5 ms·

> Basically, I would say that unauthorized access should require some material deception to gain access. This seems like a poor definition, IMO. For example,

> Basically, I would say that unauthorized access should require some material deception to gain access. This seems like a poor definition, IMO. For example, what if I tell you I'm going to club you over the head and get access to the computer you're on. And I do so. There was no material deception. I did exactly what I said. Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.

takeda 5y ago
But then that would be considered hacking only if you used an axe.
dane-pgp 5y ago
Presumably the argument is that you are "deceiving" the computer into thinking that you are the person whose head you clubbed, or who walked away from the counter.
- kenjackson 5y ago
  Only if the computer had some type of technical authorization associated with it.
Natsu 5y ago
> For example, what if I tell you I'm going to club you over the head and get access to the computer you're on That's either a true threat, or assault and battery. It only becomes computer fraud if you fraudulently use my credentials to access the computer. > Another example is what if I just walk around the counter while you're not there. There is no one around to deceive. That's trespass, not computer fraud. There's more than one crime on the books. Saying that something isn't computer fraud isn't claiming that all those things should be legal. Like in this case, I think it should be bribery more than computer fraud.
- kenjackson 5y ago
  > That's trespass, not computer fraud. Why is that trespassing? There's no sign that says I can't go behind the counter? In fact, in many cases you can go behind the counter, just you aren't expected to jump on their computer. The problem isn't that I'm behind the counter. The problem is that I'm using a computer I'm not authorized to use -- it's just whoever set up the computer didn't set up an authorization gateway. But really access to the computer really isn't fraud. It's what you do once your at the computer that matters much more. Its authorization for the action that matter, not access authorization.
  - mananaysiempre 5y ago
    There’s actually an argument to be had around how illegal this should be. Let’s take computers out of the picture again. Suppose I know that an organization O throws out folders with sensitive data D into the trash can in their publicly-accessible lobby every Friday at 3 pm. People that want to know D pay me to come there at 2:55, root through the can and write down the pieces that they need. Should what I am doing be illegal? Whatever your answer, is it in any way different from walking around that same lobby sniffing O’s open Wi-Fi network except for “computers were involved”?
    - kenjackson 5y ago
      So how is this any different than my front door if I don't lock it. Can you just walk around in my house if the door is unlocked. Trespassing doesn't depend on doors being locked or not. The act of trespassing (and most crimes) doesn't depend on the victim setting up a suitable defense before what you've done is a crime. Even things like sex require some sort of consent (implied or otherwise) or it's a crime. Can I walk into a bank and take all the money from the vault if they leave it open? But yet somehow with a computer that isn't yours you seem to be stating that if you don't properly protect it then access to it by anyone who happens upon it is completely legal.
  - Natsu 5y ago
    > Why is that trespassing? There's no sign that says I can't go behind the counter? You wrote it as if it's somewhere you're not authorized to be, e.g. an Employee's Only section which would tend to be trespass. If you are authorized to be there and they leave records out that they shouldn't, I think that failure is on them and they need to improve security. If someone leaves a database of everyone's personal details on an open webserver, that doesn't become hacking or computer fraud if someone visits the site. I mean, I don't think it should be true that I could say "you, specifically, aren't authorized to read this post" and have that morph into a federal felony. In my view, there has to be at least some kind of notice that someone is crossing a criminal boundary. I think lying makes a decent, if imperfect, boundary. It's possible that someone can think of something better, too.
mananaysiempre 5y ago
> For example, what if I tell you I’m going to club you over the head and get access to the computer you’re on. [...] There is no material deception. Then there’s no hacking and you should be charged with assault or whatever else is appropriate. > Another example is what if I just walk around the counter while you’re not there. Then it doesn’t matter if there was an unlocked computer or an unlocked cabinet behind that counter. There doesn’t need to be, for every illegal act X, an extra special law or punishment for “X but a computer was involved”. People want a criminal penalty for hacking and maybe they’re right, but you shouldn’t try to cover every undesirable act that involves a computer with a single law any more than every undesirable act that involves a piece of paper is covered with one. You also shouldn’t claim that breaking down a door is the same as walking through an open one, even when both constitute (among other things) trespassing.
- _carbyau_ 5y ago
  This is the frustration I have with things like "cyberbullying laws". I mean, sure the usual "plain ol' bullying laws" might need an update to keep up with the times but a whole separate set of laws just to capture "but it used a computer" is silly. Mind you, I also have a thing about professional sports breaking out into punchfests. They should get prosecuted for assault or whatever just the same as anyone on the street.

takeda 5y ago

But then that would be considered hacking only if you used an axe.

dane-pgp 5y ago

Presumably the argument is that you are "deceiving" the computer into thinking that you are the person whose head you clubbed, or who walked away from the counter.

kenjackson 5y ago
Only if the computer had some type of technical authorization associated with it.

Natsu 5y ago

> For example, what if I tell you I'm going to club you over the head and get access to the computer you're on That's either a true threat, or assault and battery. It only becomes computer fraud if you fraudulently use my credentials to access the computer. > Another example is what if I just walk around the counter while you're not there. There is no one around to deceive. That's trespass, not computer fraud. There's more than one crime on the books. Saying that something isn't computer fraud isn't claiming that all those things should be legal. Like in this case, I think it should be bribery more than computer fraud.

kenjackson 5y ago
> That's trespass, not computer fraud. Why is that trespassing? There's no sign that says I can't go behind the counter? In fact, in many cases you can go behind the counter, just you aren't expected to jump on their computer. The problem isn't that I'm behind the counter. The problem is that I'm using a computer I'm not authorized to use -- it's just whoever set up the computer didn't set up an authorization gateway. But really access to the computer really isn't fraud. It's what you do once your at the computer that matters much more. Its authorization for the action that matter, not access authorization.
- mananaysiempre 5y ago
  There’s actually an argument to be had around how illegal this should be. Let’s take computers out of the picture again. Suppose I know that an organization O throws out folders with sensitive data D into the trash can in their publicly-accessible lobby every Friday at 3 pm. People that want to know D pay me to come there at 2:55, root through the can and write down the pieces that they need. Should what I am doing be illegal? Whatever your answer, is it in any way different from walking around that same lobby sniffing O’s open Wi-Fi network except for “computers were involved”?
  - kenjackson 5y ago
    So how is this any different than my front door if I don't lock it. Can you just walk around in my house if the door is unlocked. Trespassing doesn't depend on doors being locked or not. The act of trespassing (and most crimes) doesn't depend on the victim setting up a suitable defense before what you've done is a crime. Even things like sex require some sort of consent (implied or otherwise) or it's a crime. Can I walk into a bank and take all the money from the vault if they leave it open? But yet somehow with a computer that isn't yours you seem to be stating that if you don't properly protect it then access to it by anyone who happens upon it is completely legal.
- Natsu 5y ago
  > Why is that trespassing? There's no sign that says I can't go behind the counter? You wrote it as if it's somewhere you're not authorized to be, e.g. an Employee's Only section which would tend to be trespass. If you are authorized to be there and they leave records out that they shouldn't, I think that failure is on them and they need to improve security. If someone leaves a database of everyone's personal details on an open webserver, that doesn't become hacking or computer fraud if someone visits the site. I mean, I don't think it should be true that I could say "you, specifically, aren't authorized to read this post" and have that morph into a federal felony. In my view, there has to be at least some kind of notice that someone is crossing a criminal boundary. I think lying makes a decent, if imperfect, boundary. It's possible that someone can think of something better, too.

mananaysiempre 5y ago

> For example, what if I tell you I’m going to club you over the head and get access to the computer you’re on. [...] There is no material deception. Then there’s no hacking and you should be charged with assault or whatever else is appropriate. > Another example is what if I just walk around the counter while you’re not there. Then it doesn’t matter if there was an unlocked computer or an unlocked cabinet behind that counter. There doesn’t need to be, for every illegal act X, an extra special law or punishment for “X but a computer was involved”. People want a criminal penalty for hacking and maybe they’re right, but you shouldn’t try to cover every undesirable act that involves a computer with a single law any more than every undesirable act that involves a piece of paper is covered with one. You also shouldn’t claim that breaking down a door is the same as walking through an open one, even when both constitute (among other things) trespassing.

_carbyau_ 5y ago
This is the frustration I have with things like "cyberbullying laws". I mean, sure the usual "plain ol' bullying laws" might need an update to keep up with the times but a whole separate set of laws just to capture "but it used a computer" is silly. Mind you, I also have a thing about professional sports breaking out into punchfests. They should get prosecuted for assault or whatever just the same as anyone on the street.