3 ms·

https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-vi

by saurik 3y ago

https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-violating-... > Judge John Bates ruled on Friday that the plaintiffs' proposed research wouldn't violate the CFAA's criminal provisions at all. Someone violates the CFAA when they bypass an access restriction like a password. But someone who logs into a website with a valid password doesn't become a hacker simply by doing something prohibited by a website's terms of service, the judge concluded. > "Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote. https://arstechnica.com/tech-policy/2019/09/web-scraping-doesnt-violate-anti-hacking-law-appeals-court-rules/ https://arstechnica.com/tech-policy/2019/09/web-scraping-doe... > Scraping a public website without the approval of the website's owner isn't a violation of the Computer Fraud and Abuse Act, an appeals court ruled on Monday. The ruling comes in a legal battle that pits Microsoft-owned LinkedIn against a small data-analytics company called hiQ Labs. So, uh... cool story, bro, but you seem to have a ridiculously extreme and pretty clearly unintended interpretation of this law. The users of Beeper have valid credentials to this service and are accessing only the things they were intended to be able to access... they merely are doing so with a modified or alternative client, which usually is protected under various laws due to an interest in competition and interoperability.

paulmd 3y ago
Ground level judges don’t matter all that much if they fuck around. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— or (C) information from any protected computer; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; > (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— or (II) has moved in or otherwise affects interstate or foreign commerce; Both of these clauses are being facially violated here. The clause of interstate commerce to be a protected system is trivially satisfied. Beeper additionally has taken commercial advantage in excess of $5k. Ianal. Apple can come down like a ton of bricks though. That’s what people wanted in the 80s/90s.
- hn_acker 3y ago
  The CFAA is overbroad and remains unclear with respect to "without authorization, or exceeds authorized access" even after the 2021 Van Buren v. United States ruling. But Beeper Mini doesn't damage or destroy any files on Apple's servers, so I think the CFAA doesn't apply [1]: > The majority also recognized that the portions of the CFAA that define damage and loss are premised on harm to computer files and data, rather than general non-digital harm such as trespassing on another person’s property: “The statutory definitions of ‘damage’ and ‘loss’ thus focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data,” the Court wrote. This is important because loss and damage are prerequisites to civil CFAA claims, and the ability of private entities to enforce the CFAA has been a threat that deters security research when companies might rather their vulnerabilities remain unknown to the public. The relevant text of the CFAA is 18 U.S. Code § 1030(a)(5) [2]: > (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; > (B)intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or > (C)intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. [1] https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security https://www.eff.org/deeplinks/2021/06/van-buren-victory-agai... [2] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

by saurik 3y ago

paulmd 3y ago

Ground level judges don’t matter all that much if they fuck around. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— or (C) information from any protected computer; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; > (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— or (II) has moved in or otherwise affects interstate or foreign commerce; Both of these clauses are being facially violated here. The clause of interstate commerce to be a protected system is trivially satisfied. Beeper additionally has taken commercial advantage in excess of $5k. Ianal. Apple can come down like a ton of bricks though. That’s what people wanted in the 80s/90s.

hn_acker 3y ago
The CFAA is overbroad and remains unclear with respect to "without authorization, or exceeds authorized access" even after the 2021 Van Buren v. United States ruling. But Beeper Mini doesn't damage or destroy any files on Apple's servers, so I think the CFAA doesn't apply [1]: > The majority also recognized that the portions of the CFAA that define damage and loss are premised on harm to computer files and data, rather than general non-digital harm such as trespassing on another person’s property: “The statutory definitions of ‘damage’ and ‘loss’ thus focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data,” the Court wrote. This is important because loss and damage are prerequisites to civil CFAA claims, and the ability of private entities to enforce the CFAA has been a threat that deters security research when companies might rather their vulnerabilities remain unknown to the public. The relevant text of the CFAA is 18 U.S. Code § 1030(a)(5) [2]: > (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; > (B)intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or > (C)intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. [1] https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security https://www.eff.org/deeplinks/2021/06/van-buren-victory-agai... [2] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030