3 ms·

>You can do unauthorized things without having to "work around" controls. The term "unauthorized" is overloaded. There is one sense in which he was unauthorize

>You can do unauthorized things without having to "work around" controls. The term "unauthorized" is overloaded. There is one sense in which he was unauthorized by policy. There is another sense by which he was authorized by technical access. These are separate scenarios and separate violations. It makes no sense for unauthorized-by-policy to be a violation of a computer hacking statute.

NovemberWhiskey 5y ago
There's some kind of weird penumbra here. The intent of the owner of the computer system clearly matters, but how much? At the "seems pretty clearly like unauthorized access" end of the spectrum, we can imagine someone brute-forcing a password to gain access to a system. They're "authorized by technical access" once they have the username/password, but that's surely a focal case of the kind of crime that the statute was intended to address. Alternatively, say there was a guest account activated with a default password. Would we argue that someone with no relationship to the owner who discovered the account was active and then used it was "authorized by technical access"? Presumably the answer is that authorization in that case depends on whether it was the intent to allow strangers to use the system as a guest or whether it was some kind of technical oversight. What about if you were hired as a data entry operator, but your account was accidentally set up as a superuser? The owner of the system intended to give you one level of access but accidentally gave you another. Are you a hacker if you use the unintended access grant to snoop around? Again, you're "authorized by technical access". What about if your boss puts his username/password on a post-it note on his monitor and you use his account without his knowledge? What about if you use it with his knowledge and agreement?
- hackinthebochs 5y ago
  Yeah, the issue is a lot more ambiguous than my comment let on. If I had to make a determination, I would say any specialized technical knowledge or extra effort to access the resource would fall under the CFAA. So knowing of a default guest account that wasn't pointed out to you by staff, or finding the boss' password on a post-it note and entering it would count. Being given a superuser account is even greyer. Perhaps if you come across sensitive data in the natural course of your work, then you would be safe from this law. If you recognized your elevated privileges and then went out of your way to find sensitive information, then that should be a violation.

NovemberWhiskey 5y ago

There's some kind of weird penumbra here. The intent of the owner of the computer system clearly matters, but how much? At the "seems pretty clearly like unauthorized access" end of the spectrum, we can imagine someone brute-forcing a password to gain access to a system. They're "authorized by technical access" once they have the username/password, but that's surely a focal case of the kind of crime that the statute was intended to address. Alternatively, say there was a guest account activated with a default password. Would we argue that someone with no relationship to the owner who discovered the account was active and then used it was "authorized by technical access"? Presumably the answer is that authorization in that case depends on whether it was the intent to allow strangers to use the system as a guest or whether it was some kind of technical oversight. What about if you were hired as a data entry operator, but your account was accidentally set up as a superuser? The owner of the system intended to give you one level of access but accidentally gave you another. Are you a hacker if you use the unintended access grant to snoop around? Again, you're "authorized by technical access". What about if your boss puts his username/password on a post-it note on his monitor and you use his account without his knowledge? What about if you use it with his knowledge and agreement?

hackinthebochs 5y ago
Yeah, the issue is a lot more ambiguous than my comment let on. If I had to make a determination, I would say any specialized technical knowledge or extra effort to access the resource would fall under the CFAA. So knowing of a default guest account that wasn't pointed out to you by staff, or finding the boss' password on a post-it note and entering it would count. Being given a superuser account is even greyer. Perhaps if you come across sensitive data in the natural course of your work, then you would be safe from this law. If you recognized your elevated privileges and then went out of your way to find sensitive information, then that should be a violation.