4 ms·

Ever since Aaron Swartz, I wouldn't bet on scraping and then publically dumping data to be risk free legally, even if said data was public/badly protected to be

Ever since Aaron Swartz, I wouldn't bet on scraping and then publically dumping data to be risk free legally, even if said data was public/badly protected to begin with.

adler0901 6y ago
what I came here to say
sigzero 6y ago
His case was entirely different from what happened to Parler but I get the uneasiness.
gravypod 6y ago
Leonard French had a video in the past year where he stressed that the "ease" of doing something did not make it legal. From what I understand if you have any amount of protection on your information (and one might count visibility: hidden as a protection) then its possible you are violating the computer fraud and abuse act. The law isn't specific and only requires you do something that the system owners did not reasonably expect you would do.
- curryst 6y ago
  In HiQ vs LinkedIn, on the injunction the Ninth Circuit Court granted HiQ's injunctions on the grounds that they had raised serious concerns over whether the CFAA can apply at all to systems that do not have an access control mechanism. > Public LinkedIn profiles, available to anyone with an Internet connection, fall into the first category. With regard to such information, the “breaking and entering” analogue invoked so frequently during congressional consideration has no application, and the concept of “without authorization” is inapt. "visibility: hidden" is unlikely to meet that burden. It's not any kind of access control mechanism; the people who are able to see it are defined by their knowledge of the tool, not by being granted access. This is the criteria they used: > Put differently, the CFAA contemplates the existence of three kinds of computer information: (1) information for which access is open to the general public and permission is not required, (2) information for which authorization is required and has been given, and (3) information for which authorization is required but has not been given (or, in the case of the prohibition on exceeding authorized access, has not been given for the part of the system accessed). Obfuscation does not require any kind of authorization. It makes it more difficult to extract information, but I think you would have a hard time arguing that other users are not authorized simply because they don't know the URL. There isn't even a list of who is allowed, so "granting" access in this case is nonsensical. The only way I can see this being illegal is if Parler can successfully argue that they intended for this to require authorization, the scraper knew that Parler intended this to require authorization, and that it's a violation of the CFAA to do something that the provider didn't intend for you to be allowed to do. I don't see that as a remotely likely outcome.
ryanlol 6y ago
> even if said data was public Here’s a huge difference between the Swartz case and Parler, the data Swartz was scraping wasn’t public.

Ever since Aaron Swartz, I wouldn't bet on scraping and then publically dumping data to be risk free legally, even if said data was public/badly protected to begin with.

adler0901 6y ago

what I came here to say

sigzero 6y ago

His case was entirely different from what happened to Parler but I get the uneasiness.

gravypod 6y ago

Leonard French had a video in the past year where he stressed that the "ease" of doing something did not make it legal. From what I understand if you have any amount of protection on your information (and one might count visibility: hidden as a protection) then its possible you are violating the computer fraud and abuse act. The law isn't specific and only requires you do something that the system owners did not reasonably expect you would do.

curryst 6y ago
In HiQ vs LinkedIn, on the injunction the Ninth Circuit Court granted HiQ's injunctions on the grounds that they had raised serious concerns over whether the CFAA can apply at all to systems that do not have an access control mechanism. > Public LinkedIn profiles, available to anyone with an Internet connection, fall into the first category. With regard to such information, the “breaking and entering” analogue invoked so frequently during congressional consideration has no application, and the concept of “without authorization” is inapt. "visibility: hidden" is unlikely to meet that burden. It's not any kind of access control mechanism; the people who are able to see it are defined by their knowledge of the tool, not by being granted access. This is the criteria they used: > Put differently, the CFAA contemplates the existence of three kinds of computer information: (1) information for which access is open to the general public and permission is not required, (2) information for which authorization is required and has been given, and (3) information for which authorization is required but has not been given (or, in the case of the prohibition on exceeding authorized access, has not been given for the part of the system accessed). Obfuscation does not require any kind of authorization. It makes it more difficult to extract information, but I think you would have a hard time arguing that other users are not authorized simply because they don't know the URL. There isn't even a list of who is allowed, so "granting" access in this case is nonsensical. The only way I can see this being illegal is if Parler can successfully argue that they intended for this to require authorization, the scraper knew that Parler intended this to require authorization, and that it's a violation of the CFAA to do something that the provider didn't intend for you to be allowed to do. I don't see that as a remotely likely outcome.

ryanlol 6y ago

> even if said data was public Here’s a huge difference between the Swartz case and Parler, the data Swartz was scraping wasn’t public.