forms. When I was asked these sorts of things I asked two questions: 1. Am I required to sign this in order to maintain my employment? 2. Can you put it in writing that I am required to sign this to maintain my employment? It never gets past question 2.
- xiaoma 16y ago
  What's the result? Do you usually get fired for no specified cause?
  - fleitz 16y ago
    I was threatened with firing once unless I started coming in at 9 am. I had never come in before 10 am and I suspect it was because the company figured I couldn't risk my job after having some legal problems. Didn't bother showing up at their requested time and a couple months later (on the ides of march, you can't say I'm not poetic) I tendered my resignation after another star programmer quit. I got yelled at because apparently I wasn't supposed to call their bluff when they were in no position to back it up. The day before my notice was up they decided it was ok for me to continue my normal schedule.
bugsy 16y ago
Completely insane!
simonh 16y ago
I'm a Brit, and live in the UK but I do access US based computer systems so I suppose I could be subject to this law. >accesses a computer without authorization or exceeds authorized access There are two possible meanings of 'authorized access' here. One is authorization by the computer's security system, e.g. file access permissions. The other is authorization according to a contract of some kind. The court in this case used the latter interpretation. Were the judges even aware that this term could be interpreted in more than one way? What was the intention of the original law in this regard, did it indicate which interpretation(s) were intended?

42 points by ssclafani 16y ago

>> unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period Going from $4999.99 to $5000.00 turns it from nothing to a federal crime! If we engineers were making such stupid algorithms, nothing these law-makers use in their daily lives would work!

pyre 16y ago
On the other hand, you would be complaining that the law was 'too broad' if it only defined it as a 'significant amount' or something equally as nebulous.
- alok-g 16y ago
  "Make everything as simple as possible, but not simpler." - Albert Einstein There are more options besides making it over-simple, or leaving it incomplete (nebulous).
icegreentea 16y ago
Uh huh. And all it takes is a few seconds for kiddy porn to become normal porn, and underage drinking to be normal drinking, and voting from some future possibility to a choice you actually have to make (..or ignore i guess...). Arbitrary hard delineations suck (even the law makers know that). They're just necessary at times.

hga 16y ago

Volokh conspirator Orin Kerr has some good commentary on this: http://volokh.com/2011/04/28/ninth-circuit-holds-that-violating-any-employer-restriction-on-computer-use-exceeds-authorized-access-making-it-a-federal-crime/ http://volokh.com/2011/04/28/ninth-circuit-holds-that-violat...

lotharbot 16y ago

There's a lot wrong with this law and certain interpretations thereof, and a lot of room to debate its appropriate reach, constitutionality, etc. But this particular objection -- that you don't need to "hack" to be prosecuted as a "hacker" -- seems strange to me, seeing as the law never uses the word hack [0]. It's not a "hacking" law, but a "fraud and related activity" law. It refers repeatedly to situations wherein a person "accesses a computer without authorization or exceeds authorized access"; the law doesn't care if that access was gained through technically impressive means (sophisticated cracks based on zero-day exploits) or mundane means (an employee misusing access). [0] http://www.law.cornell.edu/uscode/18/1030.html http://www.law.cornell.edu/uscode/18/1030.html , ctrl-f hack. It's not there.

pyre 16y ago
From the article: The case against Drew hinged on the government’s novel argument that violating MySpace’s terms of service was the legal equivalent of computer hacking and a violation of the CFAA. This could mean that websites that have Terms of Service agreements preventing linking to their site could constitute a Federal crime with mandatory jail time? That doesn't seem right to me.
- dangrossman 16y ago
  Linking to a site does not involve accessing any other computer. The terms of service can show that certain access is unauthorized, they can't make unrelated activities into computer access.
- fleitz 16y ago
  Install a greasemonkey script that modifies the text of the TOS to something more suitable to you. Ensure you document your modifications to the TOS, since no one submits the TOS to check it it would be an interesting legal point to argue as to whether the computer is an agent of the company as it's allowed to bind the company to a non-modified TOS.
jeza 16y ago
Just because a computer is involved, does it really make it computer fraud? Surely if you've been entrusted with information on a computer system, it should be treated in the same way as if you'd been entrusted with information on paper. They should find some other legislation more relevant to general fraud or pursue it as breach of contract if its clearly a civil matter. Computer fraud laws should be left for cases were people were never authorised to access information at all.

fleitz 16y ago

This is why I never sign those stupid HR forms. When I was asked these sorts of things I asked two questions: 1. Am I required to sign this in order to maintain my employment? 2. Can you put it in writing that I am required to sign this to maintain my employment? It never gets past question 2.

xiaoma 16y ago
What's the result? Do you usually get fired for no specified cause?
- fleitz 16y ago
  I was threatened with firing once unless I started coming in at 9 am. I had never come in before 10 am and I suspect it was because the company figured I couldn't risk my job after having some legal problems. Didn't bother showing up at their requested time and a couple months later (on the ides of march, you can't say I'm not poetic) I tendered my resignation after another star programmer quit. I got yelled at because apparently I wasn't supposed to call their bluff when they were in no position to back it up. The day before my notice was up they decided it was ok for me to continue my normal schedule.

bugsy 16y ago

Completely insane!

simonh 16y ago

I'm a Brit, and live in the UK but I do access US based computer systems so I suppose I could be subject to this law. >accesses a computer without authorization or exceeds authorized access There are two possible meanings of 'authorized access' here. One is authorization by the computer's security system, e.g. file access permissions. The other is authorization according to a contract of some kind. The court in this case used the latter interpretation. Were the judges even aware that this term could be interpreted in more than one way? What was the intention of the original law in this regard, did it indicate which interpretation(s) were intended?