4 ms·

This doesn't require bad faith in Google's part, there's any number of levers Apple can pull to pretty much force this: claim DMCA violation, CFAA violation, Pl

This doesn't require bad faith in Google's part, there's any number of levers Apple can pull to pretty much force this: claim DMCA violation, CFAA violation, Play policy violation, etc etc.

paulmd 3y ago
It’s an obvious play policy violation. Can’t have apps that are deliberately and obviously intended solely to violate the terms of service of another service, or conduct illegal activity (CFAA unauthorized access). You won’t find Reddit is Fun or any third party Reddit clients there anymore either even though it’s obviously trivially possible to just scrape it and keep trucking. Because that’s against Reddit’s TOS too, and doing so anyway is a CFAA violation. Shockingly, google doesn’t want to be an accessory to your computer crimes. Rightly or wrongly the law is quite broad in this area, you aren’t supposed to be accessing this system, it is an open-and-shut case just as much as illicitly connecting to TymNet. The only fact that matters is that the system operator doesn’t want you there, that is sufficient for this to be a felony, people have been globally extradited over this. Google isn’t going down because you want to use an open-relay that the system operator is actively indicating shouldn’t be open and is trying to lock down. And if the tables were turned and some other third-party built a commercial service on reselling spoofed access to gmail smtp relays or something… google would shut you down themselves too, “gatekeeper” or no (lots of domains struggle to send mail to gmail and outlook). Things have gotten real silly because of the extreme degree of apple-bashing that people entertain. And apple has been very very tolerant, because they know the optics would be horrible. But the law here is clear and the penalties are enormous. This is not different in kind to any other unauthorized-access case.
- saurik 3y ago
  https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-violating-... > Judge John Bates ruled on Friday that the plaintiffs' proposed research wouldn't violate the CFAA's criminal provisions at all. Someone violates the CFAA when they bypass an access restriction like a password. But someone who logs into a website with a valid password doesn't become a hacker simply by doing something prohibited by a website's terms of service, the judge concluded. > "Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote. https://arstechnica.com/tech-policy/2019/09/web-scraping-doesnt-violate-anti-hacking-law-appeals-court-rules/ https://arstechnica.com/tech-policy/2019/09/web-scraping-doe... > Scraping a public website without the approval of the website's owner isn't a violation of the Computer Fraud and Abuse Act, an appeals court ruled on Monday. The ruling comes in a legal battle that pits Microsoft-owned LinkedIn against a small data-analytics company called hiQ Labs. So, uh... cool story, bro, but you seem to have a ridiculously extreme and pretty clearly unintended interpretation of this law. The users of Beeper have valid credentials to this service and are accessing only the things they were intended to be able to access... they merely are doing so with a modified or alternative client, which usually is protected under various laws due to an interest in competition and interoperability.
  - paulmd 3y ago
    Ground level judges don’t matter all that much if they fuck around. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— or (C) information from any protected computer; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; > (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— or (II) has moved in or otherwise affects interstate or foreign commerce; Both of these clauses are being facially violated here. The clause of interstate commerce to be a protected system is trivially satisfied. Beeper additionally has taken commercial advantage in excess of $5k. Ianal. Apple can come down like a ton of bricks though. That’s what people wanted in the 80s/90s.
    - hn_acker 3y ago
      The CFAA is overbroad and remains unclear with respect to "without authorization, or exceeds authorized access" even after the 2021 Van Buren v. United States ruling. But Beeper Mini doesn't damage or destroy any files on Apple's servers, so I think the CFAA doesn't apply [1]: > The majority also recognized that the portions of the CFAA that define damage and loss are premised on harm to computer files and data, rather than general non-digital harm such as trespassing on another person’s property: “The statutory definitions of ‘damage’ and ‘loss’ thus focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data,” the Court wrote. This is important because loss and damage are prerequisites to civil CFAA claims, and the ability of private entities to enforce the CFAA has been a threat that deters security research when companies might rather their vulnerabilities remain unknown to the public. The relevant text of the CFAA is 18 U.S. Code § 1030(a)(5) [2]: > (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; > (B)intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or > (C)intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. [1] https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security https://www.eff.org/deeplinks/2021/06/van-buren-victory-agai... [2] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

This doesn't require bad faith in Google's part, there's any number of levers Apple can pull to pretty much force this: claim DMCA violation, CFAA violation, Play policy violation, etc etc.

paulmd 3y ago

It’s an obvious play policy violation. Can’t have apps that are deliberately and obviously intended solely to violate the terms of service of another service, or conduct illegal activity (CFAA unauthorized access). You won’t find Reddit is Fun or any third party Reddit clients there anymore either even though it’s obviously trivially possible to just scrape it and keep trucking. Because that’s against Reddit’s TOS too, and doing so anyway is a CFAA violation. Shockingly, google doesn’t want to be an accessory to your computer crimes. Rightly or wrongly the law is quite broad in this area, you aren’t supposed to be accessing this system, it is an open-and-shut case just as much as illicitly connecting to TymNet. The only fact that matters is that the system operator doesn’t want you there, that is sufficient for this to be a felony, people have been globally extradited over this. Google isn’t going down because you want to use an open-relay that the system operator is actively indicating shouldn’t be open and is trying to lock down. And if the tables were turned and some other third-party built a commercial service on reselling spoofed access to gmail smtp relays or something… google would shut you down themselves too, “gatekeeper” or no (lots of domains struggle to send mail to gmail and outlook). Things have gotten real silly because of the extreme degree of apple-bashing that people entertain. And apple has been very very tolerant, because they know the optics would be horrible. But the law here is clear and the penalties are enormous. This is not different in kind to any other unauthorized-access case.

saurik 3y ago
https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-violating-... > Judge John Bates ruled on Friday that the plaintiffs' proposed research wouldn't violate the CFAA's criminal provisions at all. Someone violates the CFAA when they bypass an access restriction like a password. But someone who logs into a website with a valid password doesn't become a hacker simply by doing something prohibited by a website's terms of service, the judge concluded. > "Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote. https://arstechnica.com/tech-policy/2019/09/web-scraping-doesnt-violate-anti-hacking-law-appeals-court-rules/ https://arstechnica.com/tech-policy/2019/09/web-scraping-doe... > Scraping a public website without the approval of the website's owner isn't a violation of the Computer Fraud and Abuse Act, an appeals court ruled on Monday. The ruling comes in a legal battle that pits Microsoft-owned LinkedIn against a small data-analytics company called hiQ Labs. So, uh... cool story, bro, but you seem to have a ridiculously extreme and pretty clearly unintended interpretation of this law. The users of Beeper have valid credentials to this service and are accessing only the things they were intended to be able to access... they merely are doing so with a modified or alternative client, which usually is protected under various laws due to an interest in competition and interoperability.
- paulmd 3y ago
  Ground level judges don’t matter all that much if they fuck around. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— or (C) information from any protected computer; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; > (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— or (II) has moved in or otherwise affects interstate or foreign commerce; Both of these clauses are being facially violated here. The clause of interstate commerce to be a protected system is trivially satisfied. Beeper additionally has taken commercial advantage in excess of $5k. Ianal. Apple can come down like a ton of bricks though. That’s what people wanted in the 80s/90s.
  - hn_acker 3y ago
    The CFAA is overbroad and remains unclear with respect to "without authorization, or exceeds authorized access" even after the 2021 Van Buren v. United States ruling. But Beeper Mini doesn't damage or destroy any files on Apple's servers, so I think the CFAA doesn't apply [1]: > The majority also recognized that the portions of the CFAA that define damage and loss are premised on harm to computer files and data, rather than general non-digital harm such as trespassing on another person’s property: “The statutory definitions of ‘damage’ and ‘loss’ thus focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data,” the Court wrote. This is important because loss and damage are prerequisites to civil CFAA claims, and the ability of private entities to enforce the CFAA has been a threat that deters security research when companies might rather their vulnerabilities remain unknown to the public. The relevant text of the CFAA is 18 U.S. Code § 1030(a)(5) [2]: > (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; > (B)intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or > (C)intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. [1] https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security https://www.eff.org/deeplinks/2021/06/van-buren-victory-agai... [2] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030