6 ms·

EDIT:Make my point more clear Edited comment: It seems to me that Federal law is able to be applied to websites created by private individuals or businesses.

• tptacek 14y ago
  No, you cannot do that. A prosecutor must demonstrate, first to a grand jury, then to a criminal jury, and simultaneously to a judge, that the accused not only violated the terms of service to a website, but in doing so caused material harm or found material gain, and that they did so knowing that they were violating the terms of the site.
  • SeanDav 14y ago
    The fact seems to remain that any private individual can create a website and have the force of federal government apply to a third party as long as said party has knowingly broken the ToS and gained materially somehow from that.
    • tptacek 14y ago
      Don't knowingly break the terms of service of websites for profit or to harm others. Sounds straightforward to me.
      • SeanDav 14y ago
        Yet stealing a bar of chocolate from your corner shop is not a federal crime. Additionally if you hack a site and copy all their data but don't do anything with it, is that now not a federal crime because you have not benefited materially from it?
        • tptacek 14y ago
          Stealing a bar of chocolate from a website is also not a federal crime.
          • ja27 14y ago
            Yes it is because it is interstate commerce. Even if you are located in the same building as the server, just being connected to the internet raises the potential for it to be interstate commerce so it falls into the federal domain. 18 USC 1030(a)(4): (a) Whoever— ... 4. knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value ...
            • danielweber 14y ago
              A "protected computer" has a specific definition, and "a website" doesn't necessarily meet it. tptacek knows the CFAA pretty well for a non-lawyer. It doesn't mean he's always right, but you should be careful if you're trying to trip him up.
              • tptacek 14y ago
                I think he might be right.
                • ja27 14y ago
                  "Protected computer" is an incredibly broad term that covers almost any modern computer or device: (2) the term “protected computer” means a computer— ... (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; I can't imagine they'd ever prosecute anything below the $5,000 mark but even a candy bar sized loss does appear to fall into the federal domain. (Not saying I agree with it, but that's how the interstate commerce clause has been applied in almost every case.)
      • aggronn 14y ago
        If a restaurant had a 'terms of service' that said no reselling of food that they make, should you be open to federal prosecution if you stopped by to pick up food for yourself and some co-workers? Especially if someone gave you a few dollars for the trouble of running the errand? And even more, if the restaurant has their own delivery service? Am I missing an important distinction here? Should private companies be able to make binding rules that open people up to criminal prosecution for something that doesn't violate any laws per se? A person breaking a specific law AND breaking a ToS makes sense. A person breaking a law BY breaking a ToS doesn't make sense.
        • tptacek 14y ago
          I can't reply to this because no part of the example you provided constitutes a federal crime under the CFAA. On the other hand, the criminal aspect of using a university's noncommercial JSTOR access to scrape a substantial portion of the entire database so you can put it on BitTorrent is not hard to understand.
          • aggronn 14y ago
            It was unclear if what you were implying was that you shouldn't violate a ToS for your own profit (or at someone's expense) because it was a federal offense. (I can see now that that was not what you were trying to get at) What are your thoughts on PadMapper vs CL? What is the distinction between scraping that data vs scraping this data that makes one worthy of federal prosecution, but not the other? Considering in both cases it was done for profit or detriment
            • tptacek 14y ago
              Elements missing from a CFAA case for PadMapper include at least interstate commerce and intent to defraud. Swartz's prosecution alleges --- credibly, given what Swartz allegedly posted prior to scraping JSTOR --- that Swartz intention was to liberate data from a commercial database onto file sharing networks, making intent a much easier case to prove. Moreover, the indictment is at pains to point out that MIT and JSTOR repeatedly attempted to stop Swartz from continuing his plan, and found themselves in a cat-and-mouse game with Swartz eventually trespassing to maintain access. PadMapper found itself having exceeded Craigslist's terms, found out by having its access withdrawn and becoming the target of a civil suit, and did not (directly, at least) attempt to evade the countermeasures Craiglist applied to prevent them from obtaining further access. Whether or not you believe Swartz did something wrong here (I do) or whether you think he should get a felony conviction for doing it (he probably shouldn't), you can see pretty clearly how JSTOR had no straightforward civil remedy to what Swartz was doing. Swartz was playing chicken with them, and he lost --- or rather, his bicycle collided with JSTOR's semi truck at high speed.
• danielweber 14y ago
  No, merely violating a ToS, by itself, is not criminal. Lori Drew isn't binding on the whole country, but it is precedent.
  • tptacek 14y ago
    You don't even need Lori Drew to arrive at this conclusion. The CFAA doesn't create strict liability crimes. You have to know you're violating the ToS, and, more than that, you have to benefit (or materially harm someone).
    • nitrogen 14y ago
      ...you have to benefit (or materially harm someone). Are benefit and harm legally defined terms in this instance, or can a clever prosecutor convince a jury of the criminal equivalent of the idea that making a phone with rounded rectangles is worth $1B?
      • tptacek 14y ago
        Yes, they are defined. Moreover, no part of the indictment relies on silly things like the billion dollar valuation of rounded rectangles.
    • Karunamon 14y ago
      "Materially harm" is such a broad term (it's been used to escape one-penny raises in phone bills) that, in the context of CFAA, it might as well be strict liability. Depending on how big of a dick legal is feeling like on a given day, they could make the argument that having the sysadmin dig up logs was materially harming.
      • tptacek 14y ago
        Harm has nothing to do with strict liability.
        • 14y ago