5 ms·

This will very likely be overturned as it flies in the face of the 9th circuit court decision on HiQ vs LinkedIn. This is in a different circuit, so it'll need

This will very likely be overturned as it flies in the face of the 9th circuit court decision on HiQ vs LinkedIn. This is in a different circuit, so it'll need to be elevated, but CFAA is absolutely the incorrect tool to be utilized here. [1] https://calawyers.org/privacy-law/ninth-circuit-holds-data-scraping-is-legal-in-hiq-v-linkedin/ https://calawyers.org/privacy-law/ninth-circuit-holds-data-s...

inopinatus 2y ago
We may well find that this matter doesn't ultimately hinge on screen-scraping as much as it does deceptive behaviour by an agent.
HDThoreaun 2y ago
Or the 9ths decision gets overturned...
- deleted 2y ago
  [deleted]
jcranmer 2y ago
I haven't followed the facts of this case, and I haven't found any quickly online. The best I have is the order on the motion to dismiss [1], which covers why the judge thought HiQ v LinkedIn wasn't sufficient prior precedent to preclude this being a CFAA violation, along with Ryanair's motion for summary judgement [2] which suggests the results of discovery. The short answer is... uh, not much. The order on the motion to dismiss suggests that to violate the CFAA, there is a requirement that you're specifically bypassing some form of access control, and it says the complaint sufficiently alleges such control (specifically password-protects internet accounts). Which... is a somewhat weak argument, but the judge here seems to think that HiQ is narrowly focused on "what's publicly available without requiring users to authenticate themselves." The motion for summary judgement states: > Booking and Kayak admit that their access was intentional, and there are no factual disputes that Booking’s and Kayak’s access circumvents authentication mechanisms implemented by Ryanair specifically to keep Defendants out. which, again, is vague on what those authentication mechanisms were, and it's not like this article provides any elucidation. It's far from certain that this will be overturned on appeal, but "creating an account to use for screen scraping" doesn't sound like something that CFAA prohibits. [1] https://storage.courtlistener.com/recap/gov.uscourts.ded.73139/gov.uscourts.ded.73139.105.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.ded.731... [2] https://storage.courtlistener.com/recap/gov.uscourts.ded.73139/gov.uscourts.ded.73139.354.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.ded.731...
byteknight 2y ago
CFAA was already reworded I thought to avoid these exact types of situations? Among other things, responsible disclosure.
- hdmoore 2y ago
  The CFAA has not been amended, but there was DoJ policy change on enforcement. So everyone is always breaking the law in the course of normal business, and it's still up to the prosector to determine who to go after: - https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...

inopinatus 2y ago

We may well find that this matter doesn't ultimately hinge on screen-scraping as much as it does deceptive behaviour by an agent.

HDThoreaun 2y ago

Or the 9ths decision gets overturned...

deleted 2y ago
[deleted]

jcranmer 2y ago

I haven't followed the facts of this case, and I haven't found any quickly online. The best I have is the order on the motion to dismiss [1], which covers why the judge thought HiQ v LinkedIn wasn't sufficient prior precedent to preclude this being a CFAA violation, along with Ryanair's motion for summary judgement [2] which suggests the results of discovery. The short answer is... uh, not much. The order on the motion to dismiss suggests that to violate the CFAA, there is a requirement that you're specifically bypassing some form of access control, and it says the complaint sufficiently alleges such control (specifically password-protects internet accounts). Which... is a somewhat weak argument, but the judge here seems to think that HiQ is narrowly focused on "what's publicly available without requiring users to authenticate themselves." The motion for summary judgement states: > Booking and Kayak admit that their access was intentional, and there are no factual disputes that Booking’s and Kayak’s access circumvents authentication mechanisms implemented by Ryanair specifically to keep Defendants out. which, again, is vague on what those authentication mechanisms were, and it's not like this article provides any elucidation. It's far from certain that this will be overturned on appeal, but "creating an account to use for screen scraping" doesn't sound like something that CFAA prohibits. [1] https://storage.courtlistener.com/recap/gov.uscourts.ded.73139/gov.uscourts.ded.73139.105.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.ded.731... [2] https://storage.courtlistener.com/recap/gov.uscourts.ded.73139/gov.uscourts.ded.73139.354.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.ded.731...

byteknight 2y ago

CFAA was already reworded I thought to avoid these exact types of situations? Among other things, responsible disclosure.

hdmoore 2y ago
The CFAA has not been amended, but there was DoJ policy change on enforcement. So everyone is always breaking the law in the course of normal business, and it's still up to the prosector to determine who to go after: - https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act https://www.justice.gov/opa/pr/department-justice-announces-...