7 ms·

I agree with this decision, but I've always advocated my own personal test for whether access is 'unauthorized' or not. Basically, I would say that unauthorize

by Natsu 5y ago

I agree with this decision, but I've always advocated my own personal test for whether access is 'unauthorized' or not. Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever). This would avoid catching people out because someone set permissions to give too much access or wrote overbroad AUPs that shouldn't be turned into federal felonies, while providing a nice bright line because you can actually test whether, if not for the deception, they'd have been granted access to the system, especially the computer side of that. So the people who used anonymous FTP with a fake email won't become felons because it's easy to prove the system lets in everyone no matter what their email is set to, whereas the person using someone else's credentials lied to the system about who they are and should get punished, etc. I think that my test would be consistent with this holding, but remember that this is merely my view of how the law should be. It's not a description of how the law is, it's something I would advocate that I believe provides a reasonable boundary between authorized an unauthorized access that's both clear and testable.

pessimizer 5y ago
What if I, as your employer, say "you're not authorized to look at records that haven't been assigned to you" and you then look at a record that hasn't been assigned to you - is that unauthorized access? edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.
- Natsu 5y ago
  I'd say that should only be fraud if you lied to get access, I don't agree with interpretations that allow any random AUP to create new felonies. Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.
- shuntress 5y ago
  That is "hacking" the same way opening an unlocked filing cabinet you were told never to look in is "lockpicking".
- secothroa 5y ago
  >is that unauthorized access? Yes. And SCOTUS's problem is that they think the punishment for visiting facebook at work shouldn't be the same as the punishment for stealing company records - and that's fine, and of course something I agree with. But SCOTUS should actually address that directly, rather than going down this weird path of trying to warp the definition of "authorized".
  - techsupporter 5y ago
    > rather than going down this weird path of trying to warp the definition of "authorized". I don't think they are. I think SCOTUS is looking at this, as is their wont, from a legal perspective. We have two legal systems: civil and criminal. Both of them have the concept of "authorized." What SCOTUS has said here is that whether or not something is unauthorized may be a civil tort claim--you broke a contract--versus a criminal offense--you broke the law. That seems to be the knot everyone is trying to untie here. It's not illegal for me to break a contract with someone. It is illegal for me to break the law.
- LocalPCGuy 5y ago
  That isn't "hacking" as defined by the CFAA (according to this ruling). It's certainly not following your employer's policies, but your employer policies should not rise to the level of potential federal criminal prosecution. Now, if your employer put software on your machine or on their network that prevents you from viewing Facebook, and you work around that restriction, it could be argued that you have now "hacked" their network and gained access you were not authorized to have. The distinction is pretty clear in the ruling - if you have access, you can do X without it being considered a violation of the CFAA (doesn't mean you can't be fired, or prosecuted for other crimes leading from the actions, or other repercussions). If you don't have access, and you figure out a way to gain access, it is now a violation of the CFAA.
bitcurious 5y ago
>Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever). Interesting test. What if you set your user agent to chrome instead of firefox and that grants you access to a website?
- aidenn0 5y ago
  That would arguably be wire-fraud (you lied over an electronic network in order to get some material gain).
- Natsu 5y ago
  Yeah, cases like this are a bit harder. Part of the idea is how important the lie is to gaining access. It is difficult to distinguish a relatively harmless lie like this, or claiming to have actually read the 1,000,000 page AUP, to someone impersonating another.
- a1369209993 5y ago
  > What if you set your user agent to chrome instead of firefox and that grants you access to a website? The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.
  - haswell 5y ago
    But where do you draw the line re: which type of "lie" matters? A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header. But what about headers that are not so well-defined? What about custom headers? I'm not disagreeing with you, but these are the first questions that come to mind. It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.
kenjackson 5y ago
> Basically, I would say that unauthorized access should require some material deception to gain access. This seems like a poor definition, IMO. For example, what if I tell you I'm going to club you over the head and get access to the computer you're on. And I do so. There was no material deception. I did exactly what I said. Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.
- takeda 5y ago
  But then that would be considered hacking only if you used an axe.
- dane-pgp 5y ago
  Presumably the argument is that you are "deceiving" the computer into thinking that you are the person whose head you clubbed, or who walked away from the counter.
  - kenjackson 5y ago
    Only if the computer had some type of technical authorization associated with it.
- Natsu 5y ago
  > For example, what if I tell you I'm going to club you over the head and get access to the computer you're on That's either a true threat, or assault and battery. It only becomes computer fraud if you fraudulently use my credentials to access the computer. > Another example is what if I just walk around the counter while you're not there. There is no one around to deceive. That's trespass, not computer fraud. There's more than one crime on the books. Saying that something isn't computer fraud isn't claiming that all those things should be legal. Like in this case, I think it should be bribery more than computer fraud.
  - kenjackson 5y ago
    > That's trespass, not computer fraud. Why is that trespassing? There's no sign that says I can't go behind the counter? In fact, in many cases you can go behind the counter, just you aren't expected to jump on their computer. The problem isn't that I'm behind the counter. The problem is that I'm using a computer I'm not authorized to use -- it's just whoever set up the computer didn't set up an authorization gateway. But really access to the computer really isn't fraud. It's what you do once your at the computer that matters much more. Its authorization for the action that matter, not access authorization.
repiret 5y ago
I think the problem with the deception test is that if the login screen for the DMV database access had a checkbox that said "I am only using the system in a way consistent with department policies" or something, then you could argue that checking that box was deceitful. I think Congress' intent with CCFA was to criminalize hacking. There are already laws against fraud, so we don't need a deceitfulness test to catch, say, social engineering. The problem I think is that CCFA was written in 1986 and not enough people understood what hacking was well enough to write it down clearly in the law, so instead the "excess of authorized access" language is in the law, and has been used to criminalize lots of things that aren't really hacking and Congress didn't intend to criminalize with the CCFA.
- Natsu 5y ago
  I think that is a real worry and you're not wrong that that's a hard test to pass. I just wish for a brighter line over what 'unauthorized' means and it's hard to do that in a way that doesn't let companies write AUPs that effectively define the scope of criminal laws in some way.
  - repiret 5y ago
    The decision talks about a gates-up-or-down analysis, which seems like the seed of a reasonable test: when the gates are up, entering a restricted area isn’t criminalized; when the gates are down, picking the lock or finding a home in the wall is criminalized. I haven’t read the decision closely enough yet to see how well developed that idea is.

by Natsu 5y ago

pessimizer 5y ago

What if I, as your employer, say "you're not authorized to look at records that haven't been assigned to you" and you then look at a record that hasn't been assigned to you - is that unauthorized access? edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.

Natsu 5y ago
I'd say that should only be fraud if you lied to get access, I don't agree with interpretations that allow any random AUP to create new felonies. Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.
shuntress 5y ago
That is "hacking" the same way opening an unlocked filing cabinet you were told never to look in is "lockpicking".
secothroa 5y ago
>is that unauthorized access? Yes. And SCOTUS's problem is that they think the punishment for visiting facebook at work shouldn't be the same as the punishment for stealing company records - and that's fine, and of course something I agree with. But SCOTUS should actually address that directly, rather than going down this weird path of trying to warp the definition of "authorized".
- techsupporter 5y ago
  > rather than going down this weird path of trying to warp the definition of "authorized". I don't think they are. I think SCOTUS is looking at this, as is their wont, from a legal perspective. We have two legal systems: civil and criminal. Both of them have the concept of "authorized." What SCOTUS has said here is that whether or not something is unauthorized may be a civil tort claim--you broke a contract--versus a criminal offense--you broke the law. That seems to be the knot everyone is trying to untie here. It's not illegal for me to break a contract with someone. It is illegal for me to break the law.
LocalPCGuy 5y ago
That isn't "hacking" as defined by the CFAA (according to this ruling). It's certainly not following your employer's policies, but your employer policies should not rise to the level of potential federal criminal prosecution. Now, if your employer put software on your machine or on their network that prevents you from viewing Facebook, and you work around that restriction, it could be argued that you have now "hacked" their network and gained access you were not authorized to have. The distinction is pretty clear in the ruling - if you have access, you can do X without it being considered a violation of the CFAA (doesn't mean you can't be fired, or prosecuted for other crimes leading from the actions, or other repercussions). If you don't have access, and you figure out a way to gain access, it is now a violation of the CFAA.

bitcurious 5y ago

>Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever). Interesting test. What if you set your user agent to chrome instead of firefox and that grants you access to a website?

aidenn0 5y ago
That would arguably be wire-fraud (you lied over an electronic network in order to get some material gain).
Natsu 5y ago
Yeah, cases like this are a bit harder. Part of the idea is how important the lie is to gaining access. It is difficult to distinguish a relatively harmless lie like this, or claiming to have actually read the 1,000,000 page AUP, to someone impersonating another.
a1369209993 5y ago
> What if you set your user agent to chrome instead of firefox and that grants you access to a website? The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.
- haswell 5y ago
  But where do you draw the line re: which type of "lie" matters? A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header. But what about headers that are not so well-defined? What about custom headers? I'm not disagreeing with you, but these are the first questions that come to mind. It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.

kenjackson 5y ago

> Basically, I would say that unauthorized access should require some material deception to gain access. This seems like a poor definition, IMO. For example, what if I tell you I'm going to club you over the head and get access to the computer you're on. And I do so. There was no material deception. I did exactly what I said. Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.

takeda 5y ago
But then that would be considered hacking only if you used an axe.
dane-pgp 5y ago
Presumably the argument is that you are "deceiving" the computer into thinking that you are the person whose head you clubbed, or who walked away from the counter.
- kenjackson 5y ago
  Only if the computer had some type of technical authorization associated with it.
Natsu 5y ago
> For example, what if I tell you I'm going to club you over the head and get access to the computer you're on That's either a true threat, or assault and battery. It only becomes computer fraud if you fraudulently use my credentials to access the computer. > Another example is what if I just walk around the counter while you're not there. There is no one around to deceive. That's trespass, not computer fraud. There's more than one crime on the books. Saying that something isn't computer fraud isn't claiming that all those things should be legal. Like in this case, I think it should be bribery more than computer fraud.
- kenjackson 5y ago
  > That's trespass, not computer fraud. Why is that trespassing? There's no sign that says I can't go behind the counter? In fact, in many cases you can go behind the counter, just you aren't expected to jump on their computer. The problem isn't that I'm behind the counter. The problem is that I'm using a computer I'm not authorized to use -- it's just whoever set up the computer didn't set up an authorization gateway. But really access to the computer really isn't fraud. It's what you do once your at the computer that matters much more. Its authorization for the action that matter, not access authorization.

repiret 5y ago

I think the problem with the deception test is that if the login screen for the DMV database access had a checkbox that said "I am only using the system in a way consistent with department policies" or something, then you could argue that checking that box was deceitful. I think Congress' intent with CCFA was to criminalize hacking. There are already laws against fraud, so we don't need a deceitfulness test to catch, say, social engineering. The problem I think is that CCFA was written in 1986 and not enough people understood what hacking was well enough to write it down clearly in the law, so instead the "excess of authorized access" language is in the law, and has been used to criminalize lots of things that aren't really hacking and Congress didn't intend to criminalize with the CCFA.

Natsu 5y ago
I think that is a real worry and you're not wrong that that's a hard test to pass. I just wish for a brighter line over what 'unauthorized' means and it's hard to do that in a way that doesn't let companies write AUPs that effectively define the scope of criminal laws in some way.
- repiret 5y ago
  The decision talks about a gates-up-or-down analysis, which seems like the seed of a reasonable test: when the gates are up, entering a restricted area isn’t criminalized; when the gates are down, picking the lock or finding a home in the wall is criminalized. I haven’t read the decision closely enough yet to see how well developed that idea is.