7 ms·

Issue spotter: I think we've got him on trespass to a protected computer system used in interstate commerce, common law fraud, and theft of services. What othe

by patio11 14y ago

Issue spotter: I think we've got him on trespass to a protected computer system used in interstate commerce, common law fraud, and theft of services. What other crimes did he just admit to that I missed? (We'll ignore that he hacked a computer while on an airplane, a detail which I would not expect the government to be neutral about.) Seriously, kids: this is an astoundingly bad idea.

ihavebeenseen 14y ago
I am guessing Google will be upset with him too when they get wind of this.
fiatmoney 14y ago
I'm not seeing how this is at all legally problematic. AFAICT there's no TOS violation, and if there were, TOS violations don't make it a crime. The user agent is totally discretionary on the part of the browser and price-discriminating based on one is in no way an access control mechanism. It seems equivalent to saying "red computers get charged half price", and then objecting when someone snaps a red shell on their laptop.
- patio11 14y ago
  Do you want me to start quoting Title 18 U.S.C Section 1030 (the Computer Fraud and Abuse Act) or can you Google it yourself? There is no possible reading of these facts that does not run afoul of that law, among others. There is no affirmative defense "But it was really easy for me to exceed my authorized privileges because their security sucked" provided for in the law.
  - mindcrime 14y ago
    So what? Everyone of us probably runs afoul of hundreds or thousands of bogus laws every day. It's time to start encouraging people to be bolder and violate more laws, as far as I'm concerned. Now excuse me while I go listen to some Judas Priest... \m/
    - tptacek 14y ago
      The idea behind computer fraud laws, and fraud laws in general, is that tricking people to obtain valuable services at the expense of the victim is dishonest. People and companies should be able to offer services assuming that their counterparties are honest. When dishonest people abuse company offerings, they impose a cost on everyone in the market. In this specific case, the prospect of fraudulent access requires the wireless ISP to spend money strengthening their security controls; the costs associated with that are passed on to the market, as are the inconveniences associated with new controls. In other words: the law sees it as a bad thing that ISPs should have to bulletproof their offerings so that when they make a service available to phones, it isn't easy to trick those systems into providing service to computers. The law says, "it is silly that the market should have to bear the cost of that engineering, because it's undertaken solely to prevent dishonest people from obtaining undue benefit". The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. People probably do violate all sorts of stupid laws all the time. But that's a very different point than "people commit all sorts of frauds all the time". They do not. Fraud is invariably wrong.
      - lowboy 14y ago
        > The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. What services did he steal? He paid for wifi services for the duration of the flight. The device by which he enjoys that service should be of no consequence.
        tptacek 14y ago
        He paid for wifi services for his computer for the duration of the flight. The fact that you do not recognize the legitimacy of a commercial offering does not give you the right to invent your own terms; you take the terms as offered, or you don't do business at all.
        14y ago
  - fiatmoney 14y ago
    Actually, please do clarify. I am genuinely curious as to your reasoning. Consider also that there is no TOS violation as far as I can tell [1], and TOS violations do not a crime make [2]. Actually "hacking" something to get the service for free (sniffing a cookie and spoofing a MAC address, perhaps) would of course be another matter, but there's not even an access control being circumvented here. Edit: Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? [1] http://www.gogoair.com/gogo/cms/term.do http://www.gogoair.com/gogo/cms/term.do [2] http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en-banc-decision-in-united-states-v-nosal-adopting-narrow-interpretation-of-computer-fraud-and-abuse-act/ http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en...
    - tptacek 14y ago
      You do not need to violate a black letter TOS agreement to commit fraud. You do need to intend to deceive to commit fraud, which moots your later example.
    - jahewson 14y ago
      > Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? No. The browser window size, or user agent string are just proxies for the real question: is the device a laptop or a phone/tablet/etc? Your laptop remains a laptop whatever size the window is. This guy's laptop remained very much not a phone after altering his user agent. Edit: It's worth adding that desktop browsers do not use mobile device user agent strings during normal operation, but small windows are perfectly legitimate.
  - tptacek 14y ago
    You are right in spirit but wrong, I think, in the specifics. In spirit: yes, knowingly exceeding your authorized access to a system in order to obtain a personal benefit is a federal crime, described by the CFAA, and I'm pretty sure the TOS on the site does not need to be ironclad to give that force. But in the specifics: (i) Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? (ii) Did they have an intent to defraud? (This is the key issue and the point I believe you were making) (iii) Did the actual computer access materially advance their fraudulent scheme? (You can't drag computers into any given fraud case to make it federal) (iv) Did they obtain anything of value? So far so bad: the answers to all four questions are "yes". But: when the object of the fraud is access to the computer system itself --- that is, when the "thing of value" is "use of the computer system in question", there's a fifth test: (v) Was the total value of the computer usage greater than $5000? Nope. Very important to note here though: regardless of the fact that it is vanishingly unlikely that a CFAA case would be brought here, and even less likely that the prosecution would prevail, if by committing this particular little fraud and then bragging about it on the Internet this blog post cost the operators of the service a huge amount of money to strengthen defenses or investigate system usage, the blogger has opened themselves up to a very painful civil case.
    - lowboy 14y ago
      > Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? The answer to that one is "no". He had authorization to both pages. Unless we're going to interpret that authorization was given to each device and not the person.
      - tptacek 14y ago
        You're suggesting that the defendant in this case either didn't know the difference between a phone and a computer, or had a reasonable belief that despite the obvious language on those pages, the provider did not care whether he was using a phone or a computer. Good luck with that argument.
- jahewson 14y ago
  While it is not mentioned in the ToS, the pricing varies based on what device you have (this is stated elsewhere). This guy has a laptop and is claiming that it's a phone - a deception made for personal gain - a.k.a fraud.
  - fiatmoney 14y ago
    I would argue with your "claiming it's a phone". Under that rationale, everyone using Internet Explorer is committing fraud as soon as someone decides to price-discriminate based on it, since it claims to be Mozilla [1]. User agents are totally discretionary. It's like the color of your laptop. [1] http://www.useragentstring.com/pages/Internet%20Explorer/ http://www.useragentstring.com/pages/Internet%20Explorer/
    - jahewson 14y ago
      > everyone using Internet Explorer is committing fraud No - there's no financial gain from using IE. He has manipulated his computer to inform web servers that his device is a mobile device. I'm not aware of any desktop browsers which use mobile device user agent strings during normal operation. Whether it is discretionary or not is irrelevant, the point is that he's deviated significantly from normal behaviour, deliberately, without any legitimate reason (e.g. he wasn't at the time say, testing a mobile site), in fact with only the intent to defraud. Ultimately, user agent strings are not a brilliant way to create a legally binding contract - it would be much smarter to have the contract amended based on the user-string to include "I confirm that my device is a laptop", and make this click-through.
alexmunroe 14y ago
As far as I can see he's done absolutely nothing illegal, immoral maybe depending on your view on the matter. It's rather like totally trusting client side javascript for authentication, unless you check that the data being received is accurate then you'll never be able to stop this. It's a simple case of trusting the client. I would imagine that should the submitted have been running an Android Development Image on his system and access via a browser on that the effect would be the same.
- sp332 14y ago
  Intentionally misrepresenting the situation to get a better deal is called fraud.
  - mindcrime 14y ago
    UA strings aren't bound to any legal requirements, as far as I know. So how is it fraud if one party has no reasonable expectation of any particular representation of the situation in the first place?
    - lowboy 14y ago
      Wellllll, it would be reasonable to expect that 99.99% of people wouldn't change their UA.
    - jahewson 14y ago
      Name me one desktop browser which uses a mobile UA string during normal operation.
lowboy 14y ago
Assuming this isn't a troll post: 1) He didn't trespass on a protected computer system or hack anything - he's using a web browser. 2) Users are not required to leave their browser's default settings intact when interacting with websites. 3) Where are the theft of services? He paid for a wifi internet connection for the duration of the flight with a price he was offered. He could have just as easily paid using his phone and then tethered his laptop to it.
- flatline3 14y ago
  I think that's a stretch. Here's another example: A certain airline offers upgrades to first class seating, but only within a certain time period before the flight. When using their website, I realized that I could pass in the time constraint as a parameter to their webapp. Boom, cheap first class upgrade, at any time! Is that stealing? Yes. At the very least, theft of service. That first class ticket can sell for thousands of dollars, and instead, this trick would have allowed me to get it for hundreds. Just because their webapp allowed it doesn't make it OK. It's no different than tricking someone at the counter into giving you an item for free, or giving you extra change.
  - tptacek 14y ago
    The distinction you're trying to draw between "theft" and "theft of service" is the reason we have fraud statutes. Fraud is a more general crime than theft.
  - lowboy 14y ago
    I think that analogy is flawed because the airline can only sell that seat once. If you used that hack, then you would be removing the chance that the airline could sell that seat for the full price. That doesn't apply to the wifi situation.
    - flatline3 14y ago
      You've clearly not dealt with congested airplane wifi.
drivebyacct2 14y ago
So what if I paid for it and used my USB tether? Am I committing fraud? Violating the TOS maybe? Both?
- masonhensley 14y ago
  I glanced at the first two screenshots before I read the article and thought he was just going to create a wifi hotspot off his phone... that way he could get internet on both devices for the mobile price.
  - ariwilson 14y ago
    You can't create a WiFi hotspot from a WiFi connection on a Galaxy Nexus.

by patio11 14y ago

ihavebeenseen 14y ago

I am guessing Google will be upset with him too when they get wind of this.

fiatmoney 14y ago

I'm not seeing how this is at all legally problematic. AFAICT there's no TOS violation, and if there were, TOS violations don't make it a crime. The user agent is totally discretionary on the part of the browser and price-discriminating based on one is in no way an access control mechanism. It seems equivalent to saying "red computers get charged half price", and then objecting when someone snaps a red shell on their laptop.

patio11 14y ago
Do you want me to start quoting Title 18 U.S.C Section 1030 (the Computer Fraud and Abuse Act) or can you Google it yourself? There is no possible reading of these facts that does not run afoul of that law, among others. There is no affirmative defense "But it was really easy for me to exceed my authorized privileges because their security sucked" provided for in the law.
- mindcrime 14y ago
  So what? Everyone of us probably runs afoul of hundreds or thousands of bogus laws every day. It's time to start encouraging people to be bolder and violate more laws, as far as I'm concerned. Now excuse me while I go listen to some Judas Priest... \m/
  - tptacek 14y ago
    The idea behind computer fraud laws, and fraud laws in general, is that tricking people to obtain valuable services at the expense of the victim is dishonest. People and companies should be able to offer services assuming that their counterparties are honest. When dishonest people abuse company offerings, they impose a cost on everyone in the market. In this specific case, the prospect of fraudulent access requires the wireless ISP to spend money strengthening their security controls; the costs associated with that are passed on to the market, as are the inconveniences associated with new controls. In other words: the law sees it as a bad thing that ISPs should have to bulletproof their offerings so that when they make a service available to phones, it isn't easy to trick those systems into providing service to computers. The law says, "it is silly that the market should have to bear the cost of that engineering, because it's undertaken solely to prevent dishonest people from obtaining undue benefit". The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. People probably do violate all sorts of stupid laws all the time. But that's a very different point than "people commit all sorts of frauds all the time". They do not. Fraud is invariably wrong.
    - lowboy 14y ago
      > The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. What services did he steal? He paid for wifi services for the duration of the flight. The device by which he enjoys that service should be of no consequence.
      - tptacek 14y ago
        He paid for wifi services for his computer for the duration of the flight. The fact that you do not recognize the legitimacy of a commercial offering does not give you the right to invent your own terms; you take the terms as offered, or you don't do business at all.
        14y ago
- fiatmoney 14y ago
  Actually, please do clarify. I am genuinely curious as to your reasoning. Consider also that there is no TOS violation as far as I can tell [1], and TOS violations do not a crime make [2]. Actually "hacking" something to get the service for free (sniffing a cookie and spoofing a MAC address, perhaps) would of course be another matter, but there's not even an access control being circumvented here. Edit: Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? [1] http://www.gogoair.com/gogo/cms/term.do http://www.gogoair.com/gogo/cms/term.do [2] http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en-banc-decision-in-united-states-v-nosal-adopting-narrow-interpretation-of-computer-fraud-and-abuse-act/ http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en...
  - tptacek 14y ago
    You do not need to violate a black letter TOS agreement to commit fraud. You do need to intend to deceive to commit fraud, which moots your later example.
  - jahewson 14y ago
    > Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? No. The browser window size, or user agent string are just proxies for the real question: is the device a laptop or a phone/tablet/etc? Your laptop remains a laptop whatever size the window is. This guy's laptop remained very much not a phone after altering his user agent. Edit: It's worth adding that desktop browsers do not use mobile device user agent strings during normal operation, but small windows are perfectly legitimate.
- tptacek 14y ago
  You are right in spirit but wrong, I think, in the specifics. In spirit: yes, knowingly exceeding your authorized access to a system in order to obtain a personal benefit is a federal crime, described by the CFAA, and I'm pretty sure the TOS on the site does not need to be ironclad to give that force. But in the specifics: (i) Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? (ii) Did they have an intent to defraud? (This is the key issue and the point I believe you were making) (iii) Did the actual computer access materially advance their fraudulent scheme? (You can't drag computers into any given fraud case to make it federal) (iv) Did they obtain anything of value? So far so bad: the answers to all four questions are "yes". But: when the object of the fraud is access to the computer system itself --- that is, when the "thing of value" is "use of the computer system in question", there's a fifth test: (v) Was the total value of the computer usage greater than $5000? Nope. Very important to note here though: regardless of the fact that it is vanishingly unlikely that a CFAA case would be brought here, and even less likely that the prosecution would prevail, if by committing this particular little fraud and then bragging about it on the Internet this blog post cost the operators of the service a huge amount of money to strengthen defenses or investigate system usage, the blogger has opened themselves up to a very painful civil case.
  - lowboy 14y ago
    > Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? The answer to that one is "no". He had authorization to both pages. Unless we're going to interpret that authorization was given to each device and not the person.
    - tptacek 14y ago
      You're suggesting that the defendant in this case either didn't know the difference between a phone and a computer, or had a reasonable belief that despite the obvious language on those pages, the provider did not care whether he was using a phone or a computer. Good luck with that argument.
jahewson 14y ago
While it is not mentioned in the ToS, the pricing varies based on what device you have (this is stated elsewhere). This guy has a laptop and is claiming that it's a phone - a deception made for personal gain - a.k.a fraud.
- fiatmoney 14y ago
  I would argue with your "claiming it's a phone". Under that rationale, everyone using Internet Explorer is committing fraud as soon as someone decides to price-discriminate based on it, since it claims to be Mozilla [1]. User agents are totally discretionary. It's like the color of your laptop. [1] http://www.useragentstring.com/pages/Internet%20Explorer/ http://www.useragentstring.com/pages/Internet%20Explorer/
  - jahewson 14y ago
    > everyone using Internet Explorer is committing fraud No - there's no financial gain from using IE. He has manipulated his computer to inform web servers that his device is a mobile device. I'm not aware of any desktop browsers which use mobile device user agent strings during normal operation. Whether it is discretionary or not is irrelevant, the point is that he's deviated significantly from normal behaviour, deliberately, without any legitimate reason (e.g. he wasn't at the time say, testing a mobile site), in fact with only the intent to defraud. Ultimately, user agent strings are not a brilliant way to create a legally binding contract - it would be much smarter to have the contract amended based on the user-string to include "I confirm that my device is a laptop", and make this click-through.

alexmunroe 14y ago

As far as I can see he's done absolutely nothing illegal, immoral maybe depending on your view on the matter. It's rather like totally trusting client side javascript for authentication, unless you check that the data being received is accurate then you'll never be able to stop this. It's a simple case of trusting the client. I would imagine that should the submitted have been running an Android Development Image on his system and access via a browser on that the effect would be the same.

sp332 14y ago
Intentionally misrepresenting the situation to get a better deal is called fraud.
- mindcrime 14y ago
  UA strings aren't bound to any legal requirements, as far as I know. So how is it fraud if one party has no reasonable expectation of any particular representation of the situation in the first place?
  - lowboy 14y ago
    Wellllll, it would be reasonable to expect that 99.99% of people wouldn't change their UA.
  - jahewson 14y ago
    Name me one desktop browser which uses a mobile UA string during normal operation.

lowboy 14y ago

Assuming this isn't a troll post: 1) He didn't trespass on a protected computer system or hack anything - he's using a web browser. 2) Users are not required to leave their browser's default settings intact when interacting with websites. 3) Where are the theft of services? He paid for a wifi internet connection for the duration of the flight with a price he was offered. He could have just as easily paid using his phone and then tethered his laptop to it.

flatline3 14y ago
I think that's a stretch. Here's another example: A certain airline offers upgrades to first class seating, but only within a certain time period before the flight. When using their website, I realized that I could pass in the time constraint as a parameter to their webapp. Boom, cheap first class upgrade, at any time! Is that stealing? Yes. At the very least, theft of service. That first class ticket can sell for thousands of dollars, and instead, this trick would have allowed me to get it for hundreds. Just because their webapp allowed it doesn't make it OK. It's no different than tricking someone at the counter into giving you an item for free, or giving you extra change.
- tptacek 14y ago
  The distinction you're trying to draw between "theft" and "theft of service" is the reason we have fraud statutes. Fraud is a more general crime than theft.
- lowboy 14y ago
  I think that analogy is flawed because the airline can only sell that seat once. If you used that hack, then you would be removing the chance that the airline could sell that seat for the full price. That doesn't apply to the wifi situation.
  - flatline3 14y ago
    You've clearly not dealt with congested airplane wifi.

drivebyacct2 14y ago

So what if I paid for it and used my USB tether? Am I committing fraud? Violating the TOS maybe? Both?

masonhensley 14y ago
I glanced at the first two screenshots before I read the article and thought he was just going to create a wifi hotspot off his phone... that way he could get internet on both devices for the mobile price.
- ariwilson 14y ago
  You can't create a WiFi hotspot from a WiFi connection on a Galaxy Nexus.