4 ms·

Submitting a job application with false information does not violate any law that I am aware of (perhaps if it's a government position there is? I'm not sure).

Submitting a job application with false information does not violate any law that I am aware of (perhaps if it's a government position there is? I'm not sure). Manually submitting 50 job applications with false information also does not violate any laws that I am aware of. The focus then becomes on automation. But if I automate the job application process at 1 application/day, that's not illegal. So it becomes a balancing act between how fast I am automating, and how shoddily designed the application system is. I don't think it's as cut and dry as "this is illegal" or not.

lordlimecat 5y ago
The intent to access systems in an unauthorized way in order to disrupt those systems-- the clear intent of this script-- would fall afoul of the rather broad CFAA.
vageli 5y ago
Sending a single request to a website is not illegal. Hammering a website with thousands of requests per second with the intent of taking it down or making it inaccessible is. I agree it's not cut and dry but intent matters to some extent.
- ziddoap 5y ago
  In the context of this specific scenario, I can agree to that. But in the context of the parent comment ("what would the law be on DDOS of an online business by union members"), there's a valid discussion to be had. If my code submits 1 fake application to each open position, once per hour or once per day (which is well within what I can do manually), and that code is shared between thousands of striking workers (and their supporters), and that results in downtime or inaccessibility, should that be illegal? If so, why? Would it be different if there wasn't code, but just thousands of strikers submitting applications as fast as they manually can and as fast as the website allows? At what point does the responsibility lie with the company who isn't rate-limiting or captcha-ing?
  - colejohnson66 5y ago
    With the CFAA, it's actual entirely possible that the person who wrote the code is entirely at fault if their intent was that multiple people run malicious code. Courts aren't black and white and take intent and amount of damage into account. There's no hard and fast "number" on how many people makes a DDOS. In fact, the service (site) doesn't even need to be hampered to be considered a DOS. Just having HR have to filter through tens of thousands of bogus applications can be considered a DOS.
    - ziddoap 5y ago
      In the context of the CFAA, I think you can make just about any activity on a computer be deemed illegal. Which is why I think these cases are worth discussing, and we should have the discussions with the intent of improving what the CFAA is and does, because it's grossly outdated. Personally, I believe that if a few thousand striking workers decided to manually fill out job applications as fast as they could, as opposed to walking a picket line, that should potentially considered a valid form of protest. If the job-application-taking website fails or slows down or HR gets a headache, so be it. That's sort of the point of union workers protesting - cause headaches so their voices will hopefully be heard. And at that point, what is the difference between a few thousand people manually submitting applications or using code to submit them at a pace which they manually could anyways?
      - colejohnson66 5y ago
        Again: intent. If your intent is to harm/sabotage the company, it's beyond a protest.
        ziddoap 5y ago
        What do you think the intent of a strike is? Is holding up every car that enters or leaves the work premise not considered an intent to harm the operations of the company? Is resfuing to do your job, slowing the overall production of the company, not considered harmful to the company? What is the intent of the striking worker who airs their grievences on signs and media? Striking, by nature, has the intent of causing grief/headache/slowed business/etc., in order to make demands heard.
- pc86 5y ago
  Nobody is talking about "hammering a website with thousands of requests per second with the intent of taking it down." They're flooding an application process so that Kellogg HR can't find any real people in the giant pile of fake applications. Taking the website down is not a goal.
  - lordlimecat 5y ago
    Both are attacks on availability in an IT context which is what makes it illegal. The goal is to cost the company money by reducing their ability to use recruiting systems, which is rather analogous to taking down a website in the eyes of the law.
    - pc86 5y ago
      What do you mean by "in an IT context?" The limit of the "IT" part of this is submitting the application online. There is no further technical piece, and I can't help drawing a parallel between you saying this is illegal because it's "in an IT context" and similarly ridiculous things like patenting already-patented processes but "on a computer."
- confidantlake 5y ago
  If this stuff is illegal then posting a job when you already have an internal candidate in mind, or you are just collecting resumes or the actual job does not match the listing should also be illegal. After all aren't they sabotaging my application process with their spammy adds?

lordlimecat 5y ago

The intent to access systems in an unauthorized way in order to disrupt those systems-- the clear intent of this script-- would fall afoul of the rather broad CFAA.

vageli 5y ago

Sending a single request to a website is not illegal. Hammering a website with thousands of requests per second with the intent of taking it down or making it inaccessible is. I agree it's not cut and dry but intent matters to some extent.

ziddoap 5y ago
In the context of this specific scenario, I can agree to that. But in the context of the parent comment ("what would the law be on DDOS of an online business by union members"), there's a valid discussion to be had. If my code submits 1 fake application to each open position, once per hour or once per day (which is well within what I can do manually), and that code is shared between thousands of striking workers (and their supporters), and that results in downtime or inaccessibility, should that be illegal? If so, why? Would it be different if there wasn't code, but just thousands of strikers submitting applications as fast as they manually can and as fast as the website allows? At what point does the responsibility lie with the company who isn't rate-limiting or captcha-ing?
- colejohnson66 5y ago
  With the CFAA, it's actual entirely possible that the person who wrote the code is entirely at fault if their intent was that multiple people run malicious code. Courts aren't black and white and take intent and amount of damage into account. There's no hard and fast "number" on how many people makes a DDOS. In fact, the service (site) doesn't even need to be hampered to be considered a DOS. Just having HR have to filter through tens of thousands of bogus applications can be considered a DOS.
  - ziddoap 5y ago
    In the context of the CFAA, I think you can make just about any activity on a computer be deemed illegal. Which is why I think these cases are worth discussing, and we should have the discussions with the intent of improving what the CFAA is and does, because it's grossly outdated. Personally, I believe that if a few thousand striking workers decided to manually fill out job applications as fast as they could, as opposed to walking a picket line, that should potentially considered a valid form of protest. If the job-application-taking website fails or slows down or HR gets a headache, so be it. That's sort of the point of union workers protesting - cause headaches so their voices will hopefully be heard. And at that point, what is the difference between a few thousand people manually submitting applications or using code to submit them at a pace which they manually could anyways?
    - colejohnson66 5y ago
      Again: intent. If your intent is to harm/sabotage the company, it's beyond a protest.
      - ziddoap 5y ago
        What do you think the intent of a strike is? Is holding up every car that enters or leaves the work premise not considered an intent to harm the operations of the company? Is resfuing to do your job, slowing the overall production of the company, not considered harmful to the company? What is the intent of the striking worker who airs their grievences on signs and media? Striking, by nature, has the intent of causing grief/headache/slowed business/etc., in order to make demands heard.
pc86 5y ago
Nobody is talking about "hammering a website with thousands of requests per second with the intent of taking it down." They're flooding an application process so that Kellogg HR can't find any real people in the giant pile of fake applications. Taking the website down is not a goal.
- lordlimecat 5y ago
  Both are attacks on availability in an IT context which is what makes it illegal. The goal is to cost the company money by reducing their ability to use recruiting systems, which is rather analogous to taking down a website in the eyes of the law.
  - pc86 5y ago
    What do you mean by "in an IT context?" The limit of the "IT" part of this is submitting the application online. There is no further technical piece, and I can't help drawing a parallel between you saying this is illegal because it's "in an IT context" and similarly ridiculous things like patenting already-patented processes but "on a computer."
confidantlake 5y ago
If this stuff is illegal then posting a job when you already have an internal candidate in mind, or you are just collecting resumes or the actual job does not match the listing should also be illegal. After all aren't they sabotaging my application process with their spammy adds?