6 ms·

I'm not seeing how this is at all legally problematic. AFAICT there's no TOS violation, and if there were, TOS violations don't make it a crime. The user agen

I'm not seeing how this is at all legally problematic. AFAICT there's no TOS violation, and if there were, TOS violations don't make it a crime. The user agent is totally discretionary on the part of the browser and price-discriminating based on one is in no way an access control mechanism. It seems equivalent to saying "red computers get charged half price", and then objecting when someone snaps a red shell on their laptop.

patio11 14y ago
Do you want me to start quoting Title 18 U.S.C Section 1030 (the Computer Fraud and Abuse Act) or can you Google it yourself? There is no possible reading of these facts that does not run afoul of that law, among others. There is no affirmative defense "But it was really easy for me to exceed my authorized privileges because their security sucked" provided for in the law.
- mindcrime 14y ago
  So what? Everyone of us probably runs afoul of hundreds or thousands of bogus laws every day. It's time to start encouraging people to be bolder and violate more laws, as far as I'm concerned. Now excuse me while I go listen to some Judas Priest... \m/
  - tptacek 14y ago
    The idea behind computer fraud laws, and fraud laws in general, is that tricking people to obtain valuable services at the expense of the victim is dishonest. People and companies should be able to offer services assuming that their counterparties are honest. When dishonest people abuse company offerings, they impose a cost on everyone in the market. In this specific case, the prospect of fraudulent access requires the wireless ISP to spend money strengthening their security controls; the costs associated with that are passed on to the market, as are the inconveniences associated with new controls. In other words: the law sees it as a bad thing that ISPs should have to bulletproof their offerings so that when they make a service available to phones, it isn't easy to trick those systems into providing service to computers. The law says, "it is silly that the market should have to bear the cost of that engineering, because it's undertaken solely to prevent dishonest people from obtaining undue benefit". The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. People probably do violate all sorts of stupid laws all the time. But that's a very different point than "people commit all sorts of frauds all the time". They do not. Fraud is invariably wrong.
    - lowboy 14y ago
      > The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. What services did he steal? He paid for wifi services for the duration of the flight. The device by which he enjoys that service should be of no consequence.
      - tptacek 14y ago
        He paid for wifi services for his computer for the duration of the flight. The fact that you do not recognize the legitimacy of a commercial offering does not give you the right to invent your own terms; you take the terms as offered, or you don't do business at all.
        lowboy 14y ago
        He received what he paid for: wifi services for that flight. I still don't see fraud here.
        jahewson 14y ago
        He paid for a WiFi connection between a phone and the internet. He received a connection between a laptop and the internet.
        lowboy 14y ago
        He paid for a WiFi connection between a device and the internet. He received a connection between a device and the internet. If GoGo can't tell the difference between a laptop and a mobile phone, that's their problem. And no, the UA string doesn't guarantee that and there is no law that I've heard of that prevents users from altering their UA string (or anything for that matter). They showed him a price for a service on his device, and he bought that service.
        14y ago
  - danielweber 14y ago
    If you think you are participating in civil disobedience, you will have better luck if you are not gaining something of value while doing so.
  - shimsham 14y ago
    Judas Priest should be charged for making foul music.
- fiatmoney 14y ago
  Actually, please do clarify. I am genuinely curious as to your reasoning. Consider also that there is no TOS violation as far as I can tell [1], and TOS violations do not a crime make [2]. Actually "hacking" something to get the service for free (sniffing a cookie and spoofing a MAC address, perhaps) would of course be another matter, but there's not even an access control being circumvented here. Edit: Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? [1] http://www.gogoair.com/gogo/cms/term.do http://www.gogoair.com/gogo/cms/term.do [2] http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en-banc-decision-in-united-states-v-nosal-adopting-narrow-interpretation-of-computer-fraud-and-abuse-act/ http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en...
  - tptacek 14y ago
    You do not need to violate a black letter TOS agreement to commit fraud. You do need to intend to deceive to commit fraud, which moots your later example.
  - jahewson 14y ago
    > Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? No. The browser window size, or user agent string are just proxies for the real question: is the device a laptop or a phone/tablet/etc? Your laptop remains a laptop whatever size the window is. This guy's laptop remained very much not a phone after altering his user agent. Edit: It's worth adding that desktop browsers do not use mobile device user agent strings during normal operation, but small windows are perfectly legitimate.
- tptacek 14y ago
  You are right in spirit but wrong, I think, in the specifics. In spirit: yes, knowingly exceeding your authorized access to a system in order to obtain a personal benefit is a federal crime, described by the CFAA, and I'm pretty sure the TOS on the site does not need to be ironclad to give that force. But in the specifics: (i) Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? (ii) Did they have an intent to defraud? (This is the key issue and the point I believe you were making) (iii) Did the actual computer access materially advance their fraudulent scheme? (You can't drag computers into any given fraud case to make it federal) (iv) Did they obtain anything of value? So far so bad: the answers to all four questions are "yes". But: when the object of the fraud is access to the computer system itself --- that is, when the "thing of value" is "use of the computer system in question", there's a fifth test: (v) Was the total value of the computer usage greater than $5000? Nope. Very important to note here though: regardless of the fact that it is vanishingly unlikely that a CFAA case would be brought here, and even less likely that the prosecution would prevail, if by committing this particular little fraud and then bragging about it on the Internet this blog post cost the operators of the service a huge amount of money to strengthen defenses or investigate system usage, the blogger has opened themselves up to a very painful civil case.
  - lowboy 14y ago
    > Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? The answer to that one is "no". He had authorization to both pages. Unless we're going to interpret that authorization was given to each device and not the person.
    - tptacek 14y ago
      You're suggesting that the defendant in this case either didn't know the difference between a phone and a computer, or had a reasonable belief that despite the obvious language on those pages, the provider did not care whether he was using a phone or a computer. Good luck with that argument.
jahewson 14y ago
While it is not mentioned in the ToS, the pricing varies based on what device you have (this is stated elsewhere). This guy has a laptop and is claiming that it's a phone - a deception made for personal gain - a.k.a fraud.
- fiatmoney 14y ago
  I would argue with your "claiming it's a phone". Under that rationale, everyone using Internet Explorer is committing fraud as soon as someone decides to price-discriminate based on it, since it claims to be Mozilla [1]. User agents are totally discretionary. It's like the color of your laptop. [1] http://www.useragentstring.com/pages/Internet%20Explorer/ http://www.useragentstring.com/pages/Internet%20Explorer/
  - jahewson 14y ago
    > everyone using Internet Explorer is committing fraud No - there's no financial gain from using IE. He has manipulated his computer to inform web servers that his device is a mobile device. I'm not aware of any desktop browsers which use mobile device user agent strings during normal operation. Whether it is discretionary or not is irrelevant, the point is that he's deviated significantly from normal behaviour, deliberately, without any legitimate reason (e.g. he wasn't at the time say, testing a mobile site), in fact with only the intent to defraud. Ultimately, user agent strings are not a brilliant way to create a legally binding contract - it would be much smarter to have the contract amended based on the user-string to include "I confirm that my device is a laptop", and make this click-through.

patio11 14y ago

Do you want me to start quoting Title 18 U.S.C Section 1030 (the Computer Fraud and Abuse Act) or can you Google it yourself? There is no possible reading of these facts that does not run afoul of that law, among others. There is no affirmative defense "But it was really easy for me to exceed my authorized privileges because their security sucked" provided for in the law.

mindcrime 14y ago
So what? Everyone of us probably runs afoul of hundreds or thousands of bogus laws every day. It's time to start encouraging people to be bolder and violate more laws, as far as I'm concerned. Now excuse me while I go listen to some Judas Priest... \m/
- tptacek 14y ago
  The idea behind computer fraud laws, and fraud laws in general, is that tricking people to obtain valuable services at the expense of the victim is dishonest. People and companies should be able to offer services assuming that their counterparties are honest. When dishonest people abuse company offerings, they impose a cost on everyone in the market. In this specific case, the prospect of fraudulent access requires the wireless ISP to spend money strengthening their security controls; the costs associated with that are passed on to the market, as are the inconveniences associated with new controls. In other words: the law sees it as a bad thing that ISPs should have to bulletproof their offerings so that when they make a service available to phones, it isn't easy to trick those systems into providing service to computers. The law says, "it is silly that the market should have to bear the cost of that engineering, because it's undertaken solely to prevent dishonest people from obtaining undue benefit". The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. People probably do violate all sorts of stupid laws all the time. But that's a very different point than "people commit all sorts of frauds all the time". They do not. Fraud is invariably wrong.
  - lowboy 14y ago
    > The only question you really have to ask here is, "am I tricking a business into offering me something with a dollar value without paying for it?" Yes? That's fraud. It's the definition of fraud. What services did he steal? He paid for wifi services for the duration of the flight. The device by which he enjoys that service should be of no consequence.
    - tptacek 14y ago
      He paid for wifi services for his computer for the duration of the flight. The fact that you do not recognize the legitimacy of a commercial offering does not give you the right to invent your own terms; you take the terms as offered, or you don't do business at all.
      - lowboy 14y ago
        He received what he paid for: wifi services for that flight. I still don't see fraud here.
        jahewson 14y ago
        He paid for a WiFi connection between a phone and the internet. He received a connection between a laptop and the internet.
        lowboy 14y ago
        He paid for a WiFi connection between a device and the internet. He received a connection between a device and the internet. If GoGo can't tell the difference between a laptop and a mobile phone, that's their problem. And no, the UA string doesn't guarantee that and there is no law that I've heard of that prevents users from altering their UA string (or anything for that matter). They showed him a price for a service on his device, and he bought that service.
        14y ago
- danielweber 14y ago
  If you think you are participating in civil disobedience, you will have better luck if you are not gaining something of value while doing so.
- shimsham 14y ago
  Judas Priest should be charged for making foul music.
fiatmoney 14y ago
Actually, please do clarify. I am genuinely curious as to your reasoning. Consider also that there is no TOS violation as far as I can tell [1], and TOS violations do not a crime make [2]. Actually "hacking" something to get the service for free (sniffing a cookie and spoofing a MAC address, perhaps) would of course be another matter, but there's not even an access control being circumvented here. Edit: Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? [1] http://www.gogoair.com/gogo/cms/term.do http://www.gogoair.com/gogo/cms/term.do [2] http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en-banc-decision-in-united-states-v-nosal-adopting-narrow-interpretation-of-computer-fraud-and-abuse-act/ http://www.volokh.com/2012/04/10/ninth-circuit-hands-down-en...
- tptacek 14y ago
  You do not need to violate a black letter TOS agreement to commit fraud. You do need to intend to deceive to commit fraud, which moots your later example.
- jahewson 14y ago
  > Let's say they were price discriminating by looking at the size of your browser window, assuming anything < 600x400 is mobile and charging less. Is it illegal to resize? No. The browser window size, or user agent string are just proxies for the real question: is the device a laptop or a phone/tablet/etc? Your laptop remains a laptop whatever size the window is. This guy's laptop remained very much not a phone after altering his user agent. Edit: It's worth adding that desktop browsers do not use mobile device user agent strings during normal operation, but small windows are perfectly legitimate.
tptacek 14y ago
You are right in spirit but wrong, I think, in the specifics. In spirit: yes, knowingly exceeding your authorized access to a system in order to obtain a personal benefit is a federal crime, described by the CFAA, and I'm pretty sure the TOS on the site does not need to be ironclad to give that force. But in the specifics: (i) Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? (ii) Did they have an intent to defraud? (This is the key issue and the point I believe you were making) (iii) Did the actual computer access materially advance their fraudulent scheme? (You can't drag computers into any given fraud case to make it federal) (iv) Did they obtain anything of value? So far so bad: the answers to all four questions are "yes". But: when the object of the fraud is access to the computer system itself --- that is, when the "thing of value" is "use of the computer system in question", there's a fifth test: (v) Was the total value of the computer usage greater than $5000? Nope. Very important to note here though: regardless of the fact that it is vanishingly unlikely that a CFAA case would be brought here, and even less likely that the prosecution would prevail, if by committing this particular little fraud and then bragging about it on the Internet this blog post cost the operators of the service a huge amount of money to strengthen defenses or investigate system usage, the blogger has opened themselves up to a very painful civil case.
- lowboy 14y ago
  > Did the defendant knowingly access a system used by the federal government, a financial institution, or a system used in interstate commerce without authorization? The answer to that one is "no". He had authorization to both pages. Unless we're going to interpret that authorization was given to each device and not the person.
  - tptacek 14y ago
    You're suggesting that the defendant in this case either didn't know the difference between a phone and a computer, or had a reasonable belief that despite the obvious language on those pages, the provider did not care whether he was using a phone or a computer. Good luck with that argument.

jahewson 14y ago

While it is not mentioned in the ToS, the pricing varies based on what device you have (this is stated elsewhere). This guy has a laptop and is claiming that it's a phone - a deception made for personal gain - a.k.a fraud.

fiatmoney 14y ago
I would argue with your "claiming it's a phone". Under that rationale, everyone using Internet Explorer is committing fraud as soon as someone decides to price-discriminate based on it, since it claims to be Mozilla [1]. User agents are totally discretionary. It's like the color of your laptop. [1] http://www.useragentstring.com/pages/Internet%20Explorer/ http://www.useragentstring.com/pages/Internet%20Explorer/
- jahewson 14y ago
  > everyone using Internet Explorer is committing fraud No - there's no financial gain from using IE. He has manipulated his computer to inform web servers that his device is a mobile device. I'm not aware of any desktop browsers which use mobile device user agent strings during normal operation. Whether it is discretionary or not is irrelevant, the point is that he's deviated significantly from normal behaviour, deliberately, without any legitimate reason (e.g. he wasn't at the time say, testing a mobile site), in fact with only the intent to defraud. Ultimately, user agent strings are not a brilliant way to create a legally binding contract - it would be much smarter to have the contract amended based on the user-string to include "I confirm that my device is a laptop", and make this click-through.