3 ms·

I think we are in violent agreement that the system is imperfect and that it could use some fixing, and that there have been some serious travesties of justice

I think we are in violent agreement that the system is imperfect and that it could use some fixing, and that there have been some serious travesties of justice that we should all be ashamed of. (I’m personally of the opinion that a prosecutor who intentionally withholds potentially exculpatory evidence from a defendant should be fined, disbarred, and banned from running for or holding a public office ever again.) By all means, advocate those fixes, and make your case to your representatives who are in the best position to address your concerns. But we are pretty far afield from the basic question here, which is about keeping out of other people’s stuff without consent. If we can’t agree on the basic morality of that, and whether people should be punished when they intentionally don’t, then I guess there’s no place to go. (We don’t know the facts of this case. But even if the OP only discovered and communicated the locations of files, they could still be guilty of a crime if they conspired with someone else to actually use the referenced data without authorization. Conspiracy is a powerful tool in a prosecutor’s belt.)

giantg2 5y ago
"which is about keeping out of other people’s stuff without consent. If we can’t agree on the basic morality of that" That's not what's being discussed. I think we agree that violation of one's private things/data or trespass is wrong. Where the contention lies is in what circumstances the person can expect to have that privacy and what the definitions are/should be to maximize societal benefit when it comes to internet usage. "and whether people should be punished when they intentionally don’t, then I guess there’s no place to go." Intentional access isn't even at issue here. "Knowing" access is all it takes under the law. I put knowing in quotes here because a prosecutor can prove that simply by your violation of the implicit agreement to ToS, even if you never read or knew them. So the issue isn't that people who knowingly or intentionally violate privacy/trespass need to be punished, it's in identifying when a violation has actually occurred, equally enforcing it, and whether the law is appropriately crafted to protect everyone and provide societal benefit. The way it is crafted now is not well defined, is not equally enforced, and can be used against people who have no ill intent or even knowledge that something was wrong. So not about punishing people who should be punished, but about the ability to punish those who shouldn't, as well as how to define them. So yeah, we can't agree on this topic, but your strawman argument of why is not the reason.
- otterley 5y ago
  > maximize societal benefit when it comes to internet usage. How would it maximize societal benefit to make it lawful to access and retain content that the owner didn't intend to make public? > Intentional access isn't even at issue here. "Knowing" access is all it takes under the law. I put knowing in quotes here because a prosecutor can prove that simply by your violation of the implicit agreement to ToS, even if you never read or knew them. I do not think this is correct, either under a plain reading of the text, or my experience. I'm looking at CFAA again (18 U.S.C. 1030 et seq.) and I don't see a bare knowledge requirement for any of the enumerated proscribed activities. Can you point to a specific one at issue? Besides, if you can show that a defendant had knowledge that the content was private and that they wouldn't have had been granted access had they asked the owner permission, yet the defendant proceeded to access the content anyway, how can one not conclude that proceeding further was intentional? At any rate, if you ever see a case where someone is successfully convicted for unauthorized access without proving an ill intent based on the circumstances of the case, by all means, I'd love to hear about it. But I haven't heard of any so far, and I don't expect to in the future.
  - giantg2 5y ago
    "How would it maximize societal benefit to make it lawful to access and retain content that the owner didn't intend to make public?" Because it would lead to companies implementing better cyber security policies and scanning, which reduces our county's susceptibility to foreign attacks, instead of spending money on lawyers just to sue people and spending tax money policing an issue that is the result of poor due diligence on the part of the company. This means that we would strengthen the incentive to prevent issues instead of relying on after the fact actions which may not even be feasible due to international actors. It also can also protect people from inadvertently violating the law and being prosecuted in a biased way if the boundaries of authorizations and public/private resources are more explicitly defined. This will also allow peace of mind for beneficial professionals like security researchers, journalists, and others in fields that currently find themselves at risk of significant legal fees even if they decide not to charge them. "Besides, if you can show that a defendant had knowledge that the content was private and that they wouldn't have had been granted access had they asked the owner permission, yet the defendant proceeded to access the content anyway, how can one not conclude that proceeding further was intentional?" How can you prove that, or is that a "reasonable person" (which is especially tricky when it comes to tech)? For example, do you always ask permission before posting or visiting links online? You have no way of knowing if someone is going to give permission or not in most cases. I assume you, like the vast majority of us, access publically available computer resources based on the implied consent that if it was made public, that it's authorized to use. The OP thinks he was allowed to link to public files. I'm inclined to agree. If you put something in public, you should expect the public to interact with it. That's common sense and consistent with concepts already in use in physical property law (viewing/recording private property from a public space). "At any rate, if you ever see a case where someone is successfully convicted for unauthorized access without proving an ill intent based on the circumstances of the case" Conviction isn't the only damage. It can cost thousands of dollars just for the legal representation if you are just investigated. The recent high profile MO reporter case is an example of this. The individual came forward with the information showing good faith and still they had to retain legal council to deal with the accusation. Security researchers have no ill intent and they are often the target of the CFAA. United States v Drew shows that it's a CFAA violation just if you create a fake account without knowing it's a ToS violation. "I'm looking at CFAA again (18 U.S.C. 1030 et seq.) and I don't see a bare knowledge requirement" You're right that the code required intent. But there have been rulings that just require knowingly accessing a system, and that ToS violations are enough to meet the criteria. Sandvig v Barr demonstrates that ToS violations can be CFAA violations (even though the specific research was found to be excluded). Van Buren v United States and United States v Drew further supports ToS violations being enforced, even if Drew didn't actually know it was a ToS violation. There are a lot of legal documents around this issue from the EFF and ACLU. They are especially concerned about the lack of definition around what constitutes authorization, a concern I share.

giantg2 5y ago

"which is about keeping out of other people’s stuff without consent. If we can’t agree on the basic morality of that" That's not what's being discussed. I think we agree that violation of one's private things/data or trespass is wrong. Where the contention lies is in what circumstances the person can expect to have that privacy and what the definitions are/should be to maximize societal benefit when it comes to internet usage. "and whether people should be punished when they intentionally don’t, then I guess there’s no place to go." Intentional access isn't even at issue here. "Knowing" access is all it takes under the law. I put knowing in quotes here because a prosecutor can prove that simply by your violation of the implicit agreement to ToS, even if you never read or knew them. So the issue isn't that people who knowingly or intentionally violate privacy/trespass need to be punished, it's in identifying when a violation has actually occurred, equally enforcing it, and whether the law is appropriately crafted to protect everyone and provide societal benefit. The way it is crafted now is not well defined, is not equally enforced, and can be used against people who have no ill intent or even knowledge that something was wrong. So not about punishing people who should be punished, but about the ability to punish those who shouldn't, as well as how to define them. So yeah, we can't agree on this topic, but your strawman argument of why is not the reason.

otterley 5y ago
> maximize societal benefit when it comes to internet usage. How would it maximize societal benefit to make it lawful to access and retain content that the owner didn't intend to make public? > Intentional access isn't even at issue here. "Knowing" access is all it takes under the law. I put knowing in quotes here because a prosecutor can prove that simply by your violation of the implicit agreement to ToS, even if you never read or knew them. I do not think this is correct, either under a plain reading of the text, or my experience. I'm looking at CFAA again (18 U.S.C. 1030 et seq.) and I don't see a bare knowledge requirement for any of the enumerated proscribed activities. Can you point to a specific one at issue? Besides, if you can show that a defendant had knowledge that the content was private and that they wouldn't have had been granted access had they asked the owner permission, yet the defendant proceeded to access the content anyway, how can one not conclude that proceeding further was intentional? At any rate, if you ever see a case where someone is successfully convicted for unauthorized access without proving an ill intent based on the circumstances of the case, by all means, I'd love to hear about it. But I haven't heard of any so far, and I don't expect to in the future.
- giantg2 5y ago
  "How would it maximize societal benefit to make it lawful to access and retain content that the owner didn't intend to make public?" Because it would lead to companies implementing better cyber security policies and scanning, which reduces our county's susceptibility to foreign attacks, instead of spending money on lawyers just to sue people and spending tax money policing an issue that is the result of poor due diligence on the part of the company. This means that we would strengthen the incentive to prevent issues instead of relying on after the fact actions which may not even be feasible due to international actors. It also can also protect people from inadvertently violating the law and being prosecuted in a biased way if the boundaries of authorizations and public/private resources are more explicitly defined. This will also allow peace of mind for beneficial professionals like security researchers, journalists, and others in fields that currently find themselves at risk of significant legal fees even if they decide not to charge them. "Besides, if you can show that a defendant had knowledge that the content was private and that they wouldn't have had been granted access had they asked the owner permission, yet the defendant proceeded to access the content anyway, how can one not conclude that proceeding further was intentional?" How can you prove that, or is that a "reasonable person" (which is especially tricky when it comes to tech)? For example, do you always ask permission before posting or visiting links online? You have no way of knowing if someone is going to give permission or not in most cases. I assume you, like the vast majority of us, access publically available computer resources based on the implied consent that if it was made public, that it's authorized to use. The OP thinks he was allowed to link to public files. I'm inclined to agree. If you put something in public, you should expect the public to interact with it. That's common sense and consistent with concepts already in use in physical property law (viewing/recording private property from a public space). "At any rate, if you ever see a case where someone is successfully convicted for unauthorized access without proving an ill intent based on the circumstances of the case" Conviction isn't the only damage. It can cost thousands of dollars just for the legal representation if you are just investigated. The recent high profile MO reporter case is an example of this. The individual came forward with the information showing good faith and still they had to retain legal council to deal with the accusation. Security researchers have no ill intent and they are often the target of the CFAA. United States v Drew shows that it's a CFAA violation just if you create a fake account without knowing it's a ToS violation. "I'm looking at CFAA again (18 U.S.C. 1030 et seq.) and I don't see a bare knowledge requirement" You're right that the code required intent. But there have been rulings that just require knowingly accessing a system, and that ToS violations are enough to meet the criteria. Sandvig v Barr demonstrates that ToS violations can be CFAA violations (even though the specific research was found to be excluded). Van Buren v United States and United States v Drew further supports ToS violations being enforced, even if Drew didn't actually know it was a ToS violation. There are a lot of legal documents around this issue from the EFF and ACLU. They are especially concerned about the lack of definition around what constitutes authorization, a concern I share.