5 ms·

IANAL, but legally speaking unauthorized access is a crime regardless of how easy it was to gain access.

pyre 15y ago
This was struck down by the courts by the way. Why? If unauthorized access is a federal offense, and unauthorized access can be determined by (e.g.) a EULA, then it basically allows a business to dictate criminal law. For example: 1. This would allow all of those 'You agree that you are not a law enforcement official' B.S. 'terms of use' on warez servers to actually have teeth. 2. "If you are a {black,hispanic,gay,etc} person, you are not allowed to access my website." Do any of these sound reasonable? I should hope not.
- tedunangst 15y ago
  That's because those restrictions are illegal themselves. "Don't download the whole database" is not an illegal restriction.
  - pyre 15y ago
    * How about "You are not allowed to hyperlink to this page?" * How about that 'MySpace Hacking' case? From Wikipedia: Judge Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals." For these reasons, Judge Wu granted Drew's motion for acquittal. Government eventually decided not to appeal [16]. http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew
    - tedunangst 15y ago
      I don't think hyperlinking is the crime in question for this case.
      - deleted 15y ago
        [deleted]
      - pyre 15y ago
        My post wasn't very clear. I was making two separate points.
        tedunangst 15y ago
        There are two separate issues as well, whether or not a restriction is valid and the ease with which it is circumvented. Lots of EULA/TOS terms are unreasonably broad. But let's say the TOS says "use of service without a password is unauthorized". Seems reasonable. Somebody runs a program to guess passwords until they find one that works. "Ah ha," they say, "I have a password, so my usage is now authorized." I don't think a judge or jury will buy that. Even if the password was easy to guess. I believe that was SpikeGronim's point. Assuming the definition of unauthorized is legit, there's no such "it was too easy" defense. Or "I could do it, therefore I must have been allowed to do it."
carbonica 15y ago
I think the parent was just disappointed at using "hacking" to refer to something as mundane as getting guest accounts to the network.
jrockway 15y ago
This is a very frightening belief. How long until posting a negative comment to a blog is "unautorized access" to that blog? Gaining access was easy: all you had to do was type a comment and hit submit. But some Powers That Be decided they didn't really want you to post that, so now it's a federal computer crime. Land of the free.
- _delirium 15y ago
  That's currently unsettled, and yes a lot of computer-crime experts (even typically law-and-order-leaning ones) consider it a huge problem--- it might actually be a federal crime to post a comment on a blog in violation of the blog's Terms of Service. This case is currently winding its way through the courts, and will hopefully be overturned: http://volokh.com/2011/06/14/petition-for-rehearing-filed-in-united-states-v-nosal-ninth-circuit-case-on-criminalizing-violations-of-computer-use-policies/ http://volokh.com/2011/06/14/petition-for-rehearing-filed-in...
- kronusaturn 15y ago
  This problem extends way beyond hacking laws—the average person in the US probably commits several felonies a day: http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx
  - jrockway 15y ago
    I read this book and think that federal crimes are punished too harshly, but the people profiled seem far from average.
- tptacek 15y ago
  Speaking of "TV drama levels of understanding of criminal justice"... :) With only a few exceptions, persons accused of crimes are not presumed to have mens rea. Statutory rape, for instance, has "strict liability"; even if you don't know you're committing a crime, you're liable. Most criminal offenses are not like this. The state is required to establish mens rea. A prosecutor could say that a ToS-infringing blog comment is a criminal violation, but unless that prosecutor can establish that the comment was made in purposeful, knowing, or reckless violation of the ToS, they'd be wasting their time.

pyre 15y ago

This was struck down by the courts by the way. Why? If unauthorized access is a federal offense, and unauthorized access can be determined by (e.g.) a EULA, then it basically allows a business to dictate criminal law. For example: 1. This would allow all of those 'You agree that you are not a law enforcement official' B.S. 'terms of use' on warez servers to actually have teeth. 2. "If you are a {black,hispanic,gay,etc} person, you are not allowed to access my website." Do any of these sound reasonable? I should hope not.

tedunangst 15y ago
That's because those restrictions are illegal themselves. "Don't download the whole database" is not an illegal restriction.
- pyre 15y ago
  * How about "You are not allowed to hyperlink to this page?" * How about that 'MySpace Hacking' case? From Wikipedia: Judge Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals." For these reasons, Judge Wu granted Drew's motion for acquittal. Government eventually decided not to appeal [16]. http://en.wikipedia.org/wiki/United_States_v._Lori_Drew http://en.wikipedia.org/wiki/United_States_v._Lori_Drew
  - tedunangst 15y ago
    I don't think hyperlinking is the crime in question for this case.
    - deleted 15y ago
      [deleted]
    - pyre 15y ago
      My post wasn't very clear. I was making two separate points.
      - tedunangst 15y ago
        There are two separate issues as well, whether or not a restriction is valid and the ease with which it is circumvented. Lots of EULA/TOS terms are unreasonably broad. But let's say the TOS says "use of service without a password is unauthorized". Seems reasonable. Somebody runs a program to guess passwords until they find one that works. "Ah ha," they say, "I have a password, so my usage is now authorized." I don't think a judge or jury will buy that. Even if the password was easy to guess. I believe that was SpikeGronim's point. Assuming the definition of unauthorized is legit, there's no such "it was too easy" defense. Or "I could do it, therefore I must have been allowed to do it."

carbonica 15y ago

I think the parent was just disappointed at using "hacking" to refer to something as mundane as getting guest accounts to the network.

jrockway 15y ago

This is a very frightening belief. How long until posting a negative comment to a blog is "unautorized access" to that blog? Gaining access was easy: all you had to do was type a comment and hit submit. But some Powers That Be decided they didn't really want you to post that, so now it's a federal computer crime. Land of the free.

_delirium 15y ago
That's currently unsettled, and yes a lot of computer-crime experts (even typically law-and-order-leaning ones) consider it a huge problem--- it might actually be a federal crime to post a comment on a blog in violation of the blog's Terms of Service. This case is currently winding its way through the courts, and will hopefully be overturned: http://volokh.com/2011/06/14/petition-for-rehearing-filed-in-united-states-v-nosal-ninth-circuit-case-on-criminalizing-violations-of-computer-use-policies/ http://volokh.com/2011/06/14/petition-for-rehearing-filed-in...
kronusaturn 15y ago
This problem extends way beyond hacking laws—the average person in the US probably commits several felonies a day: http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx http://www.threefelonies.com/Youtoo/tabid/86/Default.aspx
- jrockway 15y ago
  I read this book and think that federal crimes are punished too harshly, but the people profiled seem far from average.
tptacek 15y ago
Speaking of "TV drama levels of understanding of criminal justice"... :) With only a few exceptions, persons accused of crimes are not presumed to have mens rea. Statutory rape, for instance, has "strict liability"; even if you don't know you're committing a crime, you're liable. Most criminal offenses are not like this. The state is required to establish mens rea. A prosecutor could say that a ToS-infringing blog comment is a criminal violation, but unless that prosecutor can establish that the comment was made in purposeful, knowing, or reckless violation of the ToS, they'd be wasting their time.