5 ms·
Could these "Researchers" be prosecuted under CFAA? Purposely accessing information known to be private? EDIT: accidently wrote DMCA
by swalsh 6y ago
Could these "Researchers" be prosecuted under CFAA? Purposely accessing information known to be private?
EDIT: accidently wrote DMCA
- Miner49er 6y agoYes, of course. This is an illegal hack. Edit: I should add, it would be under the CFAA. Edit #2: I could be wrong, it looks like they used Parler's APIs, and didn't bypass any auth. I really shouldn't have even called this a hack, it's more just archiving. But weev went to jail for the same thing, so I'd say there's a chance of prosecution, would come down to a court case. If I was the person who did this, I would never step foot in America, just to be safe.
- ceejayoz 6y agoIs it? The article indicates at least some of this comes from merely incrementing an integer in the video URLs. > I am now crawling URLs of all videos uploaded to Parler. Sequentially from latest to oldest. VIDXXX.txt files coming up, 50k chunks, there will be 1.1M URLs total...
- dragontamer 6y agoI believe from a legal standpoint, all that matters is whether the user intended it to be private or not. It is a felony to open a mail envelope addressed to someone else. It doesn't matter that a butterknife can cut open the envelope, the intent is clear.
- andromeduck 6y agoThis is more a postcard than a letter.
- dragontamer 6y agoThe public posts are probably allowed to be accessed (like a postcard). The issue comes with the posts that were deleted: they arguably have an expectation of privacy. EDIT: And direct messages, if they work like Twitter, DEFINITELY have an expectation of privacy. If Parler has a DM-like system, they are probably illegal to access.
- lmkg 6y agoAt least one person has already been prosecuted for "hacking" for incrementing integers in a URL.
- deleted 6y ago[deleted]
- bgentry 6y agoPeople have been sent to prison before for nothing more than fetching publicly available web pages by incrementing numbers in a URL: https://en.wikipedia.org/wiki/Weev https://en.wikipedia.org/wiki/Weev
- ceejayoz 6y agoWe tend to think that's bad and an incorrect definition of cracking that should be overturned around here, right? > the conviction was vacated by a higher court > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained.
- deleted 6y ago[deleted]
- Eupolemos 6y agoI don't know how it works "over there", but where I'm from "URL-hacking" is not considered hacking, but data publicly available.
- rob74 6y ago...and you are 100% sure that if this got before a court, the decision would go your way?
- Eupolemos 6y agoNo, I am not a lawyer. I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale___Straffelovens___263__stk._1.pdf https://projekter.aau.dk/projekter/files/305754822/Speciale_... But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacking-ikke-hacking-1076182 https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...
- Miner49er 6y agoWeev when to jail for the exact same thing under the CFAA.
- ceejayoz 6y agoWeev's conviction was vacated.
- Miner49er 6y agoOn a technicality because of where he was charged, not because of the law. I don't think he should have ever been convicted under the CFAA, but he was.
- ceejayoz 6y agoFrom Wiki on his case: > While the judges did not address the substantive question on the legality of the site access, they were skeptical of the original conviction, noting that no circumvention of passwords had occurred and that only publicly accessible information was obtained. It's a pity it didn't make it to full review on appeal to get a solid ruling on this.
- deleted 6y ago[deleted]
- rvz 6y agoWell if I were to do the same to any social network, I would have to request their permission first on the basis of security research according to their Terms of Service. In this case it is still an unauthorised hack.
- lmkg 6y agoDMCA is only for intellectual property, not private information in general. There are other laws this would likely fall under. Laws against hacking are generally "access in excess of authorization," where "authorization" is legal permission, not system permission.
- swalsh 6y agoI think I meant to write CFAA, thanks for pointing that out. Comment updated.
- Anon1096 6y agoI think the extracting of the data will definitely go to court as a violation of the CFAA. The publishing of the data might also fall under the DMCA but it sounds less plausible to me. I'm not a lawyer so take this with a grain of salt.
- AnHonestComment 6y agoPublishing the data could be DMCA’d by the authors of the original messages.
- base698 6y agoPractically no. Judges, tech community lobbyists, and basically the entire state is on their side.
- neartheplain 6y agoThat's not really how it works, jury nullification notwithstanding.
- nrmitchi 6y agoTrigger warning, but this reminds me of the Steubenville High school rape case (you can google it). A hacker accessed and leaked video of the situation in question (IIRC after officials refused to take action, and gone as far as too allegedly cover up the incident in order to protect the athletes and school's program). At least one of the individuals responsible for leaking the video was charged under CFAA. IIRC this individual received a harsher sentence than those involved in the underlying crime. You'd like to think that a judge and entire state would be understanding, but that's not always the case and not something to depend on.
- diebeforei485 6y agoPossibly. Automatically creating fake user accounts[1] likely falls into that category. I'm not in favor of vigilante justice. I hope some of these people do sued under the CFAA. If all they wanted to do was archive public posts, there are ways to do that that don't involve programmatically creating fake accounts. [1] https://archive.is/Dupjk https://archive.is/Dupjk
- GaryNumanVevo 6y agoDoubtful, all the links were publicly accessible. I believe the researcher just crawled the "video.parler.com" domain after finding out they used sequential IDs. Allegedly Parler didn't scrub exif data from any media, including all of their "verification" materials including Drivers Licenses and Passports.