4 ms·

> it's that it shares the 2B1.1 loss table with all the other federal criminal statutes, and computers are very good and very fast at running the number on that

> it's that it shares the 2B1.1 loss table with all the other federal criminal statutes, and computers are very good and very fast at running the number on that table up. That's a problem with it, but another big one is that it's inherently ambiguous. The normal way you know if you're authorized to do something with a computer is that it processes the request. They're perfectly capable of refusing; you get "forbidden" or "access denied" but in that case you're not actually accessing it, you're just being informed that you're not allowed to right now. So for there to be a violation the computer would have to let you do something it isn't supposed to. But how are you supposed to know that then? On a lot of websites -- like this one -- you go to a page like https://news.ycombinator.com/user?id=<user_id> and you get the user's profile. If you put in your user there then you can see your email address and edit your profile etc. If the server was misconfigured and showing everyone's email address when it isn't supposed to, how is someone supposed to know that? Venmo publishes their users' financial transactions. If you notice that and think it's weird and write a post about it, should the company -- possibly retroactively -- be able to decide that the data you're criticizing them for making public wasn't intended to be, and therefore your accessing it was a crime? If you notice this by accident when it's obvious the data shouldn't be public -- you saw it when you made a typo in the URL -- should there be a law that can put you in jail if you admit to this in the process of making the public aware of the company's mistake, even if your access resulted in no harm to anyone? The wording is too vague and it criminalizes too much. "Malicious hacking" might not always be wire fraud but in other cases it could be misappropriation of trade secrets etc., i.e. whatever the actual act of malice is. The problem with the CFAA is that it's more or less attempting to be the federal computer law against burglary (i.e. unlawful entry with the intent to commit a crime) except that it makes the "unlawful" part too hard to pin down and failed to include the part about intent to commit a crime, which allows it to be applied against people it ought not to.

JumpCrisscross 1y ago
> how is someone supposed to know that? When was the last CFAA prosecution where the perpetrator literally didn't know they were doing something unauthorised?
- mapt 1y ago
  Legislative overreach that leads to an almost total reliance on prosecutorial discretion is a terrible way to run a society. The moment that federal prosecutors stop being obsessed with 100% conviction rates, the whole weaponized process becomes tyrannical overnight. Regardless of innocence, most people get advised today to take the dramatically reduced plea bargain because of the extortion-tier penalties for most crimes; we barely use trials to establish facts and guilt any more.
  - JumpCrisscross 1y ago
    > almost total reliance on prosecutorial discretion is a terrible way to run a society Asking for precedence is not the same as "total reliance on prosecutorial discretion." It's asking if a hypothetical is grounded. > moment that federal prosecutors stop being obsessed with 100% conviction rates, the whole weaponized process becomes tyrannical overnight This is an orthogonal problem. Prosecutors can bring bullshit cases with zero basis in the law if they want to.
- AnthonyMouse 1y ago
  So that's actually a big part of the problem. "Unauthorized" means what, that they abstractly don't like what you're doing? It's hard to tell what it really means because by its terms it prohibits way too much. Like it would plausibly be unconstitutional if they actually tried to enforce it that way. Which creates the expectation that things are unauthorized that potentially can't be prohibited, and that's the ambiguity. It's not that you don't know what you can't do, it's that it nominally prohibits so much that you don't know what you can do. So then you get cases like Sandvig v. Barr where the researchers are assuming the thing they want to do isn't authorized even though that would be unreasonable and then they have to go to court over it. Which is how you get chilling effects, because not everyone has the resources to do that, and companies or the government can threaten people with prosecution to silence them without charges ever being brought because the accused doesn't want to experience "the process is the punishment" when the law doesn't make it sufficiently clear that what they're doing isn't illegal.
  - 1y ago
tptacek 1y ago
'JumpCrisscross is stipulating that you might be right in this analysis but observing that in practice CFAA doesn't play out that way. I'm instead going to go right at your argument and say that a precise definition of unauthorized access isn't necessary in the first place. The statute turns on intent. It's the burden of the prosecution to prove not just that some kind of access was pro-forma unauthorized, but also that the defendant should have known it was. This is no different than zillions of other criminal statutes, the majority of which hinge on intent.
- AnthonyMouse 1y ago
  The problem with trying to make everything hinge on intent is that it's incredibly hard to prove what someone was thinking, which makes judges unreasonably sympathetic to the prosecution's inability to do it. And that frequently leads to various ways of diluting the intent requirement. A common one is to apply the requirement narrowly. You didn't intend to hurt anyone or steal anything, but you intended to visit that URL, so that's the prosecution's burden satisfied. Which is why you need it to hinge on more than just intent. Otherwise why do we even have different laws? Just pass one that says it's illegal to be bad, right?
  - akerl_ 1y ago
    How is this any different than all the other commonly prosecuted laws that hinge on intent?
    - AnthonyMouse 1y ago
      For most laws the badness is inherent in the act. Intentionally killing someone is illegal because killing someone is bad and we're basically just giving you an out if it was unintentional, i.e. accidental killings aren't murder. The problem here is that accessing a computer is a completely normal and unproblematic thing to do on purpose, so the intent requirement isn't doing much without knowing what "authorization" is supposed to mean but that's the part that isn't clear.

JumpCrisscross 1y ago

> how is someone supposed to know that? When was the last CFAA prosecution where the perpetrator literally didn't know they were doing something unauthorised?

mapt 1y ago
Legislative overreach that leads to an almost total reliance on prosecutorial discretion is a terrible way to run a society. The moment that federal prosecutors stop being obsessed with 100% conviction rates, the whole weaponized process becomes tyrannical overnight. Regardless of innocence, most people get advised today to take the dramatically reduced plea bargain because of the extortion-tier penalties for most crimes; we barely use trials to establish facts and guilt any more.
- JumpCrisscross 1y ago
  > almost total reliance on prosecutorial discretion is a terrible way to run a society Asking for precedence is not the same as "total reliance on prosecutorial discretion." It's asking if a hypothetical is grounded. > moment that federal prosecutors stop being obsessed with 100% conviction rates, the whole weaponized process becomes tyrannical overnight This is an orthogonal problem. Prosecutors can bring bullshit cases with zero basis in the law if they want to.
AnthonyMouse 1y ago
So that's actually a big part of the problem. "Unauthorized" means what, that they abstractly don't like what you're doing? It's hard to tell what it really means because by its terms it prohibits way too much. Like it would plausibly be unconstitutional if they actually tried to enforce it that way. Which creates the expectation that things are unauthorized that potentially can't be prohibited, and that's the ambiguity. It's not that you don't know what you can't do, it's that it nominally prohibits so much that you don't know what you can do. So then you get cases like Sandvig v. Barr where the researchers are assuming the thing they want to do isn't authorized even though that would be unreasonable and then they have to go to court over it. Which is how you get chilling effects, because not everyone has the resources to do that, and companies or the government can threaten people with prosecution to silence them without charges ever being brought because the accused doesn't want to experience "the process is the punishment" when the law doesn't make it sufficiently clear that what they're doing isn't illegal.
- 1y ago

tptacek 1y ago

'JumpCrisscross is stipulating that you might be right in this analysis but observing that in practice CFAA doesn't play out that way. I'm instead going to go right at your argument and say that a precise definition of unauthorized access isn't necessary in the first place. The statute turns on intent. It's the burden of the prosecution to prove not just that some kind of access was pro-forma unauthorized, but also that the defendant should have known it was. This is no different than zillions of other criminal statutes, the majority of which hinge on intent.

AnthonyMouse 1y ago
The problem with trying to make everything hinge on intent is that it's incredibly hard to prove what someone was thinking, which makes judges unreasonably sympathetic to the prosecution's inability to do it. And that frequently leads to various ways of diluting the intent requirement. A common one is to apply the requirement narrowly. You didn't intend to hurt anyone or steal anything, but you intended to visit that URL, so that's the prosecution's burden satisfied. Which is why you need it to hinge on more than just intent. Otherwise why do we even have different laws? Just pass one that says it's illegal to be bad, right?
- akerl_ 1y ago
  How is this any different than all the other commonly prosecuted laws that hinge on intent?
  - AnthonyMouse 1y ago
    For most laws the badness is inherent in the act. Intentionally killing someone is illegal because killing someone is bad and we're basically just giving you an out if it was unintentional, i.e. accidental killings aren't murder. The problem here is that accessing a computer is a completely normal and unproblematic thing to do on purpose, so the intent requirement isn't doing much without knowing what "authorization" is supposed to mean but that's the part that isn't clear.