9 ms·

Van Buren is a victory against overbroad interpretations of the CFAA

232 points by sohkamyung 5y ago

ateng 5y ago
tangetially related: Hong Kong's top court made a similar ruling on a similar case back in 2019 https://hongkongfp.com/2019/04/04/catch-computer-offence-not-apply-person-using-device-hong-kongs-top-court-rules/ https://hongkongfp.com/2019/04/04/catch-computer-offence-not...
zoobab 5y ago
Cracks in the foundation of TOS feudalism?
peterkelly 5y ago
Related: "Aaron Swartz, Vindicated" https://news.ycombinator.com/item?id=27394974 https://news.ycombinator.com/item?id=27394974
- perihelions 5y ago
  Also related: "US Supreme Court Restricts Scope of Computer Fraud and Abuse Act [pdf]" https://news.ycombinator.com/item?id=27382752 https://news.ycombinator.com/item?id=27382752
- sigzero 5y ago
  Except he wasn't. Not by this ruling.
  - olliej 5y ago
    I mean he’s dead and that’s an ok result for the police, being guilty or not doesn’t really matter. And we’ll never know if this ruling would be sufficient because again, he’s dead.
    - gscott 5y ago
      There should be some sort of count of people who committed suicide because of overcharging by prosecutors.
      - TheSpiceIsLife 5y ago
        Prosecutors could paint hit counters on the side of their cars like fight pilots do their planes (in the movies anyways).
giantg2 5y ago
Generally good news. I just hope they have specific laws about abusing government data. For example, the LEO taking money to do searches of the database and releasing that otherwise protected. information.
PureParadigm 5y ago
The key takeaway for me is how this decision affects port scanning. According to the article: > Van Buren is really good news for port scanning, for example: so long as the computer is open to the public, you don’t have to worry about the conditions for use to scan the port. As a frequent user of nmap, this is good to hear.
- chx 5y ago
  OK that's good to hear yes. But I am confused by the implications here. How is port scanning different legally from brute forcing passwords? Iterating integers is fine, iterating the dictionary is not? What if there's an integer ID in the URL but it's MD5 hash'd and I recognize for what it is and iterate integers and MD5 them?
  - quickthrowman 5y ago
    Brute forcing passwords is attempting to access a computer without authorization, port scanning.. is not
  - ncallaway 5y ago
    > How is port scanning different legally from brute forcing passwords? Because humans are trivially able to recognize the difference between those two activities. A judge that has that case in front of them can _really_ easily see the difference between those activities.
  - rocqua 5y ago
    I think brute-forcing passwords offline isn't illegal under the CFAA. Using a password you got that way would be illegal. Similarly, password stuffing (just trying many passwords on the login form) would be illegal, since you are trying to gain access. Not sure how that works if you are not successful though. Port-scanning would be fine. Interesting edge case is, what happens if you port-scan, find an open telnet port, and use it to get a shell. There is no authentication, but does that mean you are authorized? My gut says that logging in to such a telnet port (when the device is not yours) is a CFAA violation. Just like walking in to a random house when the door is open is still illegal.
mywittyname 5y ago
This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal? Aside, I do understand and agree with the argument allowing for spidering and screen scrapping. Like, if I buy a subscription to an online parts catalog, I should be able to use a bot to access that data in the same ways a human could.
- TazeTSchnitzel 5y ago
  > To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system That is not the meaning of the ruling. Nothing precludes trying someone for other crimes.
- 0110101001 5y ago
  The guy was also convicted of wire fraud and bribery. Those charges were not at question in this decision. This decision only says that looking up records you have access to is not hacking.
- JoeCortopassi 5y ago
  In your example, the information you sell would still be illegal, it just wouldn't have the added crime of hacking aka "unauthorized access" attached to it. People are calling this a win because the CFAA, as it used to be interpreted, would have had you potentially charged for changing the url of this post from 'https://news.ycombinator.com/item?id=27389500 https://news.ycombinator.com/item?id=27389500' to this 'https://news.ycombinator.com/item?id=waffles https://news.ycombinator.com/item?id=waffles'. This allowed cops/feds to charge you with crazy high penalties if they really wanted to make you sweat, see Aaron Schwartz Some of the most memorable SCOTUS cases had less than noble test cases (ever hear of Miranda rights? https://en.wikipedia.org/wiki/Miranda_v._Arizona https://en.wikipedia.org/wiki/Miranda_v._Arizona). SCOTUS isn't deciding if the defendant is a dirt bag or not, just if the very specific law is valid/applied correctly
benlivengood 5y ago
This should also make the use of open wireless access points legally protected. It was always ridiculous that an AP could broadcast "come join me" incessantly but it was potentially infringing to actually join and use the advertised network.
- ComodoHacker 5y ago
  A simple captive portal with ToS would solve it, right?
  - benlivengood 5y ago
    The problem is that the law was bad and so connecting to an unauthorized network had to happen before agreeing to ToS. It also put the onus on normal people to carefully pick SSIDs instead of on AP owners to secure their network.
caturopath 5y ago
Oral arguments at https://www.oyez.org/cases/2020/19-783 https://www.oyez.org/cases/2020/19-783 if anyone wants to listen, along with other information.
redis_mlc 5y ago
The real question is this: how did a dirty cop get a Supreme Court hearing? Who paid for that?

232 points by sohkamyung 5y ago

tangetially related: Hong Kong's top court made a similar ruling on a similar case back in 2019 https://hongkongfp.com/2019/04/04/catch-computer-offence-not-apply-person-using-device-hong-kongs-top-court-rules/ https://hongkongfp.com/2019/04/04/catch-computer-offence-not...

zoobab 5y ago

Cracks in the foundation of TOS feudalism?

peterkelly 5y ago

Related: "Aaron Swartz, Vindicated" https://news.ycombinator.com/item?id=27394974 https://news.ycombinator.com/item?id=27394974

perihelions 5y ago
Also related: "US Supreme Court Restricts Scope of Computer Fraud and Abuse Act [pdf]" https://news.ycombinator.com/item?id=27382752 https://news.ycombinator.com/item?id=27382752
sigzero 5y ago
Except he wasn't. Not by this ruling.
- olliej 5y ago
  I mean he’s dead and that’s an ok result for the police, being guilty or not doesn’t really matter. And we’ll never know if this ruling would be sufficient because again, he’s dead.
  - gscott 5y ago
    There should be some sort of count of people who committed suicide because of overcharging by prosecutors.
    - TheSpiceIsLife 5y ago
      Prosecutors could paint hit counters on the side of their cars like fight pilots do their planes (in the movies anyways).

giantg2 5y ago

Generally good news. I just hope they have specific laws about abusing government data. For example, the LEO taking money to do searches of the database and releasing that otherwise protected. information.

PureParadigm 5y ago

The key takeaway for me is how this decision affects port scanning. According to the article: > Van Buren is really good news for port scanning, for example: so long as the computer is open to the public, you don’t have to worry about the conditions for use to scan the port. As a frequent user of nmap, this is good to hear.

chx 5y ago
OK that's good to hear yes. But I am confused by the implications here. How is port scanning different legally from brute forcing passwords? Iterating integers is fine, iterating the dictionary is not? What if there's an integer ID in the URL but it's MD5 hash'd and I recognize for what it is and iterate integers and MD5 them?
- quickthrowman 5y ago
  Brute forcing passwords is attempting to access a computer without authorization, port scanning.. is not
- ncallaway 5y ago
  > How is port scanning different legally from brute forcing passwords? Because humans are trivially able to recognize the difference between those two activities. A judge that has that case in front of them can _really_ easily see the difference between those activities.
- rocqua 5y ago
  I think brute-forcing passwords offline isn't illegal under the CFAA. Using a password you got that way would be illegal. Similarly, password stuffing (just trying many passwords on the login form) would be illegal, since you are trying to gain access. Not sure how that works if you are not successful though. Port-scanning would be fine. Interesting edge case is, what happens if you port-scan, find an open telnet port, and use it to get a shell. There is no authentication, but does that mean you are authorized? My gut says that logging in to such a telnet port (when the device is not yours) is a CFAA violation. Just like walking in to a random house when the door is open is still illegal.

mywittyname 5y ago

This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal? Aside, I do understand and agree with the argument allowing for spidering and screen scrapping. Like, if I buy a subscription to an online parts catalog, I should be able to use a bot to access that data in the same ways a human could.

TazeTSchnitzel 5y ago
> To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system That is not the meaning of the ruling. Nothing precludes trying someone for other crimes.
0110101001 5y ago
The guy was also convicted of wire fraud and bribery. Those charges were not at question in this decision. This decision only says that looking up records you have access to is not hacking.
JoeCortopassi 5y ago
In your example, the information you sell would still be illegal, it just wouldn't have the added crime of hacking aka "unauthorized access" attached to it. People are calling this a win because the CFAA, as it used to be interpreted, would have had you potentially charged for changing the url of this post from 'https://news.ycombinator.com/item?id=27389500 https://news.ycombinator.com/item?id=27389500' to this 'https://news.ycombinator.com/item?id=waffles https://news.ycombinator.com/item?id=waffles'. This allowed cops/feds to charge you with crazy high penalties if they really wanted to make you sweat, see Aaron Schwartz Some of the most memorable SCOTUS cases had less than noble test cases (ever hear of Miranda rights? https://en.wikipedia.org/wiki/Miranda_v._Arizona https://en.wikipedia.org/wiki/Miranda_v._Arizona). SCOTUS isn't deciding if the defendant is a dirt bag or not, just if the very specific law is valid/applied correctly

benlivengood 5y ago

This should also make the use of open wireless access points legally protected. It was always ridiculous that an AP could broadcast "come join me" incessantly but it was potentially infringing to actually join and use the advertised network.

ComodoHacker 5y ago
A simple captive portal with ToS would solve it, right?
- benlivengood 5y ago
  The problem is that the law was bad and so connecting to an unauthorized network had to happen before agreeing to ToS. It also put the onus on normal people to carefully pick SSIDs instead of on AP owners to secure their network.

caturopath 5y ago

Oral arguments at https://www.oyez.org/cases/2020/19-783 https://www.oyez.org/cases/2020/19-783 if anyone wants to listen, along with other information.

redis_mlc 5y ago

The real question is this: how did a dirty cop get a Supreme Court hearing? Who paid for that?