3 ms·

I think the problem with the deception test is that if the login screen for the DMV database access had a checkbox that said "I am only using the system in a wa

I think the problem with the deception test is that if the login screen for the DMV database access had a checkbox that said "I am only using the system in a way consistent with department policies" or something, then you could argue that checking that box was deceitful. I think Congress' intent with CCFA was to criminalize hacking. There are already laws against fraud, so we don't need a deceitfulness test to catch, say, social engineering. The problem I think is that CCFA was written in 1986 and not enough people understood what hacking was well enough to write it down clearly in the law, so instead the "excess of authorized access" language is in the law, and has been used to criminalize lots of things that aren't really hacking and Congress didn't intend to criminalize with the CCFA.

Natsu 5y ago
I think that is a real worry and you're not wrong that that's a hard test to pass. I just wish for a brighter line over what 'unauthorized' means and it's hard to do that in a way that doesn't let companies write AUPs that effectively define the scope of criminal laws in some way.
- repiret 5y ago
  The decision talks about a gates-up-or-down analysis, which seems like the seed of a reasonable test: when the gates are up, entering a restricted area isn’t criminalized; when the gates are down, picking the lock or finding a home in the wall is criminalized. I haven’t read the decision closely enough yet to see how well developed that idea is.