5 ms·

The Supreme Court curtailed the broad scope of the CFAA recently in the van Buren case. I personally agree with that decision (and also find it funny as it cont

by cletus 5y ago

The Supreme Court curtailed the broad scope of the CFAA recently in the van Buren case. I personally agree with that decision (and also find it funny as it continues the long trend of Clarence Thomas being on the wrong side of history). While van Buren's actions were obviously problematic he was an authorized user of the computer system. The issue is the vagueness of the CFAA has been a prosecutor's wet dream and a predictable source of overreach. Case in point: Aaron Swartz. So here's what's interesting: by taking up this case SCOTUS is potentially going in the other direction. The Appeals Court held that the CFAA didn't apply, allowing hiQ to continue. And here's where (in my layman's view) SCOTUS may choose to act: The Appeals Court stopped LinkedIn taking action to impede hiQ's access. I personally view this as overreach. There's a difference between not "hacking (in CFAA) terms a website and blocking the information provider impeding bots. As much as Microsoft/LinkedIn is a nightmare of data misuse and dark patterns (eg to obtain contacts), I think it would be a bad decision to let the current hiQ ruling stand. Disallowing sites from taking action to block scrapers from systematically taking all that information and building a competitor seems like a bad idea. But given the van Buren ruling, it seems unlikely SCOTUS will reverse course and declare hiQ's actions "hacking" (in CFAA terms). I suspect they'll curtail the remedy.

dannyw 5y ago
My counterpoint: companies shouldn't get to have their cake and eat it too, as in offering public content, but then preventing competitors from using that public content. To use another example, what if Google+ was a success, and Google blocks every other competing search engine from indexing even public posts on Google+? Is that a good outcome? There are already copyright protections to stop Shutterstock from ripping, say, all of Getty Image's photos. What we are talking about here is information so banal, so unoriginal, so uncreative, that copyright doesn't even apply.
- gwoplock 5y ago
  > My counterpoint: companies shouldn't get to have their cake and eat it too, as in offering public content, but then preventing competitors from using that public content. I agree this case is taking an anti-competitive action and spinning it into a pro-privacy case. However, what's the line? Personally I believe if you apply the rules equally to competitors and non-competitors alike you can restrict programmatic access to public data. Since LinkedIn isn't doing that, HiQ shouldn't be restricted. In any case I think this is a poor use of the CFAA.
- jjk166 5y ago
  Let's say you own a restaurant. It's a public place, people are welcome to come on in and take a seat. But there's a guy across the street who likes to come in, take pictures of everyone eating there, piss off your customers, and then leave without even ordering anything. After he's done this several times, you tell him he's not allowed in your restaurant anymore. He comes back anyways. Is he trespassing? This isn't a matter of stealing information. HiQ is more than welcome to acquire the information by other means. If hiQ scraped the same information from an archive site hosted by someone else it would be fine. But they've been explicitly told they're not authorized to access linkedin, and the CFAA is unambiguous that if you don't have authorization to access a system it's illegal to access it anyways, which is very much in keeping with how we'd treat access to a brick and mortar public business.
jrochkind1 5y ago
> by taking up this case SCOTUS is potentially going in the other direction. They didn't actually take it up, but sent it back to the 9th for a re-hearing in light of Van Buren v. US. But that ruling seems to make LinkedIn's case even weaker, I too am somewhat confused about what's going on, what options were available to the supreme court and what signal this one sends. Anyone have a better article?
- cletus 5y ago
  Thanks for highlighting this. Honestly I missed this subtlety but it does make it even clearer: SCOTUS is asking the Appeals Court to revisit if bots constitute "unauthorized" use (under CFAA). Van Buren decided that if an authorized user used a computer system for what were effectively policy violations and didn't bypass restrictions on that use then it's not "unauthorized" in the CFAA sense. Consider a phone book (ie the white pages). It has names of individuals who haven't opted out in alphabetic order. This makes it incredibly easy to find a mapping of name -> phone number (in O(log n) technically). You could do a lookup of phone number -> name but its inefficient (O(n)) and the volume of names is so large that it's not feasible for a person to do it. There are good reasons to prevent this reverse mapping, privacy among them. Now imagine that phone book is online. Obviously someone could scrape this data and built that reverse index. So the website provider does things like rate-limit your queries, occasionally CAPTCHA you (FWIW) and so on. If the LinkedIn decision stands, such impediments may be blocked by courts. That's probably not a good outcome. Additionally, doing that lookup yourself is infeasible but totally feasible with a bunch of automated lookalikes (ie bots). So I would say SCOTUS is hinting that the Appeals Court ruling is too broad and some limits on website access can apply. That's my guess anyway.
  - jrochkind1 5y ago
    > If the LinkedIn decision stands, such impediments may be blocked by courts. That's probably not a good outcome. Nope, I think you have it totally incorrect. The issue isn't whether it can be illegal to put technology impediments in place -- that isn't a claim in this case. The issue is potentially whether you can charge someone with a felony for working around the impediments you put in place. (i'm not totally sure if that is relevant in this case?) Or even more so, if you can charge someone with a felony for hacking for just doing something you politely asked them not to do. But there is nothing at stake here that could possibly make it illegal to put technological impediments like rate-limiting or CAPTCHA's in place. If I'm wrong, please direct me to the details of where/why. But that was definitely not at stake in Van Buren v. US, which is what the Supreme Court says prompted the remit for a re-hearing. The CFAA is about a felony crime of unauthorized access; nothing in it, decided either way, can make it a crime (or "blocked by courts") to put technological impediments in place. But overall, OP article is doing a very poor job of explaining either the facts or law of this case, so there's a lot I'm not sure about from just this write-up and what else I've been able to lazily google alone. If anyone has a better article explaining the relevant facts and law in dispute here, I'm still interested.

by cletus 5y ago

dannyw 5y ago

My counterpoint: companies shouldn't get to have their cake and eat it too, as in offering public content, but then preventing competitors from using that public content. To use another example, what if Google+ was a success, and Google blocks every other competing search engine from indexing even public posts on Google+? Is that a good outcome? There are already copyright protections to stop Shutterstock from ripping, say, all of Getty Image's photos. What we are talking about here is information so banal, so unoriginal, so uncreative, that copyright doesn't even apply.

gwoplock 5y ago
> My counterpoint: companies shouldn't get to have their cake and eat it too, as in offering public content, but then preventing competitors from using that public content. I agree this case is taking an anti-competitive action and spinning it into a pro-privacy case. However, what's the line? Personally I believe if you apply the rules equally to competitors and non-competitors alike you can restrict programmatic access to public data. Since LinkedIn isn't doing that, HiQ shouldn't be restricted. In any case I think this is a poor use of the CFAA.
jjk166 5y ago
Let's say you own a restaurant. It's a public place, people are welcome to come on in and take a seat. But there's a guy across the street who likes to come in, take pictures of everyone eating there, piss off your customers, and then leave without even ordering anything. After he's done this several times, you tell him he's not allowed in your restaurant anymore. He comes back anyways. Is he trespassing? This isn't a matter of stealing information. HiQ is more than welcome to acquire the information by other means. If hiQ scraped the same information from an archive site hosted by someone else it would be fine. But they've been explicitly told they're not authorized to access linkedin, and the CFAA is unambiguous that if you don't have authorization to access a system it's illegal to access it anyways, which is very much in keeping with how we'd treat access to a brick and mortar public business.

jrochkind1 5y ago

> by taking up this case SCOTUS is potentially going in the other direction. They didn't actually take it up, but sent it back to the 9th for a re-hearing in light of Van Buren v. US. But that ruling seems to make LinkedIn's case even weaker, I too am somewhat confused about what's going on, what options were available to the supreme court and what signal this one sends. Anyone have a better article?

cletus 5y ago
Thanks for highlighting this. Honestly I missed this subtlety but it does make it even clearer: SCOTUS is asking the Appeals Court to revisit if bots constitute "unauthorized" use (under CFAA). Van Buren decided that if an authorized user used a computer system for what were effectively policy violations and didn't bypass restrictions on that use then it's not "unauthorized" in the CFAA sense. Consider a phone book (ie the white pages). It has names of individuals who haven't opted out in alphabetic order. This makes it incredibly easy to find a mapping of name -> phone number (in O(log n) technically). You could do a lookup of phone number -> name but its inefficient (O(n)) and the volume of names is so large that it's not feasible for a person to do it. There are good reasons to prevent this reverse mapping, privacy among them. Now imagine that phone book is online. Obviously someone could scrape this data and built that reverse index. So the website provider does things like rate-limit your queries, occasionally CAPTCHA you (FWIW) and so on. If the LinkedIn decision stands, such impediments may be blocked by courts. That's probably not a good outcome. Additionally, doing that lookup yourself is infeasible but totally feasible with a bunch of automated lookalikes (ie bots). So I would say SCOTUS is hinting that the Appeals Court ruling is too broad and some limits on website access can apply. That's my guess anyway.
- jrochkind1 5y ago
  > If the LinkedIn decision stands, such impediments may be blocked by courts. That's probably not a good outcome. Nope, I think you have it totally incorrect. The issue isn't whether it can be illegal to put technology impediments in place -- that isn't a claim in this case. The issue is potentially whether you can charge someone with a felony for working around the impediments you put in place. (i'm not totally sure if that is relevant in this case?) Or even more so, if you can charge someone with a felony for hacking for just doing something you politely asked them not to do. But there is nothing at stake here that could possibly make it illegal to put technological impediments like rate-limiting or CAPTCHA's in place. If I'm wrong, please direct me to the details of where/why. But that was definitely not at stake in Van Buren v. US, which is what the Supreme Court says prompted the remit for a re-hearing. The CFAA is about a felony crime of unauthorized access; nothing in it, decided either way, can make it a crime (or "blocked by courts") to put technological impediments in place. But overall, OP article is doing a very poor job of explaining either the facts or law of this case, so there's a lot I'm not sure about from just this write-up and what else I've been able to lazily google alone. If anyone has a better article explaining the relevant facts and law in dispute here, I'm still interested.