4 ms·

Ground level judges don’t matter all that much if they fuck around. > (2) intentionally accesses a computer without authorization or exceeds authorized access,

by paulmd 3y ago

Ground level judges don’t matter all that much if they fuck around. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— or (C) information from any protected computer; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; > (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— or (II) has moved in or otherwise affects interstate or foreign commerce; Both of these clauses are being facially violated here. The clause of interstate commerce to be a protected system is trivially satisfied. Beeper additionally has taken commercial advantage in excess of $5k. Ianal. Apple can come down like a ton of bricks though. That’s what people wanted in the 80s/90s.

hn_acker 3y ago
The CFAA is overbroad and remains unclear with respect to "without authorization, or exceeds authorized access" even after the 2021 Van Buren v. United States ruling. But Beeper Mini doesn't damage or destroy any files on Apple's servers, so I think the CFAA doesn't apply [1]: > The majority also recognized that the portions of the CFAA that define damage and loss are premised on harm to computer files and data, rather than general non-digital harm such as trespassing on another person’s property: “The statutory definitions of ‘damage’ and ‘loss’ thus focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data,” the Court wrote. This is important because loss and damage are prerequisites to civil CFAA claims, and the ability of private entities to enforce the CFAA has been a threat that deters security research when companies might rather their vulnerabilities remain unknown to the public. The relevant text of the CFAA is 18 U.S. Code § 1030(a)(5) [2]: > (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; > (B)intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or > (C)intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. [1] https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security https://www.eff.org/deeplinks/2021/06/van-buren-victory-agai... [2] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030

by paulmd 3y ago

hn_acker 3y ago

The CFAA is overbroad and remains unclear with respect to "without authorization, or exceeds authorized access" even after the 2021 Van Buren v. United States ruling. But Beeper Mini doesn't damage or destroy any files on Apple's servers, so I think the CFAA doesn't apply [1]: > The majority also recognized that the portions of the CFAA that define damage and loss are premised on harm to computer files and data, rather than general non-digital harm such as trespassing on another person’s property: “The statutory definitions of ‘damage’ and ‘loss’ thus focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data,” the Court wrote. This is important because loss and damage are prerequisites to civil CFAA claims, and the ability of private entities to enforce the CFAA has been a threat that deters security research when companies might rather their vulnerabilities remain unknown to the public. The relevant text of the CFAA is 18 U.S. Code § 1030(a)(5) [2]: > (A)knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; > (B)intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or > (C)intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. [1] https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security https://www.eff.org/deeplinks/2021/06/van-buren-victory-agai... [2] https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030