3 ms·

This is a good sensationalist title that could easily be changed to "Will using a VPN become illegal under the CFAA?" and like any such headlines, the answer is

by cletus 5y ago

This is a good sensationalist title that could easily be changed to "Will using a VPN become illegal under the CFAA?" and like any such headlines, the answer is "no". Just because one side is making an argument for that interpretation in a civil case means pretty much exactly nothing. What's more, the Supreme Court in recent rulings has started to slap down overly broad interpretations of "hacking" under the CFAA. Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a welcome but somewhat unexpected ruling. There's absolutely nothing to worry about here. [1]: https://www.lawfareblog.com/supreme-court-reins-cfaa-van-buren https://www.lawfareblog.com/supreme-court-reins-cfaa-van-bur... EDIT: corrected van Buren characterization.

monkeynotes 5y ago
Any headline I see with a question in that manner I don't click on. I know they will conclude with either "we don't know" or "no". It's just not worth reading unless you are interested in two sides of an argument but generally these articles are cheap fluff.
- wgx 5y ago
  https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
  - colejohnson66 5y ago
    “Is ‘Betteridge's law of headlines’ actually real?”
jcranmer 5y ago
> Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a completely and somewhat unexpected ruling. A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.)
- nobody9999 5y ago
  >A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.) That's an excellent point. And something folks should keep in mind. That said, I'm not sure how the restrictions in CFAA could apply here, as LinkedIn explicitly grants authorization to everyone by making the web content in question publicly accessible. What's more, other content on LinkedIn's web platform is not publicly accessible. If LinkedIn wants to make a claim that someone can exceed authorized access, then the content shouldn't be publicly available, as that explicitly allows access by anyone. I suppose they could make the argument that such automated scraping is some sort of DOS attack based on increased usage of their bandwidth/CPU from such activity, but that's a very different argument, IMHO. N.B.: IANAL Edit: Fixed typo

by cletus 5y ago

monkeynotes 5y ago

Any headline I see with a question in that manner I don't click on. I know they will conclude with either "we don't know" or "no". It's just not worth reading unless you are interested in two sides of an argument but generally these articles are cheap fluff.

wgx 5y ago
https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...
- colejohnson66 5y ago
  “Is ‘Betteridge's law of headlines’ actually real?”

jcranmer 5y ago

> Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a completely and somewhat unexpected ruling. A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.)

nobody9999 5y ago
>A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.) That's an excellent point. And something folks should keep in mind. That said, I'm not sure how the restrictions in CFAA could apply here, as LinkedIn explicitly grants authorization to everyone by making the web content in question publicly accessible. What's more, other content on LinkedIn's web platform is not publicly accessible. If LinkedIn wants to make a claim that someone can exceed authorized access, then the content shouldn't be publicly available, as that explicitly allows access by anyone. I suppose they could make the argument that such automated scraping is some sort of DOS attack based on increased usage of their bandwidth/CPU from such activity, but that's a very different argument, IMHO. N.B.: IANAL Edit: Fixed typo