12 ms·

Using a VPN could become a criminal offence under new CFAA interpretation

315 points by janmo 5y ago

I am surprised this is not discussed at all on Hackernews, but in the ongoing "hiQ Labs, Inc. v. LinkedIn" case, Linkedin is arguing that "intentionally and knowingly bypassing an IP block" is an exceed authorized access and qualify as a criminal offence. That's because in their opinion they are allowed to put the "gate down" for some users on an otherwise publicly accessible website. If the court follows this argument using a VPN to get access to content that is otherwise blocked in your country through an IP Block for example could become a criminal offence as well. Hearing link: https://www.youtube.com/watch?v=tUkoHeiPGQw

em-bee 5y ago
could you provide links to the case please
- janmo 5y ago
  Hearing here: https://www.youtube.com/watch?v=tUkoHeiPGQw https://www.youtube.com/watch?v=tUkoHeiPGQw
sharemywin 5y ago
couldn't the logic for anonymous browsing be similar? what about ad blockers?
- FateOfNations 5y ago
  The underlying issue is "accessing a computer system you know (or should know) you shouldn't be accessing". Ad blockers operate on your own equipment and network and don't involve accessing any other systems. "Anonymous browsing" isn't clearly defined enough to analyze. If it was something like "We don't allow connections via Tor", and you used Tor to connect anyways, this concept would apply (especially if you attempted to bypass technical controls, or intentionally disguised the traffic).
  - tyingq 5y ago
    Ad blockers often include paywall/regwall bypasses, which does somewhat fit the description.
    - FateOfNations 5y ago
      I would argue that it depends on how it is implemented. Some pay/reg walls are implemented such that the site is sending the full content to you but directing your web browser not to display it (like using a `display: none` CSS property). I would say using a browser extension to direct the browser to display it anyways wouldn't be a violation. You were authorized to make the initial request for the otherwise public page and they choose to send the full content to you. You aren't making any other connections to their system that you aren't authorized to make. On the other hand, if it is doing something to trick the server into sending you content that it wouldn't otherwise send you and you aren't authorized to access, I would tend towards seeing that as something closer to a violation.
      - nobody9999 5y ago
        >I would say using a browser extension to direct the browser to display it anyways wouldn't be a violation. You were authorized to make the initial request for the otherwise public page and they choose to send the full content to you. You aren't making any other connections to their system that you aren't authorized to make. An interesting point. I, as a general rule, disable javascript in my daily driver browser (Firefox). Doing so breaks the paywall on certain sites. I'm not specifically targeting those sites (e.g., with uBlock or noscript), as I've disabled javascript for all sites and don't use any extensions to bypass paywalls. Where the use of javascript is required (and I find that out by visiting the site -- then decide whether I actually want to view/use it) I'll use a different browser altogether (in my case, Vivaldi). I don't believe that disabling javascript is a "hacking" attempt, mostly because I don't do so to bypass anything -- rather, I don't want arbitrary javascript executing on my systems.
  - DarkWiiPlayer 5y ago
    No, that's not the point: If a website states "you are not allowed to use this website with an ad blocker", then by accessing it anyway, you're suddenly a "hacker" before the law and could face severe legal consequences.
sharemywin 5y ago
The biggest question would be what is my IP versus one that's not mine?
rolph 5y ago
https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-linkedin-protects-scraping-public-data https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-l... [2019] https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn
sandworm101 5y ago
>> VPN to get access to content that is otherwise blocked in your country through an IP Block for example could become a criminal offence as well. Yes. Accessing material that has been deemed illegal enough to be the subject of a country-wide block is generally going to be a criminal offense. We might all hate censorship, but the people who write the censorship laws are the same as the ones writing the criminal laws. If you are using technology to bypass blocks imposed by your local government, you are probably some sort of criminal in the eyes of that government. This is why I don't like people who casually advise people facing a block to "just use a VPN". Doing so might put them in danger.
- lifeslikethis 5y ago
  It's always good to do research about VPNs before using/buying them, especially if you're not in the US.
- syshum 5y ago
  Well in the case in question is a US case, based on US Law, and using CFAA to get around the 1st amendment is indeed scary and should be given more weight than a causal dimssial of "well we hate censorship but...." which calls in the question if you really even hate censorship... I have my doubts Beyond that this is CLEARLY a bad reading of CFAA, recent US Supreme Court rulings have shown they would prefer a narrow reading of the law instead of a broad one so I hope the lower court recognizes this and shots LinkedIn Down.
- FateOfNations 5y ago
  From the context, (CFAA, a US law) "VPN to get access to content that is otherwise blocked in your country through an IP Block" wouldn't be referring to using a VPN to bypass blocks imposed by "your local government" or censorship-related issues, but rather circumventing blocks imposed by US-based content providers. Hypothetical scenario: User outside the United States uses a VPN to access US Netflix content. In doing so, have circumvented Netflix access control mechanism and are accessing the Netflix's computer systems in an unauthorized manner. Unauthorized access to computer systems is a violation of the CFAA. Accordingly, the foreign user is potentially liable for felony criminal charges in the US, just the same as they had "hacked" any other computer system in the US.
PeterisP 5y ago
It's not being talked about because there's no evidence of "new CFAA interpretation" until the court says something like that. It's very common for parties to try and argue all kinds of extreme interpretations of law that might favor their case, with the expectation that it most likely will be refused but hey, it's worth to try; but they are not newsworthy until/unless the court actually considers the argument as valid.
- notTheAuth 5y ago
  So only after it’s precedent and harder to undo then does it matter? This is basically saying there’s no point in testing software, ship every line to prod and see what happens. This is exactly the kind of political ennui the system purposely tries to inculcate. Not fine grain mind control, but indifference. Laws dictate acceptable social agency. One might think we’d take what ends up in them at least as seriously as rich man’s busy work.
  - FDSGSG 5y ago
    notTheAuth is a pedophile! What are you going to do to fight this? Maybe it's just not something worth pursuing?
    - tombert 5y ago
      I understand the point you're trying to make (e.g. making a hyperbolic claim and leaving the onus on the accused to disprove it), but I think if you wanted to avoid downvotes while making the same point, you might have better luck saying something like: > How would you feel if I said "<username> is a pedophile! What are you going to do to fight this? Maybe it's just not something worth pursuing?" And then spend a bit of time explaining why this reasoning doesn't make sense to you. I'm a relative veteran of HN and even I had to do a double-take because I thought you were genuinely accusing the person of being a pedophile.
      - FDSGSG 5y ago
        Honestly, I really hope that I don't need to explain the logic behind my comment. It should be obvious to anyone willing to spend more than a couple of seconds thinking about it. I would hope that on HN we'd actually try to read and understand the comment we're voting on. Of course I'm being overly optimistic, but I'd prefer to be naive and wrong than cynical and right.
bellyfullofbac 5y ago
The tone of your question is odd, "I'm surprised..." is usually followed by a mention of "MSM" and a hint of "They're censoring discussions!". But well, for the people too lazy to google: https://h2o.law.harvard.edu/text_blocks/30226 https://h2o.law.harvard.edu/text_blocks/30226 . The only mention of IP I could find was: > The Ninth Circuit found a CFAA violation where “after receiving written notification from Facebook” Power Ventures “circumvented IP barriers” and continued to access Facebook servers. Id. at 1068. In short, Power Ventures accessed Facebook computers “without authorization.” IANAL but I would only worry about a criminal offence after getting a written warning...
dfstorm 5y ago
Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you contact isn’t. So they are well within their right to block anyone. But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. Hope the judge know how to use a computer and understand the implications…
- ravenstine 5y ago
  I really wish that every legal professional and judicial administrator had some rudimentary computer science knowledge. Having friends whom are lawyers, I can tell you that most of them don't have any meaningful understanding of technology becauae they spend so many years of their career heads down on what is effecctively paperwork. They know enough to realize how bass ackwards their industry is when it comes to tech, but if you asked them if webpages are encrypted they would have no idea and would probably assume they are not. We are headed for a more authoritarian future if those making law or making judgments only see privacy tech as fringe and criminal, or have little meaningful underatandiing of it.
  - baktubi 5y ago
    Hmm. You could also argue that not having understanding of the technology is a good thing. For instance, the judge can remove themselves from the details and look at it on a higher level. It’s the job of the attorneys to make the case for or against using subject matter experts etc.
    - wizzwizz4 5y ago
      You could argue that. However, it means that people can basically lie to the judges, and the judges don't have the background to call them out on it.
      - baktubi 5y ago
        Pretty sure they lie to the judges anyway.
suifbwish 5y ago
Wouldn’t the nature of a vpn make this kind of difficult to enforce?
- iamthirsty 5y ago
  I'd think they'd block certain well known VPN services IPs, no?
LinuxBender 5y ago
hiQ is based in California. What impact would the case have for machine learning companies that do not reside in the U.S.? Would those companies have an advantage over ML companies that operate in the U.S.?
nextlevelwizard 5y ago
Title is bullshit
- janmo 5y ago
  Unfortunately I cannot change the title, but this one would be the most accurate: "Using a VPN to bypass a GeoIp block could become a criminal offence under Linkedin's CFAA interpretation"
  - nobody9999 5y ago
    >Unfortunately I cannot change the title, but this one would be the most accurate: "Using a VPN to bypass a GeoIp block could become a criminal offence under Linkedin's CFAA interpretation" I'm a little confused by that interpretation of the specific case in question (Hiq Labs v. LinkedIn). IIUC, LinkedIn isn't doing GeoIP blocks (AFAIK, the San Francisco bay area is not being blocked by LinkedIn, just HiQ Labs' IP range). What's more, HiQ Labs is scraping publicly available content. Most GeoIP blocking (such as Netflix/BBC, etc.) is done to keep subscribers from accessing content that the provider isn't licensed to provide in the location where the connection originates. Even more, accessing such content even if you are in a location where that content is available requires a login (i.e., isn't publicly available) to access that content. I don't see a parallel here. As such, I'm not sure how the result here (either way) could impact the use of VPNs more broadly. Then again, IANAL and may well be missing something. If you'd expound on your reasoning around this, it would be greatly appreciated. Thanks! Edit: Fixed typo.
qwerty456127 5y ago
> in their opinion they are allowed to put the "gate down" for some users on a public website. If they want to, the only reasonable way is to inform the visitor they're not eligible to use the site unless they fulfill specific conditions. If the user knowingly ignores this information - this is reasonable to be interpreted as some sort of offense depending on the context. IP-based segregation, however, is just bullshit.
1vuio0pswjnm7 5y ago
Well, in the video of the hearing you posted earlier hiQ's counsel said an IP block is not akin to a password. The court added that IP addresses do not identify people. As such IP blocks ban computers not people. There was also suggestion that the "access control" only relates to the manner of access; people can easily change IP addresses. The court seemed to agree with that argument. hiQ's counsel argued that a "gates up, gates down" analysis is not appropriate because in this case "there is no gate" (or at least, the gate was up from the beginning). Again, the court seemed to agree. Watching that hearing it seemed clear to me the court understands the dangers of letting tech companies use the threat of CFAA's criminal culpability against www users or competitors. One justice made the point that when the CFAA was passed there was no www. The court questioned how public web servers could be comparable to "private" government computers.
- winkeltripel 5y ago
  I think a nice metaphor would be that linkedin banned my car from their property, then I keep coming back in by taxi.
  - janmo 5y ago
    I think that's a good metaphor. And that case the taxi or rental car would be the VPN.
  - Cypher 5y ago
    Yes and Linked wants to argue that it's trying to lock you out but you keep coming back and so they want to throw you in jail.
- morpheuskafka 5y ago
  > As such IP blocks ban computers not people. As another example, many websites block their customers when they are connected to a VPN but have no intention of prohibiting those people from access generally.
- 908B64B197 5y ago
  With NAT and the rise of WFH, I wouldn't be surprised if a lot more legitimate users were under VPN without even knowing it.
cletus 5y ago
This is a good sensationalist title that could easily be changed to "Will using a VPN become illegal under the CFAA?" and like any such headlines, the answer is "no". Just because one side is making an argument for that interpretation in a civil case means pretty much exactly nothing. What's more, the Supreme Court in recent rulings has started to slap down overly broad interpretations of "hacking" under the CFAA. Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a welcome but somewhat unexpected ruling. There's absolutely nothing to worry about here. [1]: https://www.lawfareblog.com/supreme-court-reins-cfaa-van-buren https://www.lawfareblog.com/supreme-court-reins-cfaa-van-bur... EDIT: corrected van Buren characterization.
- monkeynotes 5y ago
  Any headline I see with a question in that manner I don't click on. I know they will conclude with either "we don't know" or "no". It's just not worth reading unless you are interested in two sides of an argument but generally these articles are cheap fluff.
  - wgx 5y ago
    https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
    - colejohnson66 5y ago
      “Is ‘Betteridge's law of headlines’ actually real?”
- jcranmer 5y ago
  > Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a completely and somewhat unexpected ruling. A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.)
beervirus 5y ago
People argue all kinds of dumb shit in litigation. Wake me up when a court agrees with them on this.
curryst 5y ago
It's just not that dire yet. For one, the court hasn't ruled yet. This is purely LinkedIn's argument, and they're allowed to argue anything they want. They could argue that hiQ isn't allowed to access their service because the company name doesn't start with a capital letter if they wanted to. They wouldn't win, but they could make the argument. Secondly, if you read the context of the case, this is not a situation a normal person is at all likely to find themselves in. hiQ was specifically sent a cease and desist, which is why "bypassing an IP block" is couched in "intentionally and knowingly". IANAL, but a follower of the law, and my layman's reading of that is that LinkedIn is intentionally scoping this to only target subjects that have previously been sent a cease and desist. And finally, even if they did do that, it's unlikely to impact VPNs for streaming. I severely doubt that any first world country would extradite one of their citizens to the US to face charges for bypassing an IP block. Within the US, I still doubt the charges would be used like that even if they could. I don't think this is something the FBI is going to spend resources on proactively tracking, so it would be up to Netflix et al to push the cases. I really strongly doubt they would do that. "Paying Netflix customer sued by Netflix for watching content he wasn't supposed to" is a really bad PR headline, and it's mainstream-adjacent enough to get picked up by major news networks. That's a really hard story to spin, and I strongly suspect the bad PR would cost much, much more than people try to avoid region-locks (who are likely to just pirate it if VPNs become CFAA-able).
newshorts 5y ago
Good luck with that. You’d have the largest tech companies in the world fighting it.
tptacek 5y ago
Really, this is a post of the video of the hearing (Youtube links are just fine on Hacker News) that is somewhat abusing the "no URL" feature of submissions to dramatically editorialize. That's the reason links in no-URL posts aren't clickable! The better way to do this would be to write a blog post about your concerns surrounding this hearing, and take your chances submitting that. What we should do here is make this post the Youtube link itself, and title it "hiQ Labs, Inc. v. LinkedIn Corporation hearing on IP blocks", or something similar, and demote the text of this submission to a comment. Hacker News submissions are community property; the submitter isn't entitled to provide a short editorial for the link to direct the discussion. That's what comments are for.
infogulch 5y ago
Wow this is the same case that came up two years ago, where LinkedIn tried to argue that a violation of the ToS was CFAA. "Court: Violating a site’s terms of service isn’t criminal hacking" [0]. I made a comment at the time [1]: > So Microsoft chose a method of authorization that is unfit for the purpose of keeping people they don't want to have access out of their system. "But but but how else would they keep people off?" I don't know, but it doesn't matter. Make people sign a contract under supervision of a notary, or validate their drivers license, or whatever. The fact that Microsoft is too lazy to implement a solution that effectively implements their desired policy isn't material to what the actually implemented policy enables. [0]: https://news.ycombinator.com/item?id=22738180 https://news.ycombinator.com/item?id=22738180 [1]: https://news.ycombinator.com/item?id=22745104 https://news.ycombinator.com/item?id=22745104
djrogers 5y ago
Key mis-statement here: "under new CFAA interpretation" There has been no 'new' interpretation, nor is it likely that there will be. This is merely one of a number of arguments put forward by LinkedIn's counsel during a civil case. All kinds of crazy poop gets put forward in those.
LanceH 5y ago
They have the relief of whitelisting IP's. Have at it :)
arnmac 5y ago
What a world we live in! Just read how shoplifting isn't worth prosecuting so it isn't a "crime" anymore. Now using a VPN is. Yeah!

315 points by janmo 5y ago

em-bee 5y ago

could you provide links to the case please

janmo 5y ago
Hearing here: https://www.youtube.com/watch?v=tUkoHeiPGQw https://www.youtube.com/watch?v=tUkoHeiPGQw

sharemywin 5y ago

couldn't the logic for anonymous browsing be similar? what about ad blockers?

FateOfNations 5y ago
The underlying issue is "accessing a computer system you know (or should know) you shouldn't be accessing". Ad blockers operate on your own equipment and network and don't involve accessing any other systems. "Anonymous browsing" isn't clearly defined enough to analyze. If it was something like "We don't allow connections via Tor", and you used Tor to connect anyways, this concept would apply (especially if you attempted to bypass technical controls, or intentionally disguised the traffic).
- tyingq 5y ago
  Ad blockers often include paywall/regwall bypasses, which does somewhat fit the description.
  - FateOfNations 5y ago
    I would argue that it depends on how it is implemented. Some pay/reg walls are implemented such that the site is sending the full content to you but directing your web browser not to display it (like using a `display: none` CSS property). I would say using a browser extension to direct the browser to display it anyways wouldn't be a violation. You were authorized to make the initial request for the otherwise public page and they choose to send the full content to you. You aren't making any other connections to their system that you aren't authorized to make. On the other hand, if it is doing something to trick the server into sending you content that it wouldn't otherwise send you and you aren't authorized to access, I would tend towards seeing that as something closer to a violation.
    - nobody9999 5y ago
      >I would say using a browser extension to direct the browser to display it anyways wouldn't be a violation. You were authorized to make the initial request for the otherwise public page and they choose to send the full content to you. You aren't making any other connections to their system that you aren't authorized to make. An interesting point. I, as a general rule, disable javascript in my daily driver browser (Firefox). Doing so breaks the paywall on certain sites. I'm not specifically targeting those sites (e.g., with uBlock or noscript), as I've disabled javascript for all sites and don't use any extensions to bypass paywalls. Where the use of javascript is required (and I find that out by visiting the site -- then decide whether I actually want to view/use it) I'll use a different browser altogether (in my case, Vivaldi). I don't believe that disabling javascript is a "hacking" attempt, mostly because I don't do so to bypass anything -- rather, I don't want arbitrary javascript executing on my systems.
- DarkWiiPlayer 5y ago
  No, that's not the point: If a website states "you are not allowed to use this website with an ad blocker", then by accessing it anyway, you're suddenly a "hacker" before the law and could face severe legal consequences.

sharemywin 5y ago

The biggest question would be what is my IP versus one that's not mine?

rolph 5y ago

https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-linkedin-protects-scraping-public-data https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-l... [2019] https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn

sandworm101 5y ago

>> VPN to get access to content that is otherwise blocked in your country through an IP Block for example could become a criminal offence as well. Yes. Accessing material that has been deemed illegal enough to be the subject of a country-wide block is generally going to be a criminal offense. We might all hate censorship, but the people who write the censorship laws are the same as the ones writing the criminal laws. If you are using technology to bypass blocks imposed by your local government, you are probably some sort of criminal in the eyes of that government. This is why I don't like people who casually advise people facing a block to "just use a VPN". Doing so might put them in danger.

lifeslikethis 5y ago
It's always good to do research about VPNs before using/buying them, especially if you're not in the US.
syshum 5y ago
Well in the case in question is a US case, based on US Law, and using CFAA to get around the 1st amendment is indeed scary and should be given more weight than a causal dimssial of "well we hate censorship but...." which calls in the question if you really even hate censorship... I have my doubts Beyond that this is CLEARLY a bad reading of CFAA, recent US Supreme Court rulings have shown they would prefer a narrow reading of the law instead of a broad one so I hope the lower court recognizes this and shots LinkedIn Down.
FateOfNations 5y ago
From the context, (CFAA, a US law) "VPN to get access to content that is otherwise blocked in your country through an IP Block" wouldn't be referring to using a VPN to bypass blocks imposed by "your local government" or censorship-related issues, but rather circumventing blocks imposed by US-based content providers. Hypothetical scenario: User outside the United States uses a VPN to access US Netflix content. In doing so, have circumvented Netflix access control mechanism and are accessing the Netflix's computer systems in an unauthorized manner. Unauthorized access to computer systems is a violation of the CFAA. Accordingly, the foreign user is potentially liable for felony criminal charges in the US, just the same as they had "hacked" any other computer system in the US.

PeterisP 5y ago

It's not being talked about because there's no evidence of "new CFAA interpretation" until the court says something like that. It's very common for parties to try and argue all kinds of extreme interpretations of law that might favor their case, with the expectation that it most likely will be refused but hey, it's worth to try; but they are not newsworthy until/unless the court actually considers the argument as valid.

notTheAuth 5y ago
So only after it’s precedent and harder to undo then does it matter? This is basically saying there’s no point in testing software, ship every line to prod and see what happens. This is exactly the kind of political ennui the system purposely tries to inculcate. Not fine grain mind control, but indifference. Laws dictate acceptable social agency. One might think we’d take what ends up in them at least as seriously as rich man’s busy work.
- FDSGSG 5y ago
  notTheAuth is a pedophile! What are you going to do to fight this? Maybe it's just not something worth pursuing?
  - tombert 5y ago
    I understand the point you're trying to make (e.g. making a hyperbolic claim and leaving the onus on the accused to disprove it), but I think if you wanted to avoid downvotes while making the same point, you might have better luck saying something like: > How would you feel if I said "<username> is a pedophile! What are you going to do to fight this? Maybe it's just not something worth pursuing?" And then spend a bit of time explaining why this reasoning doesn't make sense to you. I'm a relative veteran of HN and even I had to do a double-take because I thought you were genuinely accusing the person of being a pedophile.
    - FDSGSG 5y ago
      Honestly, I really hope that I don't need to explain the logic behind my comment. It should be obvious to anyone willing to spend more than a couple of seconds thinking about it. I would hope that on HN we'd actually try to read and understand the comment we're voting on. Of course I'm being overly optimistic, but I'd prefer to be naive and wrong than cynical and right.

bellyfullofbac 5y ago

The tone of your question is odd, "I'm surprised..." is usually followed by a mention of "MSM" and a hint of "They're censoring discussions!". But well, for the people too lazy to google: https://h2o.law.harvard.edu/text_blocks/30226 https://h2o.law.harvard.edu/text_blocks/30226 . The only mention of IP I could find was: > The Ninth Circuit found a CFAA violation where “after receiving written notification from Facebook” Power Ventures “circumvented IP barriers” and continued to access Facebook servers. Id. at 1068. In short, Power Ventures accessed Facebook computers “without authorization.” IANAL but I would only worry about a criminal offence after getting a written warning...

dfstorm 5y ago

Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you contact isn’t. So they are well within their right to block anyone. But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. Hope the judge know how to use a computer and understand the implications…

ravenstine 5y ago
I really wish that every legal professional and judicial administrator had some rudimentary computer science knowledge. Having friends whom are lawyers, I can tell you that most of them don't have any meaningful understanding of technology becauae they spend so many years of their career heads down on what is effecctively paperwork. They know enough to realize how bass ackwards their industry is when it comes to tech, but if you asked them if webpages are encrypted they would have no idea and would probably assume they are not. We are headed for a more authoritarian future if those making law or making judgments only see privacy tech as fringe and criminal, or have little meaningful underatandiing of it.
- baktubi 5y ago
  Hmm. You could also argue that not having understanding of the technology is a good thing. For instance, the judge can remove themselves from the details and look at it on a higher level. It’s the job of the attorneys to make the case for or against using subject matter experts etc.
  - wizzwizz4 5y ago
    You could argue that. However, it means that people can basically lie to the judges, and the judges don't have the background to call them out on it.
    - baktubi 5y ago
      Pretty sure they lie to the judges anyway.

suifbwish 5y ago

Wouldn’t the nature of a vpn make this kind of difficult to enforce?

iamthirsty 5y ago
I'd think they'd block certain well known VPN services IPs, no?

LinuxBender 5y ago

hiQ is based in California. What impact would the case have for machine learning companies that do not reside in the U.S.? Would those companies have an advantage over ML companies that operate in the U.S.?

nextlevelwizard 5y ago

Title is bullshit

janmo 5y ago
Unfortunately I cannot change the title, but this one would be the most accurate: "Using a VPN to bypass a GeoIp block could become a criminal offence under Linkedin's CFAA interpretation"
- nobody9999 5y ago
  >Unfortunately I cannot change the title, but this one would be the most accurate: "Using a VPN to bypass a GeoIp block could become a criminal offence under Linkedin's CFAA interpretation" I'm a little confused by that interpretation of the specific case in question (Hiq Labs v. LinkedIn). IIUC, LinkedIn isn't doing GeoIP blocks (AFAIK, the San Francisco bay area is not being blocked by LinkedIn, just HiQ Labs' IP range). What's more, HiQ Labs is scraping publicly available content. Most GeoIP blocking (such as Netflix/BBC, etc.) is done to keep subscribers from accessing content that the provider isn't licensed to provide in the location where the connection originates. Even more, accessing such content even if you are in a location where that content is available requires a login (i.e., isn't publicly available) to access that content. I don't see a parallel here. As such, I'm not sure how the result here (either way) could impact the use of VPNs more broadly. Then again, IANAL and may well be missing something. If you'd expound on your reasoning around this, it would be greatly appreciated. Thanks! Edit: Fixed typo.

qwerty456127 5y ago

> in their opinion they are allowed to put the "gate down" for some users on a public website. If they want to, the only reasonable way is to inform the visitor they're not eligible to use the site unless they fulfill specific conditions. If the user knowingly ignores this information - this is reasonable to be interpreted as some sort of offense depending on the context. IP-based segregation, however, is just bullshit.

1vuio0pswjnm7 5y ago

Well, in the video of the hearing you posted earlier hiQ's counsel said an IP block is not akin to a password. The court added that IP addresses do not identify people. As such IP blocks ban computers not people. There was also suggestion that the "access control" only relates to the manner of access; people can easily change IP addresses. The court seemed to agree with that argument. hiQ's counsel argued that a "gates up, gates down" analysis is not appropriate because in this case "there is no gate" (or at least, the gate was up from the beginning). Again, the court seemed to agree. Watching that hearing it seemed clear to me the court understands the dangers of letting tech companies use the threat of CFAA's criminal culpability against www users or competitors. One justice made the point that when the CFAA was passed there was no www. The court questioned how public web servers could be comparable to "private" government computers.

winkeltripel 5y ago
I think a nice metaphor would be that linkedin banned my car from their property, then I keep coming back in by taxi.
- janmo 5y ago
  I think that's a good metaphor. And that case the taxi or rental car would be the VPN.
- Cypher 5y ago
  Yes and Linked wants to argue that it's trying to lock you out but you keep coming back and so they want to throw you in jail.
morpheuskafka 5y ago
> As such IP blocks ban computers not people. As another example, many websites block their customers when they are connected to a VPN but have no intention of prohibiting those people from access generally.
908B64B197 5y ago
With NAT and the rise of WFH, I wouldn't be surprised if a lot more legitimate users were under VPN without even knowing it.

cletus 5y ago

This is a good sensationalist title that could easily be changed to "Will using a VPN become illegal under the CFAA?" and like any such headlines, the answer is "no". Just because one side is making an argument for that interpretation in a civil case means pretty much exactly nothing. What's more, the Supreme Court in recent rulings has started to slap down overly broad interpretations of "hacking" under the CFAA. Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a welcome but somewhat unexpected ruling. There's absolutely nothing to worry about here. [1]: https://www.lawfareblog.com/supreme-court-reins-cfaa-van-buren https://www.lawfareblog.com/supreme-court-reins-cfaa-van-bur... EDIT: corrected van Buren characterization.

monkeynotes 5y ago
Any headline I see with a question in that manner I don't click on. I know they will conclude with either "we don't know" or "no". It's just not worth reading unless you are interested in two sides of an argument but generally these articles are cheap fluff.
- wgx 5y ago
  https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
  - colejohnson66 5y ago
    “Is ‘Betteridge's law of headlines’ actually real?”
jcranmer 5y ago
> Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a completely and somewhat unexpected ruling. A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.)

beervirus 5y ago

People argue all kinds of dumb shit in litigation. Wake me up when a court agrees with them on this.

curryst 5y ago

It's just not that dire yet. For one, the court hasn't ruled yet. This is purely LinkedIn's argument, and they're allowed to argue anything they want. They could argue that hiQ isn't allowed to access their service because the company name doesn't start with a capital letter if they wanted to. They wouldn't win, but they could make the argument. Secondly, if you read the context of the case, this is not a situation a normal person is at all likely to find themselves in. hiQ was specifically sent a cease and desist, which is why "bypassing an IP block" is couched in "intentionally and knowingly". IANAL, but a follower of the law, and my layman's reading of that is that LinkedIn is intentionally scoping this to only target subjects that have previously been sent a cease and desist. And finally, even if they did do that, it's unlikely to impact VPNs for streaming. I severely doubt that any first world country would extradite one of their citizens to the US to face charges for bypassing an IP block. Within the US, I still doubt the charges would be used like that even if they could. I don't think this is something the FBI is going to spend resources on proactively tracking, so it would be up to Netflix et al to push the cases. I really strongly doubt they would do that. "Paying Netflix customer sued by Netflix for watching content he wasn't supposed to" is a really bad PR headline, and it's mainstream-adjacent enough to get picked up by major news networks. That's a really hard story to spin, and I strongly suspect the bad PR would cost much, much more than people try to avoid region-locks (who are likely to just pirate it if VPNs become CFAA-able).

newshorts 5y ago

Good luck with that. You’d have the largest tech companies in the world fighting it.

tptacek 5y ago

Really, this is a post of the video of the hearing (Youtube links are just fine on Hacker News) that is somewhat abusing the "no URL" feature of submissions to dramatically editorialize. That's the reason links in no-URL posts aren't clickable! The better way to do this would be to write a blog post about your concerns surrounding this hearing, and take your chances submitting that. What we should do here is make this post the Youtube link itself, and title it "hiQ Labs, Inc. v. LinkedIn Corporation hearing on IP blocks", or something similar, and demote the text of this submission to a comment. Hacker News submissions are community property; the submitter isn't entitled to provide a short editorial for the link to direct the discussion. That's what comments are for.

infogulch 5y ago

Wow this is the same case that came up two years ago, where LinkedIn tried to argue that a violation of the ToS was CFAA. "Court: Violating a site’s terms of service isn’t criminal hacking" [0]. I made a comment at the time [1]: > So Microsoft chose a method of authorization that is unfit for the purpose of keeping people they don't want to have access out of their system. "But but but how else would they keep people off?" I don't know, but it doesn't matter. Make people sign a contract under supervision of a notary, or validate their drivers license, or whatever. The fact that Microsoft is too lazy to implement a solution that effectively implements their desired policy isn't material to what the actually implemented policy enables. [0]: https://news.ycombinator.com/item?id=22738180 https://news.ycombinator.com/item?id=22738180 [1]: https://news.ycombinator.com/item?id=22745104 https://news.ycombinator.com/item?id=22745104

djrogers 5y ago

Key mis-statement here: "under new CFAA interpretation" There has been no 'new' interpretation, nor is it likely that there will be. This is merely one of a number of arguments put forward by LinkedIn's counsel during a civil case. All kinds of crazy poop gets put forward in those.

LanceH 5y ago

They have the relief of whitelisting IP's. Have at it :)

arnmac 5y ago

What a world we live in! Just read how shoplifting isn't worth prosecuting so it isn't a "crime" anymore. Now using a VPN is. Yeah!