3 ms·
The heart of this is the difference between legal authorization vs technical authorization. Legally, it is (or rather, used to be) OK to say "you have have acce
by lmkg 5y ago
The heart of this is the difference between legal authorization vs technical authorization. Legally, it is (or rather, used to be) OK to say "you have have access to data X for purpose Y." While the technical controls could not enforce restrictions on the purpose, it was understood that purpose limitation was valid. There was an understanding that technical controls are only an approximation of policy, and it's the policy that has legal weight when determining what access is authorized.
Hopefully this particular case also runs afoul of other laws. Like something about granting access to unauthorized individuals, which is what the defendant was doing (selling government data). That can, and perhaps should be, separately illegal from accessing data for improper purposes.
- phkahler 5y ago>> The heart of this is the difference between legal authorization vs technical authorization. We must not confuse legal authorization (felony for violation) with private or contractual agreements. Any law that allows private entities to define what actions constitute a felony is bad, and hopefully unconstitutional. Technical access measures are somewhat like physical locks. Terms of use are more similar to contracts. IANAL so my analogies my be crap.
- ClumsyPilot 5y agoThis is a very good point and what people often confuse. There is a crime of breaking and entering - and thats well defined. Then there are permissions of: "you can be in my house as long as you dont use the bathrolm and only wear pink socks" - if a person were to wear green socks, you can icik them out, but it does not suddenly become a home invasion