15 ms·

I guess this is the part that matters most? "We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it ill

I guess this is the part that matters most? "We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” He did not. This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" Thomas, Alito and Roberts dissented, and I hate to say it, but I agree with them. "The question here is straightforward: Would an ordinary reader of the English language understand Van Buren to have “exceed[ed] authorized access” to the database when he used it under circumstances that were expressly forbidden? In my view, the answer is yes. The necessary precondition that permitted him to obtain that data was absent." That's Thomas dissenting.

fossuser 5y ago
> "This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" I think this would have acquitted Aaron Swartz (though he likely would have been acquitted anyway since they didn't even allege improper motive iirc). In his case he accessed journals that were available to him via MIT's open network. There is the second issue of his trespassing in a closet to leave a laptop on the network, but that would have been minor when compared to the string of felonies they charged him with which was tied to the CFAA. This seems like a good restriction to me at first glance.
- vmception 5y ago
  Do you think people will be able to acknowledge that predisposition to suicide is what killed him and not the gravity of the DA obsession to convict him? The US doesn't have the most people in prison because long sentences caused everyone to kill themselves first, its because people do the time. I just see so much focus on needing to identify a catalyst (which doesn't affect most people) instead of the pre-existing mental health issue of the person. I think this hampers the necessary conversations to be had on suicide.
  - 0003 5y ago
    Look up the eggshell doctrine. From wikipedia: The rule states that, in a tort case, the unexpected frailty of the injured person is not a valid defense to the seriousness of any injury caused to them.
    - vmception 5y ago
      this wasn't a tort case, it was a criminal case even if the family sued the state civilly there would be nothing for the state to defend against
  - deleted 5y ago
    [deleted]
  - thebooktocome 5y ago
    I don't see the need to assign a single cause to a given event, to the exclusion of all others. Most events that occur have multiple causes, with varying degrees of importance.
    - vmception 5y ago
      people are misattributing the most important one, then: planning and following through with the action incompatible with maintaining a consciousness on this plane of existence.
  - fossuser 5y ago
    > "Do you think people will be able to acknowledge that predisposition to suicide is what killed him and not the gravity of the DA obsession to convict him?" This is itself presumptive and I think largely wrong. Like most things it's a combination of factors. No doubt Aaron was struggling with depression, but facing federal prison with a trial defense costing $1.5M (even if acquitted in the end) is enough pressure to break even an otherwise healthy person. I don't understand the need for people to frame this as you are. I suspect Aaron would be alive today if the prosecution had shown some discretion. In this specific case, it would also have been the right/just thing as well as the legally correct thing.
austincheney 5y ago
Exceeded authorized access commonly refers to privilege escalation, which means access to a resource beyond his/her level of granted permission, whether by modification of technical controls, social engineering, or physical access. That is not what happened here. The access to the resource occurred exactly in accordance with the access controls and authority granted, but the motivation and intention were in clear ethical violation. Judge Barret said exactly this in her opinion.
lmkg 5y ago
The heart of this is the difference between legal authorization vs technical authorization. Legally, it is (or rather, used to be) OK to say "you have have access to data X for purpose Y." While the technical controls could not enforce restrictions on the purpose, it was understood that purpose limitation was valid. There was an understanding that technical controls are only an approximation of policy, and it's the policy that has legal weight when determining what access is authorized. Hopefully this particular case also runs afoul of other laws. Like something about granting access to unauthorized individuals, which is what the defendant was doing (selling government data). That can, and perhaps should be, separately illegal from accessing data for improper purposes.
- phkahler 5y ago
  >> The heart of this is the difference between legal authorization vs technical authorization. We must not confuse legal authorization (felony for violation) with private or contractual agreements. Any law that allows private entities to define what actions constitute a felony is bad, and hopefully unconstitutional. Technical access measures are somewhat like physical locks. Terms of use are more similar to contracts. IANAL so my analogies my be crap.
  - ClumsyPilot 5y ago
    This is a very good point and what people often confuse. There is a crime of breaking and entering - and thats well defined. Then there are permissions of: "you can be in my house as long as you dont use the bathrolm and only wear pink socks" - if a person were to wear green socks, you can icik them out, but it does not suddenly become a home invasion
kayodelycaon 5y ago
The argument against the dissent is CFAA defines the terms used. Ordinary reader rule does not apply in that circumstance and nor should it.
burkaman 5y ago
The court's hypothetical is useful: > For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. Accessing data for a forbidden reason should be a fireable offense, but not criminal. So if Thomas is right, it's a very bad law. I'm not sure I agree with him though. I think if you asked an average person, they might say something like "yes I am authorized to access that database, because I have credentials, but I'm not supposed to without a good reason". I don't think there is a single plain English reading of this phrase that any large group of people would agree on.
ncallaway 5y ago
I don't agree. I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of "entitled". Since I think the opinion (at least, the little bit of it that I've skimmed) makes a fairly compelling case around the majority's interpretation of the words "so" and "entitled" I won't rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that. The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud, and I haven't abused any access control mechanisms on the computer. Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You've "exceeded the authorized access", if you interpret "entitled" and "authorized" as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony? That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me. That, combined with what I perceive as the better textual reading of the phrases "so" and "entitled", I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.
- merpnderp 5y ago
  I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.
- WillPostForFood 5y ago
  That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.
fooey 5y ago
I very much feel their ruling is correct. The CFAA is intended to target "hackers," not policy violations. Here's a quote from the ruling making the point that applying the law to something like access policy is far too broad to be viable > The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise. The Government’s approach would also inject arbitrariness into the assessment of criminal liability, because whether conduct like Van Buren’s violated the CFAA would depend on how an employer phrased the policy violated
- anonymousiam 5y ago
  I agree that the ruling is correct. The officer was granted the accesses he had, and he was fully authorized to use them. He violated a department policy by using his access improperly. The government wants to turn policy violations into a felony, and even set up a sting operation in this case to get a felony conviction. The officer should be disciplined/fired/etc. for violating department policy, but the CFAA should not be used to turn him into a felon.
  - yarcob 5y ago
    The problem is that the officer is corrupt, and he should be charged for taking a bribe. I don't think corruption is "just a policy violation", but I don't know enough about US law to know if taking bribes make you a felon or not (I would hope so, but I assume it depends on circumstances). In any case, it shouldn't matter that he used a computer to commit a crime. If he had gotten the relevant information by reading them from a paper file or by asking a coworker the crime should be the same, in my opinion.
    - Natsu 5y ago
generalizations 5y ago
It sounds similar to the problem of someone with access to a file cabinet, where they aren't allowed to use some of the files in the cabinet, but are allowed to access other files in the same cabinet.
- AnimalMuppet 5y ago
  And if do access the files that they aren't allowed to, we don't charge them with safecracking. They did something, but safecracking doesn't fit.
  - badRNG 5y ago
    Similar to if someone does something they aren't supposed to in a business, they aren't immediately charged with breaking and entering or trespass.
buu700 5y ago
My initial reaction was to agree with you, but based on my reading of the law I actually have to support the majority opinion: https://www.law.cornell.edu/uscode/text/18/1030#e_6 https://www.law.cornell.edu/uscode/text/18/1030#e_6 (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; The language here is relatively narrow. Nathan did "access a computer with authorization", and he didn't obtain information that he was "not entitled so to obtain or alter". He may have obtained it for a purpose that was expressly forbidden by the department policy, but he was permitted to obtain the information in and of itself. To qualify as being "under circumstances that were expressly forbidden", I think it would have to be a situation wherein he wasn't allowed to obtain the information in general, e.g. if he were only allowed to access it within certain hours or with a superior present. It's like the difference between giving someone your phone (which, for the sake of argument, qualifies as a "protected computer" in this scenario) and telling them that they can go through your photos so long as they don't take out their own phone and photograph any of them, and telling them that they can only open your photos while you're watching. It would be extremely rude in either case to secretly take your phone and exfiltrate your photos — and may even still be a crime in and of itself (and/or lead to follow-on crimes) — but I wouldn't consider the former to violate this particular law.
deleted 5y ago
[deleted]
duxup 5y ago
Plain English to me seems like the person in question had authorized access. His actions maybe should be criminal in some way (time to write a law maybe), but his access was authorized.
lumost 5y ago
This is the outcome of a legislative branch which can no longer legislate effectively. The courts have to "interpret" the laws into a sensible form of common law which minimizes the difference between the legislation, and practical governance concerns. Interpreting the law in such a way as to make private policy makers the arbiters of felony charges is not compatible with our society. This would be the equivalent of a restaurant letting you in, asking you to take a seat, and then charging you with a felony for choosing the wrong seat as listed on a tiny sign in the back of the restaurant.
nullc 5y ago
Civil and criminal law are distinct for a reason. In criminal law the consequences for your wrongs are much more dire-- you face the power of the state against you and you can be denied your freedom. Triggering the CFAA on policy violations creates a general tool to convert civil matters into not just a crime, but a relatively serious one! It essentially lets system operators write private law with criminal enforcement without the oversight of the public. To give a silly example: Your landlord prohibits you from painting your walls. Their payments website has some terms of US that makes it a CFAA violation to use their site with painted walls. Suddenly what otherwise might be a lawsuit over the $500 cost to repaint is a state funded attack where you face ten years in prison. It's clearly wrong to use the CFAA that way in the silly example, but it's no less wrong in less silly cases. Saying the CFAA can't be used to create private criminal law doesn't mean that policy violations can't be prosecuted-- but it means they should be prosecuted under other laws (with intentionally matched terms and penalties) or as civil matters.
- failwhaleshark 5y ago
  Actual hacking into a network with intent should be on the order of breaking-and-entering, not robbing a bank, murder, or committing acts of terrorism. Hacking to rob a bank should be the same as robbing a bank. Hacking to intentionally poison a water supply is something like terrorism. Cracking, gnireenigne copy-protection, copying a publicly-/privately-available archive of information, etc. should be "speeding tickets" not 50 years in pound-me-in-the-ass federal pen. Hacking should be seen as an amoral means to commit another act, not a specific criminal, malicious activity in-and-of-itself.
cletus 5y ago
A policy change by your employer shouldn't lead to the possibility of a criminal prosecution for "hacking" and that's the net result of what you're suggesting and what that interpretation would mean. To me this is the definition of overreach.
appleflaxen 5y ago
Would that make you a criminal if you mistyped your URL, and ended up looking at someone else's document? It seems like it would to me, and I don't like that interpretation. If you want me to keep out, then keep me out. Don't make something available to me and then accuse me of a felony when I see it.
deleted 5y ago
[deleted]
whiddershins 5y ago
Based on your quote, with no other context, using your authentication to access information you aren’t supposed to access is verbatim the scenario the law speaks to.

fossuser 5y ago

> "This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" I think this would have acquitted Aaron Swartz (though he likely would have been acquitted anyway since they didn't even allege improper motive iirc). In his case he accessed journals that were available to him via MIT's open network. There is the second issue of his trespassing in a closet to leave a laptop on the network, but that would have been minor when compared to the string of felonies they charged him with which was tied to the CFAA. This seems like a good restriction to me at first glance.

vmception 5y ago
Do you think people will be able to acknowledge that predisposition to suicide is what killed him and not the gravity of the DA obsession to convict him? The US doesn't have the most people in prison because long sentences caused everyone to kill themselves first, its because people do the time. I just see so much focus on needing to identify a catalyst (which doesn't affect most people) instead of the pre-existing mental health issue of the person. I think this hampers the necessary conversations to be had on suicide.
- 0003 5y ago
  Look up the eggshell doctrine. From wikipedia: The rule states that, in a tort case, the unexpected frailty of the injured person is not a valid defense to the seriousness of any injury caused to them.
  - vmception 5y ago
    this wasn't a tort case, it was a criminal case even if the family sued the state civilly there would be nothing for the state to defend against
- deleted 5y ago
  [deleted]
- thebooktocome 5y ago
  I don't see the need to assign a single cause to a given event, to the exclusion of all others. Most events that occur have multiple causes, with varying degrees of importance.
  - vmception 5y ago
    people are misattributing the most important one, then: planning and following through with the action incompatible with maintaining a consciousness on this plane of existence.
- fossuser 5y ago
  > "Do you think people will be able to acknowledge that predisposition to suicide is what killed him and not the gravity of the DA obsession to convict him?" This is itself presumptive and I think largely wrong. Like most things it's a combination of factors. No doubt Aaron was struggling with depression, but facing federal prison with a trial defense costing $1.5M (even if acquitted in the end) is enough pressure to break even an otherwise healthy person. I don't understand the need for people to frame this as you are. I suspect Aaron would be alive today if the prosecution had shown some discretion. In this specific case, it would also have been the right/just thing as well as the legally correct thing.

austincheney 5y ago

Exceeded authorized access commonly refers to privilege escalation, which means access to a resource beyond his/her level of granted permission, whether by modification of technical controls, social engineering, or physical access. That is not what happened here. The access to the resource occurred exactly in accordance with the access controls and authority granted, but the motivation and intention were in clear ethical violation. Judge Barret said exactly this in her opinion.

lmkg 5y ago

The heart of this is the difference between legal authorization vs technical authorization. Legally, it is (or rather, used to be) OK to say "you have have access to data X for purpose Y." While the technical controls could not enforce restrictions on the purpose, it was understood that purpose limitation was valid. There was an understanding that technical controls are only an approximation of policy, and it's the policy that has legal weight when determining what access is authorized. Hopefully this particular case also runs afoul of other laws. Like something about granting access to unauthorized individuals, which is what the defendant was doing (selling government data). That can, and perhaps should be, separately illegal from accessing data for improper purposes.

phkahler 5y ago
>> The heart of this is the difference between legal authorization vs technical authorization. We must not confuse legal authorization (felony for violation) with private or contractual agreements. Any law that allows private entities to define what actions constitute a felony is bad, and hopefully unconstitutional. Technical access measures are somewhat like physical locks. Terms of use are more similar to contracts. IANAL so my analogies my be crap.
- ClumsyPilot 5y ago
  This is a very good point and what people often confuse. There is a crime of breaking and entering - and thats well defined. Then there are permissions of: "you can be in my house as long as you dont use the bathrolm and only wear pink socks" - if a person were to wear green socks, you can icik them out, but it does not suddenly become a home invasion

kayodelycaon 5y ago

The argument against the dissent is CFAA defines the terms used. Ordinary reader rule does not apply in that circumstance and nor should it.

burkaman 5y ago

The court's hypothetical is useful: > For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. Accessing data for a forbidden reason should be a fireable offense, but not criminal. So if Thomas is right, it's a very bad law. I'm not sure I agree with him though. I think if you asked an average person, they might say something like "yes I am authorized to access that database, because I have credentials, but I'm not supposed to without a good reason". I don't think there is a single plain English reading of this phrase that any large group of people would agree on.

ncallaway 5y ago

I don't agree. I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of "entitled". Since I think the opinion (at least, the little bit of it that I've skimmed) makes a fairly compelling case around the majority's interpretation of the words "so" and "entitled" I won't rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that. The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud, and I haven't abused any access control mechanisms on the computer. Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You've "exceeded the authorized access", if you interpret "entitled" and "authorized" as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony? That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me. That, combined with what I perceive as the better textual reading of the phrases "so" and "entitled", I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.

merpnderp 5y ago
I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.
WillPostForFood 5y ago
That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.

fooey 5y ago

I very much feel their ruling is correct. The CFAA is intended to target "hackers," not policy violations. Here's a quote from the ruling making the point that applying the law to something like access policy is far too broad to be viable > The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise. The Government’s approach would also inject arbitrariness into the assessment of criminal liability, because whether conduct like Van Buren’s violated the CFAA would depend on how an employer phrased the policy violated

anonymousiam 5y ago
I agree that the ruling is correct. The officer was granted the accesses he had, and he was fully authorized to use them. He violated a department policy by using his access improperly. The government wants to turn policy violations into a felony, and even set up a sting operation in this case to get a felony conviction. The officer should be disciplined/fired/etc. for violating department policy, but the CFAA should not be used to turn him into a felon.
- yarcob 5y ago
  The problem is that the officer is corrupt, and he should be charged for taking a bribe. I don't think corruption is "just a policy violation", but I don't know enough about US law to know if taking bribes make you a felon or not (I would hope so, but I assume it depends on circumstances). In any case, it shouldn't matter that he used a computer to commit a crime. If he had gotten the relevant information by reading them from a paper file or by asking a coworker the crime should be the same, in my opinion.
  - Natsu 5y ago

generalizations 5y ago

It sounds similar to the problem of someone with access to a file cabinet, where they aren't allowed to use some of the files in the cabinet, but are allowed to access other files in the same cabinet.

AnimalMuppet 5y ago
And if do access the files that they aren't allowed to, we don't charge them with safecracking. They did something, but safecracking doesn't fit.
- badRNG 5y ago
  Similar to if someone does something they aren't supposed to in a business, they aren't immediately charged with breaking and entering or trespass.

buu700 5y ago

My initial reaction was to agree with you, but based on my reading of the law I actually have to support the majority opinion: https://www.law.cornell.edu/uscode/text/18/1030#e_6 https://www.law.cornell.edu/uscode/text/18/1030#e_6 (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; The language here is relatively narrow. Nathan did "access a computer with authorization", and he didn't obtain information that he was "not entitled so to obtain or alter". He may have obtained it for a purpose that was expressly forbidden by the department policy, but he was permitted to obtain the information in and of itself. To qualify as being "under circumstances that were expressly forbidden", I think it would have to be a situation wherein he wasn't allowed to obtain the information in general, e.g. if he were only allowed to access it within certain hours or with a superior present. It's like the difference between giving someone your phone (which, for the sake of argument, qualifies as a "protected computer" in this scenario) and telling them that they can go through your photos so long as they don't take out their own phone and photograph any of them, and telling them that they can only open your photos while you're watching. It would be extremely rude in either case to secretly take your phone and exfiltrate your photos — and may even still be a crime in and of itself (and/or lead to follow-on crimes) — but I wouldn't consider the former to violate this particular law.

deleted 5y ago

[deleted]

duxup 5y ago

Plain English to me seems like the person in question had authorized access. His actions maybe should be criminal in some way (time to write a law maybe), but his access was authorized.

lumost 5y ago

This is the outcome of a legislative branch which can no longer legislate effectively. The courts have to "interpret" the laws into a sensible form of common law which minimizes the difference between the legislation, and practical governance concerns. Interpreting the law in such a way as to make private policy makers the arbiters of felony charges is not compatible with our society. This would be the equivalent of a restaurant letting you in, asking you to take a seat, and then charging you with a felony for choosing the wrong seat as listed on a tiny sign in the back of the restaurant.

nullc 5y ago

Civil and criminal law are distinct for a reason. In criminal law the consequences for your wrongs are much more dire-- you face the power of the state against you and you can be denied your freedom. Triggering the CFAA on policy violations creates a general tool to convert civil matters into not just a crime, but a relatively serious one! It essentially lets system operators write private law with criminal enforcement without the oversight of the public. To give a silly example: Your landlord prohibits you from painting your walls. Their payments website has some terms of US that makes it a CFAA violation to use their site with painted walls. Suddenly what otherwise might be a lawsuit over the $500 cost to repaint is a state funded attack where you face ten years in prison. It's clearly wrong to use the CFAA that way in the silly example, but it's no less wrong in less silly cases. Saying the CFAA can't be used to create private criminal law doesn't mean that policy violations can't be prosecuted-- but it means they should be prosecuted under other laws (with intentionally matched terms and penalties) or as civil matters.

failwhaleshark 5y ago
Actual hacking into a network with intent should be on the order of breaking-and-entering, not robbing a bank, murder, or committing acts of terrorism. Hacking to rob a bank should be the same as robbing a bank. Hacking to intentionally poison a water supply is something like terrorism. Cracking, gnireenigne copy-protection, copying a publicly-/privately-available archive of information, etc. should be "speeding tickets" not 50 years in pound-me-in-the-ass federal pen. Hacking should be seen as an amoral means to commit another act, not a specific criminal, malicious activity in-and-of-itself.

cletus 5y ago

A policy change by your employer shouldn't lead to the possibility of a criminal prosecution for "hacking" and that's the net result of what you're suggesting and what that interpretation would mean. To me this is the definition of overreach.

appleflaxen 5y ago

Would that make you a criminal if you mistyped your URL, and ended up looking at someone else's document? It seems like it would to me, and I don't like that interpretation. If you want me to keep out, then keep me out. Don't make something available to me and then accuse me of a felony when I see it.

deleted 5y ago

[deleted]

whiddershins 5y ago

Based on your quote, with no other context, using your authentication to access information you aren’t supposed to access is verbatim the scenario the law speaks to.