3 ms·

IANAL, but I'd imagine that for US folks, violating the intent of the code -- namely, doing something while lacking the authorization to do so -- is illegal, ev

by jude- 5y ago

IANAL, but I'd imagine that for US folks, violating the intent of the code -- namely, doing something while lacking the authorization to do so -- is illegal, even if the code lets you do it. Otherwise, basically all forms of criminal hacking would be legal. Of course, if the smart contract expressly permitted anyone to take tokens out of it via any means allowed by the platform, that's a different story.

TheRealPomax 5y ago
Except in the US you can't sue on just intent, the letter of the law still needs to agree. So if the smart contract permits something, by not forbidding it, that something is entirely legal.
- jude- 5y ago
  That can't be right. That would mean that all forms of hacking are legal, since after all, the remote server permitted you to run your shell code.
jcranmer 5y ago
The law you're thinking of is CFAA, and it's not clear that this violates the CFAA. The requisite element is "accesses [...] without authorization or exceeds authorized access." Given the general enthusiasm of blockchain proponents to believe that "the code is law", it's a pretty easy argument to make that taking advantage of poorly-written code is well within the user's authorized capabilities. Will it win in court? shrug
- jude- 5y ago
  Again IANAL, but I think there's more to it than "the code is law." If we accept that hacking is illegal, then we must also accept that the law recognizes a difference between what the code does and what the code intended to do. I would think that this means that the courts would recognize a faulty but good-faith attempt at an authorization check on token movements to be evidence of the developer's intent to prevent tokens from being moved without authorization. If so, then they would further conclude that token movement that doesn't follow the intended authorization code paths is a violation of the CFAA.
  - jcranmer 5y ago
    IANAL either, but from my following of SCOTUS and other law cases, it does seem that the actual judicial interpretation of CFAA's authorization requirements is kind of vague and unsettled. There's a pending case before SCOTUS this term about CFAA (although it's not directly related to what the question in this thread, it's possible the opinion weighs in on it). Reading the amici, I'm not sure I'd find any consensus as to whether or not people believe this kind of access violates or doesn't violate the CFAA. That's why I ended with shrug--there's not enough clarity to answer if it is or isn't legal with any degree of certainty.
    - NovemberWhiskey 5y ago
      I think regardless of the circuit split on the meaning of "authorization", it seems fairly well settled that the meaning is not "what the computer system allows you to do". e.g. Van Buren is about resolving the question of whether someone who is given access to a computer system for their job can be considered to have used it in an "unauthorized" way if they use that system in ways that are unrelated to that job. The circuit-level decisions both start from the position "authorized" means something like "the owner of the computer has decided to grant access", which is more rather than less. i.e. X intended to give Y access (this is the part of "authorized" on which there is consensus) but Y used it for purposes that X did not approve of (this is the subject matter of the disagreement)

by jude- 5y ago

TheRealPomax 5y ago

Except in the US you can't sue on just intent, the letter of the law still needs to agree. So if the smart contract permits something, by not forbidding it, that something is entirely legal.

jude- 5y ago
That can't be right. That would mean that all forms of hacking are legal, since after all, the remote server permitted you to run your shell code.

jcranmer 5y ago

The law you're thinking of is CFAA, and it's not clear that this violates the CFAA. The requisite element is "accesses [...] without authorization or exceeds authorized access." Given the general enthusiasm of blockchain proponents to believe that "the code is law", it's a pretty easy argument to make that taking advantage of poorly-written code is well within the user's authorized capabilities. Will it win in court? shrug

jude- 5y ago
Again IANAL, but I think there's more to it than "the code is law." If we accept that hacking is illegal, then we must also accept that the law recognizes a difference between what the code does and what the code intended to do. I would think that this means that the courts would recognize a faulty but good-faith attempt at an authorization check on token movements to be evidence of the developer's intent to prevent tokens from being moved without authorization. If so, then they would further conclude that token movement that doesn't follow the intended authorization code paths is a violation of the CFAA.
- jcranmer 5y ago
  IANAL either, but from my following of SCOTUS and other law cases, it does seem that the actual judicial interpretation of CFAA's authorization requirements is kind of vague and unsettled. There's a pending case before SCOTUS this term about CFAA (although it's not directly related to what the question in this thread, it's possible the opinion weighs in on it). Reading the amici, I'm not sure I'd find any consensus as to whether or not people believe this kind of access violates or doesn't violate the CFAA. That's why I ended with shrug--there's not enough clarity to answer if it is or isn't legal with any degree of certainty.
  - NovemberWhiskey 5y ago
    I think regardless of the circuit split on the meaning of "authorization", it seems fairly well settled that the meaning is not "what the computer system allows you to do". e.g. Van Buren is about resolving the question of whether someone who is given access to a computer system for their job can be considered to have used it in an "unauthorized" way if they use that system in ways that are unrelated to that job. The circuit-level decisions both start from the position "authorized" means something like "the owner of the computer has decided to grant access", which is more rather than less. i.e. X intended to give Y access (this is the part of "authorized" on which there is consensus) but Y used it for purposes that X did not approve of (this is the subject matter of the disagreement)